規則

建立聯合規則

BetaFederationRule Beta.Organization.Federation.Rules.Create(parameters, cancellationToken = default)

POST/v1/organizations/federation_rules

需要具有 org:admin 範圍的 OAuth 存取權杖，可透過 ant auth login --scope org:admin 或工作負載身分聯合規則取得；不接受 Admin API 金鑰。請參閱使用 Admin API 管理 WIF。

列出聯合規則

RuleListPage Beta.Organization.Federation.Rules.List(parameters, cancellationToken = default)

GET/v1/organizations/federation_rules

取得聯合規則

BetaFederationRule Beta.Organization.Federation.Rules.Retrieve(parameters, cancellationToken = default)

GET/v1/organizations/federation_rules/{federation_rule_id}

更新聯合規則

BetaFederationRule Beta.Organization.Federation.Rules.Update(parameters, cancellationToken = default)

POST/v1/organizations/federation_rules/{federation_rule_id}

封存聯合規則

BetaFederationRule Beta.Organization.Federation.Rules.Archive(parameters, cancellationToken = default)

POST/v1/organizations/federation_rules/{federation_rule_id}/archive

Models

class BetaFederationRule { Type = "federation_rule"; ID; AppliesToAllWorkspaces; /* 17 more */ }

Authorization rule binding an external OIDC identity to Anthropic.

Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to a single workspace where the rule is enabled (chosen by the caller at exchange time when the rule is enabled for more than one). For rules enabled via workspace_ids or applies_to_all_workspaces, the target service account must be a member of that workspace (it is implicitly a member of the default workspace); rules carrying only the legacy workspace_id binding do not enforce this.

class BetaFederationRuleMatch { Audience; Claims; Condition; SubjectPrefix; }

Does the incoming JWT qualify?

All populated fields must pass; omitted fields are skipped. At least one of subject_prefix (other than a wildcard-only value like *), claims, or condition is required; audience alone is not sufficient.

string? Audience

Exact match against the aud claim (any element if array). When omitted, the JWT's aud must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.

maxLength1024

IReadOnlyDictionary<string, string>? Claims

Exact-match {claim: value} pairs against top-level claims. Only string-valued claims can be matched; use condition for non-string claims.

string? Condition

CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the claims variable; a constant-true expression (such as true) is rejected with 400.

maxLength4096

string? SubjectPrefix

Match the verified JWT sub claim. Exact match unless the value ends with *, in which case it is a prefix match. Example: repo:my-org/my-repo:ref:refs/heads/main.

maxLength1024

class BetaFederationRuleWorkspace { Type = "federation_rule_workspace"; CreatedAt; CreatedByActorID; /* 3 more */ }

JsonElement Type = "federation_rule_workspace"

required DateTimeOffset CreatedAt

When this workspace was enabled for the rule.

formatdate-time

required string? CreatedByActorID

Tagged ID (user_... or svac_...) of the actor that enabled this workspace for the rule, if known.

required string FederationRuleID

Tagged ID of the federation rule.

required string WorkspaceID

Tagged ID of the workspace this rule is enabled for.

required string? WorkspaceName

Workspace display name. Populated when listing; null in the enable response.

class BetaServiceAccountTarget { Type = "service_account"; ServiceAccountID; ServiceAccountName; }

Bind to a fixed service account by ID.

JsonElement Type = "service_account"

required string ServiceAccountID

Tagged ID of the service account to mint tokens for.

string? ServiceAccountName

Service account's display name at read time. Ignored on writes.

規則

建立聯合規則

列出聯合規則

取得聯合規則

更新聯合規則

封存聯合規則

Models

規則工作區

新增聯合規則工作區

列出聯合規則工作區

移除聯合規則工作區

規則

Models

規則工作區

規則工作區