Claude Platform Docs

更新聯合規則

client.Organization.Federation.Rules.Update(ctx, federationRuleID, body) (*FederationRule, error)
POST/v1/organizations/federation_rules/{federation_rule_id}

需要具有 org:admin 範圍的 OAuth 存取權杖，可透過 ant auth login --scope org:admin 或工作負載身分聯合（workload identity federation）規則取得；不接受 Admin API 金鑰。請參閱使用 Admin API 管理 WIF。

部分更新聯合規則。

issuer_id 無法變更。設定 match 和 target 時，會以整個物件取代。所參照的服務帳戶與工作區必須存在於您的組織中；無效的參照會以 400 錯誤拒絕。已封存的規則無法更新；此操作會傳回 400。請改為建立新的規則。位於知名共用簽發者（GitHub Actions、GitLab、Buildkite、Terraform Cloud、Google）上的規則，必須透過帶有身分的宣告、固定租用戶的主體前綴（例如 repo:YOUR_ORG/...），或參照上述身分宣告之一的 CEL 條件（例如 claims.repository_owner）來限制租用戶身分。在這些簽發者上，每次更新都會重新檢查此要求；若現有規則儲存的比對條件尚未限制租用戶身分，則任何更新（即使只是重新命名或變更描述）都必須在同一請求中一併提供符合規定的 match。OAuth 呼叫者只能管理 oauth_scope 為 workspace:developer 或 workspace:inference 的規則；其他範圍需要 Console 工作階段。

Parameters
federationRuleID string⁠Path parameter

ID of the federation rule to update.

body OrganizationFederationRuleUpdateParams
AppliesToAllWorkspaces param.Opt[bool] Optional

When true, enables this rule for every workspace in the org (including workspaces created later). Setting false is rejected with 400 if no workspace would remain enabled; a rule with only a legacy workspace_id binding continues to mint.

Description param.Opt[string] Optional

Replaces the description. Omit to leave unchanged; send null to clear (the field is stored as an empty string).

maxLength2000
Match FederationRuleMatchParam Optional

Replaces the entire match object. All populated matcher fields must pass.

Name param.Opt[string] Optional

Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.

minLength1
maxLength255
OAuthScope param.Opt[string] Optional

Replaces the space-separated OAuth scopes granted on minted tokens. OAuth callers may only set workspace:developer or workspace:inference; other scopes (such as org:admin) require a Console session.

minLength1
Target ServiceAccountTargetParam Optional

Replaces the entire target object. Currently always a service_account target.

TokenLifetimeSeconds param.Opt[int64] Optional

Replaces the lifetime in seconds for access tokens minted via this rule (60-86400). Minted tokens are capped at max(60, min(this value, 2 × remaining assertion validity)) seconds.

minimum60
maximum86400
WorkspaceID param.Opt[string] Optional

Replaces the existing single workspace enablement (the previous one is removed). Rejected with 400 if the rule is enabled for more than one workspace; use the /federation_rules/{federation_rule_id}/workspaces sub-resource instead.

Returns
type FederationRule struct { Type: "federation_rule"; ID; AppliesToAllWorkspaces; /* 15 more */ }

Authorization rule binding an external OIDC identity to Anthropic.

Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to a single workspace where the rule is enabled (chosen by the caller at exchange time when the rule is enabled for more than one). For rules enabled via workspace_ids or applies_to_all_workspaces, the target service account must be a member of that workspace (it is implicitly a member of the default workspace); rules carrying only the legacy workspace_id binding do not enforce this.

更新聯合規則
package main

import (
	"context"
	"fmt"

	"github.com/anthropics/anthropic-sdk-go"
	"github.com/anthropics/anthropic-sdk-go/option"
)

func main() {
	client := anthropic.NewClient(
		option.WithAPIKey("my-anthropic-api-key"),
	)
	federationRule, err := client.Organization.Federation.Rules.Update(
		context.TODO(),
		"federation_rule_id",
		anthropic.OrganizationFederationRuleUpdateParams{},
	)
	if err != nil {
		panic(err.Error())
	}
	fmt.Printf("%+v\n", federationRule.ID)
}
Returns Examples
Response 200
{
  "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
  "applies_to_all_workspaces": true,
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "attributes": {
    "foo": "string"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "issuer_id": "issuer_id",
  "issuer_name": "issuer_name",
  "match": {
    "audience": "audience",
    "claims": {
      "foo": "string"
    },
    "condition": "condition",
    "subject_prefix": "subject_prefix"
  },
  "name": "prod-deploy-pipeline",
  "oauth_scope": "oauth_scope",
  "target": {
    "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
    "type": "service_account",
    "service_account_name": "service_account_name"
  },
  "token_lifetime_seconds": 0,
  "type": "federation_rule",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id",
  "workspace_id": "workspace_id",
  "workspace_ids": [
    "string"
  ]
}