--- title: Organization url: https://platform.claude.com/docs/en/api/csharp/organization --- # Organization ## Get Current Organization `OrganizationInfo Organization.Retrieve(parameters, cancellationToken = default)` **GET** `/v1/organizations/me` Retrieve information about the organization associated with the authenticated API key. ### Parameters - `OrganizationRetrieveParams parameters` ### Returns - `class OrganizationInfo` - `JsonElement Type = "organization"` Object type. For Organizations, this is always `"organization"`. - `required string ID` ID of the Organization. format: uuid - `required string Name` Name of the Organization. ### Example ```csharp using System; using Anthropic.Models.Organization; OrganizationRetrieveParams parameters = new(); var organizationInfo = await client.Organization.Retrieve(parameters); Console.WriteLine(organizationInfo); ``` #### Response (200) ```json { "id": "12345678-1234-5678-1234-567812345678", "name": "Organization Name", "type": "organization" } ``` ## Domain types ### Organization Info - `class OrganizationInfo` - `JsonElement Type = "organization"` Object type. For Organizations, this is always `"organization"`. - `required string ID` ID of the Organization. format: uuid - `required string Name` Name of the Organization. ### Organization Role - `enum OrganizationRole` - `Admin("admin")` - `Billing("billing")` - `ClaudeCodeUser("claude_code_user")` - `Developer("developer")` - `Managed("managed")` - `MembershipAdmin("membership_admin")` - `Owner("owner")` - `PrimaryOwner("primary_owner")` - `User("user")` ## Organization › API Keys ### List API Keys `ApiKeyListPage Organization.ApiKeys.List(parameters, cancellationToken = default)` **GET** `/v1/organizations/api_keys` List API Keys #### Parameters - `ApiKeyListParams parameters` - `string afterID` (query parameter) ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object. - `string beforeID` (query parameter) ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object. - `string? createdByUserID` (query parameter) Filter by the ID of the User who created the object. - `long limit` (query parameter) Number of items to return per page. Defaults to `20`. Ranges from `1` to `1000`. minimum: 1, maximum: 1000 - `Status? status` (query parameter) Filter by API key status. - `Active("active")` - `Archived("archived")` - `Expired("expired")` - `Inactive("inactive")` - `string? workspaceID` (query parameter) Filter by Workspace ID. #### Returns - `class ApiKey` - `JsonElement Type = "api_key"` Object type. For API Keys, this is always `"api_key"`. - `required string ID` ID of the API key. - `required DateTimeOffset CreatedAt` RFC 3339 datetime string indicating when the API Key was created. format: date-time - `required ApiKeyCreatedBy? CreatedBy` The ID and type of the actor that created the API key, or `null` when the creator is not recorded (legacy, workload-identity-federated, or system-created keys). - `required Type Type` Type of the actor that created the object. - `ServiceAccount("service_account")` - `User("user")` - `required string ID` ID of the actor that created the object. - `required DateTimeOffset? ExpiresAt` RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires. format: date-time - `required string Name` Name of the API key. - `required string? PartialKeyHint` Partially redacted hint for the API key. - `required Principal? Principal` The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal. - `class ApiKeyUserActor` - `JsonElement Type = "user_actor"` Principal type. Always `"user_actor"` for a User. - `required string UserID` ID of the User the API key acts as. - `class ApiKeyServiceAccountActor` - `JsonElement Type = "service_account_actor"` Principal type. Always `"service_account_actor"` for a Service Account. - `required string ServiceAccountID` ID of the Service Account the API key acts as. - `required Scope Scope` Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace. - `class ApiKeyOrganizationScope` - `JsonElement Type = "organization"` Scope type. Always `"organization"`: the API key has no Workspace. Only a principal-bound API key can have this scope. - `class ApiKeyWorkspaceScope` - `JsonElement Type = "workspace"` Scope type. Always `"workspace"`: the API key belongs to one Workspace. - `required string WorkspaceID` ID of the Workspace the API key belongs to, including when it is the organization's default Workspace. - `required Status Status` Status of the API key. - `Active("active")` - `Archived("archived")` - `Expired("expired")` - `Inactive("inactive")` #### Example ```csharp using System; using Anthropic.Models.Organization.ApiKeys; ApiKeyListParams parameters = new(); var page = await client.Organization.ApiKeys.List(parameters); await foreach (var item in page.Paginate()) { Console.WriteLine(item); } ``` ##### Response (200) ```json { "data": [ { "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT", "created_at": "2024-10-30T23:58:27.427722Z", "created_by": { "id": "user_01WxYzAbCdEfGhJkMnPqRsTu", "type": "user" }, "expires_at": "2024-10-30T23:58:27.427722Z", "name": "Developer Key", "partial_key_hint": "sk-ant-api03-R2D...igAA", "principal": { "type": "user_actor", "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu" }, "scope": { "type": "workspace", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ" }, "status": "active", "type": "api_key" } ], "first_id": "first_id", "has_more": true, "last_id": "last_id" } ``` ### Retrieve API Key (Admin API) `ApiKey Organization.ApiKeys.Retrieve(parameters, cancellationToken = default)` **GET** `/v1/organizations/api_keys/{api_key_id}` Retrieve information about a single API key in your organization, looked up by its ID. This Admin API endpoint requires an Admin API key, is intended for programmatic key management, and never returns the key's secret value. To view or create your own API keys, go to [API keys](https://platform.claude.com/settings/keys) in the Claude Console. #### Parameters - `ApiKeyRetrieveParams parameters` - `required string apiKeyID` (path parameter) ID of the API key. #### Returns - `class ApiKey` - `JsonElement Type = "api_key"` Object type. For API Keys, this is always `"api_key"`. - `required string ID` ID of the API key. - `required DateTimeOffset CreatedAt` RFC 3339 datetime string indicating when the API Key was created. format: date-time - `required ApiKeyCreatedBy? CreatedBy` The ID and type of the actor that created the API key, or `null` when the creator is not recorded (legacy, workload-identity-federated, or system-created keys). - `required Type Type` Type of the actor that created the object. - `ServiceAccount("service_account")` - `User("user")` - `required string ID` ID of the actor that created the object. - `required DateTimeOffset? ExpiresAt` RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires. format: date-time - `required string Name` Name of the API key. - `required string? PartialKeyHint` Partially redacted hint for the API key. - `required Principal? Principal` The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal. - `class ApiKeyUserActor` - `JsonElement Type = "user_actor"` Principal type. Always `"user_actor"` for a User. - `required string UserID` ID of the User the API key acts as. - `class ApiKeyServiceAccountActor` - `JsonElement Type = "service_account_actor"` Principal type. Always `"service_account_actor"` for a Service Account. - `required string ServiceAccountID` ID of the Service Account the API key acts as. - `required Scope Scope` Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace. - `class ApiKeyOrganizationScope` - `JsonElement Type = "organization"` Scope type. Always `"organization"`: the API key has no Workspace. Only a principal-bound API key can have this scope. - `class ApiKeyWorkspaceScope` - `JsonElement Type = "workspace"` Scope type. Always `"workspace"`: the API key belongs to one Workspace. - `required string WorkspaceID` ID of the Workspace the API key belongs to, including when it is the organization's default Workspace. - `required Status Status` Status of the API key. - `Active("active")` - `Archived("archived")` - `Expired("expired")` - `Inactive("inactive")` #### Example ```csharp using System; using Anthropic.Models.Organization.ApiKeys; ApiKeyRetrieveParams parameters = new() { ApiKeyID = "api_key_id" }; var apiKey = await client.Organization.ApiKeys.Retrieve(parameters); Console.WriteLine(apiKey); ``` ##### Response (200) ```json { "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT", "created_at": "2024-10-30T23:58:27.427722Z", "created_by": { "id": "user_01WxYzAbCdEfGhJkMnPqRsTu", "type": "user" }, "expires_at": "2024-10-30T23:58:27.427722Z", "name": "Developer Key", "partial_key_hint": "sk-ant-api03-R2D...igAA", "principal": { "type": "user_actor", "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu" }, "scope": { "type": "workspace", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ" }, "status": "active", "type": "api_key" } ``` ### Update API Key `ApiKey Organization.ApiKeys.Update(parameters, cancellationToken = default)` **POST** `/v1/organizations/api_keys/{api_key_id}` Update API Key #### Parameters - `ApiKeyUpdateParams parameters` - `required string apiKeyID` (path parameter) ID of the API key. - `string? name` Name of the API key. minLength: 1, maxLength: 500 - `Status? status` Status of the API key. - `Active("active")` - `Archived("archived")` - `Inactive("inactive")` #### Returns - `class ApiKey` - `JsonElement Type = "api_key"` Object type. For API Keys, this is always `"api_key"`. - `required string ID` ID of the API key. - `required DateTimeOffset CreatedAt` RFC 3339 datetime string indicating when the API Key was created. format: date-time - `required ApiKeyCreatedBy? CreatedBy` The ID and type of the actor that created the API key, or `null` when the creator is not recorded (legacy, workload-identity-federated, or system-created keys). - `required Type Type` Type of the actor that created the object. - `ServiceAccount("service_account")` - `User("user")` - `required string ID` ID of the actor that created the object. - `required DateTimeOffset? ExpiresAt` RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires. format: date-time - `required string Name` Name of the API key. - `required string? PartialKeyHint` Partially redacted hint for the API key. - `required Principal? Principal` The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal. - `class ApiKeyUserActor` - `JsonElement Type = "user_actor"` Principal type. Always `"user_actor"` for a User. - `required string UserID` ID of the User the API key acts as. - `class ApiKeyServiceAccountActor` - `JsonElement Type = "service_account_actor"` Principal type. Always `"service_account_actor"` for a Service Account. - `required string ServiceAccountID` ID of the Service Account the API key acts as. - `required Scope Scope` Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace. - `class ApiKeyOrganizationScope` - `JsonElement Type = "organization"` Scope type. Always `"organization"`: the API key has no Workspace. Only a principal-bound API key can have this scope. - `class ApiKeyWorkspaceScope` - `JsonElement Type = "workspace"` Scope type. Always `"workspace"`: the API key belongs to one Workspace. - `required string WorkspaceID` ID of the Workspace the API key belongs to, including when it is the organization's default Workspace. - `required Status Status` Status of the API key. - `Active("active")` - `Archived("archived")` - `Expired("expired")` - `Inactive("inactive")` #### Example ```csharp using System; using Anthropic.Models.Organization.ApiKeys; ApiKeyUpdateParams parameters = new() { ApiKeyID = "api_key_id" }; var apiKey = await client.Organization.ApiKeys.Update(parameters); Console.WriteLine(apiKey); ``` ##### Response (200) ```json { "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT", "created_at": "2024-10-30T23:58:27.427722Z", "created_by": { "id": "user_01WxYzAbCdEfGhJkMnPqRsTu", "type": "user" }, "expires_at": "2024-10-30T23:58:27.427722Z", "name": "Developer Key", "partial_key_hint": "sk-ant-api03-R2D...igAA", "principal": { "type": "user_actor", "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu" }, "scope": { "type": "workspace", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ" }, "status": "active", "type": "api_key" } ``` ## Organization › External Keys ### Create External Key `ExternalKey Organization.ExternalKeys.Create(parameters, cancellationToken = default)` **POST** `/v1/organizations/external_keys` Create an external key config owned by the caller's organization. #### Parameters - `ExternalKeyCreateParams parameters` - `required ProviderConfig providerConfig` KMS provider identity and auth coordinates. - `class AwsExternalKeyConfig` - `JsonElement Type = "aws"` - `required string KmsArn` Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account. maxLength: 2048 - `string? Region` AWS region. Derived from `kms_arn` if omitted. - `class GcpExternalKeyConfig` - `JsonElement Type = "gcp"` - `required string KeyName` Full resource name of the Cloud KMS key. - `class AzureExternalKeyConfigParam` Azure Key Vault provider configuration. - `JsonElement Type = "azure"` - `required string KeyName` Name of the key within the vault. - `required string TenantID` Azure AD tenant ID. - `required string VaultUri` Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`. - `string? ClientID` Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory. - `string? displayName` Human-friendly display name. minLength: 1, maxLength: 255 - `Geo geo` Data residency geo. Only `us` is supported. - `Us("us")` - `string? userProfileID` ID of a user profile to bind the key to. Omit this field for a key that isn't bound to a user profile. Such a key can be attached to a Workspace whatever its user profile. The binding cannot be changed later. A key bound to a user profile can only be attached to a Workspace that has the same user profile. #### Returns - `class ExternalKey` CMEK external key config belonging to the caller's organization. Configs are organization-scoped. Workspaces attach to a config; once any workspace references it, the provider fields become effectively immutable (existing encrypted data needs the config for decrypt). - `JsonElement Type = "external_key"` - `required string ID` Identifier of the external key config: a tagged ID prefixed `ekey_`, or, on Claude Platform on AWS, an AWS KMS key's ARN. - `required Attachment Attachment` Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted. - `class ExternalKeyAttachedAttachment` - `JsonElement Type = "attached"` - `class ExternalKeyUnattachedAttachment` - `JsonElement Type = "unattached"` - `required DateTimeOffset CreatedAt` format: date-time - `required string? DisplayName` Human-friendly display name. Null if none was set. - `required string Geo` Data residency geo. Selects the region that handles this key's encrypt/decrypt roundtrips. - `required ProviderConfig ProviderConfig` KMS provider identity and auth coordinates. - `class AwsExternalKeyConfig` - `JsonElement Type = "aws"` - `required string KmsArn` Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account. maxLength: 2048 - `string? Region` AWS region. Derived from `kms_arn` if omitted. - `class GcpExternalKeyConfig` - `JsonElement Type = "gcp"` - `required string KeyName` Full resource name of the Cloud KMS key. - `class AzureExternalKeyConfig` - `JsonElement Type = "azure"` - `required string KeyName` Name of the key within the vault. - `required string TenantID` Azure AD tenant ID. - `required string VaultUri` Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`. - `string? ClientID` Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory. - `required DateTimeOffset UpdatedAt` format: date-time - `required string? UserProfileID` ID of the user profile the key is bound to, or null if the key is not bound to one. A key bound to a user profile can only be attached to a Workspace that has the same user profile. A key that isn't bound can be attached to a Workspace whatever its user profile. #### Example ```csharp using System; using Anthropic.Models.Organization.ExternalKeys; ExternalKeyCreateParams parameters = new() { ProviderConfig = new AwsExternalKeyConfig() { KmsArn = "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222", Region = "us-east-1", }, }; var externalKey = await client.Organization.ExternalKeys.Create(parameters); Console.WriteLine(externalKey); ``` ##### Response (200) ```json { "id": "ekey_01SDCCSbTxrXDpWc1phhtcfK", "attachment": { "type": "attached" }, "created_at": "2024-10-30T23:58:27.427722Z", "display_name": "prod-us-key", "geo": "us", "provider_config": { "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222", "type": "aws", "region": "us-east-1", "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek" }, "type": "external_key", "updated_at": "2024-10-30T23:58:27.427722Z", "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK" } ``` ### List External Keys `ExternalKeyListPage Organization.ExternalKeys.List(parameters, cancellationToken = default)` **GET** `/v1/organizations/external_keys` List external key configs in the caller's organization. Results are ordered by creation time (newest first). Use the `next_page` cursor from the response to fetch subsequent pages. #### Parameters - `ExternalKeyListParams parameters` - `long limit` (query parameter) Number of results per page. minimum: 1, maximum: 100 - `string? page` (query parameter) Opaque cursor from a previous response's `next_page`. #### Returns - `class ExternalKey` CMEK external key config belonging to the caller's organization. Configs are organization-scoped. Workspaces attach to a config; once any workspace references it, the provider fields become effectively immutable (existing encrypted data needs the config for decrypt). - `JsonElement Type = "external_key"` - `required string ID` Identifier of the external key config: a tagged ID prefixed `ekey_`, or, on Claude Platform on AWS, an AWS KMS key's ARN. - `required Attachment Attachment` Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted. - `class ExternalKeyAttachedAttachment` - `JsonElement Type = "attached"` - `class ExternalKeyUnattachedAttachment` - `JsonElement Type = "unattached"` - `required DateTimeOffset CreatedAt` format: date-time - `required string? DisplayName` Human-friendly display name. Null if none was set. - `required string Geo` Data residency geo. Selects the region that handles this key's encrypt/decrypt roundtrips. - `required ProviderConfig ProviderConfig` KMS provider identity and auth coordinates. - `class AwsExternalKeyConfig` - `JsonElement Type = "aws"` - `required string KmsArn` Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account. maxLength: 2048 - `string? Region` AWS region. Derived from `kms_arn` if omitted. - `class GcpExternalKeyConfig` - `JsonElement Type = "gcp"` - `required string KeyName` Full resource name of the Cloud KMS key. - `class AzureExternalKeyConfig` - `JsonElement Type = "azure"` - `required string KeyName` Name of the key within the vault. - `required string TenantID` Azure AD tenant ID. - `required string VaultUri` Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`. - `string? ClientID` Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory. - `required DateTimeOffset UpdatedAt` format: date-time - `required string? UserProfileID` ID of the user profile the key is bound to, or null if the key is not bound to one. A key bound to a user profile can only be attached to a Workspace that has the same user profile. A key that isn't bound can be attached to a Workspace whatever its user profile. #### Example ```csharp using System; using Anthropic.Models.Organization.ExternalKeys; ExternalKeyListParams parameters = new(); var page = await client.Organization.ExternalKeys.List(parameters); await foreach (var item in page.Paginate()) { Console.WriteLine(item); } ``` ##### Response (200) ```json { "data": [ { "id": "ekey_01SDCCSbTxrXDpWc1phhtcfK", "attachment": { "type": "attached" }, "created_at": "2024-10-30T23:58:27.427722Z", "display_name": "prod-us-key", "geo": "us", "provider_config": { "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222", "type": "aws", "region": "us-east-1", "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek" }, "type": "external_key", "updated_at": "2024-10-30T23:58:27.427722Z", "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK" } ], "next_page": "next_page" } ``` ### Get External Key `ExternalKey Organization.ExternalKeys.Retrieve(parameters, cancellationToken = default)` **GET** `/v1/organizations/external_keys/{external_key_id}` Retrieve a single external key config in the caller's organization by ID. #### Parameters - `ExternalKeyRetrieveParams parameters` - `required string externalKeyID` (path parameter) ID of the External Key. maxLength: 2048 #### Returns - `class ExternalKey` CMEK external key config belonging to the caller's organization. Configs are organization-scoped. Workspaces attach to a config; once any workspace references it, the provider fields become effectively immutable (existing encrypted data needs the config for decrypt). - `JsonElement Type = "external_key"` - `required string ID` Identifier of the external key config: a tagged ID prefixed `ekey_`, or, on Claude Platform on AWS, an AWS KMS key's ARN. - `required Attachment Attachment` Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted. - `class ExternalKeyAttachedAttachment` - `JsonElement Type = "attached"` - `class ExternalKeyUnattachedAttachment` - `JsonElement Type = "unattached"` - `required DateTimeOffset CreatedAt` format: date-time - `required string? DisplayName` Human-friendly display name. Null if none was set. - `required string Geo` Data residency geo. Selects the region that handles this key's encrypt/decrypt roundtrips. - `required ProviderConfig ProviderConfig` KMS provider identity and auth coordinates. - `class AwsExternalKeyConfig` - `JsonElement Type = "aws"` - `required string KmsArn` Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account. maxLength: 2048 - `string? Region` AWS region. Derived from `kms_arn` if omitted. - `class GcpExternalKeyConfig` - `JsonElement Type = "gcp"` - `required string KeyName` Full resource name of the Cloud KMS key. - `class AzureExternalKeyConfig` - `JsonElement Type = "azure"` - `required string KeyName` Name of the key within the vault. - `required string TenantID` Azure AD tenant ID. - `required string VaultUri` Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`. - `string? ClientID` Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory. - `required DateTimeOffset UpdatedAt` format: date-time - `required string? UserProfileID` ID of the user profile the key is bound to, or null if the key is not bound to one. A key bound to a user profile can only be attached to a Workspace that has the same user profile. A key that isn't bound can be attached to a Workspace whatever its user profile. #### Example ```csharp using System; using Anthropic.Models.Organization.ExternalKeys; ExternalKeyRetrieveParams parameters = new() { ExternalKeyID = "external_key_id" }; var externalKey = await client.Organization.ExternalKeys.Retrieve(parameters); Console.WriteLine(externalKey); ``` ##### Response (200) ```json { "id": "ekey_01SDCCSbTxrXDpWc1phhtcfK", "attachment": { "type": "attached" }, "created_at": "2024-10-30T23:58:27.427722Z", "display_name": "prod-us-key", "geo": "us", "provider_config": { "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222", "type": "aws", "region": "us-east-1", "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek" }, "type": "external_key", "updated_at": "2024-10-30T23:58:27.427722Z", "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK" } ``` ### Update External Key `ExternalKey Organization.ExternalKeys.Update(parameters, cancellationToken = default)` **POST** `/v1/organizations/external_keys/{external_key_id}` Partially update an external key config. Omitted fields are left unchanged. `display_name` is always editable. `geo` and `provider_config` cannot be changed once any workspace references this config, because previously encrypted data requires the original key identity to decrypt. #### Parameters - `ExternalKeyUpdateParams parameters` - `required string externalKeyID` (path parameter) ID of the External Key. maxLength: 2048 - `string? displayName` Human-friendly display name. minLength: 1, maxLength: 255 - `Geo? geo` Data residency geo. Only `us` is supported. - `Us("us")` - `ProviderConfig? providerConfig` KMS provider identity and auth coordinates. - `class AwsExternalKeyConfig` - `JsonElement Type = "aws"` - `required string KmsArn` Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account. maxLength: 2048 - `string? Region` AWS region. Derived from `kms_arn` if omitted. - `class GcpExternalKeyConfig` - `JsonElement Type = "gcp"` - `required string KeyName` Full resource name of the Cloud KMS key. - `class AzureExternalKeyConfigParam` Azure Key Vault provider configuration. - `JsonElement Type = "azure"` - `required string KeyName` Name of the key within the vault. - `required string TenantID` Azure AD tenant ID. - `required string VaultUri` Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`. - `string? ClientID` Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory. #### Returns - `class ExternalKey` CMEK external key config belonging to the caller's organization. Configs are organization-scoped. Workspaces attach to a config; once any workspace references it, the provider fields become effectively immutable (existing encrypted data needs the config for decrypt). - `JsonElement Type = "external_key"` - `required string ID` Identifier of the external key config: a tagged ID prefixed `ekey_`, or, on Claude Platform on AWS, an AWS KMS key's ARN. - `required Attachment Attachment` Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted. - `class ExternalKeyAttachedAttachment` - `JsonElement Type = "attached"` - `class ExternalKeyUnattachedAttachment` - `JsonElement Type = "unattached"` - `required DateTimeOffset CreatedAt` format: date-time - `required string? DisplayName` Human-friendly display name. Null if none was set. - `required string Geo` Data residency geo. Selects the region that handles this key's encrypt/decrypt roundtrips. - `required ProviderConfig ProviderConfig` KMS provider identity and auth coordinates. - `class AwsExternalKeyConfig` - `JsonElement Type = "aws"` - `required string KmsArn` Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account. maxLength: 2048 - `string? Region` AWS region. Derived from `kms_arn` if omitted. - `class GcpExternalKeyConfig` - `JsonElement Type = "gcp"` - `required string KeyName` Full resource name of the Cloud KMS key. - `class AzureExternalKeyConfig` - `JsonElement Type = "azure"` - `required string KeyName` Name of the key within the vault. - `required string TenantID` Azure AD tenant ID. - `required string VaultUri` Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`. - `string? ClientID` Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory. - `required DateTimeOffset UpdatedAt` format: date-time - `required string? UserProfileID` ID of the user profile the key is bound to, or null if the key is not bound to one. A key bound to a user profile can only be attached to a Workspace that has the same user profile. A key that isn't bound can be attached to a Workspace whatever its user profile. #### Example ```csharp using System; using Anthropic.Models.Organization.ExternalKeys; ExternalKeyUpdateParams parameters = new() { ExternalKeyID = "external_key_id" }; var externalKey = await client.Organization.ExternalKeys.Update(parameters); Console.WriteLine(externalKey); ``` ##### Response (200) ```json { "id": "ekey_01SDCCSbTxrXDpWc1phhtcfK", "attachment": { "type": "attached" }, "created_at": "2024-10-30T23:58:27.427722Z", "display_name": "prod-us-key", "geo": "us", "provider_config": { "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222", "type": "aws", "region": "us-east-1", "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek" }, "type": "external_key", "updated_at": "2024-10-30T23:58:27.427722Z", "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK" } ``` ### Delete External Key `ExternalKeyDeleteResponse Organization.ExternalKeys.Delete(parameters, cancellationToken = default)` **DELETE** `/v1/organizations/external_keys/{external_key_id}` Delete an external key config. The request is rejected if any workspace still references this config. #### Parameters - `ExternalKeyDeleteParams parameters` - `required string externalKeyID` (path parameter) ID of the External Key. maxLength: 2048 #### Returns - `class ExternalKeyDeleteResponse` - `JsonElement Type = "external_key_deleted"` - `required string ID` ID of the deleted External Key. #### Example ```csharp using System; using Anthropic.Models.Organization.ExternalKeys; ExternalKeyDeleteParams parameters = new() { ExternalKeyID = "external_key_id" }; var externalKey = await client.Organization.ExternalKeys.Delete(parameters); Console.WriteLine(externalKey); ``` ##### Response (200) ```json { "id": "ekey_01AbCdEfGhIjKlMnOpQrStUv", "type": "external_key_deleted" } ``` ### Validate External Key `ExternalKeyValidateResponse Organization.ExternalKeys.Validate(parameters, cancellationToken = default)` **POST** `/v1/organizations/external_keys/{external_key_id}/validate` Validate an external key config against the customer's KMS. Anthropic performs an encrypt/decrypt roundtrip against the configured KMS key and waits up to 30 seconds for the result. The response status is `success` if the roundtrip succeeded, or `failure` with an error message if it failed or timed out. #### Parameters - `ExternalKeyValidateParams parameters` - `required string externalKeyID` (path parameter) ID of the External Key. maxLength: 2048 #### Returns - `class ExternalKeyValidateResponse` Result of a validation roundtrip against the customer's KMS. HTTP 200 for both outcomes — the operation completed; `status` says whether the key works. - `JsonElement Type = "external_key_validation"` - `required string? Error` Error message when status is `failure`. Null otherwise. - `required Status Status` `success` — encrypt/decrypt roundtrip succeeded. `failure` — the roundtrip failed or timed out; see `error`. - `Failure("failure")` - `Success("success")` #### Example ```csharp using System; using Anthropic.Models.Organization.ExternalKeys; ExternalKeyValidateParams parameters = new() { ExternalKeyID = "external_key_id" }; var response = await client.Organization.ExternalKeys.Validate(parameters); Console.WriteLine(response); ``` ##### Response (200) ```json { "error": "error", "status": "failure", "type": "external_key_validation" } ``` ## Organization › Federation › Issuers ### Create Federation Issuer `FederationIssuer Organization.Federation.Issuers.Create(parameters, cancellationToken = default)` **POST** `/v1/organizations/federation_issuers` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Register an OIDC issuer that Anthropic will trust for workload identity federation in your organization. The `jwks` field controls how the issuer's signing keys are obtained and takes one of three shapes selected by `type`: `discovery` (resolve keys through OIDC discovery), `explicit_url` (fetch keys from a fixed JWKS URL), or `inline` (provide a static key set). When `jwks.type` is `discovery` and no `discovery_base` is set, the issuer URL must be publicly reachable over HTTPS so Anthropic can fetch the discovery document; for `explicit_url` and `inline` modes the issuer URL is only matched as the JWT's `iss` claim and is not fetched. #### Parameters - `IssuerCreateParams parameters` - `required string issuerUrl` The `iss` claim value to match against. minLength: 1 - `required string name` Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409. minLength: 1, maxLength: 255 - `bool? checkJti` Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Defaults to true. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement. - `Jwks jwks` How signing keys are obtained. Defaults to OIDC discovery. - `class JwksDiscovery` JWKS via the issuer's OIDC discovery document. - `JsonElement Type = "discovery"` - `string? CACertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `string? DiscoveryBase` Set when the discovery URL differs from `issuer_url`. - `class JwksExplicitUrl` JWKS fetched from a fixed endpoint. - `JsonElement Type = "explicit_url"` - `required string Url` JWKS endpoint. minLength: 1 - `string? CACertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `class JwksInline` JWKS supplied directly; no network fetch. - `JsonElement Type = "inline"` - `required IReadOnlyList> Keys` Inline JWK objects. minItems: 1 - `long? maxJwtLifetimeSeconds` Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Defaults to 3600 (1h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected. minimum: 1, maximum: 176400 #### Returns - `class FederationIssuer` Registered external OIDC identity provider. Records an external IdP the organization trusts for the RFC 7523 jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly. - `JsonElement Type = "federation_issuer"` - `required string ID` Tagged ID of the federation issuer. - `required DateTimeOffset? ArchivedAt` If set, all rules referencing this issuer reject token exchange. format: date-time - `required string? ArchivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this issuer. - `required bool CheckJti` Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement. - `required DateTimeOffset CreatedAt` When this issuer was created. format: date-time - `required string? CreatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this issuer. - `required string IssuerUrl` The `iss` claim value. Incoming JWTs must match exactly. - `required Jwks Jwks` How signing keys are obtained for signature verification. - `class JwksDiscovery` JWKS via the issuer's OIDC discovery document. - `JsonElement Type = "discovery"` - `string? CACertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `string? DiscoveryBase` Set when the discovery URL differs from `issuer_url`. - `class JwksExplicitUrl` JWKS fetched from a fixed endpoint. - `JsonElement Type = "explicit_url"` - `required string Url` JWKS endpoint. minLength: 1 - `string? CACertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `class JwksInline` JWKS supplied directly; no network fetch. - `JsonElement Type = "inline"` - `required IReadOnlyList> Keys` Inline JWK objects. minItems: 1 - `required DateTimeOffset? JwksPollingDisabledAt` If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session. format: date-time - `required long MaxJwtLifetimeSeconds` Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected. - `required string Name` Admin-chosen slug identifier. - `required FederationIssuerPollStatus? PollStatus` Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet. - `required long ConsecutiveFailures` Consecutive fetch failures since the last success. - `required DateTimeOffset? LastFetchedAt` When the last successful fetch completed. format: date-time - `required DateTimeOffset? NextPollAt` When the next fetch is scheduled. Null if paused. format: date-time - `required DateTimeOffset UpdatedAt` When this issuer was last updated. format: date-time - `required string? UpdatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer. #### Example ```csharp using System; using Anthropic.Models.Organization.Federation.Issuers; IssuerCreateParams parameters = new() { IssuerUrl = "x", Name = "x", }; var federationIssuer = await client.Organization.Federation.Issuers.Create(parameters); Console.WriteLine(federationIssuer); ``` ##### Response (200) ```json { "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "check_jti": true, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "issuer_url": "https://token.actions.githubusercontent.com", "jwks": { "type": "discovery", "ca_cert_pem": "ca_cert_pem", "discovery_base": "discovery_base" }, "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z", "max_jwt_lifetime_seconds": 0, "name": "github-actions", "poll_status": { "consecutive_failures": 0, "last_fetched_at": "2019-12-27T18:11:19.117Z", "next_poll_at": "2019-12-27T18:11:19.117Z" }, "type": "federation_issuer", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ``` ### List Federation Issuers `IssuerListPage Organization.Federation.Issuers.List(parameters, cancellationToken = default)` **GET** `/v1/organizations/federation_issuers` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). List federation issuers in your organization. Archived issuers are excluded unless `include_archived=true`. #### Parameters - `IssuerListParams parameters` - `bool includeArchived` (query parameter) Include archived resources. Defaults to false. - `long limit` (query parameter) Number of results per page. minimum: 1, maximum: 100 - `string? page` (query parameter) Opaque cursor from a previous response's `next_page`. #### Returns - `class FederationIssuer` Registered external OIDC identity provider. Records an external IdP the organization trusts for the RFC 7523 jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly. - `JsonElement Type = "federation_issuer"` - `required string ID` Tagged ID of the federation issuer. - `required DateTimeOffset? ArchivedAt` If set, all rules referencing this issuer reject token exchange. format: date-time - `required string? ArchivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this issuer. - `required bool CheckJti` Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement. - `required DateTimeOffset CreatedAt` When this issuer was created. format: date-time - `required string? CreatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this issuer. - `required string IssuerUrl` The `iss` claim value. Incoming JWTs must match exactly. - `required Jwks Jwks` How signing keys are obtained for signature verification. - `class JwksDiscovery` JWKS via the issuer's OIDC discovery document. - `JsonElement Type = "discovery"` - `string? CACertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `string? DiscoveryBase` Set when the discovery URL differs from `issuer_url`. - `class JwksExplicitUrl` JWKS fetched from a fixed endpoint. - `JsonElement Type = "explicit_url"` - `required string Url` JWKS endpoint. minLength: 1 - `string? CACertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `class JwksInline` JWKS supplied directly; no network fetch. - `JsonElement Type = "inline"` - `required IReadOnlyList> Keys` Inline JWK objects. minItems: 1 - `required DateTimeOffset? JwksPollingDisabledAt` If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session. format: date-time - `required long MaxJwtLifetimeSeconds` Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected. - `required string Name` Admin-chosen slug identifier. - `required FederationIssuerPollStatus? PollStatus` Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet. - `required long ConsecutiveFailures` Consecutive fetch failures since the last success. - `required DateTimeOffset? LastFetchedAt` When the last successful fetch completed. format: date-time - `required DateTimeOffset? NextPollAt` When the next fetch is scheduled. Null if paused. format: date-time - `required DateTimeOffset UpdatedAt` When this issuer was last updated. format: date-time - `required string? UpdatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer. #### Example ```csharp using System; using Anthropic.Models.Organization.Federation.Issuers; IssuerListParams parameters = new(); var page = await client.Organization.Federation.Issuers.List(parameters); await foreach (var item in page.Paginate()) { Console.WriteLine(item); } ``` ##### Response (200) ```json { "data": [ { "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "check_jti": true, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "issuer_url": "https://token.actions.githubusercontent.com", "jwks": { "type": "discovery", "ca_cert_pem": "ca_cert_pem", "discovery_base": "discovery_base" }, "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z", "max_jwt_lifetime_seconds": 0, "name": "github-actions", "poll_status": { "consecutive_failures": 0, "last_fetched_at": "2019-12-27T18:11:19.117Z", "next_poll_at": "2019-12-27T18:11:19.117Z" }, "type": "federation_issuer", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ], "next_page": "next_page" } ``` ### Get Federation Issuer `FederationIssuer Organization.Federation.Issuers.Retrieve(parameters, cancellationToken = default)` **GET** `/v1/organizations/federation_issuers/{federation_issuer_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Retrieve a federation issuer by its ID (`fdis_...