---
title: List Federation Rules
url: https://platform.claude.com/docs/en/api/java/organization/federation/rules/list
---

# List Federation Rules

`RuleListPage organization().federation().rules().list(params = RuleListParams.none(), requestOptions = RequestOptions.none())`

**GET** `/v1/organizations/federation_rules`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=java).

List federation rules in your organization.

Optionally filter by issuer with `issuer_id`. Archived rules are excluded
unless `include_archived=true`.

## Parameters

- `RuleListParams params`

  - `Optional<Boolean> includeArchived` (query parameter)

    Include archived resources. Defaults to false.

  - `Optional<String> issuerId` (query parameter)

    Filter to rules referencing this federation issuer.

  - `Optional<Long> limit` (query parameter)

    Number of results per page.

    minimum: 1, maximum: 100

  - `Optional<String> page` (query parameter)

    Opaque cursor from a previous response's `next_page`.

## Returns

- `class FederationRule`

  Authorization rule binding an external OIDC identity to Anthropic.

  Evaluates the match conditions and mints an OAuth access token for the
  resolved target, scoped to a single workspace where the rule is enabled
  (chosen by the caller at exchange time when the rule is enabled for more
  than one). For rules enabled via `workspace_ids` or
  `applies_to_all_workspaces`, the target service account must be a member
  of that workspace (it is implicitly a member of the default workspace);
  rules carrying only the legacy `workspace_id` binding do not enforce
  this.

  - `JsonValue type = "federation_rule"`

  - `String id`

    Tagged ID of the federation rule.

  - `boolean appliesToAllWorkspaces`

    When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time.

  - `Optional<LocalDateTime> archivedAt`

    If set, this rule is archived and rejects token exchange.

    format: date-time

  - `Optional<String> archivedByActorId`

    Tagged ID (`user_`/`svac_`) of the actor that archived this rule.

  - `LocalDateTime createdAt`

    When this rule was created.

    format: date-time

  - `Optional<String> createdByActorId`

    Tagged ID (`user_`/`svac_`) of the actor that created this rule.

  - `Optional<String> description`

    Optional free-text description.

  - `String issuerId`

    Tagged ID of the issuer whose tokens this rule accepts.

  - `Optional<String> issuerName`

    Issuer's display name at read time.

  - `FederationRuleMatch match`

    Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.

    - `Optional<String> audience`

      Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.

      maxLength: 1024

    - `Optional<Claims> claims`

      Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.

    - `Optional<String> condition`

      CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.

      maxLength: 4096

    - `Optional<String> subjectPrefix`

      Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.

      maxLength: 1024

  - `String name`

    Admin-chosen slug identifier.

  - `String oauthScope`

    Space-separated OAuth scopes granted on the minted token.

  - `ServiceAccountTarget target`

    What this rule targets. Check `type` before reading the other fields. Tokens minted via a rule whose target `type` is `service_account` act as that service account.

    - `JsonValue type = "service_account"`

    - `String serviceAccountId`

      Tagged ID of the service account to mint tokens for.

    - `Optional<String> serviceAccountName`

      Service account's display name at read time. Ignored on writes.

  - `long tokenLifetimeSeconds`

    Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.

  - `LocalDateTime updatedAt`

    When this rule was last updated.

    format: date-time

  - `Optional<String> updatedByActorId`

    Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.

  - `List<String> workspaceIds`

    Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).

## Example

```java
package com.anthropic.example;

import com.anthropic.client.AnthropicClient;
import com.anthropic.client.okhttp.AnthropicOkHttpClient;
import com.anthropic.models.organization.federation.rules.RuleListPage;
import com.anthropic.models.organization.federation.rules.RuleListParams;

public final class Main {
    private Main() {}

    public static void main(String[] args) {
        AnthropicClient client = AnthropicOkHttpClient.fromEnv();

        RuleListPage page = client.organization().federation().rules().list();
    }
}
```

### Response (200)

```json
{
  "data": [
    {
      "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
      "applies_to_all_workspaces": true,
      "archived_at": "2019-12-27T18:11:19.117Z",
      "archived_by_actor_id": "archived_by_actor_id",
      "attributes": {
        "foo": "string"
      },
      "created_at": "2024-10-30T23:58:27.427722Z",
      "created_by_actor_id": "created_by_actor_id",
      "description": "description",
      "issuer_id": "issuer_id",
      "issuer_name": "issuer_name",
      "match": {
        "audience": "audience",
        "claims": {
          "foo": "string"
        },
        "condition": "condition",
        "subject_prefix": "subject_prefix"
      },
      "name": "prod-deploy-pipeline",
      "oauth_scope": "oauth_scope",
      "target": {
        "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
        "type": "service_account",
        "service_account_name": "service_account_name"
      },
      "token_lifetime_seconds": 0,
      "type": "federation_rule",
      "updated_at": "2024-10-30T23:58:27.427722Z",
      "updated_by_actor_id": "updated_by_actor_id",
      "workspace_id": "workspace_id",
      "workspace_ids": [
        "string"
      ]
    }
  ],
  "next_page": "next_page"
}
```