`). #### Parameters - `IssuerRetrieveParams parameters` - `required string federationIssuerID` (path parameter) ID of the federation issuer. #### Returns - `class FederationIssuer` Registered external OIDC identity provider. Records an external IdP the organization trusts for the RFC 7523 jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly. - `JsonElement Type = "federation_issuer"` - `required string ID` Tagged ID of the federation issuer. - `required DateTimeOffset? ArchivedAt` If set, all rules referencing this issuer reject token exchange. format: date-time - `required string? ArchivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this issuer. - `required bool CheckJti` Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement. - `required DateTimeOffset CreatedAt` When this issuer was created. format: date-time - `required string? CreatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this issuer. - `required string IssuerUrl` The `iss` claim value. Incoming JWTs must match exactly. - `required Jwks Jwks` How signing keys are obtained for signature verification. - `class JwksDiscovery` JWKS via the issuer's OIDC discovery document. - `JsonElement Type = "discovery"` - `string? CACertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `string? DiscoveryBase` Set when the discovery URL differs from `issuer_url`. - `class JwksExplicitUrl` JWKS fetched from a fixed endpoint. - `JsonElement Type = "explicit_url"` - `required string Url` JWKS endpoint. minLength: 1 - `string? CACertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `class JwksInline` JWKS supplied directly; no network fetch. - `JsonElement Type = "inline"` - `required IReadOnlyList> Keys` Inline JWK objects. minItems: 1 - `required DateTimeOffset? JwksPollingDisabledAt` If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session. format: date-time - `required long MaxJwtLifetimeSeconds` Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected. - `required string Name` Admin-chosen slug identifier. - `required FederationIssuerPollStatus? PollStatus` Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet. - `required long ConsecutiveFailures` Consecutive fetch failures since the last success. - `required DateTimeOffset? LastFetchedAt` When the last successful fetch completed. format: date-time - `required DateTimeOffset? NextPollAt` When the next fetch is scheduled. Null if paused. format: date-time - `required DateTimeOffset UpdatedAt` When this issuer was last updated. format: date-time - `required string? UpdatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer. #### Example ```csharp using System; using Anthropic.Models.Organization.Federation.Issuers; IssuerRetrieveParams parameters = new() { FederationIssuerID = "federation_issuer_id" }; var federationIssuer = await client.Organization.Federation.Issuers.Retrieve(parameters); Console.WriteLine(federationIssuer); ``` ##### Response (200) ```json { "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "check_jti": true, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "issuer_url": "https://token.actions.githubusercontent.com", "jwks": { "type": "discovery", "ca_cert_pem": "ca_cert_pem", "discovery_base": "discovery_base" }, "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z", "max_jwt_lifetime_seconds": 0, "name": "github-actions", "poll_status": { "consecutive_failures": 0, "last_fetched_at": "2019-12-27T18:11:19.117Z", "next_poll_at": "2019-12-27T18:11:19.117Z" }, "type": "federation_issuer", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ``` ### Update Federation Issuer `FederationIssuer Organization.Federation.Issuers.Update(parameters, cancellationToken = default)` **POST** `/v1/organizations/federation_issuers/{federation_issuer_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Partially update a federation issuer. Setting `jwks` replaces the full JWKS shape at once. Archived issuers cannot be updated; this returns 400. Create a new issuer instead. Updating an issuer that backs a rule with a scope outside `workspace:developer` or `workspace:inference` requires a Console session. #### Parameters - `IssuerUpdateParams parameters` - `required string federationIssuerID` (path parameter) ID of the federation issuer to update. - `bool? checkJti` Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement. - `string? issuerUrl` Replaces the `iss` claim value to match against. For discovery-mode issuers without a `discovery_base`, this is also the URL Anthropic fetches the OIDC discovery document and signing keys from, so changing it repoints the JWKS source. Changing the issuer URL to a well-known shared platform is rejected while any live rule under this issuer would not constrain tenant identity. minLength: 1 - `Jwks? jwks` Replaces the entire JWKS configuration. - `class JwksDiscovery` JWKS via the issuer's OIDC discovery document. - `JsonElement Type = "discovery"` - `string? CACertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `string? DiscoveryBase` Set when the discovery URL differs from `issuer_url`. - `class JwksExplicitUrl` JWKS fetched from a fixed endpoint. - `JsonElement Type = "explicit_url"` - `required string Url` JWKS endpoint. minLength: 1 - `string? CACertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `class JwksInline` JWKS supplied directly; no network fetch. - `JsonElement Type = "inline"` - `required IReadOnlyList> Keys` Inline JWK objects. minItems: 1 - `bool? jwksPollingDisabled` Only `false` is accepted, to re-enable polling after the system pauses it. Polling is paused automatically; sending `true` is rejected. - `long? maxJwtLifetimeSeconds` Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected. minimum: 1, maximum: 176400 - `string? name` Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409. minLength: 1, maxLength: 255 #### Returns - `class FederationIssuer` Registered external OIDC identity provider. Records an external IdP the organization trusts for the RFC 7523 jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly. - `JsonElement Type = "federation_issuer"` - `required string ID` Tagged ID of the federation issuer. - `required DateTimeOffset? ArchivedAt` If set, all rules referencing this issuer reject token exchange. format: date-time - `required string? ArchivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this issuer. - `required bool CheckJti` Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement. - `required DateTimeOffset CreatedAt` When this issuer was created. format: date-time - `required string? CreatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this issuer. - `required string IssuerUrl` The `iss` claim value. Incoming JWTs must match exactly. - `required Jwks Jwks` How signing keys are obtained for signature verification. - `class JwksDiscovery` JWKS via the issuer's OIDC discovery document. - `JsonElement Type = "discovery"` - `string? CACertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `string? DiscoveryBase` Set when the discovery URL differs from `issuer_url`. - `class JwksExplicitUrl` JWKS fetched from a fixed endpoint. - `JsonElement Type = "explicit_url"` - `required string Url` JWKS endpoint. minLength: 1 - `string? CACertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `class JwksInline` JWKS supplied directly; no network fetch. - `JsonElement Type = "inline"` - `required IReadOnlyList> Keys` Inline JWK objects. minItems: 1 - `required DateTimeOffset? JwksPollingDisabledAt` If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session. format: date-time - `required long MaxJwtLifetimeSeconds` Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected. - `required string Name` Admin-chosen slug identifier. - `required FederationIssuerPollStatus? PollStatus` Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet. - `required long ConsecutiveFailures` Consecutive fetch failures since the last success. - `required DateTimeOffset? LastFetchedAt` When the last successful fetch completed. format: date-time - `required DateTimeOffset? NextPollAt` When the next fetch is scheduled. Null if paused. format: date-time - `required DateTimeOffset UpdatedAt` When this issuer was last updated. format: date-time - `required string? UpdatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer. #### Example ```csharp using System; using Anthropic.Models.Organization.Federation.Issuers; IssuerUpdateParams parameters = new() { FederationIssuerID = "federation_issuer_id" }; var federationIssuer = await client.Organization.Federation.Issuers.Update(parameters); Console.WriteLine(federationIssuer); ``` ##### Response (200) ```json { "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "check_jti": true, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "issuer_url": "https://token.actions.githubusercontent.com", "jwks": { "type": "discovery", "ca_cert_pem": "ca_cert_pem", "discovery_base": "discovery_base" }, "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z", "max_jwt_lifetime_seconds": 0, "name": "github-actions", "poll_status": { "consecutive_failures": 0, "last_fetched_at": "2019-12-27T18:11:19.117Z", "next_poll_at": "2019-12-27T18:11:19.117Z" }, "type": "federation_issuer", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ``` ### Archive Federation Issuer `FederationIssuer Organization.Federation.Issuers.Archive(parameters, cancellationToken = default)` **POST** `/v1/organizations/federation_issuers/{federation_issuer_id}/archive` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Archive a federation issuer. Idempotent; re-archiving returns the issuer with its original `archived_at`. Rejected with 400 if any live (non-archived) federation rule still references the issuer; archive those rules first (a rule's issuer cannot be changed), or recreate them against another issuer. #### Parameters - `IssuerArchiveParams parameters` - `required string federationIssuerID` (path parameter) ID of the federation issuer to archive. #### Returns - `class FederationIssuer` Registered external OIDC identity provider. Records an external IdP the organization trusts for the RFC 7523 jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly. - `JsonElement Type = "federation_issuer"` - `required string ID` Tagged ID of the federation issuer. - `required DateTimeOffset? ArchivedAt` If set, all rules referencing this issuer reject token exchange. format: date-time - `required string? ArchivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this issuer. - `required bool CheckJti` Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement. - `required DateTimeOffset CreatedAt` When this issuer was created. format: date-time - `required string? CreatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this issuer. - `required string IssuerUrl` The `iss` claim value. Incoming JWTs must match exactly. - `required Jwks Jwks` How signing keys are obtained for signature verification. - `class JwksDiscovery` JWKS via the issuer's OIDC discovery document. - `JsonElement Type = "discovery"` - `string? CACertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `string? DiscoveryBase` Set when the discovery URL differs from `issuer_url`. - `class JwksExplicitUrl` JWKS fetched from a fixed endpoint. - `JsonElement Type = "explicit_url"` - `required string Url` JWKS endpoint. minLength: 1 - `string? CACertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `class JwksInline` JWKS supplied directly; no network fetch. - `JsonElement Type = "inline"` - `required IReadOnlyList> Keys` Inline JWK objects. minItems: 1 - `required DateTimeOffset? JwksPollingDisabledAt` If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session. format: date-time - `required long MaxJwtLifetimeSeconds` Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected. - `required string Name` Admin-chosen slug identifier. - `required FederationIssuerPollStatus? PollStatus` Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet. - `required long ConsecutiveFailures` Consecutive fetch failures since the last success. - `required DateTimeOffset? LastFetchedAt` When the last successful fetch completed. format: date-time - `required DateTimeOffset? NextPollAt` When the next fetch is scheduled. Null if paused. format: date-time - `required DateTimeOffset UpdatedAt` When this issuer was last updated. format: date-time - `required string? UpdatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer. #### Example ```csharp using System; using Anthropic.Models.Organization.Federation.Issuers; IssuerArchiveParams parameters = new() { FederationIssuerID = "federation_issuer_id" }; var federationIssuer = await client.Organization.Federation.Issuers.Archive(parameters); Console.WriteLine(federationIssuer); ``` ##### Response (200) ```json { "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "check_jti": true, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "issuer_url": "https://token.actions.githubusercontent.com", "jwks": { "type": "discovery", "ca_cert_pem": "ca_cert_pem", "discovery_base": "discovery_base" }, "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z", "max_jwt_lifetime_seconds": 0, "name": "github-actions", "poll_status": { "consecutive_failures": 0, "last_fetched_at": "2019-12-27T18:11:19.117Z", "next_poll_at": "2019-12-27T18:11:19.117Z" }, "type": "federation_issuer", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ``` ## Organization › Federation › Rules ### Create Federation Rule `FederationRule Organization.Federation.Rules.Create(parameters, cancellationToken = default)` **POST** `/v1/organizations/federation_rules` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Create a federation rule owned by your organization. The referenced issuer and the target service account must already exist in the same organization; invalid references are rejected with a 400 error. The workspace reference is validated. Membership is not checked at rule creation: token exchange resolves a single enabled workspace per call and is rejected unless the target service account is a member of that workspace (it is implicitly a member of the default workspace). Rules on well-known shared issuers (GitHub Actions, GitLab, Buildkite, Terraform Cloud, Google) must constrain tenant identity via an identity-bearing claim, a tenant-pinning subject prefix (such as `repo:YOUR_ORG/...`), or a CEL condition referencing one of those identity claims (e.g. `claims.repository_owner`). OAuth callers may only manage rules whose `oauth_scope` is `workspace:developer` or `workspace:inference`; other scopes require a Console session. #### Parameters - `RuleCreateParams parameters` - `required string issuerID` Tagged ID of the federation issuer. - `required FederationRuleMatch match` Conditions the verified JWT must satisfy for this rule to apply. At least one of `subject_prefix` (other than a wildcard-only value like `*`), `claims`, or `condition` is required; `audience` alone is not sufficient. - `required string name` Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409. minLength: 1, maxLength: 255 - `required string oauthScope` Space-separated OAuth scopes. OAuth callers may only set `workspace:developer` or `workspace:inference`; other scopes (such as `org:admin`) require a Console session. minLength: 1 - `required ServiceAccountTarget target` Identity that tokens minted via this rule act as. Currently always a `service_account` target. - `bool appliesToAllWorkspaces` When true, enable this rule for every workspace in the org (including workspaces created later). - `string? description` Optional free-text description. maxLength: 2000 - `long tokenLifetimeSeconds` Lifetime in seconds for access tokens minted via this rule (60-86400). Defaults to 3600 (1h). Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds. minimum: 60, maximum: 86400 - `string? workspaceID` Tagged ID of the workspace to enable this rule for. Required unless `applies_to_all_workspaces` is true. Additional workspaces can be added via the `/federation_rules/{federation_rule_id}/workspaces` sub-resource. #### Returns - `class FederationRule` Authorization rule binding an external OIDC identity to Anthropic. Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to a single workspace where the rule is enabled (chosen by the caller at exchange time when the rule is enabled for more than one). For rules enabled via `workspace_ids` or `applies_to_all_workspaces`, the target service account must be a member of that workspace (it is implicitly a member of the default workspace); rules carrying only the legacy `workspace_id` binding do not enforce this. - `JsonElement Type = "federation_rule"` - `required string ID` Tagged ID of the federation rule. - `required bool AppliesToAllWorkspaces` When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time. - `required DateTimeOffset? ArchivedAt` If set, this rule is archived and rejects token exchange. format: date-time - `required string? ArchivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this rule. - `required DateTimeOffset CreatedAt` When this rule was created. format: date-time - `required string? CreatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this rule. - `required string? Description` Optional free-text description. - `required string IssuerID` Tagged ID of the issuer whose tokens this rule accepts. - `required string? IssuerName` Issuer's display name at read time. - `required FederationRuleMatch Match` Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass. - `string? Audience` Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default. maxLength: 1024 - `IReadOnlyDictionary? Claims` Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims. - `string? Condition` CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400. maxLength: 4096 - `string? SubjectPrefix` Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`. maxLength: 1024 - `required string Name` Admin-chosen slug identifier. - `required string OAuthScope` Space-separated OAuth scopes granted on the minted token. - `required ServiceAccountTarget Target` What this rule targets. Check `type` before reading the other fields. Tokens minted via a rule whose target `type` is `service_account` act as that service account. - `JsonElement Type = "service_account"` - `required string ServiceAccountID` Tagged ID of the service account to mint tokens for. - `string? ServiceAccountName` Service account's display name at read time. Ignored on writes. - `required long TokenLifetimeSeconds` Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds. - `required DateTimeOffset UpdatedAt` When this rule was last updated. format: date-time - `required string? UpdatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this rule. - `required IReadOnlyList WorkspaceIds` Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty). #### Example ```csharp using System; using System.Collections.Generic; using Anthropic.Models.Organization.Federation.Rules; RuleCreateParams parameters = new() { IssuerID = "issuer_id", Match = new() { Audience = "audience", Claims = new Dictionary() { { "foo", "string" } }, Condition = "condition", SubjectPrefix = "subject_prefix", }, Name = "x", OAuthScope = "x", Target = new() { ServiceAccountID = "svac_01SDCCSbTxrXDpWc1phhtcfK", ServiceAccountName = "service_account_name", }, }; var federationRule = await client.Organization.Federation.Rules.Create(parameters); Console.WriteLine(federationRule); ``` ##### Response (200) ```json { "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK", "applies_to_all_workspaces": true, "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "attributes": { "foo": "string" }, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "description": "description", "issuer_id": "issuer_id", "issuer_name": "issuer_name", "match": { "audience": "audience", "claims": { "foo": "string" }, "condition": "condition", "subject_prefix": "subject_prefix" }, "name": "prod-deploy-pipeline", "oauth_scope": "oauth_scope", "target": { "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK", "type": "service_account", "service_account_name": "service_account_name" }, "token_lifetime_seconds": 0, "type": "federation_rule", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id", "workspace_id": "workspace_id", "workspace_ids": [ "string" ] } ``` ### List Federation Rules `RuleListPage Organization.Federation.Rules.List(parameters, cancellationToken = default)` **GET** `/v1/organizations/federation_rules` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). List federation rules in your organization. Optionally filter by issuer with `issuer_id`. Archived rules are excluded unless `include_archived=true`. #### Parameters - `RuleListParams parameters` - `bool includeArchived` (query parameter) Include archived resources. Defaults to false. - `string? issuerID` (query parameter) Filter to rules referencing this federation issuer. - `long limit` (query parameter) Number of results per page. minimum: 1, maximum: 100 - `string? page` (query parameter) Opaque cursor from a previous response's `next_page`. #### Returns - `class FederationRule` Authorization rule binding an external OIDC identity to Anthropic. Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to a single workspace where the rule is enabled (chosen by the caller at exchange time when the rule is enabled for more than one). For rules enabled via `workspace_ids` or `applies_to_all_workspaces`, the target service account must be a member of that workspace (it is implicitly a member of the default workspace); rules carrying only the legacy `workspace_id` binding do not enforce this. - `JsonElement Type = "federation_rule"` - `required string ID` Tagged ID of the federation rule. - `required bool AppliesToAllWorkspaces` When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time. - `required DateTimeOffset? ArchivedAt` If set, this rule is archived and rejects token exchange. format: date-time - `required string? ArchivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this rule. - `required DateTimeOffset CreatedAt` When this rule was created. format: date-time - `required string? CreatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this rule. - `required string? Description` Optional free-text description. - `required string IssuerID` Tagged ID of the issuer whose tokens this rule accepts. - `required string? IssuerName` Issuer's display name at read time. - `required FederationRuleMatch Match` Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass. - `string? Audience` Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default. maxLength: 1024 - `IReadOnlyDictionary? Claims` Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims. - `string? Condition` CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400. maxLength: 4096 - `string? SubjectPrefix` Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`. maxLength: 1024 - `required string Name` Admin-chosen slug identifier. - `required string OAuthScope` Space-separated OAuth scopes granted on the minted token. - `required ServiceAccountTarget Target` What this rule targets. Check `type` before reading the other fields. Tokens minted via a rule whose target `type` is `service_account` act as that service account. - `JsonElement Type = "service_account"` - `required string ServiceAccountID` Tagged ID of the service account to mint tokens for. - `string? ServiceAccountName` Service account's display name at read time. Ignored on writes. - `required long TokenLifetimeSeconds` Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds. - `required DateTimeOffset UpdatedAt` When this rule was last updated. format: date-time - `required string? UpdatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this rule. - `required IReadOnlyList WorkspaceIds` Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty). #### Example ```csharp using System; using Anthropic.Models.Organization.Federation.Rules; RuleListParams parameters = new(); var page = await client.Organization.Federation.Rules.List(parameters); await foreach (var item in page.Paginate()) { Console.WriteLine(item); } ``` ##### Response (200) ```json { "data": [ { "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK", "applies_to_all_workspaces": true, "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "attributes": { "foo": "string" }, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "description": "description", "issuer_id": "issuer_id", "issuer_name": "issuer_name", "match": { "audience": "audience", "claims": { "foo": "string" }, "condition": "condition", "subject_prefix": "subject_prefix" }, "name": "prod-deploy-pipeline", "oauth_scope": "oauth_scope", "target": { "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK", "type": "service_account", "service_account_name": "service_account_name" }, "token_lifetime_seconds": 0, "type": "federation_rule", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id", "workspace_id": "workspace_id", "workspace_ids": [ "string" ] } ], "next_page": "next_page" } ``` ### Get Federation Rule `FederationRule Organization.Federation.Rules.Retrieve(parameters, cancellationToken = default)` **GET** `/v1/organizations/federation_rules/{federation_rule_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Retrieve a federation rule by its ID (`fdrl_...`). #### Parameters - `RuleRetrieveParams parameters` - `required string federationRuleID` (path parameter) ID of the federation rule. #### Returns - `class FederationRule` Authorization rule binding an external OIDC identity to Anthropic. Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to a single workspace where the rule is enabled (chosen by the caller at exchange time when the rule is enabled for more than one). For rules enabled via `workspace_ids` or `applies_to_all_workspaces`, the target service account must be a member of that workspace (it is implicitly a member of the default workspace); rules carrying only the legacy `workspace_id` binding do not enforce this. - `JsonElement Type = "federation_rule"` - `required string ID` Tagged ID of the federation rule. - `required bool AppliesToAllWorkspaces` When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time. - `required DateTimeOffset? ArchivedAt` If set, this rule is archived and rejects token exchange. format: date-time - `required string? ArchivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this rule. - `required DateTimeOffset CreatedAt` When this rule was created. format: date-time - `required string? CreatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this rule. - `required string? Description` Optional free-text description. - `required string IssuerID` Tagged ID of the issuer whose tokens this rule accepts. - `required string? IssuerName` Issuer's display name at read time. - `required FederationRuleMatch Match` Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass. - `string? Audience` Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default. maxLength: 1024 - `IReadOnlyDictionary? Claims` Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims. - `string? Condition` CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400. maxLength: 4096 - `string? SubjectPrefix` Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`. maxLength: 1024 - `required string Name` Admin-chosen slug identifier. - `required string OAuthScope` Space-separated OAuth scopes granted on the minted token. - `required ServiceAccountTarget Target` What this rule targets. Check `type` before reading the other fields. Tokens minted via a rule whose target `type` is `service_account` act as that service account. - `JsonElement Type = "service_account"` - `required string ServiceAccountID` Tagged ID of the service account to mint tokens for. - `string? ServiceAccountName` Service account's display name at read time. Ignored on writes. - `required long TokenLifetimeSeconds` Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds. - `required DateTimeOffset UpdatedAt` When this rule was last updated. format: date-time - `required string? UpdatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this rule. - `required IReadOnlyList WorkspaceIds` Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty). #### Example ```csharp using System; using Anthropic.Models.Organization.Federation.Rules; RuleRetrieveParams parameters = new() { FederationRuleID = "federation_rule_id" }; var federationRule = await client.Organization.Federation.Rules.Retrieve(parameters); Console.WriteLine(federationRule); ``` ##### Response (200) ```json { "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK", "applies_to_all_workspaces": true, "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "attributes": { "foo": "string" }, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "description": "description", "issuer_id": "issuer_id", "issuer_name": "issuer_name", "match": { "audience": "audience", "claims": { "foo": "string" }, "condition": "condition", "subject_prefix": "subject_prefix" }, "name": "prod-deploy-pipeline", "oauth_scope": "oauth_scope", "target": { "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK", "type": "service_account", "service_account_name": "service_account_name" }, "token_lifetime_seconds": 0, "type": "federation_rule", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id", "workspace_id": "workspace_id", "workspace_ids": [ "string" ] } ``` ### Update Federation Rule `FederationRule Organization.Federation.Rules.Update(parameters, cancellationToken = default)` **POST** `/v1/organizations/federation_rules/{federation_rule_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Partially update a federation rule. `issuer_id` is immutable. `match` and `target` are replaced as whole objects when set. Referenced service accounts and workspaces must exist in your organization; invalid references are rejected with a 400 error. Archived rules cannot be updated; this returns 400. Create a new rule instead. Rules on well-known shared issuers (GitHub Actions, GitLab, Buildkite, Terraform Cloud, Google) must constrain tenant identity via an identity-bearing claim, a tenant-pinning subject prefix (such as `repo:YOUR_ORG/...`), or a CEL condition referencing one of those identity claims (e.g. `claims.repository_owner`). On these issuers the requirement is re-checked on every update; if an existing rule's stored match does not yet constrain tenant identity, any update (even a rename or description change) must also supply a conforming `match` in the same request. OAuth callers may only manage rules whose `oauth_scope` is `workspace:developer` or `workspace:inference`; other scopes require a Console session. #### Parameters - `RuleUpdateParams parameters` - `required string federationRuleID` (path parameter) ID of the federation rule to update. - `bool? appliesToAllWorkspaces` When true, enables this rule for every workspace in the org (including workspaces created later). Setting `false` is rejected with 400 if no workspace would remain enabled; a rule with only a legacy `workspace_id` binding continues to mint. - `string? description` Replaces the description. Omit to leave unchanged; send `null` to clear (the field is stored as an empty string). maxLength: 2000 - `FederationRuleMatch? match` Replaces the entire match object. All populated matcher fields must pass. - `string? name` Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409. minLength: 1, maxLength: 255 - `string? oauthScope` Replaces the space-separated OAuth scopes granted on minted tokens. OAuth callers may only set `workspace:developer` or `workspace:inference`; other scopes (such as `org:admin`) require a Console session. minLength: 1 - `ServiceAccountTarget? target` Replaces the entire target object. Currently always a `service_account` target. - `long? tokenLifetimeSeconds` Replaces the lifetime in seconds for access tokens minted via this rule (60-86400). Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds. minimum: 60, maximum: 86400 - `string? workspaceID` Replaces the existing single workspace enablement (the previous one is removed). Rejected with 400 if the rule is enabled for more than one workspace; use the `/federation_rules/{federation_rule_id}/workspaces` sub-resource instead. #### Returns - `class FederationRule` Authorization rule binding an external OIDC identity to Anthropic. Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to a single workspace where the rule is enabled (chosen by the caller at exchange time when the rule is enabled for more than one). For rules enabled via `workspace_ids` or `applies_to_all_workspaces`, the target service account must be a member of that workspace (it is implicitly a member of the default workspace); rules carrying only the legacy `workspace_id` binding do not enforce this. - `JsonElement Type = "federation_rule"` - `required string ID` Tagged ID of the federation rule. - `required bool AppliesToAllWorkspaces` When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time. - `required DateTimeOffset? ArchivedAt` If set, this rule is archived and rejects token exchange. format: date-time - `required string? ArchivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this rule. - `required DateTimeOffset CreatedAt` When this rule was created. format: date-time - `required string? CreatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this rule. - `required string? Description` Optional free-text description. - `required string IssuerID` Tagged ID of the issuer whose tokens this rule accepts. - `required string? IssuerName` Issuer's display name at read time. - `required FederationRuleMatch Match` Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass. - `string? Audience` Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default. maxLength: 1024 - `IReadOnlyDictionary? Claims` Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims. - `string? Condition` CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400. maxLength: 4096 - `string? SubjectPrefix` Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`. maxLength: 1024 - `required string Name` Admin-chosen slug identifier. - `required string OAuthScope` Space-separated OAuth scopes granted on the minted token. - `required ServiceAccountTarget Target` What this rule targets. Check `type` before reading the other fields. Tokens minted via a rule whose target `type` is `service_account` act as that service account. - `JsonElement Type = "service_account"` - `required string ServiceAccountID` Tagged ID of the service account to mint tokens for. - `string? ServiceAccountName` Service account's display name at read time. Ignored on writes. - `required long TokenLifetimeSeconds` Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds. - `required DateTimeOffset UpdatedAt` When this rule was last updated. format: date-time - `required string? UpdatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this rule. - `required IReadOnlyList WorkspaceIds` Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty). #### Example ```csharp using System; using Anthropic.Models.Organization.Federation.Rules; RuleUpdateParams parameters = new() { FederationRuleID = "federation_rule_id" }; var federationRule = await client.Organization.Federation.Rules.Update(parameters); Console.WriteLine(federationRule); ``` ##### Response (200) ```json { "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK", "applies_to_all_workspaces": true, "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "attributes": { "foo": "string" }, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "description": "description", "issuer_id": "issuer_id", "issuer_name": "issuer_name", "match": { "audience": "audience", "claims": { "foo": "string" }, "condition": "condition", "subject_prefix": "subject_prefix" }, "name": "prod-deploy-pipeline", "oauth_scope": "oauth_scope", "target": { "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK", "type": "service_account", "service_account_name": "service_account_name" }, "token_lifetime_seconds": 0, "type": "federation_rule", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id", "workspace_id": "workspace_id", "workspace_ids": [ "string" ] } ``` ### Archive Federation Rule `FederationRule Organization.Federation.Rules.Archive(parameters, cancellationToken = default)` **POST** `/v1/organizations/federation_rules/{federation_rule_id}/archive` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Archive a federation rule. Token exchange through this rule stops immediately. Idempotent; re-archiving returns the rule with its original `archived_at`. Archiving clears the rule's workspace targeting (`workspace_id` and `workspace_ids` are emptied). Tokens already minted before archive remain valid until they expire. OAuth callers may only manage rules whose `oauth_scope` is `workspace:developer` or `workspace:inference`; other scopes require a Console session. #### Parameters - `RuleArchiveParams parameters` - `required string federationRuleID` (path parameter) ID of the federation rule to archive. #### Returns - `class FederationRule` Authorization rule binding an external OIDC identity to Anthropic. Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to a single workspace where the rule is enabled (chosen by the caller at exchange time when the rule is enabled for more than one). For rules enabled via `workspace_ids` or `applies_to_all_workspaces`, the target service account must be a member of that workspace (it is implicitly a member of the default workspace); rules carrying only the legacy `workspace_id` binding do not enforce this. - `JsonElement Type = "federation_rule"` - `required string ID` Tagged ID of the federation rule. - `required bool AppliesToAllWorkspaces` When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time. - `required DateTimeOffset? ArchivedAt` If set, this rule is archived and rejects token exchange. format: date-time - `required string? ArchivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this rule. - `required DateTimeOffset CreatedAt` When this rule was created. format: date-time - `required string? CreatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this rule. - `required string? Description` Optional free-text description. - `required string IssuerID` Tagged ID of the issuer whose tokens this rule accepts. - `required string? IssuerName` Issuer's display name at read time. - `required FederationRuleMatch Match` Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass. - `string? Audience` Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default. maxLength: 1024 - `IReadOnlyDictionary? Claims` Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims. - `string? Condition` CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400. maxLength: 4096 - `string? SubjectPrefix` Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`. maxLength: 1024 - `required string Name` Admin-chosen slug identifier. - `required string OAuthScope` Space-separated OAuth scopes granted on the minted token. - `required ServiceAccountTarget Target` What this rule targets. Check `type` before reading the other fields. Tokens minted via a rule whose target `type` is `service_account` act as that service account. - `JsonElement Type = "service_account"` - `required string ServiceAccountID` Tagged ID of the service account to mint tokens for. - `string? ServiceAccountName` Service account's display name at read time. Ignored on writes. - `required long TokenLifetimeSeconds` Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds. - `required DateTimeOffset UpdatedAt` When this rule was last updated. format: date-time - `required string? UpdatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this rule. - `required IReadOnlyList WorkspaceIds` Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty). #### Example ```csharp using System; using Anthropic.Models.Organization.Federation.Rules; RuleArchiveParams parameters = new() { FederationRuleID = "federation_rule_id" }; var federationRule = await client.Organization.Federation.Rules.Archive(parameters); Console.WriteLine(federationRule); ``` ##### Response (200) ```json { "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK", "applies_to_all_workspaces": true, "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "attributes": { "foo": "string" }, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "description": "description", "issuer_id": "issuer_id", "issuer_name": "issuer_name", "match": { "audience": "audience", "claims": { "foo": "string" }, "condition": "condition", "subject_prefix": "subject_prefix" }, "name": "prod-deploy-pipeline", "oauth_scope": "oauth_scope", "target": { "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK", "type": "service_account", "service_account_name": "service_account_name" }, "token_lifetime_seconds": 0, "type": "federation_rule", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id", "workspace_id": "workspace_id", "workspace_ids": [ "string" ] } ``` ## Organization › Federation › Rules › Workspaces ### Add Federation Rule Workspace `FederationRuleWorkspace Organization.Federation.Rules.Workspaces.Add(parameters, cancellationToken = default)` **POST** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Enable a federation rule for a workspace. Idempotent; re-enabling returns the existing enablement. The rule and workspace must both belong to your organization. Membership of the rule's target service account in this workspace is not checked at enablement: token exchange into this workspace is rejected unless the target is a member (it is implicitly a member of the default workspace). Archived rules are rejected with 400. OAuth callers may only manage rules whose `oauth_scope` is `workspace:developer` or `workspace:inference`; other scopes require a Console session. #### Parameters - `WorkspaceAddParams parameters` - `required string federationRuleID` (path parameter) ID of the federation rule. - `required string workspaceID` Tagged ID of the workspace to enable this rule for. #### Returns - `class FederationRuleWorkspace` - `JsonElement Type = "federation_rule_workspace"` - `required DateTimeOffset CreatedAt` When this workspace was enabled for the rule. format: date-time - `required string? CreatedByActorID` Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known. - `required string FederationRuleID` Tagged ID of the federation rule. - `required string WorkspaceID` Tagged ID of the workspace this rule is enabled for. - `required string? WorkspaceName` Workspace display name. Populated when listing; null in the enable response. #### Example ```csharp using System; using Anthropic.Models.Organization.Federation.Rules.Workspaces; WorkspaceAddParams parameters = new() { FederationRuleID = "federation_rule_id", WorkspaceID = "workspace_id", }; var federationRuleWorkspace = await client.Organization.Federation.Rules.Workspaces.Add(parameters); Console.WriteLine(federationRuleWorkspace); ``` ##### Response (200) ```json { "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "federation_rule_id": "federation_rule_id", "type": "federation_rule_workspace", "workspace_id": "workspace_id", "workspace_name": "workspace_name" } ``` ### List Federation Rule Workspaces `WorkspaceListPage Organization.Federation.Rules.Workspaces.List(parameters, cancellationToken = default)` **GET** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). List workspaces where this federation rule is enabled. Returns all workspace enablements in a single response; the `limit` and `page` parameters are accepted but have no effect, and `next_page` is always `null`. Returns explicit per-workspace enablements only; for rules with `applies_to_all_workspaces` or a legacy single `workspace_id`, check those fields on the rule itself. #### Parameters - `WorkspaceListParams parameters` - `required string federationRuleID` (path parameter) ID of the federation rule. - `long limit` (query parameter) Number of results per page. minimum: 1, maximum: 100 - `string? page` (query parameter) Opaque cursor from a previous response's `next_page`. #### Returns - `class FederationRuleWorkspace` - `JsonElement Type = "federation_rule_workspace"` - `required DateTimeOffset CreatedAt` When this workspace was enabled for the rule. format: date-time - `required string? CreatedByActorID` Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known. - `required string FederationRuleID` Tagged ID of the federation rule. - `required string WorkspaceID` Tagged ID of the workspace this rule is enabled for. - `required string? WorkspaceName` Workspace display name. Populated when listing; null in the enable response. #### Example ```csharp using System; using Anthropic.Models.Organization.Federation.Rules.Workspaces; WorkspaceListParams parameters = new() { FederationRuleID = "federation_rule_id" }; var page = await client.Organization.Federation.Rules.Workspaces.List(parameters); await foreach (var item in page.Paginate()) { Console.WriteLine(item); } ``` ##### Response (200) ```json { "data": [ { "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "federation_rule_id": "federation_rule_id", "type": "federation_rule_workspace", "workspace_id": "workspace_id", "workspace_name": "workspace_name" } ], "next_page": "next_page" } ``` ### Remove Federation Rule Workspace `WorkspaceRemoveResponse Organization.Federation.Rules.Workspaces.Remove(parameters, cancellationToken = default)` **DELETE** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces/{workspace_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Disable a federation rule for a workspace. Idempotent; succeeds even if the enablement was already removed. OAuth callers may only manage rules whose `oauth_scope` is `workspace:developer` or `workspace:inference`; other scopes require a Console session. #### Parameters - `WorkspaceRemoveParams parameters` - `required string federationRuleID` (path parameter) ID of the federation rule. - `required string workspaceID` (path parameter) ID of the workspace to disable for. #### Returns - `class WorkspaceRemoveResponse` - `JsonElement Type = "federation_rule_workspace_deleted"` - `required string FederationRuleID` Tagged ID of the federation rule. - `required string WorkspaceID` Tagged ID of the workspace named in the delete request. Removal is idempotent. #### Example ```csharp using System; using Anthropic.Models.Organization.Federation.Rules.Workspaces; WorkspaceRemoveParams parameters = new() { FederationRuleID = "federation_rule_id", WorkspaceID = "workspace_id", }; var workspace = await client.Organization.Federation.Rules.Workspaces.Remove(parameters); Console.WriteLine(workspace); ``` ##### Response (200) ```json { "federation_rule_id": "federation_rule_id", "type": "federation_rule_workspace_deleted", "workspace_id": "workspace_id" } ``` ## Organization › Invites ### Create Invite `OrganizationInvite Organization.Invites.Create(parameters, cancellationToken = default)` **POST** `/v1/organizations/invites` Invite a user to join the organization by email. On plans that draw members from a finite pool of purchased seats, the invite automatically consumes a seat from the lowest tier with availability; there is no seat-tier parameter. When no seat is free the request fails with a 400 error rather than purchasing a seat. #### Parameters - `InviteCreateParams parameters` - `required string email` Email of the User. format: email - `required Role role` Role for the invited User. The accepted values depend on the organization type. Console and API organizations accept `user`, `developer`, `billing`, and `claude_code_user`; `admin` cannot be assigned through the API. Claude Enterprise organizations accept `user` and `managed`; inviting with the `managed` role requires the `write:rbac_groups` scope in addition to `write:members`. - `Billing("billing")` - `ClaudeCodeUser("claude_code_user")` - `Developer("developer")` - `Managed("managed")` - `User("user")` - `IReadOnlyList rbacGroupIds` RBAC group IDs to assign to the User when the Invite is accepted. A non-empty array is accepted only for a Claude Enterprise organization with RBAC groups, and requires the key to carry the `write:rbac_groups` scope. maxItems: 100 #### Returns - `class OrganizationInvite` - `JsonElement Type = "invite"` Object type. For Invites, this is always `"invite"`. - `required string ID` ID of the Invite. - `required DateTimeOffset? AcceptedAt` RFC 3339 datetime string indicating when the Invite was accepted, or null. format: date-time - `required string Email` Email of the User being invited. - `required DateTimeOffset ExpiresAt` RFC 3339 datetime string indicating when the Invite expires. format: date-time - `required DateTimeOffset InvitedAt` RFC 3339 datetime string indicating when the Invite was created. format: date-time - `required IReadOnlyList RbacGroupIds` RBAC group IDs recorded on the Invite (Claude Enterprise organizations), to be assigned to the User when the Invite is accepted. `[]` when none. - `required OrganizationRole Role` Organization role of the User. - `Admin("admin")` - `Billing("billing")` - `ClaudeCodeUser("claude_code_user")` - `Developer("developer")` - `Managed("managed")` - `MembershipAdmin("membership_admin")` - `Owner("owner")` - `PrimaryOwner("primary_owner")` - `User("user")` - `required Status Status` Status of the Invite. - `Accepted("accepted")` - `Deleted("deleted")` - `Expired("expired")` - `Pending("pending")` #### Example ```csharp using System; using Anthropic.Models.Organization.Invites; InviteCreateParams parameters = new() { Email = "user@emaildomain.com", Role = Role.User, }; var organizationInvite = await client.Organization.Invites.Create(parameters); Console.WriteLine(organizationInvite); ``` ##### Response (200) ```json { "id": "invite_015gWxCN9Hfg2QhZwTK7Mdeu", "accepted_at": "2019-12-27T18:11:19.117Z", "email": "user@emaildomain.com", "expires_at": "2024-11-20T23:58:27.427722Z", "invited_at": "2024-10-30T23:58:27.427722Z", "rbac_group_ids": [ "string" ], "role": "admin", "status": "pending", "type": "invite" } ``` ### List Invites `InviteListPage Organization.Invites.List(parameters, cancellationToken = default)` **GET** `/v1/organizations/invites` List the organization's invites. #### Parameters - `InviteListParams parameters` - `string afterID` (query parameter) ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object. - `string beforeID` (query parameter) ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object. - `string email` (query parameter) Filter by the email address the Invite was sent to. Matches the same way as the Users list's `email` filter (normalized, case-insensitive). format: email - `long limit` (query parameter) Number of items to return per page. Defaults to `20`. Ranges from `1` to `1000`. minimum: 1, maximum: 1000 - `IReadOnlyList roles` (query parameter) Filter to items whose `role` equals one of the supplied values. Repeatable; values are OR'ed together. Accepted values depend on the organization type: Console and API organizations accept `user`, `developer`, `billing`, `admin`, and `claude_code_user`; Claude Enterprise organizations accept `user`, `owner`, `primary_owner`, `membership_admin`, and `managed`. - `IReadOnlyList statuses` (query parameter) Filter by Invite status. Repeatable; values are OR'ed together. Omit to return `pending`, `accepted`, and `expired` Invites alike. - `Accepted("accepted")` - `Expired("expired")` - `Pending("pending")` #### Returns - `class OrganizationInvite` - `JsonElement Type = "invite"` Object type. For Invites, this is always `"invite"`. - `required string ID` ID of the Invite. - `required DateTimeOffset? AcceptedAt` RFC 3339 datetime string indicating when the Invite was accepted, or null. format: date-time - `required string Email` Email of the User being invited. - `required DateTimeOffset ExpiresAt` RFC 3339 datetime string indicating when the Invite expires. format: date-time - `required DateTimeOffset InvitedAt` RFC 3339 datetime string indicating when the Invite was created. format: date-time - `required IReadOnlyList RbacGroupIds` RBAC group IDs recorded on the Invite (Claude Enterprise organizations), to be assigned to the User when the Invite is accepted. `[]` when none. - `required OrganizationRole Role` Organization role of the User. - `Admin("admin")` - `Billing("billing")` - `ClaudeCodeUser("claude_code_user")` - `Developer("developer")` - `Managed("managed")` - `MembershipAdmin("membership_admin")` - `Owner("owner")` - `PrimaryOwner("primary_owner")` - `User("user")` - `required Status Status` Status of the Invite. - `Accepted("accepted")` - `Deleted("deleted")` - `Expired("expired")` - `Pending("pending")` #### Example ```csharp using System; using Anthropic.Models.Organization.Invites; InviteListParams parameters = new(); var page = await client.Organization.Invites.List(parameters); await foreach (var item in page.Paginate()) { Console.WriteLine(item); } ``` ##### Response (200) ```json { "data": [ { "id": "invite_015gWxCN9Hfg2QhZwTK7Mdeu", "accepted_at": "2019-12-27T18:11:19.117Z", "email": "user@emaildomain.com", "expires_at": "2024-11-20T23:58:27.427722Z", "invited_at": "2024-10-30T23:58:27.427722Z", "rbac_group_ids": [ "string" ], "role": "admin", "status": "pending", "type": "invite" } ], "first_id": "first_id", "has_more": true, "last_id": "last_id" } ``` ### Get Invite `OrganizationInvite Organization.Invites.Retrieve(parameters, cancellationToken = default)` **GET** `/v1/organizations/invites/{invite_id}` Retrieve an invite by ID. #### Parameters - `InviteRetrieveParams parameters` - `required string inviteID` (path parameter) ID of the Invite. #### Returns - `class OrganizationInvite` - `JsonElement Type = "invite"` Object type. For Invites, this is always `"invite"`. - `required string ID` ID of the Invite. - `required DateTimeOffset? AcceptedAt` RFC 3339 datetime string indicating when the Invite was accepted, or null. format: date-time - `required string Email` Email of the User being invited. - `required DateTimeOffset ExpiresAt` RFC 3339 datetime string indicating when the Invite expires. format: date-time - `required DateTimeOffset InvitedAt` RFC 3339 datetime string indicating when the Invite was created. format: date-time - `required IReadOnlyList RbacGroupIds` RBAC group IDs recorded on the Invite (Claude Enterprise organizations), to be assigned to the User when the Invite is accepted. `[]` when none. - `required OrganizationRole Role` Organization role of the User. - `Admin("admin")` - `Billing("billing")` - `ClaudeCodeUser("claude_code_user")` - `Developer("developer")` - `Managed("managed")` - `MembershipAdmin("membership_admin")` - `Owner("owner")` - `PrimaryOwner("primary_owner")` - `User("user")` - `required Status Status` Status of the Invite. - `Accepted("accepted")` - `Deleted("deleted")` - `Expired("expired")` - `Pending("pending")` #### Example ```csharp using System; using Anthropic.Models.Organization.Invites; InviteRetrieveParams parameters = new() { InviteID = "invite_id" }; var organizationInvite = await client.Organization.Invites.Retrieve(parameters); Console.WriteLine(organizationInvite); ``` ##### Response (200) ```json { "id": "invite_015gWxCN9Hfg2QhZwTK7Mdeu", "accepted_at": "2019-12-27T18:11:19.117Z", "email": "user@emaildomain.com", "expires_at": "2024-11-20T23:58:27.427722Z", "invited_at": "2024-10-30T23:58:27.427722Z", "rbac_group_ids": [ "string" ], "role": "admin", "status": "pending", "type": "invite" } ``` ### Delete Invite `InviteDeleteResponse Organization.Invites.Delete(parameters, cancellationToken = default)` **DELETE** `/v1/organizations/invites/{invite_id}` Delete a pending invite. #### Parameters - `InviteDeleteParams parameters` - `required string inviteID` (path parameter) ID of the Invite. #### Returns - `class InviteDeleteResponse` - `JsonElement Type = "invite_deleted"` Deleted object type. For Invites, this is always `"invite_deleted"`. - `required string ID` ID of the Invite. #### Example ```csharp using System; using Anthropic.Models.Organization.Invites; InviteDeleteParams parameters = new() { InviteID = "invite_id" }; var invite = await client.Organization.Invites.Delete(parameters); Console.WriteLine(invite); ``` ##### Response (200) ```json { "id": "invite_015gWxCN9Hfg2QhZwTK7Mdeu", "type": "invite_deleted" } ``` ## Organization › Service Accounts ### Create Service Account `ServiceAccount Organization.ServiceAccounts.Create(parameters, cancellationToken = default)` **POST** `/v1/organizations/service_accounts` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Create a service account. A service account is a named workload identity that federation rules target. `organization_role` is `developer` (default) or `admin`; a rule may only be created or retargeted to grant `org:admin` scope when the target's `organization_role` is `admin`. Creating an `admin`-role service account requires an interactive credential (a user OAuth token or a Console session) — a workload may only create `developer`-role service accounts. #### Parameters - `ServiceAccountCreateParams parameters` - `required string name` Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409. minLength: 1, maxLength: 255 - `string? description` Optional free-text description. maxLength: 2000 - `OrganizationRole organizationRole` Org-level role. Defaults to `developer`. - `Admin("admin")` - `Developer("developer")` #### Returns - `class ServiceAccount` Named non-human identity within the caller's organization. A service account is a pure identity: name + org. Authorization lives on whatever references it (federation rules). - `JsonElement Type = "service_account"` - `required string ID` Tagged ID of the service account. - `required DateTimeOffset? ArchivedAt` If set, this service account is archived. format: date-time - `required string? ArchivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this service account. - `required DateTimeOffset CreatedAt` When this service account was created. format: date-time - `required string? CreatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this service account. - `required string? Description` Optional free-text description. - `required string Name` Admin-chosen slug identifier. - `required OrganizationRole OrganizationRole` Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console. - `Admin("admin")` - `Developer("developer")` - `required DateTimeOffset UpdatedAt` When this service account was last updated. format: date-time - `required string? UpdatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this service account. #### Example ```csharp using System; using Anthropic.Models.Organization.ServiceAccounts; ServiceAccountCreateParams parameters = new() { Name = "ci-deploy-bot" }; var serviceAccount = await client.Organization.ServiceAccounts.Create(parameters); Console.WriteLine(serviceAccount); ``` ##### Response (200) ```json { "id": "svac_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "description": "description", "name": "ci-deploy-bot", "organization_role": "admin", "type": "service_account", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ``` ### List Service Accounts `ServiceAccountListPage Organization.ServiceAccounts.List(parameters, cancellationToken = default)` **GET** `/v1/organizations/service_accounts` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). List service accounts in the caller's organization. Results are ordered by creation time, newest first. Use `limit` and the `next_page` cursor to paginate; set `include_archived=true` to include archived service accounts. #### Parameters - `ServiceAccountListParams parameters` - `bool includeArchived` (query parameter) Include archived resources. Defaults to false. - `long limit` (query parameter) Number of results per page. minimum: 1, maximum: 100 - `string? page` (query parameter) Opaque cursor from a previous response's `next_page`. #### Returns - `class ServiceAccount` Named non-human identity within the caller's organization. A service account is a pure identity: name + org. Authorization lives on whatever references it (federation rules). - `JsonElement Type = "service_account"` - `required string ID` Tagged ID of the service account. - `required DateTimeOffset? ArchivedAt` If set, this service account is archived. format: date-time - `required string? ArchivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this service account. - `required DateTimeOffset CreatedAt` When this service account was created. format: date-time - `required string? CreatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this service account. - `required string? Description` Optional free-text description. - `required string Name` Admin-chosen slug identifier. - `required OrganizationRole OrganizationRole` Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console. - `Admin("admin")` - `Developer("developer")` - `required DateTimeOffset UpdatedAt` When this service account was last updated. format: date-time - `required string? UpdatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this service account. #### Example ```csharp using System; using Anthropic.Models.Organization.ServiceAccounts; ServiceAccountListParams parameters = new(); var page = await client.Organization.ServiceAccounts.List(parameters); await foreach (var item in page.Paginate()) { Console.WriteLine(item); } ``` ##### Response (200) ```json { "data": [ { "id": "svac_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "description": "description", "name": "ci-deploy-bot", "organization_role": "admin", "type": "service_account", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ], "next_page": "next_page" } ``` ### Get Service Account `ServiceAccount Organization.ServiceAccounts.Retrieve(parameters, cancellationToken = default)` **GET** `/v1/organizations/service_accounts/{service_account_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Retrieve a service account by its ID (`svac_...`). #### Parameters - `ServiceAccountRetrieveParams parameters` - `required string serviceAccountID` (path parameter) ID of the service account. #### Returns - `class ServiceAccount` Named non-human identity within the caller's organization. A service account is a pure identity: name + org. Authorization lives on whatever references it (federation rules). - `JsonElement Type = "service_account"` - `required string ID` Tagged ID of the service account. - `required DateTimeOffset? ArchivedAt` If set, this service account is archived. format: date-time - `required string? ArchivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this service account. - `required DateTimeOffset CreatedAt` When this service account was created. format: date-time - `required string? CreatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this service account. - `required string? Description` Optional free-text description. - `required string Name` Admin-chosen slug identifier. - `required OrganizationRole OrganizationRole` Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console. - `Admin("admin")` - `Developer("developer")` - `required DateTimeOffset UpdatedAt` When this service account was last updated. format: date-time - `required string? UpdatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this service account. #### Example ```csharp using System; using Anthropic.Models.Organization.ServiceAccounts; ServiceAccountRetrieveParams parameters = new() { ServiceAccountID = "service_account_id" }; var serviceAccount = await client.Organization.ServiceAccounts.Retrieve(parameters); Console.WriteLine(serviceAccount); ``` ##### Response (200) ```json { "id": "svac_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "description": "description", "name": "ci-deploy-bot", "organization_role": "admin", "type": "service_account", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ``` ### Update Service Account `ServiceAccount Organization.ServiceAccounts.Update(parameters, cancellationToken = default)` **POST** `/v1/organizations/service_accounts/{service_account_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Update a service account. Only `description` and `organization_role` are mutable; `name` cannot be changed. Archived service accounts cannot be updated; this returns 400. Setting `organization_role` to `admin` (even when unchanged) requires an interactive credential (a user OAuth token or a Console session). #### Parameters - `ServiceAccountUpdateParams parameters` - `required string serviceAccountID` (path parameter) ID of the service account to update. - `string? description` Replaces the description. Omit to leave unchanged; send `null` to clear (the field is stored as an empty string). maxLength: 2000 - `OrganizationRole? organizationRole` Replaces the org-level role. Omit or send `null` to leave unchanged. - `Admin("admin")` - `Developer("developer")` #### Returns - `class ServiceAccount` Named non-human identity within the caller's organization. A service account is a pure identity: name + org. Authorization lives on whatever references it (federation rules). - `JsonElement Type = "service_account"` - `required string ID` Tagged ID of the service account. - `required DateTimeOffset? ArchivedAt` If set, this service account is archived. format: date-time - `required string? ArchivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this service account. - `required DateTimeOffset CreatedAt` When this service account was created. format: date-time - `required string? CreatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this service account. - `required string? Description` Optional free-text description. - `required string Name` Admin-chosen slug identifier. - `required OrganizationRole OrganizationRole` Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console. - `Admin("admin")` - `Developer("developer")` - `required DateTimeOffset UpdatedAt` When this service account was last updated. format: date-time - `required string? UpdatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this service account. #### Example ```csharp using System; using Anthropic.Models.Organization.ServiceAccounts; ServiceAccountUpdateParams parameters = new() { ServiceAccountID = "service_account_id" }; var serviceAccount = await client.Organization.ServiceAccounts.Update(parameters); Console.WriteLine(serviceAccount); ``` ##### Response (200) ```json { "id": "svac_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "description": "description", "name": "ci-deploy-bot", "organization_role": "admin", "type": "service_account", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ``` ### Archive Service Account `ServiceAccount Organization.ServiceAccounts.Archive(parameters, cancellationToken = default)` **POST** `/v1/organizations/service_accounts/{service_account_id}/archive` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Archive a service account. Idempotent; re-archiving returns the service account with its original `archived_at`. Rejected with 400 if any live (non-archived) federation rule still targets this service account, same as issuer archival; archive those rules first or change their target to another service account. #### Parameters - `ServiceAccountArchiveParams parameters` - `required string serviceAccountID` (path parameter) ID of the service account to archive. #### Returns - `class ServiceAccount` Named non-human identity within the caller's organization. A service account is a pure identity: name + org. Authorization lives on whatever references it (federation rules). - `JsonElement Type = "service_account"` - `required string ID` Tagged ID of the service account. - `required DateTimeOffset? ArchivedAt` If set, this service account is archived. format: date-time - `required string? ArchivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this service account. - `required DateTimeOffset CreatedAt` When this service account was created. format: date-time - `required string? CreatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this service account. - `required string? Description` Optional free-text description. - `required string Name` Admin-chosen slug identifier. - `required OrganizationRole OrganizationRole` Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console. - `Admin("admin")` - `Developer("developer")` - `required DateTimeOffset UpdatedAt` When this service account was last updated. format: date-time - `required string? UpdatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this service account. #### Example ```csharp using System; using Anthropic.Models.Organization.ServiceAccounts; ServiceAccountArchiveParams parameters = new() { ServiceAccountID = "service_account_id" }; var serviceAccount = await client.Organization.ServiceAccounts.Archive(parameters); Console.WriteLine(serviceAccount); ``` ##### Response (200) ```json { "id": "svac_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "description": "description", "name": "ci-deploy-bot", "organization_role": "admin", "type": "service_account", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ``` ## Organization › Service Accounts › Workspaces ### Add Workspace To Service Account `ServiceAccountWorkspaceMember Organization.ServiceAccounts.Workspaces.Add(parameters, cancellationToken = default)` **POST** `/v1/organizations/service_accounts/{service_account_id}/workspaces` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Add a service account to a workspace with the given `workspace_role`. Mirror of `POST /workspaces/{workspace_id}/service_accounts`, addressed from the service-account side; both create the same membership. If the service account is already an explicit member of the workspace, its `workspace_role` is replaced with the value supplied here. Archived workspaces return 400. Archived service accounts cannot be added and are rejected. #### Parameters - `WorkspaceAddParams parameters` - `required string serviceAccountID` (path parameter) ID of the service account. - `required string workspaceID` Tagged workspace ID to add the service account to. - `required NoBillingWorkspaceRole workspaceRole` Role to assign to the service account in this workspace. #### Returns - `class ServiceAccountWorkspaceMember` - `JsonElement Type = "service_account_workspace_member"` - `required string? CreatedByActorID` Tagged ID (`user_...`/`svac_...`) of the actor who created this membership. - `required bool? Implicit` True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed. - `required string ServiceAccountID` Tagged service account ID (`svac_...`). - `required string WorkspaceID` Tagged workspace ID (`wrkspc_...`). - `required WorkspaceRole WorkspaceRole` Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role. - `WorkspaceAdmin("workspace_admin")` - `WorkspaceBilling("workspace_billing")` - `WorkspaceDeveloper("workspace_developer")` - `WorkspaceRestrictedDeveloper("workspace_restricted_developer")` - `WorkspaceUser("workspace_user")` #### Example ```csharp using System; using Anthropic.Models.Organization.ServiceAccounts.Workspaces; using Anthropic.Models.Organization.Workspaces; WorkspaceAddParams parameters = new() { ServiceAccountID = "service_account_id", WorkspaceID = "workspace_id", WorkspaceRole = NoBillingWorkspaceRole.WorkspaceAdmin, }; var serviceAccountWorkspaceMember = await client.Organization.ServiceAccounts.Workspaces.Add(parameters); Console.WriteLine(serviceAccountWorkspaceMember); ``` ##### Response (200) ```json { "created_by_actor_id": "created_by_actor_id", "implicit": true, "service_account_id": "service_account_id", "type": "service_account_workspace_member", "workspace_id": "workspace_id", "workspace_role": "workspace_admin" } ``` ### List Workspaces For Service Account `WorkspaceListPage Organization.ServiceAccounts.Workspaces.List(parameters, cancellationToken = default)` **GET** `/v1/organizations/service_accounts/{service_account_id}/workspaces` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). List the workspaces a service account is a member of. Each entry includes the service account's `workspace_role` in that workspace. Use `limit` and the `next_page` cursor to paginate. When the service account has no explicit default-workspace membership, the implicit (`implicit: true`) membership is returned as the first entry on the first page; with `limit=1` the first page may return up to 2 entries (the implicit entry plus one explicit membership) so a pagination cursor can be derived. Memberships are returned only while the service account is active. Without a `page` cursor, an archived service account returns an empty list. A `page` cursor that does not match an active membership returns a 400 invalid-request error. A cursor stops matching when the membership is removed, the workspace is deleted, or the service account is archived. Restart pagination from the first page to recover. #### Parameters - `WorkspaceListParams parameters` - `required string serviceAccountID` (path parameter) ID of the service account. - `long limit` (query parameter) Number of results per page. minimum: 1, maximum: 100 - `string? page` (query parameter) Opaque cursor from a previous response's `next_page`. #### Returns - `class ServiceAccountWorkspaceMember` - `JsonElement Type = "service_account_workspace_member"` - `required string? CreatedByActorID` Tagged ID (`user_...`/`svac_...`) of the actor who created this membership. - `required bool? Implicit` True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed. - `required string ServiceAccountID` Tagged service account ID (`svac_...`). - `required string WorkspaceID` Tagged workspace ID (`wrkspc_...`). - `required WorkspaceRole WorkspaceRole` Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role. - `WorkspaceAdmin("workspace_admin")` - `WorkspaceBilling("workspace_billing")` - `WorkspaceDeveloper("workspace_developer")` - `WorkspaceRestrictedDeveloper("workspace_restricted_developer")` - `WorkspaceUser("workspace_user")` #### Example ```csharp using System; using Anthropic.Models.Organization.ServiceAccounts.Workspaces; WorkspaceListParams parameters = new() { ServiceAccountID = "service_account_id" }; var page = await client.Organization.ServiceAccounts.Workspaces.List(parameters); await foreach (var item in page.Paginate()) { Console.WriteLine(item); } ``` ##### Response (200) ```json { "data": [ { "created_by_actor_id": "created_by_actor_id", "implicit": true, "service_account_id": "service_account_id", "type": "service_account_workspace_member", "workspace_id": "workspace_id", "workspace_role": "workspace_admin" } ], "next_page": "next_page" } ``` ### Remove Workspace From Service Account `WorkspaceRemoveResponse Organization.ServiceAccounts.Workspaces.Remove(parameters, cancellationToken = default)` **DELETE** `/v1/organizations/service_accounts/{service_account_id}/workspaces/{workspace_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Remove a service account from a workspace. Mirror of `DELETE /workspaces/{workspace_id}/service_accounts/{service_account_id}`, addressed from the service-account side. Removal is idempotent (returns 200 even if the membership was already removed). A DELETE against the implicit default-workspace membership returns 200 but is a no-op and the membership persists; deleting an explicit default-workspace row reverts to the implicit `workspace_user` membership. Archived workspaces return 400. #### Parameters - `WorkspaceRemoveParams parameters` - `required string serviceAccountID` (path parameter) ID of the service account. - `required string workspaceID` (path parameter) ID of the workspace. #### Returns - `class WorkspaceRemoveResponse` - `JsonElement Type = "service_account_workspace_member_deleted"` - `required string ServiceAccountID` Tagged service account ID (`svac_...`) named in the delete request. Removal is idempotent; see the endpoint description for the implicit-membership no-op. - `required string WorkspaceID` Tagged workspace ID (`wrkspc_...`) named in the delete request. #### Example ```csharp using System; using Anthropic.Models.Organization.ServiceAccounts.Workspaces; WorkspaceRemoveParams parameters = new() { ServiceAccountID = "service_account_id", WorkspaceID = "workspace_id", }; var workspace = await client.Organization.ServiceAccounts.Workspaces.Remove(parameters); Console.WriteLine(workspace); ``` ##### Response (200) ```json { "service_account_id": "service_account_id", "type": "service_account_workspace_member_deleted", "workspace_id": "workspace_id" } ``` ## Organization › Users ### List Users `UserListPage Organization.Users.List(parameters, cancellationToken = default)` **GET** `/v1/organizations/users` List the organization's members. #### Parameters - `UserListParams parameters` - `string afterID` (query parameter) ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object. - `string beforeID` (query parameter) ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object. - `string email` (query parameter) Filter by user email. format: email - `long limit` (query parameter) Number of items to return per page. Defaults to `20`. Ranges from `1` to `1000`. minimum: 1, maximum: 1000 - `IReadOnlyList roles` (query parameter) Filter to items whose `role` equals one of the supplied values. Repeatable; values are OR'ed together. Accepted values depend on the organization type: Console and API organizations accept `user`, `developer`, `billing`, `admin`, and `claude_code_user`; Claude Enterprise organizations accept `user`, `owner`, `primary_owner`, `membership_admin`, and `managed`. #### Returns - `class OrganizationUser` - `JsonElement Type = "user"` Object type. For Users, this is always `"user"`. - `required string ID` ID of the User. - `required DateTimeOffset AddedAt` RFC 3339 datetime string indicating when the User joined the Organization. format: date-time - `required string Email` Email of the User. - `required string Name` Name of the User. - `required OrganizationRole Role` Organization role of the User. - `Admin("admin")` - `Billing("billing")` - `ClaudeCodeUser("claude_code_user")` - `Developer("developer")` - `Managed("managed")` - `MembershipAdmin("membership_admin")` - `Owner("owner")` - `PrimaryOwner("primary_owner")` - `User("user")` #### Example ```csharp using System; using Anthropic.Models.Organization.Users; UserListParams parameters = new(); var page = await client.Organization.Users.List(parameters); await foreach (var item in page.Paginate()) { Console.WriteLine(item); } ``` ##### Response (200) ```json { "data": [ { "id": "user_01WxYzAbCdEfGhJkMnPqRsTu", "added_at": "2024-10-30T23:58:27.427722Z", "email": "user@emaildomain.com", "name": "Jane Doe", "role": "admin", "type": "user" } ], "first_id": "first_id", "has_more": true, "last_id": "last_id" } ``` ### Get User `OrganizationUser Organization.Users.Retrieve(parameters, cancellationToken = default)` **GET** `/v1/organizations/users/{user_id}` Retrieve a member of the organization by user ID. #### Parameters - `UserRetrieveParams parameters` - `required string userID` (path parameter) ID of the User. #### Returns - `class OrganizationUser` - `JsonElement Type = "user"` Object type. For Users, this is always `"user"`. - `required string ID` ID of the User. - `required DateTimeOffset AddedAt` RFC 3339 datetime string indicating when the User joined the Organization. format: date-time - `required string Email` Email of the User. - `required string Name` Name of the User. - `required OrganizationRole Role` Organization role of the User. - `Admin("admin")` - `Billing("billing")` - `ClaudeCodeUser("claude_code_user")` - `Developer("developer")` - `Managed("managed")` - `MembershipAdmin("membership_admin")` - `Owner("owner")` - `PrimaryOwner("primary_owner")` - `User("user")` #### Example ```csharp using System; using Anthropic.Models.Organization.Users; UserRetrieveParams parameters = new() { UserID = "user_id" }; var organizationUser = await client.Organization.Users.Retrieve(parameters); Console.WriteLine(organizationUser); ``` ##### Response (200) ```json { "id": "user_01WxYzAbCdEfGhJkMnPqRsTu", "added_at": "2024-10-30T23:58:27.427722Z", "email": "user@emaildomain.com", "name": "Jane Doe", "role": "admin", "type": "user" } ``` ### Update User `OrganizationUser Organization.Users.Update(parameters, cancellationToken = default)` **POST** `/v1/organizations/users/{user_id}` Update a member's organization role. #### Parameters - `UserUpdateParams parameters` - `required string userID` (path parameter) ID of the User. - `required Role role` New role for the User. The accepted values depend on the organization type. Console and API organizations accept `user`, `developer`, `billing`, and `claude_code_user`; `admin` cannot be assigned through the API. Claude Enterprise organizations accept `user` and `managed`; changing a User's role to `managed` requires the `write:rbac_groups` scope in addition to `write:members`. - `Billing("billing")` - `ClaudeCodeUser("claude_code_user")` - `Developer("developer")` - `Managed("managed")` - `User("user")` #### Returns - `class OrganizationUser` - `JsonElement Type = "user"` Object type. For Users, this is always `"user"`. - `required string ID` ID of the User. - `required DateTimeOffset AddedAt` RFC 3339 datetime string indicating when the User joined the Organization. format: date-time - `required string Email` Email of the User. - `required string Name` Name of the User. - `required OrganizationRole Role` Organization role of the User. - `Admin("admin")` - `Billing("billing")` - `ClaudeCodeUser("claude_code_user")` - `Developer("developer")` - `Managed("managed")` - `MembershipAdmin("membership_admin")` - `Owner("owner")` - `PrimaryOwner("primary_owner")` - `User("user")` #### Example ```csharp using System; using Anthropic.Models.Organization.Users; UserUpdateParams parameters = new() { UserID = "user_id", Role = Role.User, }; var organizationUser = await client.Organization.Users.Update(parameters); Console.WriteLine(organizationUser); ``` ##### Response (200) ```json { "id": "user_01WxYzAbCdEfGhJkMnPqRsTu", "added_at": "2024-10-30T23:58:27.427722Z", "email": "user@emaildomain.com", "name": "Jane Doe", "role": "admin", "type": "user" } ``` ### Remove User `UserRemoveResponse Organization.Users.Remove(parameters, cancellationToken = default)` **DELETE** `/v1/organizations/users/{user_id}` Remove a member from the organization. #### Parameters - `UserRemoveParams parameters` - `required string userID` (path parameter) ID of the User. #### Returns - `class UserRemoveResponse` - `JsonElement Type = "user_deleted"` Deleted object type. For Users, this is always `"user_deleted"`. - `required string ID` ID of the User. #### Example ```csharp using System; using Anthropic.Models.Organization.Users; UserRemoveParams parameters = new() { UserID = "user_id" }; var user = await client.Organization.Users.Remove(parameters); Console.WriteLine(user); ``` ##### Response (200) ```json { "id": "user_01WxYzAbCdEfGhJkMnPqRsTu", "type": "user_deleted" } ``` ## Organization › Workspaces ### List Workspaces `WorkspaceListPage Organization.Workspaces.List(parameters, cancellationToken = default)` **GET** `/v1/organizations/workspaces` List Workspaces #### Parameters - `WorkspaceListParams parameters` - `string afterID` (query parameter) ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object. - `string beforeID` (query parameter) ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object. - `bool includeArchived` (query parameter) Whether to include Workspaces that have been archived in the response - `bool includeDefault` (query parameter) Whether to include the organization's default Workspace in the response - `long limit` (query parameter) Number of items to return per page. Defaults to `20`. Ranges from `1` to `1000`. minimum: 1, maximum: 1000 #### Returns - `class Workspace` - `JsonElement Type = "workspace"` Object type. For Workspaces, this is always `"workspace"`. - `required string ID` ID of the Workspace. - `required DateTimeOffset? ArchivedAt` RFC 3339 datetime string indicating when the Workspace was archived, or `null` if the Workspace is not archived. format: date-time - `required string CompartmentID` Identifier for this Workspace's encryption compartment. When you configure an AWS KMS customer-managed encryption key (CMEK) that isn't bound to a user profile, reference this value in your KMS key-policy condition so the key is scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment binding automatically; you do not need to reference this value in your key configuration. See the CMEK integration guide for the required key configuration; unless your organization is on Claude Platform on AWS, it includes a separate value used during key validation. On Claude Platform on AWS there is no separate validation value: your organization's own key is validated against this Workspace's own value when it is attached, so if its key policy uses the compartment condition, add this value to it before attaching the key. - `required DateTimeOffset CreatedAt` RFC 3339 datetime string indicating when the Workspace was created. format: date-time - `required DataResidency DataResidency` Data residency configuration. - `required AllowedInferenceGeos AllowedInferenceGeos` Permitted inference geo values. 'unrestricted' means all geos are allowed. - `IReadOnlyList` - `Global("global")` - `Us("us")` - `class Unrestricted:` - `required DefaultInferenceGeo DefaultInferenceGeo` Default inference geo applied when requests omit the parameter. - `Global("global")` - `Us("us")` - `required WorkspaceGeo WorkspaceGeo` Geographic region for workspace data storage. Immutable after creation. - `required string DisplayColor` Hex color code representing the Workspace in the Anthropic Console. - `required string? ExternalKeyID` ID of the customer-managed encryption key (CMEK) configuration to use for this Workspace. Setting this field requires CMEK to be enabled for your organization. When set, data stored for this Workspace is encrypted with the referenced key. Create key configurations with the External Keys API. On Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your organization's own key must be a single-Region key in the same AWS account and Region as the Workspace. On that platform the key is validated against this Workspace when it is attached, so a key-policy problem is reported as an error on this request. This field is write-once: once a key is attached to a Workspace it cannot be detached or replaced. To rotate key material, rotate the underlying key on your cloud KMS; the `external_key_id` stays the same. - `required string Name` Name of the Workspace. - `required IReadOnlyDictionary Tags` User-defined tags as string key-value pairs. Keys may not begin with `anthropic`. - `required string? UserProfileID` ID of the user profile attached to the Workspace, or null if it has none. Every inference request through a Workspace that has a user profile must name that profile. #### Example ```csharp using System; using Anthropic.Models.Organization.Workspaces; WorkspaceListParams parameters = new(); var page = await client.Organization.Workspaces.List(parameters); await foreach (var item in page.Paginate()) { Console.WriteLine(item); } ``` ##### Response (200) ```json { "data": [ { "id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ", "archived_at": "2024-11-01T23:59:27.427722Z", "compartment_id": "f8a7b6c5-4d3e-4f1a-8b9c-0d1e2f3a4b5c", "created_at": "2024-10-30T23:58:27.427722Z", "data_residency": { "allowed_inference_geos": "unrestricted", "default_inference_geo": "global", "workspace_geo": "us" }, "display_color": "#6C5BB9", "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK", "name": "Workspace Name", "tags": { "env": "prod", "team": "platform" }, "type": "workspace", "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK" } ], "first_id": "first_id", "has_more": true, "last_id": "last_id" } ``` ### Create Workspace `Workspace Organization.Workspaces.Create(parameters, cancellationToken = default)` **POST** `/v1/organizations/workspaces` Create Workspace #### Parameters - `WorkspaceCreateParams parameters` - `required string name` Name of the Workspace. minLength: 1, maxLength: 255 - `DataResidencyCreateConfig? dataResidency` Data residency configuration for the workspace. If omitted, defaults to `workspace_geo: "us"`, `allowed_inference_geos: "unrestricted"`, and `default_inference_geo: "global"`. - `string? displayColor` Hex color code representing the Workspace in the Anthropic Console. maxLength: 7, pattern: ^#[0-9A-Fa-f]{6}$ - `string? externalKeyID` ID of the customer-managed encryption key (CMEK) configuration to use for this Workspace. Setting this field requires CMEK to be enabled for your organization. When set, data stored for this Workspace is encrypted with the referenced key. Create key configurations with the External Keys API. On Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your organization's own key must be a single-Region key in the same AWS account and Region as the Workspace. On that platform the key is validated against this Workspace when it is attached, so a key-policy problem is reported as an error on this request. This field is write-once: once a key is attached to a Workspace it cannot be detached or replaced. To rotate key material, rotate the underlying key on your cloud KMS; the `external_key_id` stays the same. - `IReadOnlyDictionary? tags` User-defined tags as string key-value pairs. Keys may not begin with `anthropic`. - `string? userProfileID` ID of a user profile to attach to the Workspace. Every inference request through the Workspace must then name this user profile; the API rejects a request that names none or a different one. The user profile can't be replaced or removed later; only deleting the user profile clears it. #### Returns - `class Workspace` - `JsonElement Type = "workspace"` Object type. For Workspaces, this is always `"workspace"`. - `required string ID` ID of the Workspace. - `required DateTimeOffset? ArchivedAt` RFC 3339 datetime string indicating when the Workspace was archived, or `null` if the Workspace is not archived. format: date-time - `required string CompartmentID` Identifier for this Workspace's encryption compartment. When you configure an AWS KMS customer-managed encryption key (CMEK) that isn't bound to a user profile, reference this value in your KMS key-policy condition so the key is scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment binding automatically; you do not need to reference this value in your key configuration. See the CMEK integration guide for the required key configuration; unless your organization is on Claude Platform on AWS, it includes a separate value used during key validation. On Claude Platform on AWS there is no separate validation value: your organization's own key is validated against this Workspace's own value when it is attached, so if its key policy uses the compartment condition, add this value to it before attaching the key. - `required DateTimeOffset CreatedAt` RFC 3339 datetime string indicating when the Workspace was created. format: date-time - `required DataResidency DataResidency` Data residency configuration. - `required AllowedInferenceGeos AllowedInferenceGeos` Permitted inference geo values. 'unrestricted' means all geos are allowed. - `IReadOnlyList` - `Global("global")` - `Us("us")` - `class Unrestricted:` - `required DefaultInferenceGeo DefaultInferenceGeo` Default inference geo applied when requests omit the parameter. - `Global("global")` - `Us("us")` - `required WorkspaceGeo WorkspaceGeo` Geographic region for workspace data storage. Immutable after creation. - `required string DisplayColor` Hex color code representing the Workspace in the Anthropic Console. - `required string? ExternalKeyID` ID of the customer-managed encryption key (CMEK) configuration to use for this Workspace. Setting this field requires CMEK to be enabled for your organization. When set, data stored for this Workspace is encrypted with the referenced key. Create key configurations with the External Keys API. On Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your organization's own key must be a single-Region key in the same AWS account and Region as the Workspace. On that platform the key is validated against this Workspace when it is attached, so a key-policy problem is reported as an error on this request. This field is write-once: once a key is attached to a Workspace it cannot be detached or replaced. To rotate key material, rotate the underlying key on your cloud KMS; the `external_key_id` stays the same. - `required string Name` Name of the Workspace. - `required IReadOnlyDictionary Tags` User-defined tags as string key-value pairs. Keys may not begin with `anthropic`. - `required string? UserProfileID` ID of the user profile attached to the Workspace, or null if it has none. Every inference request through a Workspace that has a user profile must name that profile. #### Example ```csharp using System; using Anthropic.Models.Organization.Workspaces; WorkspaceCreateParams parameters = new() { Name = "x" }; var workspace = await client.Organization.Workspaces.Create(parameters); Console.WriteLine(workspace); ``` ##### Response (200) ```json { "id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ", "archived_at": "2024-11-01T23:59:27.427722Z", "compartment_id": "f8a7b6c5-4d3e-4f1a-8b9c-0d1e2f3a4b5c", "created_at": "2024-10-30T23:58:27.427722Z", "data_residency": { "allowed_inference_geos": "unrestricted", "default_inference_geo": "global", "workspace_geo": "us" }, "display_color": "#6C5BB9", "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK", "name": "Workspace Name", "tags": { "env": "prod", "team": "platform" }, "type": "workspace", "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK" } ``` ### Get Workspace `Workspace Organization.Workspaces.Retrieve(parameters, cancellationToken = default)` **GET** `/v1/organizations/workspaces/{workspace_id}` Get Workspace #### Parameters - `WorkspaceRetrieveParams parameters` - `required string workspaceID` (path parameter) ID of the Workspace. #### Returns - `class Workspace` - `JsonElement Type = "workspace"` Object type. For Workspaces, this is always `"workspace"`. - `required string ID` ID of the Workspace. - `required DateTimeOffset? ArchivedAt` RFC 3339 datetime string indicating when the Workspace was archived, or `null` if the Workspace is not archived. format: date-time - `required string CompartmentID` Identifier for this Workspace's encryption compartment. When you configure an AWS KMS customer-managed encryption key (CMEK) that isn't bound to a user profile, reference this value in your KMS key-policy condition so the key is scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment binding automatically; you do not need to reference this value in your key configuration. See the CMEK integration guide for the required key configuration; unless your organization is on Claude Platform on AWS, it includes a separate value used during key validation. On Claude Platform on AWS there is no separate validation value: your organization's own key is validated against this Workspace's own value when it is attached, so if its key policy uses the compartment condition, add this value to it before attaching the key. - `required DateTimeOffset CreatedAt` RFC 3339 datetime string indicating when the Workspace was created. format: date-time - `required DataResidency DataResidency` Data residency configuration. - `required AllowedInferenceGeos AllowedInferenceGeos` Permitted inference geo values. 'unrestricted' means all geos are allowed. - `IReadOnlyList` - `Global("global")` - `Us("us")` - `class Unrestricted:` - `required DefaultInferenceGeo DefaultInferenceGeo` Default inference geo applied when requests omit the parameter. - `Global("global")` - `Us("us")` - `required WorkspaceGeo WorkspaceGeo` Geographic region for workspace data storage. Immutable after creation. - `required string DisplayColor` Hex color code representing the Workspace in the Anthropic Console. - `required string? ExternalKeyID` ID of the customer-managed encryption key (CMEK) configuration to use for this Workspace. Setting this field requires CMEK to be enabled for your organization. When set, data stored for this Workspace is encrypted with the referenced key. Create key configurations with the External Keys API. On Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your organization's own key must be a single-Region key in the same AWS account and Region as the Workspace. On that platform the key is validated against this Workspace when it is attached, so a key-policy problem is reported as an error on this request. This field is write-once: once a key is attached to a Workspace it cannot be detached or replaced. To rotate key material, rotate the underlying key on your cloud KMS; the `external_key_id` stays the same. - `required string Name` Name of the Workspace. - `required IReadOnlyDictionary Tags` User-defined tags as string key-value pairs. Keys may not begin with `anthropic`. - `required string? UserProfileID` ID of the user profile attached to the Workspace, or null if it has none. Every inference request through a Workspace that has a user profile must name that profile. #### Example ```csharp using System; using Anthropic.Models.Organization.Workspaces; WorkspaceRetrieveParams parameters = new() { WorkspaceID = "workspace_id" }; var workspace = await client.Organization.Workspaces.Retrieve(parameters); Console.WriteLine(workspace); ``` ##### Response (200) ```json { "id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ", "archived_at": "2024-11-01T23:59:27.427722Z", "compartment_id": "f8a7b6c5-4d3e-4f1a-8b9c-0d1e2f3a4b5c", "created_at": "2024-10-30T23:58:27.427722Z", "data_residency": { "allowed_inference_geos": "unrestricted", "default_inference_geo": "global", "workspace_geo": "us" }, "display_color": "#6C5BB9", "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK", "name": "Workspace Name", "tags": { "env": "prod", "team": "platform" }, "type": "workspace", "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK" } ``` ### Update Workspace `Workspace Organization.Workspaces.Update(parameters, cancellationToken = default)` **POST** `/v1/organizations/workspaces/{workspace_id}` Update Workspace #### Parameters - `WorkspaceUpdateParams parameters` - `required string workspaceID` (path parameter) - `DataResidencyUpdateConfig? dataResidency` Data residency configuration for the workspace. - `string displayColor` Hex color code representing the Workspace in the Anthropic Console. maxLength: 7, pattern: ^#[0-9A-Fa-f]{6}$ - `string externalKeyID` ID of the customer-managed encryption key (CMEK) configuration to use for this Workspace. Setting this field requires CMEK to be enabled for your organization. When set, data stored for this Workspace is encrypted with the referenced key. Create key configurations with the External Keys API. On Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your organization's own key must be a single-Region key in the same AWS account and Region as the Workspace. On that platform the key is validated against this Workspace when it is attached, so a key-policy problem is reported as an error on this request. This field is write-once: once a key is attached to a Workspace it cannot be detached or replaced. To rotate key material, rotate the underlying key on your cloud KMS; the `external_key_id` stays the same. - `string name` Name of the Workspace. minLength: 1, maxLength: 255 - `IReadOnlyDictionary? tags` User-defined tags as string key-value pairs. Keys may not begin with `anthropic`. - `string userProfileID` ID of a user profile to attach to the Workspace. Every inference request through the Workspace must then name this user profile; the API rejects a request that names none or a different one. Once set, it can't be replaced or removed (sending the same ID again changes nothing); only deleting the user profile clears it. The default Workspace can't have a user profile. #### Returns - `class Workspace` - `JsonElement Type = "workspace"` Object type. For Workspaces, this is always `"workspace"`. - `required string ID` ID of the Workspace. - `required DateTimeOffset? ArchivedAt` RFC 3339 datetime string indicating when the Workspace was archived, or `null` if the Workspace is not archived. format: date-time - `required string CompartmentID` Identifier for this Workspace's encryption compartment. When you configure an AWS KMS customer-managed encryption key (CMEK) that isn't bound to a user profile, reference this value in your KMS key-policy condition so the key is scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment binding automatically; you do not need to reference this value in your key configuration. See the CMEK integration guide for the required key configuration; unless your organization is on Claude Platform on AWS, it includes a separate value used during key validation. On Claude Platform on AWS there is no separate validation value: your organization's own key is validated against this Workspace's own value when it is attached, so if its key policy uses the compartment condition, add this value to it before attaching the key. - `required DateTimeOffset CreatedAt` RFC 3339 datetime string indicating when the Workspace was created. format: date-time - `required DataResidency DataResidency` Data residency configuration. - `required AllowedInferenceGeos AllowedInferenceGeos` Permitted inference geo values. 'unrestricted' means all geos are allowed. - `IReadOnlyList` - `Global("global")` - `Us("us")` - `class Unrestricted:` - `required DefaultInferenceGeo DefaultInferenceGeo` Default inference geo applied when requests omit the parameter. - `Global("global")` - `Us("us")` - `required WorkspaceGeo WorkspaceGeo` Geographic region for workspace data storage. Immutable after creation. - `required string DisplayColor` Hex color code representing the Workspace in the Anthropic Console. - `required string? ExternalKeyID` ID of the customer-managed encryption key (CMEK) configuration to use for this Workspace. Setting this field requires CMEK to be enabled for your organization. When set, data stored for this Workspace is encrypted with the referenced key. Create key configurations with the External Keys API. On Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your organization's own key must be a single-Region key in the same AWS account and Region as the Workspace. On that platform the key is validated against this Workspace when it is attached, so a key-policy problem is reported as an error on this request. This field is write-once: once a key is attached to a Workspace it cannot be detached or replaced. To rotate key material, rotate the underlying key on your cloud KMS; the `external_key_id` stays the same. - `required string Name` Name of the Workspace. - `required IReadOnlyDictionary Tags` User-defined tags as string key-value pairs. Keys may not begin with `anthropic`. - `required string? UserProfileID` ID of the user profile attached to the Workspace, or null if it has none. Every inference request through a Workspace that has a user profile must name that profile. #### Example ```csharp using System; using Anthropic.Models.Organization.Workspaces; WorkspaceUpdateParams parameters = new() { WorkspaceID = "workspace_id" }; var workspace = await client.Organization.Workspaces.Update(parameters); Console.WriteLine(workspace); ``` ##### Response (200) ```json { "id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ", "archived_at": "2024-11-01T23:59:27.427722Z", "compartment_id": "f8a7b6c5-4d3e-4f1a-8b9c-0d1e2f3a4b5c", "created_at": "2024-10-30T23:58:27.427722Z", "data_residency": { "allowed_inference_geos": "unrestricted", "default_inference_geo": "global", "workspace_geo": "us" }, "display_color": "#6C5BB9", "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK", "name": "Workspace Name", "tags": { "env": "prod", "team": "platform" }, "type": "workspace", "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK" } ``` ### Archive Workspace `Workspace Organization.Workspaces.Archive(parameters, cancellationToken = default)` **POST** `/v1/organizations/workspaces/{workspace_id}/archive` Archive Workspace #### Parameters - `WorkspaceArchiveParams parameters` - `required string workspaceID` (path parameter) #### Returns - `class Workspace` - `JsonElement Type = "workspace"` Object type. For Workspaces, this is always `"workspace"`. - `required string ID` ID of the Workspace. - `required DateTimeOffset? ArchivedAt` RFC 3339 datetime string indicating when the Workspace was archived, or `null` if the Workspace is not archived. format: date-time - `required string CompartmentID` Identifier for this Workspace's encryption compartment. When you configure an AWS KMS customer-managed encryption key (CMEK) that isn't bound to a user profile, reference this value in your KMS key-policy condition so the key is scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment binding automatically; you do not need to reference this value in your key configuration. See the CMEK integration guide for the required key configuration; unless your organization is on Claude Platform on AWS, it includes a separate value used during key validation. On Claude Platform on AWS there is no separate validation value: your organization's own key is validated against this Workspace's own value when it is attached, so if its key policy uses the compartment condition, add this value to it before attaching the key. - `required DateTimeOffset CreatedAt` RFC 3339 datetime string indicating when the Workspace was created. format: date-time - `required DataResidency DataResidency` Data residency configuration. - `required AllowedInferenceGeos AllowedInferenceGeos` Permitted inference geo values. 'unrestricted' means all geos are allowed. - `IReadOnlyList` - `Global("global")` - `Us("us")` - `class Unrestricted:` - `required DefaultInferenceGeo DefaultInferenceGeo` Default inference geo applied when requests omit the parameter. - `Global("global")` - `Us("us")` - `required WorkspaceGeo WorkspaceGeo` Geographic region for workspace data storage. Immutable after creation. - `required string DisplayColor` Hex color code representing the Workspace in the Anthropic Console. - `required string? ExternalKeyID` ID of the customer-managed encryption key (CMEK) configuration to use for this Workspace. Setting this field requires CMEK to be enabled for your organization. When set, data stored for this Workspace is encrypted with the referenced key. Create key configurations with the External Keys API. On Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your organization's own key must be a single-Region key in the same AWS account and Region as the Workspace. On that platform the key is validated against this Workspace when it is attached, so a key-policy problem is reported as an error on this request. This field is write-once: once a key is attached to a Workspace it cannot be detached or replaced. To rotate key material, rotate the underlying key on your cloud KMS; the `external_key_id` stays the same. - `required string Name` Name of the Workspace. - `required IReadOnlyDictionary Tags` User-defined tags as string key-value pairs. Keys may not begin with `anthropic`. - `required string? UserProfileID` ID of the user profile attached to the Workspace, or null if it has none. Every inference request through a Workspace that has a user profile must name that profile. #### Example ```csharp using System; using Anthropic.Models.Organization.Workspaces; WorkspaceArchiveParams parameters = new() { WorkspaceID = "workspace_id" }; var workspace = await client.Organization.Workspaces.Archive(parameters); Console.WriteLine(workspace); ``` ##### Response (200) ```json { "id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ", "archived_at": "2024-11-01T23:59:27.427722Z", "compartment_id": "f8a7b6c5-4d3e-4f1a-8b9c-0d1e2f3a4b5c", "created_at": "2024-10-30T23:58:27.427722Z", "data_residency": { "allowed_inference_geos": "unrestricted", "default_inference_geo": "global", "workspace_geo": "us" }, "display_color": "#6C5BB9", "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK", "name": "Workspace Name", "tags": { "env": "prod", "team": "platform" }, "type": "workspace", "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK" } ``` ## Organization › Workspaces › Rate Limits ### List Workspace Rate Limits `RateLimitListPage Organization.Workspaces.RateLimits.List(parameters, cancellationToken = default)` **GET** `/v1/organizations/workspaces/{workspace_id}/rate_limits` List a workspace's rate limits. By default, returns only the groups and limiter types that have a workspace-level override. With `include_inherited=true`, returns every group with organization-level limits the workspace can see, listing for each the values it inherits from the organization as well as its own overrides. Each value's `source` says which it is. When `limit` is omitted, every matching entry is returned in a single page; when `limit` truncates the result, follow `next_page` to fetch the remaining entries. #### Parameters - `RateLimitListParams parameters` - `required string workspaceID` (path parameter) The ID of the workspace. - `GroupType? groupType` (query parameter) Filter by group type. - `Batch("batch")` - `Files("files")` - `ModelGroup("model_group")` - `Skills("skills")` - `TokenCount("token_count")` - `WebSearch("web_search")` - `bool includeInherited` (query parameter) Also list the limiter values the workspace inherits from the organization, including groups with no workspace-level override. - `long? limit` (query parameter) Maximum number of items to return per page. Ranges from `1` to `1000`. When omitted, every remaining entry is returned in a single page and `next_page` is `null`. minimum: 1, maximum: 1000 - `string? page` (query parameter) Opaque cursor from a previous response's `next_page`. #### Returns - `class WorkspaceRateLimit` - `JsonElement Type = "workspace_rate_limit"` Object type. Always `workspace_rate_limit` for workspace rate-limit entries. - `required Group Group` The rate-limit group this entry's limits apply to. - `class OrganizationRateLimitModelGroup` - `JsonElement Type = "model_group"` Always `model_group`: a family of models. - `required string ID` Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization. - `required string DisplayName` Human-readable name of the model group (for example, `Claude Sonnet 4.x`). For display only; it may change. - `class OrganizationRateLimitBatchGroup` - `JsonElement Type = "batch"` Always `batch`: the Message Batches API. - `required string ID` Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization. - `class OrganizationRateLimitTokenCountGroup` - `JsonElement Type = "token_count"` Always `token_count`: the Token Count API. - `required string ID` Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization. - `class OrganizationRateLimitFilesGroup` - `JsonElement Type = "files"` Always `files`: the Files API. - `required string ID` Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization. - `class OrganizationRateLimitSkillsGroup` - `JsonElement Type = "skills"` Always `skills`: the Skills API. - `required string ID` Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization. - `class OrganizationRateLimitWebSearchGroup` - `JsonElement Type = "web_search"` Always `web_search`: the Messages API web search tool. - `required string ID` Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization. - `required IReadOnlyList Limits` The workspace's limiter values for this group. By default only the limiter types with a workspace-level override are listed. With `include_inherited` set to `true`, the limiter types the workspace inherits from the organization are listed too, each marked by `source`. - `required string Type` The limiter type (for example, `requests_per_minute` or `input_tokens_per_minute`). - `required long? OrgLimit` The organization-level value for the same limiter type, for reference. `null` when the organization has no limit configured for this limiter type. - `required Source Source` Where `value` comes from. `organization` values are listed only when `include_inherited` is `true`, and then `value` equals `org_limit`. - `class WorkspaceRateLimitWorkspaceSource` - `JsonElement Type = "workspace"` Always `workspace`: a workspace-level override is stored. - `class WorkspaceRateLimitOrganizationSource` - `JsonElement Type = "organization"` Always `organization`: no workspace-level override is stored, so the organization's value applies. - `required long Value` The workspace's value for this limiter type: the workspace-level override when `source.type` is `workspace`, otherwise the organization's value. - `required IReadOnlyList? Models` Model names this entry's limits apply to, including aliases. `null` when `group.type` is not `"model_group"`. The list covers the models this workspace has access to, so it can differ between workspaces. - `required string RateLimitID` The `id` of the organization's RateLimit entry this entry applies to. - `required string WorkspaceID` ID of the Workspace this entry applies to. #### Example ```csharp using System; using Anthropic.Models.Organization.Workspaces.RateLimits; RateLimitListParams parameters = new() { WorkspaceID = "workspace_id" }; var page = await client.Organization.Workspaces.RateLimits.List(parameters); await foreach (var item in page.Paginate()) { Console.WriteLine(item); } ``` ##### Response (200) ```json { "data": [ { "group": { "id": "id", "display_name": "display_name", "type": "model_group" }, "limits": [ { "org_limit": 0, "source": { "type": "workspace" }, "type": "type", "value": 0 } ], "models": [ "string" ], "rate_limit_id": "rate_limit_id", "type": "workspace_rate_limit", "workspace_id": "workspace_id" } ], "next_page": "next_page" } ``` ### Set Workspace Rate Limits `WorkspaceRateLimit Organization.Workspaces.RateLimits.Update(parameters, cancellationToken = default)` **POST** `/v1/organizations/workspaces/{workspace_id}/rate_limits/{rate_limit_id}` Set or clear rate-limit overrides for one rate-limit group in a workspace. Only the limiter types named in `limits` change: an integer `value` sets that type's override and `null` clears it. Types not named keep their current value. A value above the organization's own limit is stored, but the organization limit still applies, so the lower of the two is enforced. Returns the targeted group's entry with this request applied, in the shape `GET /v1/organizations/workspaces/{workspace_id}/rate_limits` returns. Changes take effect within about an hour. #### Parameters - `RateLimitUpdateParams parameters` - `required string workspaceID` (path parameter) The ID of the workspace. - `required string rateLimitID` (path parameter) The `id` of the organization's rate-limit entry to set overrides for. - `required IReadOnlyList limits` Limits to set or clear. Unspecified limit types are unchanged. minItems: 1, maxItems: 16 - `required WorkspaceRateLimitType Type` Rate limiter type. - `FastItpmca("fast_itpmca")` - `FastOtpm("fast_otpm")` - `InputTokensPerMinute("input_tokens_per_minute")` - `InputTokensPerMinuteCacheAware("input_tokens_per_minute_cache_aware")` - `OutputTokensPerMinute("output_tokens_per_minute")` - `RequestsPerMinute("requests_per_minute")` - `TokensPerDay("tokens_per_day")` - `TokensPerMinute("tokens_per_minute")` - `ToolUsesPerSecond("tool_uses_per_second")` - `required long? Value` New limit value. Set to null to clear the workspace override and fall back to the organization limit. minimum: 0, maximum: 9007199254740991 #### Returns - `class WorkspaceRateLimit` - `JsonElement Type = "workspace_rate_limit"` Object type. Always `workspace_rate_limit` for workspace rate-limit entries. - `required Group Group` The rate-limit group this entry's limits apply to. - `class OrganizationRateLimitModelGroup` - `JsonElement Type = "model_group"` Always `model_group`: a family of models. - `required string ID` Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization. - `required string DisplayName` Human-readable name of the model group (for example, `Claude Sonnet 4.x`). For display only; it may change. - `class OrganizationRateLimitBatchGroup` - `JsonElement Type = "batch"` Always `batch`: the Message Batches API. - `required string ID` Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization. - `class OrganizationRateLimitTokenCountGroup` - `JsonElement Type = "token_count"` Always `token_count`: the Token Count API. - `required string ID` Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization. - `class OrganizationRateLimitFilesGroup` - `JsonElement Type = "files"` Always `files`: the Files API. - `required string ID` Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization. - `class OrganizationRateLimitSkillsGroup` - `JsonElement Type = "skills"` Always `skills`: the Skills API. - `required string ID` Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization. - `class OrganizationRateLimitWebSearchGroup` - `JsonElement Type = "web_search"` Always `web_search`: the Messages API web search tool. - `required string ID` Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization. - `required IReadOnlyList Limits` The workspace's limiter values for this group. By default only the limiter types with a workspace-level override are listed. With `include_inherited` set to `true`, the limiter types the workspace inherits from the organization are listed too, each marked by `source`. - `required string Type` The limiter type (for example, `requests_per_minute` or `input_tokens_per_minute`). - `required long? OrgLimit` The organization-level value for the same limiter type, for reference. `null` when the organization has no limit configured for this limiter type. - `required Source Source` Where `value` comes from. `organization` values are listed only when `include_inherited` is `true`, and then `value` equals `org_limit`. - `class WorkspaceRateLimitWorkspaceSource` - `JsonElement Type = "workspace"` Always `workspace`: a workspace-level override is stored. - `class WorkspaceRateLimitOrganizationSource` - `JsonElement Type = "organization"` Always `organization`: no workspace-level override is stored, so the organization's value applies. - `required long Value` The workspace's value for this limiter type: the workspace-level override when `source.type` is `workspace`, otherwise the organization's value. - `required IReadOnlyList? Models` Model names this entry's limits apply to, including aliases. `null` when `group.type` is not `"model_group"`. The list covers the models this workspace has access to, so it can differ between workspaces. - `required string RateLimitID` The `id` of the organization's RateLimit entry this entry applies to. - `required string WorkspaceID` ID of the Workspace this entry applies to. #### Example ```csharp using System; using Anthropic.Models.Organization.Workspaces.RateLimits; RateLimitUpdateParams parameters = new() { WorkspaceID = "workspace_id", RateLimitID = "rate_limit_id", Limits = [ new() { Type = WorkspaceRateLimitType.FastItpmca, Value = 0, }, ], }; var workspaceRateLimit = await client.Organization.Workspaces.RateLimits.Update(parameters); Console.WriteLine(workspaceRateLimit); ``` ##### Response (200) ```json { "group": { "id": "id", "display_name": "display_name", "type": "model_group" }, "limits": [ { "org_limit": 0, "source": { "type": "workspace" }, "type": "type", "value": 0 } ], "models": [ "string" ], "rate_limit_id": "rate_limit_id", "type": "workspace_rate_limit", "workspace_id": "workspace_id" } ``` ## Organization › Workspaces › Members ### List Workspace Members `MemberListPage Organization.Workspaces.Members.List(parameters, cancellationToken = default)` **GET** `/v1/organizations/workspaces/{workspace_id}/members` List Workspace Members #### Parameters - `MemberListParams parameters` - `required string workspaceID` (path parameter) ID of the Workspace. - `string afterID` (query parameter) ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object. - `string beforeID` (query parameter) ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object. - `long limit` (query parameter) Number of items to return per page. Defaults to `20`. Ranges from `1` to `1000`. minimum: 1, maximum: 1000 #### Returns - `class WorkspaceMember` - `JsonElement Type = "workspace_member"` Object type. For Workspace Members, this is always `"workspace_member"`. - `required string UserID` ID of the User. - `required string WorkspaceID` ID of the Workspace. - `required WorkspaceRole WorkspaceRole` Role of the Workspace Member. - `WorkspaceAdmin("workspace_admin")` - `WorkspaceBilling("workspace_billing")` - `WorkspaceDeveloper("workspace_developer")` - `WorkspaceRestrictedDeveloper("workspace_restricted_developer")` - `WorkspaceUser("workspace_user")` #### Example ```csharp using System; using Anthropic.Models.Organization.Workspaces.Members; MemberListParams parameters = new() { WorkspaceID = "workspace_id" }; var page = await client.Organization.Workspaces.Members.List(parameters); await foreach (var item in page.Paginate()) { Console.WriteLine(item); } ``` ##### Response (200) ```json { "data": [ { "type": "workspace_member", "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ", "workspace_role": "workspace_admin" } ], "first_id": "first_id", "has_more": true, "last_id": "last_id" } ``` ### Create Workspace Member `WorkspaceMember Organization.Workspaces.Members.Add(parameters, cancellationToken = default)` **POST** `/v1/organizations/workspaces/{workspace_id}/members` Create Workspace Member #### Parameters - `MemberAddParams parameters` - `required string workspaceID` (path parameter) ID of the Workspace. - `required string userID` ID of the User. - `required NoBillingWorkspaceRole workspaceRole` Role of the new Workspace Member. Cannot be `workspace_billing`. #### Returns - `class WorkspaceMember` - `JsonElement Type = "workspace_member"` Object type. For Workspace Members, this is always `"workspace_member"`. - `required string UserID` ID of the User. - `required string WorkspaceID` ID of the Workspace. - `required WorkspaceRole WorkspaceRole` Role of the Workspace Member. - `WorkspaceAdmin("workspace_admin")` - `WorkspaceBilling("workspace_billing")` - `WorkspaceDeveloper("workspace_developer")` - `WorkspaceRestrictedDeveloper("workspace_restricted_developer")` - `WorkspaceUser("workspace_user")` #### Example ```csharp using System; using Anthropic.Models.Organization.Workspaces; using Anthropic.Models.Organization.Workspaces.Members; MemberAddParams parameters = new() { WorkspaceID = "workspace_id", UserID = "user_01WxYzAbCdEfGhJkMnPqRsTu", WorkspaceRole = NoBillingWorkspaceRole.WorkspaceAdmin, }; var workspaceMember = await client.Organization.Workspaces.Members.Add(parameters); Console.WriteLine(workspaceMember); ``` ##### Response (200) ```json { "type": "workspace_member", "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ", "workspace_role": "workspace_admin" } ``` ### Get Workspace Member `WorkspaceMember Organization.Workspaces.Members.Retrieve(parameters, cancellationToken = default)` **GET** `/v1/organizations/workspaces/{workspace_id}/members/{user_id}` Get Workspace Member #### Parameters - `MemberRetrieveParams parameters` - `required string workspaceID` (path parameter) ID of the Workspace. - `required string userID` (path parameter) ID of the User. #### Returns - `class WorkspaceMember` - `JsonElement Type = "workspace_member"` Object type. For Workspace Members, this is always `"workspace_member"`. - `required string UserID` ID of the User. - `required string WorkspaceID` ID of the Workspace. - `required WorkspaceRole WorkspaceRole` Role of the Workspace Member. - `WorkspaceAdmin("workspace_admin")` - `WorkspaceBilling("workspace_billing")` - `WorkspaceDeveloper("workspace_developer")` - `WorkspaceRestrictedDeveloper("workspace_restricted_developer")` - `WorkspaceUser("workspace_user")` #### Example ```csharp using System; using Anthropic.Models.Organization.Workspaces.Members; MemberRetrieveParams parameters = new() { WorkspaceID = "workspace_id", UserID = "user_id", }; var workspaceMember = await client.Organization.Workspaces.Members.Retrieve(parameters); Console.WriteLine(workspaceMember); ``` ##### Response (200) ```json { "type": "workspace_member", "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ", "workspace_role": "workspace_admin" } ``` ### Update Workspace Member `WorkspaceMember Organization.Workspaces.Members.Update(parameters, cancellationToken = default)` **POST** `/v1/organizations/workspaces/{workspace_id}/members/{user_id}` Update Workspace Member #### Parameters - `MemberUpdateParams parameters` - `required string workspaceID` (path parameter) ID of the Workspace. - `required string userID` (path parameter) ID of the User. - `required WorkspaceRole workspaceRole` New workspace role for the User. #### Returns - `class WorkspaceMember` - `JsonElement Type = "workspace_member"` Object type. For Workspace Members, this is always `"workspace_member"`. - `required string UserID` ID of the User. - `required string WorkspaceID` ID of the Workspace. - `required WorkspaceRole WorkspaceRole` Role of the Workspace Member. - `WorkspaceAdmin("workspace_admin")` - `WorkspaceBilling("workspace_billing")` - `WorkspaceDeveloper("workspace_developer")` - `WorkspaceRestrictedDeveloper("workspace_restricted_developer")` - `WorkspaceUser("workspace_user")` #### Example ```csharp using System; using Anthropic.Models.Organization.Workspaces; using Anthropic.Models.Organization.Workspaces.Members; MemberUpdateParams parameters = new() { WorkspaceID = "workspace_id", UserID = "user_id", WorkspaceRole = WorkspaceRole.WorkspaceAdmin, }; var workspaceMember = await client.Organization.Workspaces.Members.Update(parameters); Console.WriteLine(workspaceMember); ``` ##### Response (200) ```json { "type": "workspace_member", "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ", "workspace_role": "workspace_admin" } ``` ### Delete Workspace Member `MemberRemoveResponse Organization.Workspaces.Members.Remove(parameters, cancellationToken = default)` **DELETE** `/v1/organizations/workspaces/{workspace_id}/members/{user_id}` Delete Workspace Member #### Parameters - `MemberRemoveParams parameters` - `required string workspaceID` (path parameter) ID of the Workspace. - `required string userID` (path parameter) ID of the User. #### Returns - `class MemberRemoveResponse` - `JsonElement Type = "workspace_member_deleted"` Deleted object type. For Workspace Members, this is always `"workspace_member_deleted"`. - `required string UserID` ID of the User. - `required string WorkspaceID` ID of the Workspace. #### Example ```csharp using System; using Anthropic.Models.Organization.Workspaces.Members; MemberRemoveParams parameters = new() { WorkspaceID = "workspace_id", UserID = "user_id", }; var member = await client.Organization.Workspaces.Members.Remove(parameters); Console.WriteLine(member); ``` ##### Response (200) ```json { "type": "workspace_member_deleted", "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ" } ``` ## Organization › Workspaces › Service Accounts ### List Service Account Workspace Members `ServiceAccountListPage Organization.Workspaces.ServiceAccounts.List(parameters, cancellationToken = default)` **GET** `/v1/organizations/workspaces/{workspace_id}/service_accounts` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). List the service accounts that are members of a workspace. Each entry includes the service account's `workspace_role`. Use `limit` and the `next_page` cursor to paginate. Archived workspaces return 400; use `GET /service_accounts/{id}/workspaces` to audit memberships of an archived workspace. The implicit default-workspace membership is not included in this list. Memberships of archived service accounts are omitted from the results. #### Parameters - `ServiceAccountListParams parameters` - `required string workspaceID` (path parameter) ID of the workspace. - `long limit` (query parameter) Number of results per page. minimum: 1, maximum: 100 - `string? page` (query parameter) Opaque cursor from a previous response's `next_page`. #### Returns - `class ServiceAccountWorkspaceMember` - `JsonElement Type = "service_account_workspace_member"` - `required string? CreatedByActorID` Tagged ID (`user_...`/`svac_...`) of the actor who created this membership. - `required bool? Implicit` True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed. - `required string ServiceAccountID` Tagged service account ID (`svac_...`). - `required string WorkspaceID` Tagged workspace ID (`wrkspc_...`). - `required WorkspaceRole WorkspaceRole` Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role. - `WorkspaceAdmin("workspace_admin")` - `WorkspaceBilling("workspace_billing")` - `WorkspaceDeveloper("workspace_developer")` - `WorkspaceRestrictedDeveloper("workspace_restricted_developer")` - `WorkspaceUser("workspace_user")` #### Example ```csharp using System; using Anthropic.Models.Organization.Workspaces.ServiceAccounts; ServiceAccountListParams parameters = new() { WorkspaceID = "workspace_id" }; var page = await client.Organization.Workspaces.ServiceAccounts.List(parameters); await foreach (var item in page.Paginate()) { Console.WriteLine(item); } ``` ##### Response (200) ```json { "data": [ { "created_by_actor_id": "created_by_actor_id", "implicit": true, "service_account_id": "service_account_id", "type": "service_account_workspace_member", "workspace_id": "workspace_id", "workspace_role": "workspace_admin" } ], "next_page": "next_page" } ``` ### Create Service Account Workspace Member `ServiceAccountWorkspaceMember Organization.Workspaces.ServiceAccounts.Add(parameters, cancellationToken = default)` **POST** `/v1/organizations/workspaces/{workspace_id}/service_accounts` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Add a service account to a workspace with the given `workspace_role`. The role determines what the service account can do in the workspace and which workspace-scoped permissions it can be granted when authenticating through federation. Every service account is already an implicit `workspace_user` member of the default workspace; adding it explicitly assigns a chosen role. If the service account is already an explicit member of the workspace, its `workspace_role` is replaced with the value supplied here. Archived workspaces return 400. Archived service accounts cannot be added and are rejected. #### Parameters - `ServiceAccountAddParams parameters` - `required string workspaceID` (path parameter) ID of the workspace. - `required string serviceAccountID` Tagged service account ID to add. - `required NoBillingWorkspaceRole workspaceRole` Role to assign to the service account in this workspace. #### Returns - `class ServiceAccountWorkspaceMember` - `JsonElement Type = "service_account_workspace_member"` - `required string? CreatedByActorID` Tagged ID (`user_...`/`svac_...`) of the actor who created this membership. - `required bool? Implicit` True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed. - `required string ServiceAccountID` Tagged service account ID (`svac_...`). - `required string WorkspaceID` Tagged workspace ID (`wrkspc_...`). - `required WorkspaceRole WorkspaceRole` Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role. - `WorkspaceAdmin("workspace_admin")` - `WorkspaceBilling("workspace_billing")` - `WorkspaceDeveloper("workspace_developer")` - `WorkspaceRestrictedDeveloper("workspace_restricted_developer")` - `WorkspaceUser("workspace_user")` #### Example ```csharp using System; using Anthropic.Models.Organization.Workspaces; using Anthropic.Models.Organization.Workspaces.ServiceAccounts; ServiceAccountAddParams parameters = new() { WorkspaceID = "workspace_id", ServiceAccountID = "service_account_id", WorkspaceRole = NoBillingWorkspaceRole.WorkspaceAdmin, }; var serviceAccountWorkspaceMember = await client.Organization.Workspaces.ServiceAccounts.Add(parameters); Console.WriteLine(serviceAccountWorkspaceMember); ``` ##### Response (200) ```json { "created_by_actor_id": "created_by_actor_id", "implicit": true, "service_account_id": "service_account_id", "type": "service_account_workspace_member", "workspace_id": "workspace_id", "workspace_role": "workspace_admin" } ``` ### Get Service Account Workspace Member `ServiceAccountWorkspaceMember Organization.Workspaces.ServiceAccounts.Retrieve(parameters, cancellationToken = default)` **GET** `/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Retrieve a service account's membership in a workspace. Returns the membership record, including the service account's `workspace_role` in this workspace. Archived workspaces return 400. For the default workspace, returns the implicit (`implicit: true`) membership when no explicit membership exists; an explicitly added membership is returned with its assigned role. An archived service account returns 404. #### Parameters - `ServiceAccountRetrieveParams parameters` - `required string workspaceID` (path parameter) ID of the workspace. - `required string serviceAccountID` (path parameter) ID of the service account. #### Returns - `class ServiceAccountWorkspaceMember` - `JsonElement Type = "service_account_workspace_member"` - `required string? CreatedByActorID` Tagged ID (`user_...`/`svac_...`) of the actor who created this membership. - `required bool? Implicit` True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed. - `required string ServiceAccountID` Tagged service account ID (`svac_...`). - `required string WorkspaceID` Tagged workspace ID (`wrkspc_...`). - `required WorkspaceRole WorkspaceRole` Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role. - `WorkspaceAdmin("workspace_admin")` - `WorkspaceBilling("workspace_billing")` - `WorkspaceDeveloper("workspace_developer")` - `WorkspaceRestrictedDeveloper("workspace_restricted_developer")` - `WorkspaceUser("workspace_user")` #### Example ```csharp using System; using Anthropic.Models.Organization.Workspaces.ServiceAccounts; ServiceAccountRetrieveParams parameters = new() { WorkspaceID = "workspace_id", ServiceAccountID = "service_account_id", }; var serviceAccountWorkspaceMember = await client.Organization.Workspaces.ServiceAccounts.Retrieve(parameters); Console.WriteLine(serviceAccountWorkspaceMember); ``` ##### Response (200) ```json { "created_by_actor_id": "created_by_actor_id", "implicit": true, "service_account_id": "service_account_id", "type": "service_account_workspace_member", "workspace_id": "workspace_id", "workspace_role": "workspace_admin" } ``` ### Update Service Account Workspace Member `ServiceAccountWorkspaceMember Organization.Workspaces.ServiceAccounts.Update(parameters, cancellationToken = default)` **POST** `/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Change a service account's role in a workspace. The new `workspace_role` replaces the current one. Only explicit memberships can be updated; to set a role on the implicit default-workspace membership, add the service account explicitly with `POST /workspaces/{workspace_id}/service_accounts`. Archived workspaces return 400. Archived service accounts cannot be updated and are rejected. #### Parameters - `ServiceAccountUpdateParams parameters` - `required string workspaceID` (path parameter) ID of the workspace. - `required string serviceAccountID` (path parameter) ID of the service account. - `required NoBillingWorkspaceRole workspaceRole` New role for the service account in this workspace. #### Returns - `class ServiceAccountWorkspaceMember` - `JsonElement Type = "service_account_workspace_member"` - `required string? CreatedByActorID` Tagged ID (`user_...`/`svac_...`) of the actor who created this membership. - `required bool? Implicit` True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed. - `required string ServiceAccountID` Tagged service account ID (`svac_...`). - `required string WorkspaceID` Tagged workspace ID (`wrkspc_...`). - `required WorkspaceRole WorkspaceRole` Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role. - `WorkspaceAdmin("workspace_admin")` - `WorkspaceBilling("workspace_billing")` - `WorkspaceDeveloper("workspace_developer")` - `WorkspaceRestrictedDeveloper("workspace_restricted_developer")` - `WorkspaceUser("workspace_user")` #### Example ```csharp using System; using Anthropic.Models.Organization.Workspaces; using Anthropic.Models.Organization.Workspaces.ServiceAccounts; ServiceAccountUpdateParams parameters = new() { WorkspaceID = "workspace_id", ServiceAccountID = "service_account_id", WorkspaceRole = NoBillingWorkspaceRole.WorkspaceAdmin, }; var serviceAccountWorkspaceMember = await client.Organization.Workspaces.ServiceAccounts.Update(parameters); Console.WriteLine(serviceAccountWorkspaceMember); ``` ##### Response (200) ```json { "created_by_actor_id": "created_by_actor_id", "implicit": true, "service_account_id": "service_account_id", "type": "service_account_workspace_member", "workspace_id": "workspace_id", "workspace_role": "workspace_admin" } ``` ### Delete Service Account Workspace Member `ServiceAccountRemoveResponse Organization.Workspaces.ServiceAccounts.Remove(parameters, cancellationToken = default)` **DELETE** `/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Remove a service account from a workspace. Removal is idempotent (returns 200 even if the membership was already removed). A DELETE against the implicit default-workspace membership returns 200 but is a no-op and the membership persists; deleting an explicit default-workspace row reverts to the implicit `workspace_user` membership. Archived workspaces return 400. #### Parameters - `ServiceAccountRemoveParams parameters` - `required string workspaceID` (path parameter) ID of the workspace. - `required string serviceAccountID` (path parameter) ID of the service account. #### Returns - `class ServiceAccountRemoveResponse` - `JsonElement Type = "service_account_workspace_member_deleted"` - `required string ServiceAccountID` Tagged service account ID (`svac_...`) named in the delete request. Removal is idempotent; see the endpoint description for the implicit-membership no-op. - `required string WorkspaceID` Tagged workspace ID (`wrkspc_...`) named in the delete request. #### Example ```csharp using System; using Anthropic.Models.Organization.Workspaces.ServiceAccounts; ServiceAccountRemoveParams parameters = new() { WorkspaceID = "workspace_id", ServiceAccountID = "service_account_id", }; var serviceAccount = await client.Organization.Workspaces.ServiceAccounts.Remove(parameters); Console.WriteLine(serviceAccount); ``` ##### Response (200) ```json { "service_account_id": "service_account_id", "type": "service_account_workspace_member_deleted", "workspace_id": "workspace_id" } ``` ## Organization › Rate Limits ### List Organization Rate Limits `RateLimitListPage Organization.RateLimits.List(parameters, cancellationToken = default)` **GET** `/v1/organizations/rate_limits` List Messages API rate limits for your organization. Each entry corresponds to one rate-limit group (either a model family or an API-surface category such as the Message Batches API or the web search tool) and contains the set of limiter values that apply to it. When `limit` is omitted, every matching entry is returned in a single page; when `limit` truncates the result, follow `next_page` to fetch the remaining entries. #### Parameters - `RateLimitListParams parameters` - `GroupType? groupType` (query parameter) Filter by group type. - `Batch("batch")` - `Files("files")` - `ModelGroup("model_group")` - `Skills("skills")` - `TokenCount("token_count")` - `WebSearch("web_search")` - `long? limit` (query parameter) Maximum number of items to return per page. Ranges from `1` to `1000`. When omitted, every remaining entry is returned in a single page and `next_page` is `null`. minimum: 1, maximum: 1000 - `string? model` (query parameter) Filter to the single entry containing this model. Accepts full model names and aliases. Returns 404 if the model is not found or has no rate limits for this organization. - `string? page` (query parameter) Opaque cursor from a previous response's `next_page`. #### Returns - `class OrganizationRateLimit` - `JsonElement Type = "rate_limit"` Object type. Always `rate_limit` for organization rate-limit entries. - `required string ID` Identifier of this rate-limit entry. It is stable within the organization and differs between organizations; the group's own identifier is `group.id`. Pass it as `rate_limit_id` to set a workspace's overrides for this group. - `required Group Group` The rate-limit group this entry's limits apply to. - `class OrganizationRateLimitModelGroup` - `JsonElement Type = "model_group"` Always `model_group`: a family of models. - `required string ID` Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization. - `required string DisplayName` Human-readable name of the model group (for example, `Claude Sonnet 4.x`). For display only; it may change. - `class OrganizationRateLimitBatchGroup` - `JsonElement Type = "batch"` Always `batch`: the Message Batches API. - `required string ID` Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization. - `class OrganizationRateLimitTokenCountGroup` - `JsonElement Type = "token_count"` Always `token_count`: the Token Count API. - `required string ID` Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization. - `class OrganizationRateLimitFilesGroup` - `JsonElement Type = "files"` Always `files`: the Files API. - `required string ID` Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization. - `class OrganizationRateLimitSkillsGroup` - `JsonElement Type = "skills"` Always `skills`: the Skills API. - `required string ID` Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization. - `class OrganizationRateLimitWebSearchGroup` - `JsonElement Type = "web_search"` Always `web_search`: the Messages API web search tool. - `required string ID` Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization. - `required IReadOnlyList Limits` The limiter values that apply to this group. - `required string Type` The limiter type (for example, `requests_per_minute` or `input_tokens_per_minute`). - `required long Value` The configured limit value for this limiter type. - `required IReadOnlyList? Models` Model names this entry's limits apply to, including aliases. `null` when `group.type` is not `"model_group"`. The list covers the models your organization has access to, so it can differ between organizations. #### Example ```csharp using System; using Anthropic.Models.Organization.RateLimits; RateLimitListParams parameters = new(); var page = await client.Organization.RateLimits.List(parameters); await foreach (var item in page.Paginate()) { Console.WriteLine(item); } ``` ##### Response (200) ```json { "data": [ { "id": "id", "group": { "id": "id", "display_name": "display_name", "type": "model_group" }, "limits": [ { "type": "type", "value": 0 } ], "models": [ "string" ], "type": "rate_limit" } ], "next_page": "next_page" } ``` ## Organization › Compliance Settings ### Get Compliance Settings `OrganizationComplianceSettings Organization.ComplianceSettings.Retrieve(parameters, cancellationToken = default)` **GET** `/v1/organizations/compliance_settings` Retrieve your organization's Compliance Settings. Compliance Settings is a singleton resource: there is exactly one per organization, addressed without an identifier. The `state` field reflects whether the Compliance API is enabled. An organization with a parent organization reads the state inherited from the parent's configuration. #### Parameters - `ComplianceSettingRetrieveParams parameters` #### Returns - `class OrganizationComplianceSettings` - `JsonElement Type = "compliance_settings"` - `required ComplianceSettingsState State` Whether the Compliance API is enabled for this organization. - `class ComplianceSettingsStateEnabled` - `JsonElement Type = "enabled"` - `class ComplianceSettingsStateDisabled` - `JsonElement Type = "disabled"` #### Example ```csharp using System; using Anthropic.Models.Organization.ComplianceSettings; ComplianceSettingRetrieveParams parameters = new(); var organizationComplianceSettings = await client.Organization.ComplianceSettings.Retrieve(parameters); Console.WriteLine(organizationComplianceSettings); ``` ##### Response (200) ```json { "state": { "type": "enabled" }, "type": "compliance_settings" } ``` ### Update Compliance Settings `OrganizationComplianceSettings Organization.ComplianceSettings.Update(parameters, cancellationToken = default)` **POST** `/v1/organizations/compliance_settings` Update your organization's Compliance Settings. Setting `state` to `enabled` turns on the Compliance API and begins capturing organization activity events. Setting it to `disabled` turns both off. Access Transparency events are an exception: they are still captured while the Compliance API is disabled, and the Compliance API activity feed returns them once it is enabled again. `state` reflects whether the Compliance API is enabled. A request that sets `state` to its current value succeeds and leaves the resource unchanged. A `disabled` request stays in effect until a later `enabled` request or the organization's next provisioning action that enables Access Transparency: enabling Access Transparency also enables the Compliance API, which serves its activity events, so such provisioning (including re-runs) re-enables the Compliance API even after a `disabled` request. Automated provisioning never disables compliance settings. #### Parameters - `ComplianceSettingUpdateParams parameters` - `required ComplianceSettingsStateParam state` Desired state. Accepts the string shorthand "enabled" or "disabled" in place of the object form; the response always returns the canonical object form. #### Returns - `class OrganizationComplianceSettings` - `JsonElement Type = "compliance_settings"` - `required ComplianceSettingsState State` Whether the Compliance API is enabled for this organization. - `class ComplianceSettingsStateEnabled` - `JsonElement Type = "enabled"` - `class ComplianceSettingsStateDisabled` - `JsonElement Type = "disabled"` #### Example ```csharp using System; using Anthropic.Models.Organization.ComplianceSettings; ComplianceSettingUpdateParams parameters = new() { State = new ComplianceSettingsStateEnabledParam() }; var organizationComplianceSettings = await client.Organization.ComplianceSettings.Update(parameters); Console.WriteLine(organizationComplianceSettings); ``` ##### Response (200) ```json { "state": { "type": "enabled" }, "type": "compliance_settings" } ``` ## Organization › Analytics › Summaries ### Get Activity Summaries `SummaryListPage Organization.Analytics.Summaries.List(parameters, cancellationToken = default)` **GET** `/v1/organizations/analytics/summaries` Get organization-wide activity summaries for a date range. Returns one entry per day from `starting_date` (inclusive) to `ending_date` (exclusive) in `data`, the same `data` / `next_page` envelope as the other analytics list endpoints; the series is currently returned in full, so `next_page` is always null. Data is typically available with a 1-day lag and may be revised by a few percent over the following days: when `ending_date` is omitted it defaults to the most recent available day + 1, so the last entry covers the most recent available day. The series can be scoped to an RBAC group via `filter[]=rbac_group_id:{id}`. Available to organizations on a Claude Enterprise plan. Requires an API key with the `read:analytics` scope. #### Parameters - `SummaryListParams parameters` - `required DateOnly startingDate` (query parameter) UTC date in YYYY-MM-DD format. Start of the date range (inclusive). Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01. format: date - `DateOnly? endingDate` (query parameter) UTC date in YYYY-MM-DD format. End of the date range (exclusive). Data is typically available with a 1-day lag, so this can be at most today — which is also the default when omitted, making the last entry cover the most recent available day. Data may be revised by a few percent over the following days. The range may span at most 366 days. format: date - `IReadOnlyList? filter` (query parameter) Filters as `dimension:value`. Only `rbac_group_id` is supported (e.g. `filter[]=rbac_group_id:{id}`); repeat the param to OR across groups. Scopes the whole day series to members of the matching group(s), re-aggregated from member-level activity — org-wide seat/invite fields and the adoption rates derived from them are null on scoped rows. `rbac_group_id` accepts the tagged id (`rbac_group_...`, as emitted in responses and by the spend-limits API) or a bare group UUID, and matches users who held the group at any point during each UTC day (time-of-usage attribution). At most 100 entries. maxItems: 100 - `long? limit` (query parameter) Number of results per page (1-1000, default 100). The day series (at most 366 entries) is currently returned in full in a single page, so `limit` does not yet shorten it. minimum: 1, maximum: 1000 - `string? page` (query parameter) Opaque cursor from a previous response's `next_page` field. `next_page` is currently always null, so there is never a cursor to send. #### Returns - `class AnalyticsSingleDayActivitySummary` Per-day entry in the /summaries response. - `required long? AssignedSeatCount` Number of seats currently assigned to members. Null when the response is scoped to an RBAC group — seat assignment is org-wide and has no per-group analogue. - `required long CoworkDailyActiveUserCount` Number of users with Cowork activity on the requested day - `required long CoworkMonthlyActiveUserCount` Number of users with Cowork activity in the 30-day rolling window - `required long CoworkWeeklyActiveUserCount` Number of users with Cowork activity in the 7-day rolling window - `required long DailyActiveUserCount` Number of users with token consumption on the requested day - `required double? DailyAdoptionRate` Percentage of assigned seats with activity on the requested day (`DAU / assigned_seat_count * 100`). Null when the response is scoped to an RBAC group. - `required DateTimeOffset EndingAt` End of the aggregation period (exclusive), UTC midnight in RFC 3339 format (e.g. `2026-01-16T00:00:00Z`). format: date-time - `required long MonthlyActiveUserCount` Number of users with token consumption in the 30-day rolling window - `required double? MonthlyAdoptionRate` Percentage of assigned seats with activity in the 30-day rolling window (`MAU / assigned_seat_count * 100`). Null when the response is scoped to an RBAC group. - `required long? PendingInviteCount` Number of pending invitations to join the organization. Null when the response is scoped to an RBAC group. - `required DateTimeOffset StartingAt` Start of the aggregation period (inclusive), UTC midnight in RFC 3339 format (e.g. `2026-01-15T00:00:00Z`). format: date-time - `required long WeeklyActiveUserCount` Number of users with token consumption in the 7-day rolling window - `required double? WeeklyAdoptionRate` Percentage of assigned seats with activity in the 7-day rolling window (`WAU / assigned_seat_count * 100`). Null when the response is scoped to an RBAC group. - `long? ChatCoworkUnifiedDailyActiveUserCount` Number of users with activity in Chat and Cowork unified on the requested day. Omitted from the response on deployments that do not offer Chat and Cowork unified. - `long? ChatCoworkUnifiedMonthlyActiveUserCount` Number of users with activity in Chat and Cowork unified in the 28-day rolling window (30 days when the request filters by `rbac_group_id`). Omitted from the response on deployments that do not offer Chat and Cowork unified. - `long? ChatCoworkUnifiedWeeklyActiveUserCount` Number of users with activity in Chat and Cowork unified in the 7-day rolling window. Omitted from the response on deployments that do not offer Chat and Cowork unified. - `long? ChatDailyActiveUserCount` Number of users with claude.ai (chat) activity on the requested day. Omitted from the response while the per-product breakdown is not enabled for this organization. - `long? ChatMonthlyActiveUserCount` Number of users with claude.ai (chat) activity in the 30-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization. - `long? ChatWeeklyActiveUserCount` Number of users with claude.ai (chat) activity in the 7-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization. - `long? ClaudeCodeDailyActiveUserCount` Number of users with Claude Code activity on the requested day. Omitted from the response while the per-product breakdown is not enabled for this organization. - `long? ClaudeCodeMonthlyActiveUserCount` Number of users with Claude Code activity in the 30-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization. - `long? ClaudeCodeWeeklyActiveUserCount` Number of users with Claude Code activity in the 7-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization. - `long? ClaudeDesignDailyActiveUserCount` Number of users with Claude Design activity on the requested day. Omitted from the response while the per-product breakdown is not enabled for this organization. - `long? ClaudeDesignMonthlyActiveUserCount` Number of users with Claude Design activity in the 30-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization. - `long? ClaudeDesignWeeklyActiveUserCount` Number of users with Claude Design activity in the 7-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization. - `long? OfficeAgentDailyActiveUserCount` Number of users with Claude in Office activity on the requested day. Omitted from the response while the per-product breakdown is not enabled for this organization. - `long? OfficeAgentMonthlyActiveUserCount` Number of users with Claude in Office activity in the 30-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization. - `long? OfficeAgentWeeklyActiveUserCount` Number of users with Claude in Office activity in the 7-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization. - `long? ScienceDailyActiveUserCount` Number of users with Claude Science activity on the requested day. Omitted from the response while the per-product breakdown is not enabled for this organization. - `long? ScienceEntitledUserCount` Number of users with a Claude Science seat entitlement (per-seat RBAC) at the time of the daily snapshot. The funnel top; independent of the org-level Claude Science toggle. Null when the response is scoped to an RBAC group — entitlement is org-wide and has no per-group analogue. Omitted from the response while the per-product breakdown is not enabled for this organization. - `long? ScienceMonthlyActiveUserCount` Number of users with Claude Science activity in the 30-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization. - `long? ScienceWeeklyActiveUserCount` Number of users with Claude Science activity in the 7-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization. #### Example ```csharp using System; using Anthropic.Models.Organization.Analytics.Summaries; SummaryListParams parameters = new() { StartingDate = "2019-12-27" }; var page = await client.Organization.Analytics.Summaries.List(parameters); await foreach (var item in page.Paginate()) { Console.WriteLine(item); } ``` ##### Response (200) ```json { "data": [ { "assigned_seat_count": 0, "cowork_daily_active_user_count": 0, "cowork_monthly_active_user_count": 0, "cowork_weekly_active_user_count": 0, "daily_active_user_count": 0, "daily_adoption_rate": 0, "ending_at": "2019-12-27T18:11:19.117Z", "monthly_active_user_count": 0, "monthly_adoption_rate": 0, "pending_invite_count": 0, "starting_at": "2019-12-27T18:11:19.117Z", "weekly_active_user_count": 0, "weekly_adoption_rate": 0, "chat_cowork_unified_daily_active_user_count": 0, "chat_cowork_unified_monthly_active_user_count": 0, "chat_cowork_unified_weekly_active_user_count": 0, "chat_daily_active_user_count": 0, "chat_monthly_active_user_count": 0, "chat_weekly_active_user_count": 0, "claude_code_daily_active_user_count": 0, "claude_code_monthly_active_user_count": 0, "claude_code_weekly_active_user_count": 0, "claude_design_daily_active_user_count": 0, "claude_design_monthly_active_user_count": 0, "claude_design_weekly_active_user_count": 0, "office_agent_daily_active_user_count": 0, "office_agent_monthly_active_user_count": 0, "office_agent_weekly_active_user_count": 0, "science_daily_active_user_count": 0, "science_entitled_user_count": 0, "science_monthly_active_user_count": 0, "science_weekly_active_user_count": 0 } ], "next_page": "next_page" } ``` ## Organization › Analytics › Users ### List User Activity `UserListPage Organization.Analytics.Users.List(parameters, cancellationToken = default)` **GET** `/v1/organizations/analytics/users` Get per-user activity for a given day, with cursor-based pagination. Returns activity metrics for each user in the organization, sorted by email address. Use `group_by[]` for per-RBAC-group aggregates, or `filter[]` to scope results to specific members, groups, or a chat project. Available to organizations on a Claude Enterprise plan. Requires an API key with the `read:analytics` scope. #### Parameters - `UserListParams parameters` - `DateOnly? date` (query parameter) UTC date in YYYY-MM-DD format. The day to get user activity for. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01. format: date - `DateOnly? endingDate` (query parameter) UTC date in YYYY-MM-DD format. End of the date range (exclusive); only valid with `starting_date`. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day), so this can be at most today — which is also the default when omitted, resolved once when the first page is served and reused for the rest of the pagination sequence. At most 366 days after `starting_date`. format: date - `IReadOnlyList? filter` (query parameter) Filters as `dimension:value`, e.g. `filter[]=rbac_group_id:{id}`. Repeat the param for OR within a dimension and across dimensions for AND. Supported dimensions on this endpoint: `project_id`, `rbac_group_id`, `user_id`. Value forms: `project_id` takes a tagged project id (`claude_proj_...`); `rbac_group_id` takes the tagged id (`rbac_group_...`, as emitted in responses and by the spend-limits API) or a bare group UUID, and matches users who held the group at any point during each covered UTC day (time-of-usage attribution); `user_id` takes a tagged user id (`user_...`), as emitted in responses. An unsupported dimension returns 400. At most 100 entries. A `project_id` filter limits each member's row to their claude.ai chat activity in that project and cannot be combined with `group_by[]` or an `rbac_group_id` filter. On these rows, every count in `chat_cowork_unified_metrics.sessions` is 0, because sessions are not measured per project. On any day a member sent a chat message in Chat and Cowork unified, all of that member's project activity for the day is counted in `chat_cowork_unified_metrics.chat` instead of `chat_metrics`. maxItems: 100 - `IReadOnlyList? groupBy` (query parameter) Dimensions to break results out by (e.g. `group_by[]=rbac_group_id`). Supported on this endpoint: `rbac_group_id`. Rows are already per-member, so the one supported grouping aggregates them per RBAC group instead. Grouped rows carry the requested dimension values as additional fields and paginate like ungrouped responses via `next_page`; an unsupported dimension returns 400. `rbac_group_id` attributes a user to every group they held at any point during each covered UTC day, so grouped rows are not an exclusive partition and can sum above org-level totals. At most 100 entries. maxItems: 100 - `RbacGroupID("rbac_group_id")` - `long? limit` (query parameter) Number of results per page (1-1000, default 100). minimum: 1, maximum: 1000 - `AnalyticsOrder? order` (query parameter) Sort direction: `asc` or `desc`. Defaults to `asc` for the endpoint's sort column and to `desc` when `order_by` names a metric (a top-N ranking). Applies to `order_by`, or to the endpoint's default sort field when `order_by` is omitted. - `string? orderBy` (query parameter) Sort field. Restricted to the endpoint's sort column plus its rankable metrics (metrics default to descending; a few metrics rank in date-range mode only, per the endpoint's documented orderable set). - `string? page` (query parameter) Opaque cursor from a previous response's `next_page` field. - `DateOnly? startingDate` (query parameter) UTC date in YYYY-MM-DD format. Start of a date range (inclusive). Enables rollup mode: one row per entity aggregated over the whole range — addable counters are summed across days, and a distinct count is never summed where summing could double-count (a field's range value is recomputed exactly over the window, approximate via HLL with typical error under 2%, null, or — for the creation-event counts, whose per-day values cannot overlap — a per-day sum that is itself exact; each field's own description says which). Use either `date` or `starting_date`, not both. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01. format: date #### Returns - `class AnalyticsUserActivity` Per-user activity data for a given day. - `required AnalyticsChatMetrics ChatMetrics` Claude.ai activity metrics for a single user on a given day. - `required long ConnectorsUsedCount` Number of MCP connector invocations. - `required long DistinctArtifactsCreatedCount` Number of distinct artifacts created. Exact in date-range mode: a creation belongs to exactly one day, so the per-day counts never overlap and their sum over the window is the exact count of distinct creations in it. - `required long? DistinctConnectorsUsedCount` Distinct claude.ai connectors this user used. Excludes calls whose connector could not be identified and all calls from organizations with zero data retention. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `required long? DistinctConversationCount` Number of distinct conversations the user participated in. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `required long? DistinctFilesUploadedCount` Number of distinct files uploaded. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `required long DistinctProjectsCreatedCount` Number of distinct projects created. Exact in date-range mode: a creation belongs to exactly one day, so the per-day counts never overlap and their sum over the window is the exact count of distinct creations in it. - `required long? DistinctProjectsUsedCount` Number of distinct projects used. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `required long? DistinctSharedArtifactsViewedCount` Number of distinct shared artifacts the user viewed. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `required long? DistinctSkillsUsedCount` Number of distinct skills used. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `required long MessageCount` Number of messages sent - `required long SharedConversationsViewedCount` Number of times the user opened a shared conversation in a project - `required long ThinkingMessageCount` Number of messages that used extended thinking - `required AnalyticsClaudeCodeMetrics ClaudeCodeMetrics` Claude Code activity metrics for a single user on a given day. - `required AnalyticsCoreCodeMetrics CoreMetrics` Core Claude Code activity metrics for a single user on a given day. - `required long ArtifactsCreatedCount` Number of artifacts created in Claude Code sessions: an artifact counts once, on the day a session first saves it. Counted from 2026-08-17; 0 on earlier days. Exact in date-range mode: a creation belongs to exactly one day, so the per-day counts never overlap and their sum over the window is the exact count of distinct creations in it. - `required long CommitCount` Number of commits made via Claude Code - `required long? DistinctSessionCount` Number of distinct Claude Code sessions. On aggregated rows and in date-range mode: summed per-day distinct counts. A session essentially never spans a UTC day, so the sum is in practice the true distinct count. - `required AnalyticsLinesOfCode LinesOfCode` Lines of code added and removed via Claude Code. - `required long AddedCount` Lines of code added - `required long RemovedCount` Lines of code removed - `required long PullRequestCount` Number of pull requests created via Claude Code - `required AnalyticsToolActions ToolActions` Per-tool accepted/rejected counts for Claude Code file modification tools. - `required AnalyticsToolActionCounts EditTool` Accepted/rejected counts for a single Claude Code tool type. - `required long AcceptedCount` Number of tool proposals accepted - `required long RejectedCount` Number of tool proposals rejected - `required AnalyticsToolActionCounts MultiEditTool` Accepted/rejected counts for a single Claude Code tool type. - `required AnalyticsToolActionCounts NotebookEditTool` Accepted/rejected counts for a single Claude Code tool type. - `required AnalyticsToolActionCounts WriteTool` Accepted/rejected counts for a single Claude Code tool type. - `required AnalyticsCoworkMetrics CoworkMetrics` Cowork activity metrics for a single user on a given day. - `required long ActionCount` Number of tool actions completed in Cowork sessions - `required long ArtifactsCreatedCount` Number of artifacts created in Cowork sessions: an artifact counts once, on the day a session first saves it. Counted from 2026-08-17; 0 on earlier days. Exact in date-range mode: a creation belongs to exactly one day, so the per-day counts never overlap and their sum over the window is the exact count of distinct creations in it. - `required long ConnectorsUsedCount` Total number of connector invocations in Cowork sessions - `required long DispatchTurnCount` Number of Dispatch (background agent) turns completed - `required long? DistinctConnectorsUsedCount` Number of distinct connectors used in Cowork sessions. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `required long? DistinctPluginsUsedCount` Number of distinct plugins used in Cowork sessions. Null while Cowork plugin-use metrics are not enabled for this organization. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `required long? DistinctSessionCount` Number of distinct Cowork sessions. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `required long? DistinctSkillsUsedCount` Number of distinct skills used in Cowork sessions. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `required long? EditToolCount` Number of successful Edit tool calls in Cowork sessions. Null while the file-edit metrics are not enabled for this organization. - `required long? FileEditCount` Number of successful file-edit tool calls (Edit, MultiEdit, Write, NotebookEdit) in Cowork sessions. Null, never 0, while the file-edit metrics are not enabled for this organization. - `required long MessageCount` Number of messages sent in Cowork sessions - `required long? MultiEditToolCount` Number of successful MultiEdit tool calls in Cowork sessions. Null while the file-edit metrics are not enabled for this organization. - `required long? NotebookEditToolCount` Number of successful NotebookEdit tool calls in Cowork sessions. Null while the file-edit metrics are not enabled for this organization. - `required long? PluginsUsedCount` Total number of plugin invocations in Cowork sessions. Null while Cowork plugin-use metrics are not enabled for this organization. - `required long? SessionsWithFileEditsCount` Number of distinct Cowork sessions with at least one successful file-edit tool call. Null while the file-edit metrics are not enabled for this organization. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `required long SkillsUsedCount` Total number of skill invocations in Cowork sessions - `required long? WriteToolCount` Number of successful Write tool calls in Cowork sessions. Null while the file-edit metrics are not enabled for this organization. - `required AnalyticsDesignMetrics DesignMetrics` Claude Design activity metrics for a single user on a given day. - `required long DistinctProjectsCreatedCount` Number of distinct Claude Design projects created. Exact in date-range mode: a creation belongs to exactly one day, so the per-day counts never overlap and their sum over the window is the exact count of distinct creations in it. - `required long? DistinctProjectsUsedCount` Number of distinct Claude Design projects the user worked in. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `required long? DistinctSessionCount` Number of distinct Claude Design sessions. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `required long MessageCount` Number of messages sent in Claude Design sessions - `required long? DistinctUserCount` Number of distinct active users represented by this row. Only set for grouped rollups (`group_by[]`); null for per-user rows. In date-range mode, recomputed as an exact distinct count of the group's active members over the requested window, never a sum of per-day values. - `required AnalyticsOfficeMetrics OfficeMetrics` Office Agent activity metrics for a single user on a given day, broken out by Office product. - `required AnalyticsOfficeProductMetrics Excel` Office Agent activity metrics for a single user on a given day within one Office product. - `required long ConnectorsUsedCount` Number of MCP connector invocations - `required long? DistinctConnectorsUsedCount` Number of distinct MCP connectors used. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `required long? DistinctSessionCount` Number of distinct Office Agent sessions. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `required long? DistinctSkillsUsedCount` Number of distinct skills used. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `required long MessageCount` Number of messages sent - `required long SkillsUsedCount` Number of skill invocations - `required AnalyticsOfficeProductMetrics Outlook` Office Agent activity metrics for a single user on a given day within one Office product. - `required AnalyticsOfficeProductMetrics Powerpoint` Office Agent activity metrics for a single user on a given day within one Office product. - `required AnalyticsOfficeProductMetrics Word` Office Agent activity metrics for a single user on a given day within one Office product. - `required AnalyticsScienceMetrics ScienceMetrics` Claude Science activity metrics for a single user on a given day. - `required long DelegationCount` Number of delegations (handoffs to a specialized agent) in Claude Science sessions - `required long? DistinctSessionCount` Number of distinct Claude Science sessions. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `required long MessageCount` Number of messages sent in Claude Science sessions - `required long RemoteComputeJobCount` Number of remote compute jobs launched from Claude Science sessions - `required long SkillsUsedCount` Total number of skill invocations in Claude Science sessions - `required AnalyticsUser? User` The user this row describes. Null on rows aggregated across users. - `JsonElement Type = "user"` Object type. Always `user`. - `required string ID` Tagged user identifier (e.g. `user_...`) - `required string EmailAddress` Email address of the user - `required long WebSearchCount` Number of web searches performed - `AnalyticsChatCoworkUnifiedMetrics? ChatCoworkUnifiedMetrics` Activity recorded while the member had Chat and Cowork unified (Cowork's features inside claude.ai chat) turned on, split into `chat` (chat activity) and `sessions` (Cowork activity). Omitted from the response on deployments that do not offer Chat and Cowork unified. - `required AnalyticsChatCoworkUnifiedChatMetrics Chat` Chat activity recorded while members had Chat and Cowork unified turned on. - `required long ConnectorsUsedCount` Same measure as `chat_metrics.connectors_used_count`, for activity recorded while members had Chat and Cowork unified turned on. - `required long DistinctArtifactsCreatedCount` Same measure as `chat_metrics.distinct_artifacts_created_count`, for activity recorded while members had Chat and Cowork unified turned on. Exact in date-range mode: a creation belongs to exactly one day, so the per-day counts never overlap and their sum over the window is the exact count of distinct creations in it. - `required long? DistinctConnectorsUsedCount` Same measure as `chat_metrics.distinct_connectors_used_count`, for activity recorded while members had Chat and Cowork unified turned on. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `required long? DistinctConversationCount` Same measure as `chat_metrics.distinct_conversation_count`, for activity recorded while members had Chat and Cowork unified turned on. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `required long? DistinctFilesUploadedCount` Same measure as `chat_metrics.distinct_files_uploaded_count`, for activity recorded while members had Chat and Cowork unified turned on. It counts uploaded files as well as files Claude created and images returned by Claude's tools, such as screenshots. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `required long DistinctProjectsCreatedCount` Same measure as `chat_metrics.distinct_projects_created_count`, for activity recorded while members had Chat and Cowork unified turned on. Exact in date-range mode: a creation belongs to exactly one day, so the per-day counts never overlap and their sum over the window is the exact count of distinct creations in it. - `required long? DistinctProjectsUsedCount` Same measure as `chat_metrics.distinct_projects_used_count`, for activity recorded while members had Chat and Cowork unified turned on. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `required long? DistinctSharedArtifactsViewedCount` Always null: shared-artifact views are not currently measured. - `required long? DistinctSkillsUsedCount` Same measure as `chat_metrics.distinct_skills_used_count`, for activity recorded while members had Chat and Cowork unified turned on. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `required long MessageCount` Same measure as `chat_metrics.message_count`, for activity recorded while members had Chat and Cowork unified turned on. - `required long SharedConversationsViewedCount` Same measure as `chat_metrics.shared_conversations_viewed_count`, for activity recorded while members had Chat and Cowork unified turned on. - `required long ThinkingMessageCount` Same measure as `chat_metrics.thinking_message_count`, for activity recorded while members had Chat and Cowork unified turned on. - `required AnalyticsChatCoworkUnifiedSessionsMetrics Sessions` Cowork session activity recorded while members had Chat and Cowork unified turned on. - `required long ActionCount` Same measure as `cowork_metrics.action_count`, for activity recorded while members had Chat and Cowork unified turned on. - `required long ArtifactsCreatedCount` Same measure as `cowork_metrics.artifacts_created_count`, for activity recorded while members had Chat and Cowork unified turned on. Exact in date-range mode: a creation belongs to exactly one day, so the per-day counts never overlap and their sum over the window is the exact count of distinct creations in it. - `required long ConnectorsUsedCount` Same measure as `cowork_metrics.connectors_used_count`, for activity recorded while members had Chat and Cowork unified turned on. - `required long DispatchTurnCount` Same measure as `cowork_metrics.dispatch_turn_count`, for activity recorded while members had Chat and Cowork unified turned on. - `required long? DistinctConnectorsUsedCount` Same measure as `cowork_metrics.distinct_connectors_used_count`, for activity recorded while members had Chat and Cowork unified turned on. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `required long? DistinctPluginsUsedCount` Same measure as `cowork_metrics.distinct_plugins_used_count`, for activity recorded while members had Chat and Cowork unified turned on. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `required long? DistinctSessionCount` Same measure as `cowork_metrics.distinct_session_count`, for activity recorded while members had Chat and Cowork unified turned on. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `required long? DistinctSkillsUsedCount` Same measure as `cowork_metrics.distinct_skills_used_count`, for activity recorded while members had Chat and Cowork unified turned on. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `required long? EditToolCount` Same measure as `cowork_metrics.edit_tool_count`, for activity recorded while members had Chat and Cowork unified turned on. - `required long? FileEditCount` Same measure as `cowork_metrics.file_edit_count`, for activity recorded while members had Chat and Cowork unified turned on. - `required long MessageCount` Same measure as `cowork_metrics.message_count`, for activity recorded while members had Chat and Cowork unified turned on. - `required long? MultiEditToolCount` Same measure as `cowork_metrics.multi_edit_tool_count`, for activity recorded while members had Chat and Cowork unified turned on. Claude no longer has a multi-edit tool, so expect 0 when not null; each edit is now a separate Edit tool call, counted in `edit_tool_count` and `file_edit_count`. - `required long? NotebookEditToolCount` Same measure as `cowork_metrics.notebook_edit_tool_count`, for activity recorded while members had Chat and Cowork unified turned on. - `required long? PluginsUsedCount` Same measure as `cowork_metrics.plugins_used_count`, for activity recorded while members had Chat and Cowork unified turned on. - `required long? SessionsWithFileEditsCount` Same measure as `cowork_metrics.sessions_with_file_edits_count`, for activity recorded while members had Chat and Cowork unified turned on. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `required long SkillsUsedCount` Same measure as `cowork_metrics.skills_used_count`, for activity recorded while members had Chat and Cowork unified turned on. - `required long? WriteToolCount` Same measure as `cowork_metrics.write_tool_count`, for activity recorded while members had Chat and Cowork unified turned on. - `DateOnly? LastActivityDate` Most recent UTC day (YYYY-MM-DD) on which the user had any counted activity, within the requested window: equal to the requested `date` in single-day mode, and to the latest active day from `starting_date` (inclusive) to `ending_date` (exclusive) in date-range rollup mode — never a day earlier than the window start. On filtered requests (`filter[]`) only days matching the filter count: with `filter[]=rbac_group_id:{id}` it is the last day the user was active while a member of that group, consistent with the row's other metrics. On grouped (`group_by[]`) rows it is the latest day any member of the group was active (the requested `date` in single-day mode). Omitted from the response while last-activity reporting is not enabled for this organization. format: date - `string? RbacGroupID` Tagged RBAC group identifier (`rbac_group_...`), matching the spend-limits API spelling. Present only when the request grouped by `rbac_group_id`. - `string? RbacGroupName` Resolved RBAC group display name, alongside `rbac_group_id` when name resolution is available. Null if the group has been deleted or its name could not be resolved; `rbac_group_id` remains the stable key. #### Example ```csharp using System; using Anthropic.Models.Organization.Analytics.Users; UserListParams parameters = new(); var page = await client.Organization.Analytics.Users.List(parameters); await foreach (var item in page.Paginate()) { Console.WriteLine(item); } ``` ##### Response (200) ```json { "data": [ { "chat_metrics": { "connectors_used_count": 0, "distinct_artifacts_created_count": 0, "distinct_connectors_used_count": 0, "distinct_conversation_count": 0, "distinct_files_uploaded_count": 0, "distinct_projects_created_count": 0, "distinct_projects_used_count": 0, "distinct_shared_artifacts_viewed_count": 0, "distinct_skills_used_count": 0, "message_count": 0, "shared_conversations_viewed_count": 0, "thinking_message_count": 0 }, "claude_code_metrics": { "core_metrics": { "artifacts_created_count": 0, "commit_count": 0, "distinct_session_count": 0, "lines_of_code": { "added_count": 0, "removed_count": 0 }, "pull_request_count": 0 }, "tool_actions": { "edit_tool": { "accepted_count": 0, "rejected_count": 0 }, "multi_edit_tool": { "accepted_count": 0, "rejected_count": 0 }, "notebook_edit_tool": { "accepted_count": 0, "rejected_count": 0 }, "write_tool": { "accepted_count": 0, "rejected_count": 0 } } }, "cowork_metrics": { "action_count": 0, "artifacts_created_count": 0, "connectors_used_count": 0, "dispatch_turn_count": 0, "distinct_connectors_used_count": 0, "distinct_plugins_used_count": 0, "distinct_session_count": 0, "distinct_skills_used_count": 0, "edit_tool_count": 0, "file_edit_count": 0, "message_count": 0, "multi_edit_tool_count": 0, "notebook_edit_tool_count": 0, "plugins_used_count": 0, "sessions_with_file_edits_count": 0, "skills_used_count": 0, "write_tool_count": 0 }, "design_metrics": { "distinct_projects_created_count": 0, "distinct_projects_used_count": 0, "distinct_session_count": 0, "message_count": 0 }, "distinct_user_count": 0, "office_metrics": { "excel": { "connectors_used_count": 0, "distinct_connectors_used_count": 0, "distinct_session_count": 0, "distinct_skills_used_count": 0, "message_count": 0, "skills_used_count": 0 }, "outlook": { "connectors_used_count": 0, "distinct_connectors_used_count": 0, "distinct_session_count": 0, "distinct_skills_used_count": 0, "message_count": 0, "skills_used_count": 0 }, "powerpoint": { "connectors_used_count": 0, "distinct_connectors_used_count": 0, "distinct_session_count": 0, "distinct_skills_used_count": 0, "message_count": 0, "skills_used_count": 0 }, "word": { "connectors_used_count": 0, "distinct_connectors_used_count": 0, "distinct_session_count": 0, "distinct_skills_used_count": 0, "message_count": 0, "skills_used_count": 0 } }, "science_metrics": { "delegation_count": 0, "distinct_session_count": 0, "message_count": 0, "remote_compute_job_count": 0, "skills_used_count": 0 }, "user": { "id": "id", "email_address": "email_address", "type": "user" }, "web_search_count": 0, "chat_cowork_unified_metrics": { "chat": { "connectors_used_count": 0, "distinct_artifacts_created_count": 0, "distinct_connectors_used_count": 0, "distinct_conversation_count": 0, "distinct_files_uploaded_count": 0, "distinct_projects_created_count": 0, "distinct_projects_used_count": 0, "distinct_shared_artifacts_viewed_count": 0, "distinct_skills_used_count": 0, "message_count": 0, "shared_conversations_viewed_count": 0, "thinking_message_count": 0 }, "sessions": { "action_count": 0, "artifacts_created_count": 0, "connectors_used_count": 0, "dispatch_turn_count": 0, "distinct_connectors_used_count": 0, "distinct_plugins_used_count": 0, "distinct_session_count": 0, "distinct_skills_used_count": 0, "edit_tool_count": 0, "file_edit_count": 0, "message_count": 0, "multi_edit_tool_count": 0, "notebook_edit_tool_count": 0, "plugins_used_count": 0, "sessions_with_file_edits_count": 0, "skills_used_count": 0, "write_tool_count": 0 } }, "last_activity_date": "2019-12-27", "rbac_group_id": "rbac_group_id", "rbac_group_name": "rbac_group_name" } ], "next_page": "next_page" } ``` ## Organization › Analytics › Apps › Chat › Projects ### Get Chat Project Usage `ProjectListPage Organization.Analytics.Apps.Chat.Projects.List(parameters, cancellationToken = default)` **GET** `/v1/organizations/analytics/apps/chat/projects` Get per-project activity for a given day, with cursor-based pagination. Returns activity metrics for each project in the organization, sorted by project ID. Use `group_by[]` to break projects out per member or per RBAC group, and `filter[]` to scope results; the parameter descriptions list the supported dimensions. Available to organizations on a Claude Enterprise plan. Requires an API key with the `read:analytics` scope. #### Parameters - `ProjectListParams parameters` - `DateOnly? date` (query parameter) UTC date in YYYY-MM-DD format. The day to get project activity for. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01. format: date - `DateOnly? endingDate` (query parameter) UTC date in YYYY-MM-DD format. End of the date range (exclusive); only valid with `starting_date`. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day), so this can be at most today — which is also the default when omitted, resolved once when the first page is served and reused for the rest of the pagination sequence. At most 366 days after `starting_date`. format: date - `IReadOnlyList? filter` (query parameter) Filters as `dimension:value`, e.g. `filter[]=rbac_group_id:{id}`. Repeat the param for OR within a dimension and across dimensions for AND. Supported dimensions on this endpoint: `project_id`, `rbac_group_id`, `user_id`. Value forms: `project_id` takes a tagged project id (`claude_proj_...`); `rbac_group_id` takes the tagged id (`rbac_group_...`, as emitted in responses and by the spend-limits API) or a bare group UUID, and matches users who held the group at any point during each covered UTC day (time-of-usage attribution); `user_id` takes a tagged user id (`user_...`), as emitted in responses. An unsupported dimension returns 400. At most 100 entries. maxItems: 100 - `IReadOnlyList? groupBy` (query parameter) Dimensions to break results out by (e.g. `group_by[]=user_id`). Supported on this endpoint: `rbac_group_id`, `user_id`. Grouped rows carry the requested dimension values as additional fields and paginate like ungrouped responses via `next_page`; an unsupported dimension returns 400. `rbac_group_id` attributes a user to every group they held at any point during each covered UTC day, so grouped rows are not an exclusive partition and can sum above org-level totals. At most 100 entries. maxItems: 100 - `RbacGroupID("rbac_group_id")` - `UserID("user_id")` - `long? limit` (query parameter) Number of results per page (1-1000, default 100). minimum: 1, maximum: 1000 - `AnalyticsOrder? order` (query parameter) Sort direction: `asc` or `desc`. Defaults to `asc` for the endpoint's sort column and to `desc` when `order_by` names a metric (a top-N ranking). Applies to `order_by`, or to the endpoint's default sort field when `order_by` is omitted. - `string? orderBy` (query parameter) Sort field. Restricted to the endpoint's sort column plus its rankable metrics (metrics default to descending; a few metrics rank in date-range mode only, per the endpoint's documented orderable set). - `string? page` (query parameter) Opaque cursor from a previous response's `next_page` field. - `DateOnly? startingDate` (query parameter) UTC date in YYYY-MM-DD format. Start of a date range (inclusive). Enables rollup mode: one row per entity aggregated over the whole range — addable counters are summed across days, and a distinct count is never summed where summing could double-count (a field's range value is recomputed exactly over the window, approximate via HLL with typical error under 2%, null, or — for the creation-event counts, whose per-day values cannot overlap — a per-day sum that is itself exact; each field's own description says which). Use either `date` or `starting_date`, not both. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01. format: date #### Returns - `class AnalyticsProjectActivity` Per-project activity data for a given day. - `required DateTimeOffset? CreatedAt` Project creation timestamp in RFC 3339 format. Null if the project was deleted before attribution was recorded. format: date-time - `required AnalyticsUser? CreatedBy` User who created the project. Null if the project was deleted before attribution was recorded, or if the creator's account no longer exists. - `JsonElement Type = "user"` Object type. Always `user`. - `required string ID` Tagged user identifier (e.g. `user_...`) - `required string EmailAddress` Email address of the user - `required long? DistinctConversationCount` Number of distinct conversations in the project. Null on aggregated rows where a distinct count cannot be computed. - `required long DistinctUserCount` Number of distinct users who used the project on the requested day, or, in date-range mode, over the requested window — recomputed as an exact distinct count over the window's per-member daily rows, never a sum of per-day values. - `required long MessageCount` Number of messages sent in the project on the requested day - `required string ProjectID` Tagged project identifier (e.g. `claude_proj_...`) - `required string ProjectName` Name of the project - `string? RbacGroupID` Tagged RBAC group identifier (`rbac_group_...`), matching the spend-limits API spelling. Present only when the request grouped by `rbac_group_id`. - `string? RbacGroupName` Resolved RBAC group display name, alongside `rbac_group_id` when name resolution is available. Null if the group has been deleted or its name could not be resolved; `rbac_group_id` remains the stable key. - `string? UserID` Tagged user identifier (e.g. `user_...`). Present only when the request grouped by `user_id`. #### Example ```csharp using System; using Anthropic.Models.Organization.Analytics.Apps.Chat.Projects; ProjectListParams parameters = new(); var page = await client.Organization.Analytics.Apps.Chat.Projects.List(parameters); await foreach (var item in page.Paginate()) { Console.WriteLine(item); } ``` ##### Response (200) ```json { "data": [ { "created_at": "2019-12-27T18:11:19.117Z", "created_by": { "id": "id", "email_address": "email_address", "type": "user" }, "distinct_conversation_count": 0, "distinct_user_count": 0, "message_count": 0, "project_id": "project_id", "project_name": "project_name", "rbac_group_id": "rbac_group_id", "rbac_group_name": "rbac_group_name", "user_id": "user_id" } ], "next_page": "next_page" } ``` ## Organization › Analytics › Connectors ### Get Connector Usage `ConnectorListPage Organization.Analytics.Connectors.List(parameters, cancellationToken = default)` **GET** `/v1/organizations/analytics/connectors` Get per-connector usage for a given day, with cursor-based pagination. Returns connector usage metrics for the organization, sorted by connector name. Connector names are normalized from their various sources — for example, "Atlassian MCP server" and "mcp-atlassian" both appear as "atlassian". Use `group_by[]` to break usage out per member, per RBAC group, or per product surface, and `filter[]` to scope results; the parameter descriptions list the supported dimensions. Available to organizations on a Claude Enterprise plan. Requires an API key with the `read:analytics` scope. #### Parameters - `ConnectorListParams parameters` - `DateOnly? date` (query parameter) UTC date in YYYY-MM-DD format. The day to get connector usage for. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01. format: date - `DateOnly? endingDate` (query parameter) UTC date in YYYY-MM-DD format. End of the date range (exclusive); only valid with `starting_date`. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day), so this can be at most today — which is also the default when omitted, resolved once when the first page is served and reused for the rest of the pagination sequence. At most 366 days after `starting_date`. format: date - `IReadOnlyList? filter` (query parameter) Filters as `dimension:value`, e.g. `filter[]=rbac_group_id:{id}`. Repeat the param for OR within a dimension and across dimensions for AND. Supported dimensions on this endpoint: `connector_name`, `product`, `rbac_group_id`, `user_id`. Value forms: `connector_name` matches case-insensitively, a display name such as 'GitHub MCP' also matches its normalized stored form ('github'), and for rows whose `connector_name` is an opaque connector id the connector's display name (`connector_display_name`) also matches; `product` is one of `chat_cowork_unified`, `chat`, `claude_code`, `cowork`, or `office_agent`; `rbac_group_id` takes the tagged id (`rbac_group_...`, as emitted in responses and by the spend-limits API) or a bare group UUID, and matches users who held the group at any point during each covered UTC day (time-of-usage attribution); `user_id` takes a tagged user id (`user_...`), as emitted in responses. An unsupported dimension returns 400. At most 100 entries. `chat_cowork_unified` is accepted as a `product` value only on deployments that offer Chat and Cowork unified. maxItems: 100 - `IReadOnlyList? groupBy` (query parameter) Dimensions to break results out by (e.g. `group_by[]=user_id`). Supported on this endpoint: `product`, `rbac_group_id`, `user_id`. Grouped rows carry the requested dimension values as additional fields and paginate like ungrouped responses via `next_page`; an unsupported dimension returns 400. `rbac_group_id` attributes a user to every group they held at any point during each covered UTC day, so grouped rows are not an exclusive partition and can sum above org-level totals. At most 100 entries. maxItems: 100 - `Product("product")` - `RbacGroupID("rbac_group_id")` - `UserID("user_id")` - `long? limit` (query parameter) Number of results per page (1-1000, default 100). minimum: 1, maximum: 1000 - `AnalyticsOrder? order` (query parameter) Sort direction: `asc` or `desc`. Defaults to `asc` for the endpoint's sort column and to `desc` when `order_by` names a metric (a top-N ranking). Applies to `order_by`, or to the endpoint's default sort field when `order_by` is omitted. - `string? orderBy` (query parameter) Sort field. Restricted to the endpoint's sort column plus its rankable metrics (metrics default to descending; a few metrics rank in date-range mode only, per the endpoint's documented orderable set). - `string? page` (query parameter) Opaque cursor from a previous response's `next_page` field. - `DateOnly? startingDate` (query parameter) UTC date in YYYY-MM-DD format. Start of a date range (inclusive). Enables rollup mode: one row per entity aggregated over the whole range — addable counters are summed across days, and a distinct count is never summed where summing could double-count (a field's range value is recomputed exactly over the window, approximate via HLL with typical error under 2%, null, or — for the creation-event counts, whose per-day values cannot overlap — a per-day sum that is itself exact; each field's own description says which). Use either `date` or `starting_date`, not both. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01. format: date #### Returns - `class AnalyticsConnectorActivity` Per-connector activity data for a given day. - `required AnalyticsConnectorChatMetrics ChatMetrics` Claude.ai activity metrics for a single connector on a given day. - `required long? DistinctConversationConnectorUsedCount` Number of distinct conversations in which the connector was used. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `required AnalyticsConnectorClaudeCodeMetrics ClaudeCodeMetrics` Claude Code activity metrics for a single connector on a given day. - `required long? DistinctSessionConnectorUsedCount` Number of distinct Claude Code sessions in which the connector was used. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `required string? ConnectorDisplayName` Human-readable display name for rows whose `connector_name` is an opaque connector id rather than a readable name, resolved at request time from the organization's connectors (including connectors that have since been removed). `connector_name` remains the row's stable key for sorting and pagination, and `filter[]=connector_name:{value}` also matches these rows by display name. Display names are not unique, and the same connector's claude.ai usage can appear under a separate row with a readable `connector_name`. Null when `connector_name` is already a readable name, when the id cannot be resolved to one of the organization's connectors, or when display-name resolution is not enabled for this organization. - `required string ConnectorName` Name of the connector. Some rows carry an opaque connector id here instead of a readable name; `connector_display_name` holds the resolved name for those rows. - `required AnalyticsConnectorCoworkMetrics CoworkMetrics` Cowork activity metrics for a single connector on a given day. - `required long? DistinctSessionConnectorUsedCount` Number of distinct Cowork sessions in which the connector was used. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `required long DistinctUserCount` Number of distinct users who used the connector on the requested day, or, in date-range mode, over the requested window — recomputed as an exact distinct count over the window's per-member daily rows, never a sum of per-day values. - `required long? IndividualAuthDistinctUserCount` Number of distinct users whose use of this connector on the requested day ran on their own individual credential, connected through their own consent flow. Companion bucket to `managed_auth_distinct_user_count`, which carries the measurement, attribution, and null rules. Users whose requests used no stored credential count in neither bucket. - `required long? ManagedAuthDistinctUserCount` Number of distinct users whose use of this connector on the requested day ran on Enterprise Managed Auth (an organization-managed credential provisioned through the organization's identity provider), read from the token record each request used. Null, never 0, when managed-auth reporting is not enabled for the organization, the value cannot be attributed to the row, no credentialed requests and no managed-token mint events (a managed credential being provisioned for a user's use of the connector) were observed that day, or the day predates 2026-07-01, the first day the backing data exists (forward-only data, no backfill). When credentialed requests or mint events were observed and attributed, both managed-auth fields populate, reporting 0 for a bucket with no users; the two counts are independent, not a partition — a user whose requests that day used both kinds of credential counts in both. Mint events carry user but not surface attribution, so they count as observed auth activity on `user_id` and `rbac_group_id` cuts — attributed to the user the credential was provisioned for — but never on a cut that references `product` (group or filter). Date-range rollup mode (`starting_date`/`ending_date`) computes both fields exactly over the window — distinct users with at least one qualifying day — when the whole window starts on or after 2026-07-01, with the null-versus-0 and mint-event rules applying with the window in place of the day; a range starting earlier reports every managed-auth field as null, never a partial-window value. - `required AnalyticsConnectorOfficeMetrics OfficeMetrics` Office Agent activity metrics for a single connector on a given day, broken out by Office product. - `required AnalyticsConnectorOfficeProductMetrics Excel` Office Agent activity metrics for a single connector on a given day within one Office product. - `required long? DistinctSessionConnectorUsedCount` Number of distinct Office Agent sessions in which the connector was used. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `required AnalyticsConnectorOfficeProductMetrics Outlook` Office Agent activity metrics for a single connector on a given day within one Office product. - `required AnalyticsConnectorOfficeProductMetrics Powerpoint` Office Agent activity metrics for a single connector on a given day within one Office product. - `required AnalyticsConnectorOfficeProductMetrics Word` Office Agent activity metrics for a single connector on a given day within one Office product. - `required long? ReadCallCount` Number of connector tool calls on the requested day whose trusted read-only annotation marked them read-only. Call count, not distinct users. Every call recorded on a classified surface lands in exactly one of `read_call_count`, `write_call_count`, or `unclassified_call_count`, so the three sum to the day's classified calls. Classification is forward-only per surface: claude.ai from 2026-06-01, Claude Code from 2026-05-30, Claude in Office from 2026-05-29, Cowork from 2026-06-02 (Cowork clients predating annotation forwarding land in `unclassified_call_count`). Null, never 0, when the value cannot be stated: the read/write split is not enabled for this organization, or the day predates 2026-05-29. For a date-range total, sum the per-day values, but treat a window that extends before 2026-05-29 as null rather than summing only its covered days — date-range rollup mode (`starting_date`/`ending_date`) applies both rules server-side. - `required long? UnclassifiedCallCount` Number of connector tool calls on the requested day with no trusted read-only annotation — the annotation is optional in the MCP spec and is discarded when connector access controls are active, so unclassified calls are common. This field shows how much of the day's classified activity the read/write split actually covers. Call count, not distinct users. One of the three call-classification buckets; see `read_call_count` for the per-surface data-start dates, null conditions, and date-range guidance. - `required long? WriteCallCount` Number of connector tool calls on the requested day whose trusted read-only annotation marked them not read-only. Call count, not distinct users. One of the three call-classification buckets; see `read_call_count` for the per-surface data-start dates, null conditions, and date-range guidance. - `AnalyticsConnectorChatCoworkUnifiedMetrics? ChatCoworkUnifiedMetrics` Connector use recorded while members had Chat and Cowork unified (Cowork's features inside claude.ai chat) turned on, split into chat conversations and Cowork sessions. A count is null in date-range mode where it cannot be computed. Omitted from the response on deployments that do not offer Chat and Cowork unified. - `required AnalyticsConnectorChatCoworkUnifiedChatMetrics Chat` A connector's use in chat conversations recorded while members had Chat and Cowork unified turned on. - `required long? DistinctConversationConnectorUsedCount` Same measure as `chat_metrics.distinct_conversation_connector_used_count`, for activity recorded while members had Chat and Cowork unified turned on. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `required AnalyticsConnectorChatCoworkUnifiedSessionsMetrics Sessions` A connector's use in Cowork sessions recorded while members had Chat and Cowork unified turned on. - `required long? DistinctSessionConnectorUsedCount` Same measure as `cowork_metrics.distinct_session_connector_used_count`, for activity recorded while members had Chat and Cowork unified turned on. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `string? Product` Product that produced this row's activity: one of `chat`, `claude_code`, `cowork`, `office_agent`, or `chat_cowork_unified` (Chat and Cowork unified). These are the canonical Cost & Usage product names; an `office_agent` row's per-surface breakdown is in its `office_metrics`. On `/plugins` only `cowork`, `claude_code` and `chat_cowork_unified` occur (the only surfaces with plugin attribution); on `/artifacts` only `chat`, `claude_code`, `cowork` and `chat_cowork_unified` occur (the surfaces that create artifacts); `/apps/chat/projects` does not support the product dimension (a `product` entry in `group_by[]` or `filter[]` there is rejected). Present only when the request grouped by `product`. - `string? RbacGroupID` Tagged RBAC group identifier (`rbac_group_...`), matching the spend-limits API spelling. Present only when the request grouped by `rbac_group_id`. - `string? RbacGroupName` Resolved RBAC group display name, alongside `rbac_group_id` when name resolution is available. Null if the group has been deleted or its name could not be resolved; `rbac_group_id` remains the stable key. - `string? UserID` Tagged user identifier (e.g. `user_...`). Present only when the request grouped by `user_id`. #### Example ```csharp using System; using Anthropic.Models.Organization.Analytics.Connectors; ConnectorListParams parameters = new(); var page = await client.Organization.Analytics.Connectors.List(parameters); await foreach (var item in page.Paginate()) { Console.WriteLine(item); } ``` ##### Response (200) ```json { "data": [ { "chat_metrics": { "distinct_conversation_connector_used_count": 0 }, "claude_code_metrics": { "distinct_session_connector_used_count": 0 }, "connector_display_name": "connector_display_name", "connector_name": "connector_name", "cowork_metrics": { "distinct_session_connector_used_count": 0 }, "distinct_user_count": 0, "individual_auth_distinct_user_count": 0, "managed_auth_distinct_user_count": 0, "office_metrics": { "excel": { "distinct_session_connector_used_count": 0 }, "outlook": { "distinct_session_connector_used_count": 0 }, "powerpoint": { "distinct_session_connector_used_count": 0 }, "word": { "distinct_session_connector_used_count": 0 } }, "read_call_count": 0, "unclassified_call_count": 0, "write_call_count": 0, "chat_cowork_unified_metrics": { "chat": { "distinct_conversation_connector_used_count": 0 }, "sessions": { "distinct_session_connector_used_count": 0 } }, "product": "product", "rbac_group_id": "rbac_group_id", "rbac_group_name": "rbac_group_name", "user_id": "user_id" } ], "next_page": "next_page" } ``` ## Organization › Analytics › Plugins ### Get Plugin Usage `PluginListPage Organization.Analytics.Plugins.List(parameters, cancellationToken = default)` **GET** `/v1/organizations/analytics/plugins` Get per-plugin install + invocation usage for a given day, with pagination. Returns plugin usage metrics for the organization across Cowork and Claude Code, sorted by plugin name. The `plugin_name` value `third-party` is an aggregate bucket, not a plugin: it collects plugin activity, from either surface, for which the reporting client did not provide a plugin name — so an organization's own plugins can contribute both to their own named rows and to this bucket. Use `group_by[]` to break usage out per member, per RBAC group, or per product surface (Cowork / Claude Code), and `filter[]` to scope results; the parameter descriptions list the supported dimensions. Requires an API key with the `read:analytics` scope. `starting_date` / `ending_date` select range-rollup mode like `/skills`. #### Parameters - `PluginListParams parameters` - `DateOnly? date` (query parameter) UTC date in YYYY-MM-DD format. The day to get plugin usage for. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01. format: date - `DateOnly? endingDate` (query parameter) UTC date in YYYY-MM-DD format. End of the date range (exclusive); only valid with `starting_date`. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day), so this can be at most today — which is also the default when omitted, resolved once when the first page is served and reused for the rest of the pagination sequence. At most 366 days after `starting_date`. format: date - `IReadOnlyList? filter` (query parameter) Filters as `dimension:value`, e.g. `filter[]=rbac_group_id:{id}`. Repeat the param for OR within a dimension and across dimensions for AND. Supported dimensions on this endpoint: `plugin_name`, `product`, `rbac_group_id`, `user_id`. Value forms: `plugin_name` matches case-insensitively; `product` is `chat_cowork_unified`, `claude_code`, or `cowork` (the only surfaces with plugin attribution); `rbac_group_id` takes the tagged id (`rbac_group_...`, as emitted in responses and by the spend-limits API) or a bare group UUID, and matches users who held the group at any point during each covered UTC day (time-of-usage attribution); `user_id` takes a tagged user id (`user_...`), as emitted in responses. An unsupported dimension returns 400. At most 100 entries. `chat_cowork_unified` is accepted as a `product` value only on deployments that offer Chat and Cowork unified. maxItems: 100 - `IReadOnlyList? groupBy` (query parameter) Dimensions to break results out by (e.g. `group_by[]=user_id`). Supported on this endpoint: `product`, `rbac_group_id`, `user_id`. On this endpoint `product` takes the values `chat_cowork_unified`, `claude_code`, or `cowork` only (the surfaces with plugin attribution). Grouped rows carry the requested dimension values as additional fields and paginate like ungrouped responses via `next_page`; an unsupported dimension returns 400. `rbac_group_id` attributes a user to every group they held at any point during each covered UTC day, so grouped rows are not an exclusive partition and can sum above org-level totals. At most 100 entries. maxItems: 100 - `Product("product")` - `RbacGroupID("rbac_group_id")` - `UserID("user_id")` - `long? limit` (query parameter) Number of results per page (1-1000, default 100). minimum: 1, maximum: 1000 - `AnalyticsOrder? order` (query parameter) Sort direction: `asc` or `desc`. Defaults to `asc` for the endpoint's sort column and to `desc` when `order_by` names a metric (a top-N ranking). Applies to `order_by`, or to the endpoint's default sort field when `order_by` is omitted. - `string? orderBy` (query parameter) Sort field. Restricted to the endpoint's sort column plus its rankable metrics (metrics default to descending; a few metrics rank in date-range mode only, per the endpoint's documented orderable set). - `string? page` (query parameter) Opaque cursor from a previous response's `next_page` field. - `DateOnly? startingDate` (query parameter) UTC date in YYYY-MM-DD format. Start of a date range (inclusive). Enables rollup mode: one row per entity aggregated over the whole range — addable counters are summed across days, and a distinct count is never summed where summing could double-count (a field's range value is recomputed exactly over the window, approximate via HLL with typical error under 2%, null, or — for the creation-event counts, whose per-day values cannot overlap — a per-day sum that is itself exact; each field's own description says which). Use either `date` or `starting_date`, not both. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01. format: date #### Returns - `class AnalyticsPluginActivity` Per-plugin install + invocation activity for a given day. With `group_by[]=user_id` / `rbac_group_id` / `product` (`cowork`, `claude_code` and `chat_cowork_unified` only on this endpoint) each row is one (plugin, user), (plugin, group), or (plugin, product) cut: the flat `user_id` / `rbac_group_id` / `product` keys carry the cut and the counts are scoped to it. - `required AnalyticsPluginClaudeCodeMetrics ClaudeCodeMetrics` Claude Code activity metrics for a single plugin on a given day. - `required long? DistinctSessionPluginUsedCount` Number of distinct Claude Code sessions in which the plugin was invoked. Null on aggregated rows where a distinct count cannot be computed. - `required AnalyticsPluginCoworkMetrics CoworkMetrics` Cowork activity metrics for a single plugin on a given day. - `required long? DistinctSessionPluginUsedCount` Number of distinct Cowork sessions in which the plugin was invoked. Null on aggregated rows where a distinct count cannot be computed. - `required long DistinctUserCount` Number of distinct users with recorded install or invocation activity for the plugin on the requested day (install-only users count), or, in date-range mode, over the requested window — recomputed as an exact distinct count over the window's per-member daily rows, never a sum of per-day values. - `required long? InstallCount` Number of distinct users who installed the plugin on the requested day, or, in date-range mode, over the requested window — recomputed as an exact distinct count over the window's per-member daily rows, never a sum of per-day values. - `required long InvocationCount` Number of plugin invocations on the requested day - `required string? PluginID` Stable plugin identifier when available (e.g. `serena@claude-plugins-official`). Null for third-party Claude Code plugins (redacted at the source) and Cowork slash commands that carry only a hashed id. - `required string PluginName` Name of the plugin - `AnalyticsPluginChatCoworkUnifiedMetrics? ChatCoworkUnifiedMetrics` Plugin use recorded while members had Chat and Cowork unified (Cowork's features inside claude.ai chat) turned on. A count is null in date-range mode where it cannot be computed. Omitted from the response on deployments that do not offer Chat and Cowork unified. - `required long? DistinctSessionPluginUsedCount` Same measure as `cowork_metrics.distinct_session_plugin_used_count`, for activity recorded while members had Chat and Cowork unified turned on. Null on aggregated rows where a distinct count cannot be computed. - `string? Product` Product that produced this row's activity: one of `chat`, `claude_code`, `cowork`, `office_agent`, or `chat_cowork_unified` (Chat and Cowork unified). These are the canonical Cost & Usage product names; an `office_agent` row's per-surface breakdown is in its `office_metrics`. On `/plugins` only `cowork`, `claude_code` and `chat_cowork_unified` occur (the only surfaces with plugin attribution); on `/artifacts` only `chat`, `claude_code`, `cowork` and `chat_cowork_unified` occur (the surfaces that create artifacts); `/apps/chat/projects` does not support the product dimension (a `product` entry in `group_by[]` or `filter[]` there is rejected). Present only when the request grouped by `product`. - `string? RbacGroupID` Tagged RBAC group identifier (`rbac_group_...`), matching the spend-limits API spelling. Present only when the request grouped by `rbac_group_id`. - `string? RbacGroupName` Resolved RBAC group display name, alongside `rbac_group_id` when name resolution is available. Null if the group has been deleted or its name could not be resolved; `rbac_group_id` remains the stable key. - `string? UserID` Tagged user identifier (e.g. `user_...`). Present only when the request grouped by `user_id`. #### Example ```csharp using System; using Anthropic.Models.Organization.Analytics.Plugins; PluginListParams parameters = new(); var page = await client.Organization.Analytics.Plugins.List(parameters); await foreach (var item in page.Paginate()) { Console.WriteLine(item); } ``` ##### Response (200) ```json { "data": [ { "claude_code_metrics": { "distinct_session_plugin_used_count": 0 }, "cowork_metrics": { "distinct_session_plugin_used_count": 0 }, "distinct_user_count": 0, "install_count": 0, "invocation_count": 0, "plugin_id": "plugin_id", "plugin_name": "plugin_name", "chat_cowork_unified_metrics": { "distinct_session_plugin_used_count": 0 }, "product": "product", "rbac_group_id": "rbac_group_id", "rbac_group_name": "rbac_group_name", "user_id": "user_id" } ], "next_page": "next_page" } ``` ## Organization › Analytics › Skills ### Get Skill Usage `SkillListPage Organization.Analytics.Skills.List(parameters, cancellationToken = default)` **GET** `/v1/organizations/analytics/skills` Get per-skill usage for a given day, with cursor-based pagination. Returns skill usage metrics for the organization, sorted by skill name. Use `group_by[]` to break usage out per member, per RBAC group, or per product surface, and `filter[]` to scope results; the parameter descriptions list the supported dimensions. Available to organizations on a Claude Enterprise plan. Requires an API key with the `read:analytics` scope. #### Parameters - `SkillListParams parameters` - `DateOnly? date` (query parameter) UTC date in YYYY-MM-DD format. The day to get skill usage for. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01. format: date - `DateOnly? endingDate` (query parameter) UTC date in YYYY-MM-DD format. End of the date range (exclusive); only valid with `starting_date`. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day), so this can be at most today — which is also the default when omitted, resolved once when the first page is served and reused for the rest of the pagination sequence. At most 366 days after `starting_date`. format: date - `IReadOnlyList? filter` (query parameter) Filters as `dimension:value`, e.g. `filter[]=rbac_group_id:{id}`. Repeat the param for OR within a dimension and across dimensions for AND. Supported dimensions on this endpoint: `product`, `rbac_group_id`, `share_status`, `skill_name`, `user_id`. Value forms: `product` is one of `chat_cowork_unified`, `chat`, `claude_code`, `cowork`, or `office_agent`; `rbac_group_id` takes the tagged id (`rbac_group_...`, as emitted in responses and by the spend-limits API) or a bare group UUID, and matches users who held the group at any point during each covered UTC day (time-of-usage attribution); `share_status` is one of `organization`, `private`, or `public`; `skill_name` matches case-insensitively; `user_id` takes a tagged user id (`user_...`), as emitted in responses. An unsupported dimension returns 400. At most 100 entries. `chat_cowork_unified` is accepted as a `product` value only on deployments that offer Chat and Cowork unified. maxItems: 100 - `IReadOnlyList? groupBy` (query parameter) Dimensions to break results out by (e.g. `group_by[]=user_id`). Supported on this endpoint: `product`, `rbac_group_id`, `user_id`. Grouped rows carry the requested dimension values as additional fields and paginate like ungrouped responses via `next_page`; an unsupported dimension returns 400. `rbac_group_id` attributes a user to every group they held at any point during each covered UTC day, so grouped rows are not an exclusive partition and can sum above org-level totals. At most 100 entries. maxItems: 100 - `Product("product")` - `RbacGroupID("rbac_group_id")` - `UserID("user_id")` - `long? limit` (query parameter) Number of results per page (1-1000, default 100). minimum: 1, maximum: 1000 - `AnalyticsOrder? order` (query parameter) Sort direction: `asc` or `desc`. Defaults to `asc` for the endpoint's sort column and to `desc` when `order_by` names a metric (a top-N ranking). Applies to `order_by`, or to the endpoint's default sort field when `order_by` is omitted. - `string? orderBy` (query parameter) Sort field. Restricted to the endpoint's sort column plus its rankable metrics (metrics default to descending; a few metrics rank in date-range mode only, per the endpoint's documented orderable set). - `string? page` (query parameter) Opaque cursor from a previous response's `next_page` field. - `DateOnly? startingDate` (query parameter) UTC date in YYYY-MM-DD format. Start of a date range (inclusive). Enables rollup mode: one row per entity aggregated over the whole range — addable counters are summed across days, and a distinct count is never summed where summing could double-count (a field's range value is recomputed exactly over the window, approximate via HLL with typical error under 2%, null, or — for the creation-event counts, whose per-day values cannot overlap — a per-day sum that is itself exact; each field's own description says which). Use either `date` or `starting_date`, not both. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01. format: date #### Returns - `class AnalyticsSkillActivity` Per-skill activity data for a given day. - `required string? AttributedListPrice` List-price (rate-card) value of the member requests attributed to this skill, as a decimal string in the minor unit of `currency` (cents for USD), from Claude Code, Cowork, and Office Agent request-level attribution — the value of requests that involved the skill, not the skill's incremental cost. Unlike `estimated_overage_spend` this reflects usage value regardless of how it was funded — seat-covered usage counts — but it is undiscounted and does not tie to billed spend or the organization's spend reporting. claude.ai chat usage carries no request-level attribution and contributes nothing: the field is null on `chat` product rows and on `office_agent` product cuts dated before 2026-06-18 (the Office Agent attribution data-start), and on ungrouped rows it covers the Claude Code + Cowork + Office Agent share only (null when no attributable usage exists). Also null under the same conditions as `estimated_overage_spend` (spend reporting not enabled for this organization, `office_agent` product cuts before the 2026-06-18 data-start). "0" means attributable usage existed but none was attributed to this skill. Addable across days: date-range rollup mode returns the window's sum. On `group_by[]` and `filter[]` shapes both amounts can total below the ungrouped value for the same skill over the same date or range: spend attributed to a member–skill pair with no counted usage on that day is excluded from those cuts. - `required AnalyticsSkillChatMetrics ChatMetrics` Claude.ai activity metrics for a single skill on a given day. - `required long? DistinctConversationSkillUsedCount` Number of distinct conversations in which the skill was used. A skill counts as used only when it is explicitly activated — the model (or the user, via the skill's slash command) invokes it, reading its instructions into context as part of that activation. Skills that are merely installed or listed as available, or whose content reaches the context without an activation (preloaded, hook-injected, or read as a plain file), are not counted. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `required AnalyticsSkillClaudeCodeMetrics ClaudeCodeMetrics` Claude Code activity metrics for a single skill on a given day. - `required long? DistinctSessionSkillUsedCount` Number of distinct Claude Code sessions in which the skill was used. A skill counts as used only when it is explicitly activated — the model (or the user, via the skill's slash command) invokes it, reading its instructions into context as part of that activation. Skills that are merely installed or listed as available, or whose content reaches the context without an activation (preloaded, hook-injected, or read as a plain file), are not counted. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `required AnalyticsSkillCoworkMetrics CoworkMetrics` Cowork activity metrics for a single skill on a given day. - `required long? DistinctSessionSkillUsedCount` Number of distinct Cowork sessions in which the skill was used. A skill counts as used only when it is explicitly activated — the model (or the user, via the skill's slash command) invokes it, reading its instructions into context as part of that activation. Skills that are merely installed or listed as available, or whose content reaches the context without an activation (preloaded, hook-injected, or read as a plain file), are not counted. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `required string? Currency` Currency for this row's monetary fields (`estimated_overage_spend` and `attributed_list_price`), as an uppercase ISO-4217 code. Always "USD" when either amount is populated; null whenever both amounts are null. - `required long DistinctUserCount` Number of distinct users who used the skill on the requested day, or, in date-range mode, over the requested window — recomputed as an exact distinct count over the window's per-member daily rows, never a sum of per-day values. A skill counts as used only when it is explicitly activated — the model (or the user, via the skill's slash command) invokes it, reading its instructions into context as part of that activation. Skills that are merely installed or listed as available, or whose content reaches the context without an activation (preloaded, hook-injected, or read as a plain file), are not counted. - `required long? EnableCount` Distinct accounts that enabled this skill on the requested day (claude.ai only — the skill analog of plugin `install_count`). The count is org-wide: null when enable reporting is not enabled for this organization, or when the request scopes to `user_id` / `rbac_group_id` / `product` via `group_by[]` or `filter[]` (an org-wide count would be misleading on per-cut rows). A distinct count, not an event count: summing across days double-counts members who enable the skill on more than one day, so it is also null in date-range rollup mode (`starting_date`/`ending_date`). - `required string? EstimatedOverageSpend` Estimated overage spend attributed to this skill, as a decimal string in the minor unit of `currency` (cents for USD; "1250" is $12.50, fractional cents possible) — an allocation of each member's daily post-discount, pre-credit metered overage spend (the same cost basis as the organization's spend reporting and the Cost & Usage API, so per-skill figures are directly comparable; spend with no skill attribution — including any member-day without skill invocations — is not represented, so skill rows sum to at most those totals) across the skills the member used. Overage only: usage covered by included seat allowances bills nothing and allocates $0 here — see `attributed_list_price` for the funding-independent usage-value companion. Claude Code, Cowork, and Office Agent spend use request-level skill attribution; claude.ai chat spend is approximated proportionally to skill-invoking messages. An estimate, not a billing number — and the cost of the requests/messages that involved the skill, not the skill's incremental cost (the same request would still have cost something without the skill active). "0" means no overage spend was attributed; null when spend reporting is not enabled for this organization, on `office_agent` product cuts dated before 2026-06-18 (the Office Agent attribution data-start). Addable across days: date-range rollup mode (`starting_date`/`ending_date`) returns the window's sum. With `group_by[]=user_id` each row carries the user's own attributed spend. On `group_by[]` and `filter[]` shapes both amounts can total below the ungrouped value for the same skill over the same date or range: spend attributed to a member–skill pair with no counted usage on that day is excluded from those cuts. - `required long? InvocationCount` Total number of times this skill was invoked on the requested day (the skill analog of plugin `invocation_count`). Unlike `distinct_user_count` — which answers '\# of users' — this is the true '# of uses'. A skill counts as used only when it is explicitly activated — the model (or the user, via the skill's slash command) invokes it, reading its instructions into context as part of that activation. Skills that are merely installed or listed as available, or whose content reaches the context without an activation (preloaded, hook-injected, or read as a plain file), are not counted. Null when invocation reporting is not enabled for this organization. Sum across a date range for total uses in the window — date-range rollup mode (`starting_date`/`ending_date`) returns this sum directly. - `required AnalyticsSkillOfficeMetrics OfficeMetrics` Office Agent activity metrics for a single skill on a given day, broken out by Office product. - `required AnalyticsSkillOfficeProductMetrics Excel` Office Agent activity metrics for a single skill on a given day within one Office product. - `required long? DistinctSessionSkillUsedCount` Number of distinct Office Agent sessions in which the skill was used. A skill counts as used only when it is explicitly activated — the model (or the user, via the skill's slash command) invokes it, reading its instructions into context as part of that activation. Skills that are merely installed or listed as available, or whose content reaches the context without an activation (preloaded, hook-injected, or read as a plain file), are not counted. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `required AnalyticsSkillOfficeProductMetrics Outlook` Office Agent activity metrics for a single skill on a given day within one Office product. - `required AnalyticsSkillOfficeProductMetrics Powerpoint` Office Agent activity metrics for a single skill on a given day within one Office product. - `required AnalyticsSkillOfficeProductMetrics Word` Office Agent activity metrics for a single skill on a given day within one Office product. - `required ShareStatus? ShareStatus` Skill share status (claude.ai only): one of `private`, `organization`, or `public`. Null for skills used only in Claude Code or Office (no per-skill share-status concept) and when share-status reporting is not yet available for the organization. Filterable via `filter[]=share_status:{value}`. - `Organization("organization")` - `Private("private")` - `Public("public")` - `required string? SkillDisplayName` Human-readable display name for rows whose `skill_name` is an opaque skill id (user/organization skill types and plugin-delivered skills, whose user-defined names usage reports generally withhold). Organization-shared skills and skills delivered by the organization's own plugins (its plugin marketplaces and its library) resolve; plugin skill names are shown without their 'plugin:' prefix. The literal 'unknown' bucket row gets a fixed 'Unknown skill' label. For a member's own skill (private or personal-plugin) it is null, except when the skill's owner used it from Claude Code or Cowork in the requested period: then it shows the name that client reported at the time. Apart from that, the names of members' own skills are not disclosed to analytics-key holders. Also null for Anthropic-provided plugin skills (not resolved), for an organization skill or plugin whose name can no longer be found (for example, one since deleted), when `skill_name` is already a display name, or when display-name resolution is not enabled for this organization. - `required string SkillName` Name of the skill - `AnalyticsSkillChatCoworkUnifiedMetrics? ChatCoworkUnifiedMetrics` Skill use recorded while members had Chat and Cowork unified (Cowork's features inside claude.ai chat) turned on, split into chat conversations and Cowork sessions. A count is null in date-range mode where it cannot be computed. Omitted from the response on deployments that do not offer Chat and Cowork unified. - `required AnalyticsSkillChatCoworkUnifiedChatMetrics Chat` A skill's use in chat conversations recorded while members had Chat and Cowork unified turned on. - `required long? DistinctConversationSkillUsedCount` Same measure as `chat_metrics.distinct_conversation_skill_used_count`, for activity recorded while members had Chat and Cowork unified turned on. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `required AnalyticsSkillChatCoworkUnifiedSessionsMetrics Sessions` A skill's use in Cowork sessions recorded while members had Chat and Cowork unified turned on. - `required long? DistinctSessionSkillUsedCount` Same measure as `cowork_metrics.distinct_session_skill_used_count`, for activity recorded while members had Chat and Cowork unified turned on. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed. - `string? Product` Product that produced this row's activity: one of `chat`, `claude_code`, `cowork`, `office_agent`, or `chat_cowork_unified` (Chat and Cowork unified). These are the canonical Cost & Usage product names; an `office_agent` row's per-surface breakdown is in its `office_metrics`. On `/plugins` only `cowork`, `claude_code` and `chat_cowork_unified` occur (the only surfaces with plugin attribution); on `/artifacts` only `chat`, `claude_code`, `cowork` and `chat_cowork_unified` occur (the surfaces that create artifacts); `/apps/chat/projects` does not support the product dimension (a `product` entry in `group_by[]` or `filter[]` there is rejected). Present only when the request grouped by `product`. - `string? RbacGroupID` Tagged RBAC group identifier (`rbac_group_...`), matching the spend-limits API spelling. Present only when the request grouped by `rbac_group_id`. - `string? RbacGroupName` Resolved RBAC group display name, alongside `rbac_group_id` when name resolution is available. Null if the group has been deleted or its name could not be resolved; `rbac_group_id` remains the stable key. - `string? UserID` Tagged user identifier (e.g. `user_...`). Present only when the request grouped by `user_id`. #### Example ```csharp using System; using Anthropic.Models.Organization.Analytics.Skills; SkillListParams parameters = new(); var page = await client.Organization.Analytics.Skills.List(parameters); await foreach (var item in page.Paginate()) { Console.WriteLine(item); } ``` ##### Response (200) ```json { "data": [ { "attributed_list_price": "attributed_list_price", "chat_metrics": { "distinct_conversation_skill_used_count": 0 }, "claude_code_metrics": { "distinct_session_skill_used_count": 0 }, "cowork_metrics": { "distinct_session_skill_used_count": 0 }, "currency": "currency", "distinct_user_count": 0, "enable_count": 0, "estimated_overage_spend": "estimated_overage_spend", "invocation_count": 0, "office_metrics": { "excel": { "distinct_session_skill_used_count": 0 }, "outlook": { "distinct_session_skill_used_count": 0 }, "powerpoint": { "distinct_session_skill_used_count": 0 }, "word": { "distinct_session_skill_used_count": 0 } }, "share_status": "organization", "skill_display_name": "skill_display_name", "skill_name": "skill_name", "chat_cowork_unified_metrics": { "chat": { "distinct_conversation_skill_used_count": 0 }, "sessions": { "distinct_session_skill_used_count": 0 } }, "product": "product", "rbac_group_id": "rbac_group_id", "rbac_group_name": "rbac_group_name", "user_id": "user_id" } ], "next_page": "next_page" } ``` ## Organization › Analytics › Artifacts ### Get Artifact Activity `ArtifactListPage Organization.Analytics.Artifacts.List(parameters, cancellationToken = default)` **GET** `/v1/organizations/analytics/artifacts` Get artifact-creation activity for a given day, broken out by MIME type. Returns the full (`artifact_type`, `is_shared`) cube for the organization; `next_page` is null except for grouped queries, which paginate. The cube can be broken out per product, per member, or per RBAC group via `group_by[]`, and scoped via `filter[]`. Requires an API key with the `read:analytics` scope. #### Parameters - `ArtifactListParams parameters` - `required DateOnly date` (query parameter) UTC date in YYYY-MM-DD format. The day to get artifact activity for. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01. format: date - `IReadOnlyList? filter` (query parameter) Filters as `dimension:value`, e.g. `filter[]=rbac_group_id:{id}`. Repeat the param for OR within a dimension and across dimensions for AND. Supported dimensions on this endpoint: `artifact_type`, `is_shared`, `product`, `rbac_group_id`, `user_id`. Value forms: `artifact_type` is a canonical artifact MIME type (e.g. `text/markdown`) or `other`; `is_shared` is `true` or `false`; `product` is `chat_cowork_unified`, `chat`, `claude_code`, or `cowork` (the surfaces that create artifacts); `rbac_group_id` takes the tagged id (`rbac_group_...`, as emitted in responses and by the spend-limits API) or a bare group UUID, and matches users who held the group at any point during each covered UTC day (time-of-usage attribution); `user_id` takes a tagged user id (`user_...`), as emitted in responses. An unsupported dimension returns 400. At most 100 entries. `chat_cowork_unified` is accepted as a `product` value only on deployments that offer Chat and Cowork unified. maxItems: 100 - `IReadOnlyList? groupBy` (query parameter) Dimensions to break results out by: `product`, `user_id` and/or `rbac_group_id`. The ungrouped artifact-type cube is finite and returned in full; grouped queries multiply the cube and paginate via `next_page`. `product` takes the values `chat_cowork_unified`, `chat`, `claude_code`, or `cowork` (the surfaces that create artifacts). `rbac_group_id` attributes a user to every group they held at any point during the requested UTC day, so grouped rows are not an exclusive partition. At most 100 entries. maxItems: 100 - `Product("product")` - `RbacGroupID("rbac_group_id")` - `UserID("user_id")` - `long? limit` (query parameter) Maximum rows to return (1-1000, default 100). The ungrouped artifact-type cube is finite and returned in full; `limit` is the page size only when `group_by[]` multiplies the cube. minimum: 1, maximum: 1000 - `string? page` (query parameter) Opaque cursor from a previous response's `next_page` field. Only valid with `group_by[]` — the ungrouped cube is never paginated. #### Returns - `class AnalyticsArtifactActivity` Artifact-creation activity for one (`artifact_type`, `is_shared`) bucket on a given day. Artifacts form a small finite cube — the canonical MIME type (8 values incl. `other`) crossed with shared-vs-private — so the response is the full set of non-empty buckets, not a ranked/paginated list. Claude Code and Cowork artifacts report under `text/html` and are counted from 2026-08-17 onward; earlier days contain claude.ai chat artifacts only. With `group_by[]=product` / `user_id` / `rbac_group_id` each row is further split by the flat group keys and counts are scoped to that cut. - `required string ArtifactType` Canonical artifact MIME type (e.g. `text/markdown`, `application/vnd.ant.react`, `image/svg+xml`), or `other`. Claude Code and Cowork artifacts report as `text/html`. - `required long ArtifactsCreatedCount` Number of artifacts created in this bucket on the requested day - `required long DistinctUserCount` Number of distinct users who created artifacts in this bucket on the requested day - `required bool IsShared` Whether the artifacts in this bucket have ever been shared (a Claude Code / Cowork artifact is shared once anyone beyond its creator may open it: named members, the whole organization, or anyone with the link). - `required long PublishedArtifactsCreatedCount` Number of those artifacts that have been published (for Claude Code / Cowork artifacts: open to anyone with the link); never exceeds `artifacts_created_count` - `string? Product` Product that produced this row's activity: one of `chat`, `claude_code`, `cowork`, `office_agent`, or `chat_cowork_unified` (Chat and Cowork unified). These are the canonical Cost & Usage product names; an `office_agent` row's per-surface breakdown is in its `office_metrics`. On `/plugins` only `cowork`, `claude_code` and `chat_cowork_unified` occur (the only surfaces with plugin attribution); on `/artifacts` only `chat`, `claude_code`, `cowork` and `chat_cowork_unified` occur (the surfaces that create artifacts); `/apps/chat/projects` does not support the product dimension (a `product` entry in `group_by[]` or `filter[]` there is rejected). Present only when the request grouped by `product`. - `string? RbacGroupID` Tagged RBAC group identifier (`rbac_group_...`), matching the spend-limits API spelling. Present only when the request grouped by `rbac_group_id`. - `string? RbacGroupName` Resolved RBAC group display name, alongside `rbac_group_id` when name resolution is available. Null if the group has been deleted or its name could not be resolved; `rbac_group_id` remains the stable key. - `string? UserID` Tagged user identifier (e.g. `user_...`). Present only when the request grouped by `user_id`. #### Example ```csharp using System; using Anthropic.Models.Organization.Analytics.Artifacts; ArtifactListParams parameters = new() { Date = "2019-12-27" }; var page = await client.Organization.Analytics.Artifacts.List(parameters); await foreach (var item in page.Paginate()) { Console.WriteLine(item); } ``` ##### Response (200) ```json { "data": [ { "artifact_type": "artifact_type", "artifacts_created_count": 0, "distinct_user_count": 0, "is_shared": true, "published_artifacts_created_count": 0, "product": "product", "rbac_group_id": "rbac_group_id", "rbac_group_name": "rbac_group_name", "user_id": "user_id" } ], "next_page": "next_page" } ``` ## Organization › Spend Limits › Effective ### List Effective Spend Limits `EffectiveListPage Organization.SpendLimits.Effective.List(parameters, cancellationToken = default)` **GET** `/v1/organizations/spend_limits/effective` List each member's effective spend limit and period-to-date spend. Returns one row per (member, period) the member resolves a spend limit for, with the `source` scope the spend limit was inherited from. Paginates by member, so a member's periods never split across pages. Supported for Claude Enterprise organizations only, not for Claude Console organizations. #### Parameters - `EffectiveListParams parameters` - `long limit` (query parameter) Maximum number of members per page. A member's period rows never split across pages, so a page may carry more rows than this. Defaults to `20`. minimum: 1, maximum: 1000 - `string? page` (query parameter) Opaque cursor from a previous response's `next_page` field. - `IReadOnlyList? period` (query parameter) Restrict the report to these limit periods. Omit to return one row per period each member resolves a spend limit for. maxItems: 3 - `Daily("daily")` - `Monthly("monthly")` - `Weekly("weekly")` - `IReadOnlyList? userIds` (query parameter) Restrict the report to these members, by tagged user ID (`user_...`). At most 100 entries. maxItems: 100 #### Returns - `class SpendSummary` Per-member effective-limit report row (`GET /spend_limits/effective`). - `required Actor Actor` - `class SpendLimitUserActor` A user within the organization. `name` and `email_address` are null when the underlying account is unavailable or has been deleted; `deleted` is true only for deleted accounts. - `JsonElement Type = "user_actor"` Actor type. Always `user_actor`. - `required bool Deleted` True only when the underlying account has been deleted. - `required string? EmailAddress` The user's email address. Null when the account is unavailable or has been deleted. - `required string? Name` The user's current display name. Null when the account is unavailable, has been deleted, or has no name set. - `required string UserID` Tagged ID of the user. - `class SpendLimitScopedApiKeyActor` A scoped Admin API key acting on behalf of the organization. - `JsonElement Type = "scoped_api_key_actor"` - `required string ScopedApiKeyID` - `required string? Amount` Effective limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD). `null` means no limit applies for this row's `period` — each period resolves independently, so another period may still cap this member. - `required string Currency` ISO 4217 code of the organization's billing currency; the unit for `amount` and `period_to_date_spend`. - `required SpendLimitPeriod Period` Period this row's effective limit and spend are reported for. - `Daily("daily")` - `Monthly("monthly")` - `Weekly("weekly")` - `required string PeriodToDateSpend` The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable. - `required Scope Scope` - `class SpendLimitUserScope` Scope selecting a single member of the organization. - `JsonElement Type = "user"` Scope type. Always `user` for this scope. - `required string UserID` Tagged ID of the member the spend limit applies to. - `class SpendLimitSeatTierScope` - `JsonElement Type = "seat_tier"` - `required string SeatTier` - `class SpendLimitRbacGroupScope` - `JsonElement Type = "rbac_group"` - `required string RbacGroupID` - `class SpendLimitOrganizationServiceScope` - `JsonElement Type = "organization_service"` - `required string Service` - `class SpendLimitOrganizationScope` - `JsonElement Type = "organization"` - `class SpendLimitWorkspaceScope` Scope selecting one workspace of a Claude Console organization. - `JsonElement Type = "workspace"` Scope type. Always `workspace` for this scope. - `required string WorkspaceID` Tagged ID of the workspace the spend limit applies to. - `class SpendLimitUsageTierScope` Scope of the monthly spend cap Anthropic sets for a Claude Console organization from its usage tier, or a higher cap Anthropic granted the organization. Read-only; its `created_at` and `updated_at` are the organization's creation time, so `amount` can change while `updated_at` stays the same. - `JsonElement Type = "usage_tier"` Scope type. Always `usage_tier` for this scope. - `required Source Source` - `class SpendLimitUserScope` Scope selecting a single member of the organization. - `class SpendLimitSeatTierScope` - `class SpendLimitRbacGroupScope` - `class SpendLimitOrganizationServiceScope` - `class SpendLimitOrganizationScope` - `class SpendLimitWorkspaceScope` Scope selecting one workspace of a Claude Console organization. - `class SpendLimitUsageTierScope` Scope of the monthly spend cap Anthropic sets for a Claude Console organization from its usage tier, or a higher cap Anthropic granted the organization. Read-only; its `created_at` and `updated_at` are the organization's creation time, so `amount` can change while `updated_at` stays the same. - `required string SpendLimitID` #### Example ```csharp using System; using Anthropic.Models.Organization.SpendLimits.Effective; EffectiveListParams parameters = new(); var page = await client.Organization.SpendLimits.Effective.List(parameters); await foreach (var item in page.Paginate()) { Console.WriteLine(item); } ``` ##### Response (200) ```json { "data": [ { "actor": { "deleted": true, "email_address": "email_address", "name": "name", "type": "user_actor", "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu" }, "amount": "50000", "currency": "USD", "period": "daily", "period_to_date_spend": "12050.5", "scope": { "type": "user", "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu" }, "source": { "type": "user", "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu" }, "spend_limit_id": "spend_limit_id" } ], "next_page": "next_page" } ``` ## Organization › Spend Limits › Increase Requests ### List Spend Limit Increase Requests `IncreaseRequestListPage Organization.SpendLimits.IncreaseRequests.List(parameters, cancellationToken = default)` **GET** `/v1/organizations/spend_limit_increase_requests` List spend limit increase requests, most recent first. Pending requests include a live `spend_summary` for the requester. Requests whose requester is no longer a member are excluded. #### Parameters - `IncreaseRequestListParams parameters` - `IReadOnlyList? actorIds` (query parameter) Filter by requester, as `user_...` tagged IDs. - `long limit` (query parameter) minimum: 1, maximum: 1000 - `string? page` (query parameter) Opaque cursor from a previous response's `next_page`. - `IReadOnlyList? status` (query parameter) Filter by status. Omit to return all. - `Approved("approved")` - `Denied("denied")` - `Pending("pending")` #### Returns - `class SpendLimitIncreaseRequest` - `JsonElement Type = "spend_limit_increase_request"` - `required string ID` - `required SpendLimitIncreaseRequestActor Actor` Who submitted the increase request. - `class SpendLimitUserActor` A user within the organization. `name` and `email_address` are null when the underlying account is unavailable or has been deleted; `deleted` is true only for deleted accounts. - `JsonElement Type = "user_actor"` Actor type. Always `user_actor`. - `required bool Deleted` True only when the underlying account has been deleted. - `required string? EmailAddress` The user's email address. Null when the account is unavailable or has been deleted. - `required string? Name` The user's current display name. Null when the account is unavailable, has been deleted, or has no name set. - `required string UserID` Tagged ID of the user. - `class SpendLimitScopedApiKeyActor` A scoped Admin API key acting on behalf of the organization. - `JsonElement Type = "scoped_api_key_actor"` - `required string ScopedApiKeyID` - `required DateTimeOffset CreatedAt` format: date-time - `required SpendLimitPeriod Period` - `Daily("daily")` - `Monthly("monthly")` - `Weekly("weekly")` - `required DateTimeOffset? ResolvedAt` format: date-time - `required SpendLimitIncreaseRequestResolvedBy? ResolvedBy` Who approved or denied the increase request. - `class SpendLimitUserActor` A user within the organization. `name` and `email_address` are null when the underlying account is unavailable or has been deleted; `deleted` is true only for deleted accounts. - `class SpendLimitScopedApiKeyActor` A scoped Admin API key acting on behalf of the organization. - `required SpendSummary? SpendSummary` Per-member effective-limit report row (`GET /spend_limits/effective`). - `required Actor Actor` - `class SpendLimitUserActor` A user within the organization. `name` and `email_address` are null when the underlying account is unavailable or has been deleted; `deleted` is true only for deleted accounts. - `class SpendLimitScopedApiKeyActor` A scoped Admin API key acting on behalf of the organization. - `required string? Amount` Effective limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD). `null` means no limit applies for this row's `period` — each period resolves independently, so another period may still cap this member. - `required string Currency` ISO 4217 code of the organization's billing currency; the unit for `amount` and `period_to_date_spend`. - `required SpendLimitPeriod Period` Period this row's effective limit and spend are reported for. - `required string PeriodToDateSpend` The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable. - `required Scope Scope` - `class SpendLimitUserScope` Scope selecting a single member of the organization. - `JsonElement Type = "user"` Scope type. Always `user` for this scope. - `required string UserID` Tagged ID of the member the spend limit applies to. - `class SpendLimitSeatTierScope` - `JsonElement Type = "seat_tier"` - `required string SeatTier` - `class SpendLimitRbacGroupScope` - `JsonElement Type = "rbac_group"` - `required string RbacGroupID` - `class SpendLimitOrganizationServiceScope` - `JsonElement Type = "organization_service"` - `required string Service` - `class SpendLimitOrganizationScope` - `JsonElement Type = "organization"` - `class SpendLimitWorkspaceScope` Scope selecting one workspace of a Claude Console organization. - `JsonElement Type = "workspace"` Scope type. Always `workspace` for this scope. - `required string WorkspaceID` Tagged ID of the workspace the spend limit applies to. - `class SpendLimitUsageTierScope` Scope of the monthly spend cap Anthropic sets for a Claude Console organization from its usage tier, or a higher cap Anthropic granted the organization. Read-only; its `created_at` and `updated_at` are the organization's creation time, so `amount` can change while `updated_at` stays the same. - `JsonElement Type = "usage_tier"` Scope type. Always `usage_tier` for this scope. - `required Source Source` - `class SpendLimitUserScope` Scope selecting a single member of the organization. - `class SpendLimitSeatTierScope` - `class SpendLimitRbacGroupScope` - `class SpendLimitOrganizationServiceScope` - `class SpendLimitOrganizationScope` - `class SpendLimitWorkspaceScope` Scope selecting one workspace of a Claude Console organization. - `class SpendLimitUsageTierScope` Scope of the monthly spend cap Anthropic sets for a Claude Console organization from its usage tier, or a higher cap Anthropic granted the organization. Read-only; its `created_at` and `updated_at` are the organization's creation time, so `amount` can change while `updated_at` stays the same. - `required string SpendLimitID` - `required SpendLimitIncreaseRequestStatus Status` - `Approved("approved")` - `Denied("denied")` - `Pending("pending")` #### Example ```csharp using System; using Anthropic.Models.Organization.SpendLimits.IncreaseRequests; IncreaseRequestListParams parameters = new(); var page = await client.Organization.SpendLimits.IncreaseRequests.List(parameters); await foreach (var item in page.Paginate()) { Console.WriteLine(item); } ``` ##### Response (200) ```json { "data": [ { "id": "id", "actor": { "deleted": true, "email_address": "email_address", "name": "name", "type": "user_actor", "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu" }, "created_at": "2019-12-27T18:11:19.117Z", "period": "daily", "resolved_at": "2019-12-27T18:11:19.117Z", "resolved_by": { "deleted": true, "email_address": "email_address", "name": "name", "type": "user_actor", "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu" }, "spend_summary": { "actor": { "deleted": true, "email_address": "email_address", "name": "name", "type": "user_actor", "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu" }, "amount": "50000", "currency": "USD", "period": "daily", "period_to_date_spend": "12050.5", "scope": { "type": "user", "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu" }, "source": { "type": "user", "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu" }, "spend_limit_id": "spend_limit_id" }, "status": "approved", "type": "spend_limit_increase_request" } ], "next_page": "next_page" } ``` ### Get Spend Limit Increase Request `SpendLimitIncreaseRequest Organization.SpendLimits.IncreaseRequests.Retrieve(parameters, cancellationToken = default)` **GET** `/v1/organizations/spend_limit_increase_requests/{spend_limit_increase_request_id}` Retrieve a spend limit increase request. While `pending`, the response includes a live `spend_summary` for the requester at the request's period. #### Parameters - `IncreaseRequestRetrieveParams parameters` - `required string spendLimitIncreaseRequestID` (path parameter) ID of the spend limit increase request. #### Returns - `class SpendLimitIncreaseRequest` - `JsonElement Type = "spend_limit_increase_request"` - `required string ID` - `required SpendLimitIncreaseRequestActor Actor` Who submitted the increase request. - `class SpendLimitUserActor` A user within the organization. `name` and `email_address` are null when the underlying account is unavailable or has been deleted; `deleted` is true only for deleted accounts. - `JsonElement Type = "user_actor"` Actor type. Always `user_actor`. - `required bool Deleted` True only when the underlying account has been deleted. - `required string? EmailAddress` The user's email address. Null when the account is unavailable or has been deleted. - `required string? Name` The user's current display name. Null when the account is unavailable, has been deleted, or has no name set. - `required string UserID` Tagged ID of the user. - `class SpendLimitScopedApiKeyActor` A scoped Admin API key acting on behalf of the organization. - `JsonElement Type = "scoped_api_key_actor"` - `required string ScopedApiKeyID` - `required DateTimeOffset CreatedAt` format: date-time - `required SpendLimitPeriod Period` - `Daily("daily")` - `Monthly("monthly")` - `Weekly("weekly")` - `required DateTimeOffset? ResolvedAt` format: date-time - `required SpendLimitIncreaseRequestResolvedBy? ResolvedBy` Who approved or denied the increase request. - `class SpendLimitUserActor` A user within the organization. `name` and `email_address` are null when the underlying account is unavailable or has been deleted; `deleted` is true only for deleted accounts. - `class SpendLimitScopedApiKeyActor` A scoped Admin API key acting on behalf of the organization. - `required SpendSummary? SpendSummary` Per-member effective-limit report row (`GET /spend_limits/effective`). - `required Actor Actor` - `class SpendLimitUserActor` A user within the organization. `name` and `email_address` are null when the underlying account is unavailable or has been deleted; `deleted` is true only for deleted accounts. - `class SpendLimitScopedApiKeyActor` A scoped Admin API key acting on behalf of the organization. - `required string? Amount` Effective limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD). `null` means no limit applies for this row's `period` — each period resolves independently, so another period may still cap this member. - `required string Currency` ISO 4217 code of the organization's billing currency; the unit for `amount` and `period_to_date_spend`. - `required SpendLimitPeriod Period` Period this row's effective limit and spend are reported for. - `required string PeriodToDateSpend` The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable. - `required Scope Scope` - `class SpendLimitUserScope` Scope selecting a single member of the organization. - `JsonElement Type = "user"` Scope type. Always `user` for this scope. - `required string UserID` Tagged ID of the member the spend limit applies to. - `class SpendLimitSeatTierScope` - `JsonElement Type = "seat_tier"` - `required string SeatTier` - `class SpendLimitRbacGroupScope` - `JsonElement Type = "rbac_group"` - `required string RbacGroupID` - `class SpendLimitOrganizationServiceScope` - `JsonElement Type = "organization_service"` - `required string Service` - `class SpendLimitOrganizationScope` - `JsonElement Type = "organization"` - `class SpendLimitWorkspaceScope` Scope selecting one workspace of a Claude Console organization. - `JsonElement Type = "workspace"` Scope type. Always `workspace` for this scope. - `required string WorkspaceID` Tagged ID of the workspace the spend limit applies to. - `class SpendLimitUsageTierScope` Scope of the monthly spend cap Anthropic sets for a Claude Console organization from its usage tier, or a higher cap Anthropic granted the organization. Read-only; its `created_at` and `updated_at` are the organization's creation time, so `amount` can change while `updated_at` stays the same. - `JsonElement Type = "usage_tier"` Scope type. Always `usage_tier` for this scope. - `required Source Source` - `class SpendLimitUserScope` Scope selecting a single member of the organization. - `class SpendLimitSeatTierScope` - `class SpendLimitRbacGroupScope` - `class SpendLimitOrganizationServiceScope` - `class SpendLimitOrganizationScope` - `class SpendLimitWorkspaceScope` Scope selecting one workspace of a Claude Console organization. - `class SpendLimitUsageTierScope` Scope of the monthly spend cap Anthropic sets for a Claude Console organization from its usage tier, or a higher cap Anthropic granted the organization. Read-only; its `created_at` and `updated_at` are the organization's creation time, so `amount` can change while `updated_at` stays the same. - `required string SpendLimitID` - `required SpendLimitIncreaseRequestStatus Status` - `Approved("approved")` - `Denied("denied")` - `Pending("pending")` #### Example ```csharp using System; using Anthropic.Models.Organization.SpendLimits.IncreaseRequests; IncreaseRequestRetrieveParams parameters = new() { SpendLimitIncreaseRequestID = "spend_limit_increase_request_id" }; var spendLimitIncreaseRequest = await client.Organization.SpendLimits.IncreaseRequests.Retrieve(parameters); Console.WriteLine(spendLimitIncreaseRequest); ``` ##### Response (200) ```json { "id": "id", "actor": { "deleted": true, "email_address": "email_address", "name": "name", "type": "user_actor", "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu" }, "created_at": "2019-12-27T18:11:19.117Z", "period": "daily", "resolved_at": "2019-12-27T18:11:19.117Z", "resolved_by": { "deleted": true, "email_address": "email_address", "name": "name", "type": "user_actor", "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu" }, "spend_summary": { "actor": { "deleted": true, "email_address": "email_address", "name": "name", "type": "user_actor", "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu" }, "amount": "50000", "currency": "USD", "period": "daily", "period_to_date_spend": "12050.5", "scope": { "type": "user", "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu" }, "source": { "type": "user", "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu" }, "spend_limit_id": "spend_limit_id" }, "status": "approved", "type": "spend_limit_increase_request" } ``` ### Approve Spend Limit Increase Request `IncreaseRequestApproveResponse Organization.SpendLimits.IncreaseRequests.Approve(parameters, cancellationToken = default)` **POST** `/v1/organizations/spend_limit_increase_requests/{spend_limit_increase_request_id}/approve` Approve a pending spend limit increase request. Writes a per-user spend limit at `amount` for the requester and transitions the request to `approved`. `period` defaults to the period the member was blocked on. Anthropic emails the requester unless `suppress_notification` is set. #### Parameters - `IncreaseRequestApproveParams parameters` - `required string spendLimitIncreaseRequestID` (path parameter) ID of the spend limit increase request. - `required string amount` New per-user spend limit as a non-negative integer decimal string (minor units). - `SpendLimitPeriod? period` - `bool suppressNotification` #### Returns - `class IncreaseRequestApproveResponse` - `JsonElement Type = "spend_limit_increase_request"` - `required string ID` - `required SpendLimitIncreaseRequestActor Actor` Who submitted the increase request. - `class SpendLimitUserActor` A user within the organization. `name` and `email_address` are null when the underlying account is unavailable or has been deleted; `deleted` is true only for deleted accounts. - `JsonElement Type = "user_actor"` Actor type. Always `user_actor`. - `required bool Deleted` True only when the underlying account has been deleted. - `required string? EmailAddress` The user's email address. Null when the account is unavailable or has been deleted. - `required string? Name` The user's current display name. Null when the account is unavailable, has been deleted, or has no name set. - `required string UserID` Tagged ID of the user. - `class SpendLimitScopedApiKeyActor` A scoped Admin API key acting on behalf of the organization. - `JsonElement Type = "scoped_api_key_actor"` - `required string ScopedApiKeyID` - `required DateTimeOffset CreatedAt` format: date-time - `required SpendLimitPeriod Period` - `Daily("daily")` - `Monthly("monthly")` - `Weekly("weekly")` - `required DateTimeOffset? ResolvedAt` format: date-time - `required SpendLimitIncreaseRequestResolvedBy? ResolvedBy` Who approved or denied the increase request. - `class SpendLimitUserActor` A user within the organization. `name` and `email_address` are null when the underlying account is unavailable or has been deleted; `deleted` is true only for deleted accounts. - `class SpendLimitScopedApiKeyActor` A scoped Admin API key acting on behalf of the organization. - `required SpendLimit? SpendLimit` A configured spend limit: a cap on metered spend for one scope and period. - `JsonElement Type = "spend_limit"` Object type. Always `spend_limit`. - `required string ID` Unique tagged ID of the spend limit (`spl_...`). - `required string? Amount` Limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD): "50000" is $500.00. `null` means no numeric cap is configured at this scope — see the effective report for whether a limit applies. - `required DateTimeOffset CreatedAt` RFC 3339 datetime at which the spend limit was created. format: date-time - `required string Currency` ISO 4217 code of the organization's billing currency; the unit for `amount`. - `required bool IsEnabled` Read-only. `false` when extra usage is switched off for this organization (`organization` limit); `amount` is kept and applies again when it's switched back on. Always `true` for other limits. - `required SpendLimitPeriod Period` Length of the window the limit resets over. `amount` caps spend within each period. - `required Scope Scope` What the limit applies to. A tagged union on `type`; each variant carries the identifier for its scope. - `class SpendLimitUserScope` Scope selecting a single member of the organization. - `JsonElement Type = "user"` Scope type. Always `user` for this scope. - `required string UserID` Tagged ID of the member the spend limit applies to. - `class SpendLimitSeatTierScope` - `JsonElement Type = "seat_tier"` - `required string SeatTier` - `class SpendLimitRbacGroupScope` - `JsonElement Type = "rbac_group"` - `required string RbacGroupID` - `class SpendLimitOrganizationServiceScope` - `JsonElement Type = "organization_service"` - `required string Service` - `class SpendLimitOrganizationScope` - `JsonElement Type = "organization"` - `class SpendLimitWorkspaceScope` Scope selecting one workspace of a Claude Console organization. - `JsonElement Type = "workspace"` Scope type. Always `workspace` for this scope. - `required string WorkspaceID` Tagged ID of the workspace the spend limit applies to. - `class SpendLimitUsageTierScope` Scope of the monthly spend cap Anthropic sets for a Claude Console organization from its usage tier, or a higher cap Anthropic granted the organization. Read-only; its `created_at` and `updated_at` are the organization's creation time, so `amount` can change while `updated_at` stays the same. - `JsonElement Type = "usage_tier"` Scope type. Always `usage_tier` for this scope. - `required DateTimeOffset UpdatedAt` RFC 3339 datetime at which the spend limit was last modified. format: date-time - `required SpendSummary? SpendSummary` Per-member effective-limit report row (`GET /spend_limits/effective`). - `required Actor Actor` - `class SpendLimitUserActor` A user within the organization. `name` and `email_address` are null when the underlying account is unavailable or has been deleted; `deleted` is true only for deleted accounts. - `class SpendLimitScopedApiKeyActor` A scoped Admin API key acting on behalf of the organization. - `required string? Amount` Effective limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD). `null` means no limit applies for this row's `period` — each period resolves independently, so another period may still cap this member. - `required string Currency` ISO 4217 code of the organization's billing currency; the unit for `amount` and `period_to_date_spend`. - `required SpendLimitPeriod Period` Period this row's effective limit and spend are reported for. - `required string PeriodToDateSpend` The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable. - `required Scope Scope` - `class SpendLimitUserScope` Scope selecting a single member of the organization. - `class SpendLimitSeatTierScope` - `class SpendLimitRbacGroupScope` - `class SpendLimitOrganizationServiceScope` - `class SpendLimitOrganizationScope` - `class SpendLimitWorkspaceScope` Scope selecting one workspace of a Claude Console organization. - `class SpendLimitUsageTierScope` Scope of the monthly spend cap Anthropic sets for a Claude Console organization from its usage tier, or a higher cap Anthropic granted the organization. Read-only; its `created_at` and `updated_at` are the organization's creation time, so `amount` can change while `updated_at` stays the same. - `required Source Source` - `class SpendLimitUserScope` Scope selecting a single member of the organization. - `class SpendLimitSeatTierScope` - `class SpendLimitRbacGroupScope` - `class SpendLimitOrganizationServiceScope` - `class SpendLimitOrganizationScope` - `class SpendLimitWorkspaceScope` Scope selecting one workspace of a Claude Console organization. - `class SpendLimitUsageTierScope` Scope of the monthly spend cap Anthropic sets for a Claude Console organization from its usage tier, or a higher cap Anthropic granted the organization. Read-only; its `created_at` and `updated_at` are the organization's creation time, so `amount` can change while `updated_at` stays the same. - `required string SpendLimitID` - `required SpendLimitIncreaseRequestStatus Status` - `Approved("approved")` - `Denied("denied")` - `Pending("pending")` #### Example ```csharp using System; using Anthropic.Models.Organization.SpendLimits.IncreaseRequests; IncreaseRequestApproveParams parameters = new() { SpendLimitIncreaseRequestID = "spend_limit_increase_request_id", Amount = "50000", }; var response = await client.Organization.SpendLimits.IncreaseRequests.Approve(parameters); Console.WriteLine(response); ``` ##### Response (200) ```json { "id": "id", "actor": { "deleted": true, "email_address": "email_address", "name": "name", "type": "user_actor", "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu" }, "created_at": "2019-12-27T18:11:19.117Z", "period": "daily", "resolved_at": "2019-12-27T18:11:19.117Z", "resolved_by": { "deleted": true, "email_address": "email_address", "name": "name", "type": "user_actor", "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu" }, "spend_limit": { "id": "id", "amount": "50000", "created_at": "2019-12-27T18:11:19.117Z", "currency": "USD", "is_enabled": true, "period": "daily", "scope": { "type": "user", "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu" }, "type": "spend_limit", "updated_at": "2019-12-27T18:11:19.117Z" }, "spend_summary": { "actor": { "deleted": true, "email_address": "email_address", "name": "name", "type": "user_actor", "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu" }, "amount": "50000", "currency": "USD", "period": "daily", "period_to_date_spend": "12050.5", "scope": { "type": "user", "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu" }, "source": { "type": "user", "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu" }, "spend_limit_id": "spend_limit_id" }, "status": "approved", "type": "spend_limit_increase_request" } ``` ### Deny Spend Limit Increase Request `SpendLimitIncreaseRequest Organization.SpendLimits.IncreaseRequests.Deny(parameters, cancellationToken = default)` **POST** `/v1/organizations/spend_limit_increase_requests/{spend_limit_increase_request_id}/deny` Deny a pending spend limit increase request. Idempotent on `denied`; denying an already-`approved` request returns 400. Anthropic emails the requester unless `suppress_notification` is set. #### Parameters - `IncreaseRequestDenyParams parameters` - `required string spendLimitIncreaseRequestID` (path parameter) ID of the spend limit increase request. - `bool suppressNotification` #### Returns - `class SpendLimitIncreaseRequest` - `JsonElement Type = "spend_limit_increase_request"` - `required string ID` - `required SpendLimitIncreaseRequestActor Actor` Who submitted the increase request. - `class SpendLimitUserActor` A user within the organization. `name` and `email_address` are null when the underlying account is unavailable or has been deleted; `deleted` is true only for deleted accounts. - `JsonElement Type = "user_actor"` Actor type. Always `user_actor`. - `required bool Deleted` True only when the underlying account has been deleted. - `required string? EmailAddress` The user's email address. Null when the account is unavailable or has been deleted. - `required string? Name` The user's current display name. Null when the account is unavailable, has been deleted, or has no name set. - `required string UserID` Tagged ID of the user. - `class SpendLimitScopedApiKeyActor` A scoped Admin API key acting on behalf of the organization. - `JsonElement Type = "scoped_api_key_actor"` - `required string ScopedApiKeyID` - `required DateTimeOffset CreatedAt` format: date-time - `required SpendLimitPeriod Period` - `Daily("daily")` - `Monthly("monthly")` - `Weekly("weekly")` - `required DateTimeOffset? ResolvedAt` format: date-time - `required SpendLimitIncreaseRequestResolvedBy? ResolvedBy` Who approved or denied the increase request. - `class SpendLimitUserActor` A user within the organization. `name` and `email_address` are null when the underlying account is unavailable or has been deleted; `deleted` is true only for deleted accounts. - `class SpendLimitScopedApiKeyActor` A scoped Admin API key acting on behalf of the organization. - `required SpendSummary? SpendSummary` Per-member effective-limit report row (`GET /spend_limits/effective`). - `required Actor Actor` - `class SpendLimitUserActor` A user within the organization. `name` and `email_address` are null when the underlying account is unavailable or has been deleted; `deleted` is true only for deleted accounts. - `class SpendLimitScopedApiKeyActor` A scoped Admin API key acting on behalf of the organization. - `required string? Amount` Effective limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD). `null` means no limit applies for this row's `period` — each period resolves independently, so another period may still cap this member. - `required string Currency` ISO 4217 code of the organization's billing currency; the unit for `amount` and `period_to_date_spend`. - `required SpendLimitPeriod Period` Period this row's effective limit and spend are reported for. - `required string PeriodToDateSpend` The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable. - `required Scope Scope` - `class SpendLimitUserScope` Scope selecting a single member of the organization. - `JsonElement Type = "user"` Scope type. Always `user` for this scope. - `required string UserID` Tagged ID of the member the spend limit applies to. - `class SpendLimitSeatTierScope` - `JsonElement Type = "seat_tier"` - `required string SeatTier` - `class SpendLimitRbacGroupScope` - `JsonElement Type = "rbac_group"` - `required string RbacGroupID` - `class SpendLimitOrganizationServiceScope` - `JsonElement Type = "organization_service"` - `required string Service` - `class SpendLimitOrganizationScope` - `JsonElement Type = "organization"` - `class SpendLimitWorkspaceScope` Scope selecting one workspace of a Claude Console organization. - `JsonElement Type = "workspace"` Scope type. Always `workspace` for this scope. - `required string WorkspaceID` Tagged ID of the workspace the spend limit applies to. - `class SpendLimitUsageTierScope` Scope of the monthly spend cap Anthropic sets for a Claude Console organization from its usage tier, or a higher cap Anthropic granted the organization. Read-only; its `created_at` and `updated_at` are the organization's creation time, so `amount` can change while `updated_at` stays the same. - `JsonElement Type = "usage_tier"` Scope type. Always `usage_tier` for this scope. - `required Source Source` - `class SpendLimitUserScope` Scope selecting a single member of the organization. - `class SpendLimitSeatTierScope` - `class SpendLimitRbacGroupScope` - `class SpendLimitOrganizationServiceScope` - `class SpendLimitOrganizationScope` - `class SpendLimitWorkspaceScope` Scope selecting one workspace of a Claude Console organization. - `class SpendLimitUsageTierScope` Scope of the monthly spend cap Anthropic sets for a Claude Console organization from its usage tier, or a higher cap Anthropic granted the organization. Read-only; its `created_at` and `updated_at` are the organization's creation time, so `amount` can change while `updated_at` stays the same. - `required string SpendLimitID` - `required SpendLimitIncreaseRequestStatus Status` - `Approved("approved")` - `Denied("denied")` - `Pending("pending")` #### Example ```csharp using System; using Anthropic.Models.Organization.SpendLimits.IncreaseRequests; IncreaseRequestDenyParams parameters = new() { SpendLimitIncreaseRequestID = "spend_limit_increase_request_id" }; var spendLimitIncreaseRequest = await client.Organization.SpendLimits.IncreaseRequests.Deny(parameters); Console.WriteLine(spendLimitIncreaseRequest); ``` ##### Response (200) ```json { "id": "id", "actor": { "deleted": true, "email_address": "email_address", "name": "name", "type": "user_actor", "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu" }, "created_at": "2019-12-27T18:11:19.117Z", "period": "daily", "resolved_at": "2019-12-27T18:11:19.117Z", "resolved_by": { "deleted": true, "email_address": "email_address", "name": "name", "type": "user_actor", "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu" }, "spend_summary": { "actor": { "deleted": true, "email_address": "email_address", "name": "name", "type": "user_actor", "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu" }, "amount": "50000", "currency": "USD", "period": "daily", "period_to_date_spend": "12050.5", "scope": { "type": "user", "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu" }, "source": { "type": "user", "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu" }, "spend_limit_id": "spend_limit_id" }, "status": "approved", "type": "spend_limit_increase_request" } ``` ## Organization › RBAC Groups ### Create RBAC Group `RbacGroup Organization.RbacGroups.Create(parameters, cancellationToken = default)` **POST** `/v1/organizations/rbac_groups` Create an RBAC Group in the Claude Enterprise tenant. Groups created via the API have source type `"direct"`. The RBAC Groups API is available to Claude Enterprise organizations only. #### Parameters - `RbacGroupCreateParams parameters` - `required string name` Name of the RBAC Group. Not uniqueness-enforced. minLength: 1, maxLength: 255 #### Returns - `class RbacGroup` - `JsonElement Type = "rbac_group"` Object type. For RBAC Groups, this is always `"rbac_group"`. - `required string ID` ID of the RBAC Group. - `required DateTimeOffset CreatedAt` RFC 3339 timestamp of when the RBAC Group was created. format: date-time - `required string Name` Name of the RBAC Group. Not uniqueness-enforced. - `required IReadOnlyList? RoleIds` RBAC Role IDs attached to this RBAC Group. Role attachment is managed in the admin settings and is read-only on this API. `null` means role data was temporarily unavailable — retry to distinguish from an empty list. - `required SourceType SourceType` How the RBAC Group was created: `"direct"` for groups created directly (for example, in the organization's admin settings), `"scim"` for groups provisioned by the identity provider. - `Direct("direct")` - `Scim("scim")` - `required DateTimeOffset UpdatedAt` RFC 3339 timestamp of when the RBAC Group was last updated. format: date-time #### Example ```csharp using System; using Anthropic.Models.Organization.RbacGroups; RbacGroupCreateParams parameters = new() { Name = "Engineering" }; var rbacGroup = await client.Organization.RbacGroups.Create(parameters); Console.WriteLine(rbacGroup); ``` ##### Response (200) ```json { "id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF", "created_at": "2024-10-30T23:58:27.427722Z", "name": "Engineering", "role_ids": [ "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s" ], "source_type": "direct", "type": "rbac_group", "updated_at": "2024-10-30T23:58:27.427722Z" } ``` ### List RBAC Groups `RbacGroupListPage Organization.RbacGroups.List(parameters, cancellationToken = default)` **GET** `/v1/organizations/rbac_groups` List RBAC Groups in the Claude Enterprise tenant. The RBAC Groups API is available to Claude Enterprise organizations only. #### Parameters - `RbacGroupListParams parameters` - `long limit` (query parameter) Number of items to return per page. Defaults to `20`. Ranges from `1` to `1000`. minimum: 1, maximum: 1000 - `string? page` (query parameter) Optionally set to the `next_page` token from the previous response. #### Returns - `class RbacGroup` - `JsonElement Type = "rbac_group"` Object type. For RBAC Groups, this is always `"rbac_group"`. - `required string ID` ID of the RBAC Group. - `required DateTimeOffset CreatedAt` RFC 3339 timestamp of when the RBAC Group was created. format: date-time - `required string Name` Name of the RBAC Group. Not uniqueness-enforced. - `required IReadOnlyList? RoleIds` RBAC Role IDs attached to this RBAC Group. Role attachment is managed in the admin settings and is read-only on this API. `null` means role data was temporarily unavailable — retry to distinguish from an empty list. - `required SourceType SourceType` How the RBAC Group was created: `"direct"` for groups created directly (for example, in the organization's admin settings), `"scim"` for groups provisioned by the identity provider. - `Direct("direct")` - `Scim("scim")` - `required DateTimeOffset UpdatedAt` RFC 3339 timestamp of when the RBAC Group was last updated. format: date-time #### Example ```csharp using System; using Anthropic.Models.Organization.RbacGroups; RbacGroupListParams parameters = new(); var page = await client.Organization.RbacGroups.List(parameters); await foreach (var item in page.Paginate()) { Console.WriteLine(item); } ``` ##### Response (200) ```json { "data": [ { "id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF", "created_at": "2024-10-30T23:58:27.427722Z", "name": "Engineering", "role_ids": [ "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s" ], "source_type": "direct", "type": "rbac_group", "updated_at": "2024-10-30T23:58:27.427722Z" } ], "has_more": false, "next_page": "eyJjdXJzb3IiOiAicmJhY19ncm91cF8wMSJ9" } ``` ### Get RBAC Group `RbacGroup Organization.RbacGroups.Retrieve(parameters, cancellationToken = default)` **GET** `/v1/organizations/rbac_groups/{rbac_group_id}` Retrieve an RBAC Group by ID. The RBAC Groups API is available to Claude Enterprise organizations only. #### Parameters - `RbacGroupRetrieveParams parameters` - `required string rbacGroupID` (path parameter) ID of the RBAC Group. #### Returns - `class RbacGroup` - `JsonElement Type = "rbac_group"` Object type. For RBAC Groups, this is always `"rbac_group"`. - `required string ID` ID of the RBAC Group. - `required DateTimeOffset CreatedAt` RFC 3339 timestamp of when the RBAC Group was created. format: date-time - `required string Name` Name of the RBAC Group. Not uniqueness-enforced. - `required IReadOnlyList? RoleIds` RBAC Role IDs attached to this RBAC Group. Role attachment is managed in the admin settings and is read-only on this API. `null` means role data was temporarily unavailable — retry to distinguish from an empty list. - `required SourceType SourceType` How the RBAC Group was created: `"direct"` for groups created directly (for example, in the organization's admin settings), `"scim"` for groups provisioned by the identity provider. - `Direct("direct")` - `Scim("scim")` - `required DateTimeOffset UpdatedAt` RFC 3339 timestamp of when the RBAC Group was last updated. format: date-time #### Example ```csharp using System; using Anthropic.Models.Organization.RbacGroups; RbacGroupRetrieveParams parameters = new() { RbacGroupID = "rbac_group_id" }; var rbacGroup = await client.Organization.RbacGroups.Retrieve(parameters); Console.WriteLine(rbacGroup); ``` ##### Response (200) ```json { "id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF", "created_at": "2024-10-30T23:58:27.427722Z", "name": "Engineering", "role_ids": [ "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s" ], "source_type": "direct", "type": "rbac_group", "updated_at": "2024-10-30T23:58:27.427722Z" } ``` ### Update RBAC Group `RbacGroup Organization.RbacGroups.Update(parameters, cancellationToken = default)` **POST** `/v1/organizations/rbac_groups/{rbac_group_id}` Update an RBAC Group's name. Groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API while an organization in the tenant uses SCIM provisioning. The RBAC Groups API is available to Claude Enterprise organizations only. #### Parameters - `RbacGroupUpdateParams parameters` - `required string rbacGroupID` (path parameter) ID of the RBAC Group. - `string? name` Name of the RBAC Group. Not uniqueness-enforced. minLength: 1, maxLength: 255 #### Returns - `class RbacGroup` - `JsonElement Type = "rbac_group"` Object type. For RBAC Groups, this is always `"rbac_group"`. - `required string ID` ID of the RBAC Group. - `required DateTimeOffset CreatedAt` RFC 3339 timestamp of when the RBAC Group was created. format: date-time - `required string Name` Name of the RBAC Group. Not uniqueness-enforced. - `required IReadOnlyList? RoleIds` RBAC Role IDs attached to this RBAC Group. Role attachment is managed in the admin settings and is read-only on this API. `null` means role data was temporarily unavailable — retry to distinguish from an empty list. - `required SourceType SourceType` How the RBAC Group was created: `"direct"` for groups created directly (for example, in the organization's admin settings), `"scim"` for groups provisioned by the identity provider. - `Direct("direct")` - `Scim("scim")` - `required DateTimeOffset UpdatedAt` RFC 3339 timestamp of when the RBAC Group was last updated. format: date-time #### Example ```csharp using System; using Anthropic.Models.Organization.RbacGroups; RbacGroupUpdateParams parameters = new() { RbacGroupID = "rbac_group_id" }; var rbacGroup = await client.Organization.RbacGroups.Update(parameters); Console.WriteLine(rbacGroup); ``` ##### Response (200) ```json { "id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF", "created_at": "2024-10-30T23:58:27.427722Z", "name": "Engineering", "role_ids": [ "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s" ], "source_type": "direct", "type": "rbac_group", "updated_at": "2024-10-30T23:58:27.427722Z" } ``` ### Delete RBAC Group `DeletedRbacGroup Organization.RbacGroups.Delete(parameters, cancellationToken = default)` **DELETE** `/v1/organizations/rbac_groups/{rbac_group_id}` Delete an RBAC Group. Groups provisioned by an identity provider (source type `"scim"`) cannot be deleted via the API while an organization in the tenant uses SCIM provisioning. The RBAC Groups API is available to Claude Enterprise organizations only. #### Parameters - `RbacGroupDeleteParams parameters` - `required string rbacGroupID` (path parameter) ID of the RBAC Group. #### Returns - `class DeletedRbacGroup` - `JsonElement Type = "rbac_group_deleted"` Deleted object type. For RBAC Groups, this is always `"rbac_group_deleted"`. - `required string ID` ID of the RBAC Group. #### Example ```csharp using System; using Anthropic.Models.Organization.RbacGroups; RbacGroupDeleteParams parameters = new() { RbacGroupID = "rbac_group_id" }; var deletedRbacGroup = await client.Organization.RbacGroups.Delete(parameters); Console.WriteLine(deletedRbacGroup); ``` ##### Response (200) ```json { "id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF", "type": "rbac_group_deleted" } ``` ## Organization › RBAC Groups › Members ### List RBAC Group Members `MemberListPage Organization.RbacGroups.Members.List(parameters, cancellationToken = default)` **GET** `/v1/organizations/rbac_groups/{rbac_group_id}/members` List members of an RBAC Group. The RBAC Groups API is available to Claude Enterprise organizations only. #### Parameters - `MemberListParams parameters` - `required string rbacGroupID` (path parameter) ID of the RBAC Group. - `long limit` (query parameter) Number of items to return per page. Defaults to `20`. Ranges from `1` to `1000`. minimum: 1, maximum: 1000 - `string? page` (query parameter) Optionally set to the `next_page` token from the previous response. #### Returns - `class RbacGroupMember` - `JsonElement Type = "rbac_group_member"` Object type. For RBAC Group Members, this is always `"rbac_group_member"`. - `required DateTimeOffset CreatedAt` RFC 3339 timestamp of when the User was added to the RBAC Group. format: date-time - `required string Email` Email of the User. - `required string RbacGroupID` ID of the RBAC Group. - `required string UserID` ID of the User. #### Example ```csharp using System; using Anthropic.Models.Organization.RbacGroups.Members; MemberListParams parameters = new() { RbacGroupID = "rbac_group_id" }; var page = await client.Organization.RbacGroups.Members.List(parameters); await foreach (var item in page.Paginate()) { Console.WriteLine(item); } ``` ##### Response (200) ```json { "data": [ { "created_at": "2024-10-30T23:58:27.427722Z", "email": "user@emaildomain.com", "rbac_group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF", "type": "rbac_group_member", "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu" } ], "has_more": false, "next_page": "eyJjdXJzb3IiOiAicmJhY19ncm91cF8wMSJ9" } ``` ### Add RBAC Group Member `RbacGroupMember Organization.RbacGroups.Members.Add(parameters, cancellationToken = default)` **POST** `/v1/organizations/rbac_groups/{rbac_group_id}/members` Add a User to an RBAC Group. Membership of groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API while an organization in the tenant uses SCIM provisioning. The RBAC Groups API is available to Claude Enterprise organizations only. #### Parameters - `MemberAddParams parameters` - `required string rbacGroupID` (path parameter) ID of the RBAC Group. - `required string userID` ID of the User. #### Returns - `class RbacGroupMember` - `JsonElement Type = "rbac_group_member"` Object type. For RBAC Group Members, this is always `"rbac_group_member"`. - `required DateTimeOffset CreatedAt` RFC 3339 timestamp of when the User was added to the RBAC Group. format: date-time - `required string Email` Email of the User. - `required string RbacGroupID` ID of the RBAC Group. - `required string UserID` ID of the User. #### Example ```csharp using System; using Anthropic.Models.Organization.RbacGroups.Members; MemberAddParams parameters = new() { RbacGroupID = "rbac_group_id", UserID = "user_01WxYzAbCdEfGhJkMnPqRsTu", }; var rbacGroupMember = await client.Organization.RbacGroups.Members.Add(parameters); Console.WriteLine(rbacGroupMember); ``` ##### Response (200) ```json { "created_at": "2024-10-30T23:58:27.427722Z", "email": "user@emaildomain.com", "rbac_group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF", "type": "rbac_group_member", "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu" } ``` ### Remove RBAC Group Member `DeletedRbacGroupMember Organization.RbacGroups.Members.Remove(parameters, cancellationToken = default)` **DELETE** `/v1/organizations/rbac_groups/{rbac_group_id}/members/{user_id}` Remove a User from an RBAC Group. Membership of groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API while an organization in the tenant uses SCIM provisioning. The RBAC Groups API is available to Claude Enterprise organizations only. #### Parameters - `MemberRemoveParams parameters` - `required string rbacGroupID` (path parameter) ID of the RBAC Group. - `required string userID` (path parameter) ID of the User. #### Returns - `class DeletedRbacGroupMember` - `JsonElement Type = "rbac_group_member_deleted"` Deleted object type. For RBAC Group Members, this is always `"rbac_group_member_deleted"`. - `required string RbacGroupID` ID of the RBAC Group. - `required string UserID` ID of the User. #### Example ```csharp using System; using Anthropic.Models.Organization.RbacGroups.Members; MemberRemoveParams parameters = new() { RbacGroupID = "rbac_group_id", UserID = "user_id", }; var deletedRbacGroupMember = await client.Organization.RbacGroups.Members.Remove(parameters); Console.WriteLine(deletedRbacGroupMember); ``` ##### Response (200) ```json { "rbac_group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF", "type": "rbac_group_member_deleted", "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu" } ``` ## Organization › RBAC Roles ### List RBAC Roles `RbacRoleListPage Organization.RbacRoles.List(parameters, cancellationToken = default)` **GET** `/v1/organizations/rbac_roles` List RBAC Roles in the organization. The RBAC Roles API is available to Claude Enterprise organizations only. #### Parameters - `RbacRoleListParams parameters` - `long limit` (query parameter) Number of items to return per page. Defaults to `20`. Ranges from `1` to `1000`. minimum: 1, maximum: 1000 - `string? page` (query parameter) Optionally set to the `next_page` token from the previous response. #### Returns - `class RbacRole` - `JsonElement Type = "rbac_role"` Object type. For RBAC Roles, this is always `"rbac_role"`. - `required string ID` ID of the RBAC Role. - `required DateTimeOffset CreatedAt` RFC 3339 datetime string indicating when the RBAC Role was created. format: date-time - `required string DisplayName` Name of the RBAC Role. For a role created by Anthropic, this name can differ from the label claude.ai shows, and Anthropic may change the name. To keep a lasting reference to a role, store its `id`. - `required DateTimeOffset UpdatedAt` RFC 3339 datetime string indicating when the RBAC Role was last updated. format: date-time #### Example ```csharp using System; using Anthropic.Models.Organization.RbacRoles; RbacRoleListParams parameters = new(); var page = await client.Organization.RbacRoles.List(parameters); await foreach (var item in page.Paginate()) { Console.WriteLine(item); } ``` ##### Response (200) ```json { "data": [ { "id": "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s", "created_at": "2024-10-30T23:58:27.427722Z", "display_name": "Project Editor", "type": "rbac_role", "updated_at": "2024-10-30T23:58:27.427722Z" } ], "has_more": true, "next_page": "eyJjdXJzb3IiOiAicmJhY19yb2xlXzAxIn0" } ``` ### Get RBAC Role `RbacRole Organization.RbacRoles.Retrieve(parameters, cancellationToken = default)` **GET** `/v1/organizations/rbac_roles/{rbac_role_id}` Retrieve an RBAC Role by ID. The RBAC Roles API is available to Claude Enterprise organizations only. #### Parameters - `RbacRoleRetrieveParams parameters` - `required string rbacRoleID` (path parameter) ID of the RBAC Role. #### Returns - `class RbacRole` - `JsonElement Type = "rbac_role"` Object type. For RBAC Roles, this is always `"rbac_role"`. - `required string ID` ID of the RBAC Role. - `required DateTimeOffset CreatedAt` RFC 3339 datetime string indicating when the RBAC Role was created. format: date-time - `required string DisplayName` Name of the RBAC Role. For a role created by Anthropic, this name can differ from the label claude.ai shows, and Anthropic may change the name. To keep a lasting reference to a role, store its `id`. - `required DateTimeOffset UpdatedAt` RFC 3339 datetime string indicating when the RBAC Role was last updated. format: date-time #### Example ```csharp using System; using Anthropic.Models.Organization.RbacRoles; RbacRoleRetrieveParams parameters = new() { RbacRoleID = "rbac_role_id" }; var rbacRole = await client.Organization.RbacRoles.Retrieve(parameters); Console.WriteLine(rbacRole); ``` ##### Response (200) ```json { "id": "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s", "created_at": "2024-10-30T23:58:27.427722Z", "display_name": "Project Editor", "type": "rbac_role", "updated_at": "2024-10-30T23:58:27.427722Z" } ``` ## Organization › RBAC Roles › Permissions ### List RBAC Role Permissions `PermissionListPage Organization.RbacRoles.Permissions.List(parameters, cancellationToken = default)` **GET** `/v1/organizations/rbac_roles/{rbac_role_id}/permissions` List the permissions an RBAC Role grants. The RBAC Roles API is available to Claude Enterprise organizations only. #### Parameters - `PermissionListParams parameters` - `required string rbacRoleID` (path parameter) ID of the RBAC Role. - `long limit` (query parameter) Number of items to return per page. Defaults to `20`. Ranges from `1` to `1000`. minimum: 1, maximum: 1000 - `string? page` (query parameter) Optionally set to the `next_page` token from the previous response. #### Returns - `class RbacRolePermission` - `JsonElement Type = "rbac_role_permission"` Object type. For RBAC Role Permissions, this is always `"rbac_role_permission"`. - `required string Action` Action the permission grants on the resource. The vocabulary follows the resource: an `organization` grant carries a product-feature entitlement (for example `chat`), an admin-panel permission entitlement (`permission_*`), or a blanket capability-access mode — `capability_access_all` grants every product-feature entitlement except `inference_hooks_inspection`, which a role holds only through its own row, and `capability_access_all_ga` grants the generally-available subset of those as it stands at permission-check time; neither mode grants model-access entitlements. A consumer enumerating a role's per-feature grants should treat a blanket row as granting every product-feature entitlement it covers, or it will under-report the role's effective access. A `connector_tool` grant carries a tool-access action (`use` or `always_allow`); a `connector_scope` grant carries the scope action `grant` (the role may receive the named OAuth scope when tokens are minted for the connector); `connector` and `all_connectors` grants carry a tool-access action, the scope action, or an authentication-method action (`interactive` or `managed`). - `required Resource Resource` What the permission applies to. A tagged union: `type` names the kind of resource and determines which identifier fields are present. - `class RbacOrganizationPermissionResource` - `JsonElement Type = "organization"` Kind of resource the permission applies to. - `required string OrganizationID` UUID of the organization the permission applies to. - `class RbacConnectorToolPermissionResource` - `JsonElement Type = "connector_tool"` Kind of resource the permission applies to. - `required string ConnectorID` ID of the connector the permission applies to. - `required string ToolName` Published name of the connector tool the permission applies to. When the published name contains characters outside `[a-zA-Z0-9_-]` (or collides with a reserved form), it is server-encoded into a stable `{prefix}_{32-hex}` form — a shortened readable prefix of the name plus a hash — from which the published name is not recoverable. - `class RbacConnectorScopePermissionResource` - `JsonElement Type = "connector_scope"` Kind of resource the permission applies to. - `required string ConnectorID` ID of the connector the permission applies to. - `required string Scope` OAuth scope the permission names — the role may receive this scope when tokens are minted for the connector. Subject to the same encoding rule as `tool_name`: a scope containing characters outside `[a-zA-Z0-9_-]` (or colliding with a reserved form) appears server-encoded in a stable `{prefix}_{32-hex}` form. OAuth scopes routinely contain `:` and `/`, so most appear encoded. - `class RbacConnectorPermissionResource` - `JsonElement Type = "connector"` Kind of resource the permission applies to. - `required string ConnectorID` ID of the connector the permission applies to. - `class RbacAllConnectorsPermissionResource` - `JsonElement Type = "all_connectors"` Kind of resource the permission applies to. #### Example ```csharp using System; using Anthropic.Models.Organization.RbacRoles.Permissions; PermissionListParams parameters = new() { RbacRoleID = "rbac_role_id" }; var page = await client.Organization.RbacRoles.Permissions.List(parameters); await foreach (var item in page.Paginate()) { Console.WriteLine(item); } ``` ##### Response (200) ```json { "data": [ { "action": "use", "resource": { "organization_id": "3c4f5e6d-7a8b-49c0-9d1e-2f3a4b5c6d7e", "type": "organization" }, "type": "rbac_role_permission" } ], "has_more": true, "next_page": "eyJjdXJzb3IiOiAicmJhY19yb2xlXzAxIn0" } ```