--- title: "Get Federation Rule" method: GET path: "/v1/organizations/federation_rules/{federation_rule_id}?beta=true" --- # Get Federation Rule `GET /v1/organizations/federation_rules/{federation_rule_id}?beta=true` ## Request - Base URL: `https://api.anthropic.com` - URL: `https://api.anthropic.com/v1/organizations/federation_rules/{federation_rule_id}?beta=true` - Auth: none declared - TypeScript: (a function with typed inputs; its response is checked against the schema) **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api). Retrieve a federation rule by its ID (`fdrl_...`). ## Path parameters - `federation_rule_id` string, required: ID of the federation rule. ## Headers - `anthropic-beta` AnthropicBeta[]: Optional header to specify the beta version(s) you want to use. - union: Beta names you can send in the `anthropic-beta` header. See [Beta headers](https://platform.claude.com/docs/en/api/beta-headers) for how to send them and where to find the name a feature needs. - string - 'message-batches-2024-09-24' | 'prompt-caching-2024-07-31' | 'computer-use-2024-10-22' | 'computer-use-2025-01-24' | 'pdfs-2024-09-25' | 'token-counting-2024-11-01' | 'token-efficient-tools-2025-02-19' | 'output-128k-2025-02-19' | 'files-api-2025-04-14' | 'mcp-client-2025-04-04' | 'mcp-client-2025-11-20' | 'dev-full-thinking-2025-05-14' | 'interleaved-thinking-2025-05-14' | 'code-execution-2025-05-22' | 'extended-cache-ttl-2025-04-11' | 'context-1m-2025-08-07' | 'context-management-2025-06-27' | 'model-context-window-exceeded-2025-08-26' | 'skills-2025-10-02' | 'fast-mode-2026-02-01' | 'output-300k-2026-03-24' | 'user-profiles-2026-03-24' | 'user-profiles-2026-08-18' | 'user-profiles-2026-09-04' | 'advisor-tool-2026-03-01' | 'managed-agents-2026-04-01' | 'cache-diagnosis-2026-04-07' | 'dreaming-2026-04-21' | 'thinking-token-count-2026-05-13' | 'server-side-fallback-2026-06-01' | 'server-side-fallback-2026-07-01' | 'fallback-credit-2026-06-01' | 'fallback-credit-2026-07-01' | 'agent-memory-2026-07-22' | 'mid-conversation-tool-changes-2026-07-01' | 'compact-2026-01-12' | 'computer-use-2025-11-24' | 'mcp-tunnels-2026-06-22' | 'structured-outputs-2025-11-13' | 'task-budgets-2026-03-13' | 'thinking-display-updates-2026-08-18' | 'ce-user-management-2026-07-13' | 'mid-conversation-output-config-2026-07-01' | 'thinking-binding-controls-2026-08-01' | 'mid-conversation-system-clear-at-2026-08-21' | 'compact-2026-09-04' | 'inline-tools-2026-09-15' | 'mcp-client-2026-09-15' | 'ce-plugins-2026-09-01' | 'spend-limit-reads-2026-09-26' | 'telemetry-destinations-2026-08-11' | 'webhooks-2026-10-07' | 'admin-user-sign-out-2026-10-08' | 'message-threads-2026-08-12' | 'analytics-usage-cost-2026-08-24' | 'experimental-claude-tag-2026-10-21' - `anthropic-version` string: The version of the Claude API you want to use. Read more about versioning and our version history [here](https://platform.claude.com/docs/en/api/versioning). ## Response `200` Successful Response - BetaFederationRule: Authorization rule binding an external OIDC identity to Anthropic. Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to a single workspace where the rule is enabled (chosen by the caller at exchange time when the rule is enabled for more than one). For rules enabled via `workspace_ids` or `applies_to_all_workspaces`, the target service account must be a member of that workspace (it is implicitly a member of the default workspace); rules carrying only the legacy `workspace_id` binding do not enforce this. - `applies_to_all_workspaces` boolean, required: When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time. - `archived_at` string, date-time, nullable, required: If set, this rule is archived and rejects token exchange. - `archived_by_actor_id` string, nullable, required: Tagged ID (`user_`/`svac_`) of the actor that archived this rule. - `attributes` object, nullable, required: CEL expressions extracting named values from claims. Not yet supported; always null. - `created_at` string, date-time, required: When this rule was created. - `created_by_actor_id` string, nullable, required: Tagged ID (`user_`/`svac_`) of the actor that created this rule. - `description` string, nullable, required: Optional free-text description. - `id` string, required: Tagged ID of the federation rule. - `issuer_id` string, required: Tagged ID of the issuer whose tokens this rule accepts. - `issuer_name` string, nullable, required: Issuer's display name at read time. - `match` BetaRuleMatch, required: Does the incoming JWT qualify? All populated fields must pass; omitted fields are skipped. At least one of `subject_prefix` (other than a wildcard-only value like `*`), `claims`, or `condition` is required; `audience` alone is not sufficient. - `audience` string, nullable: Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default. - `claims` object, nullable: Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims. - `condition` string, nullable: CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400. - `subject_prefix` string, nullable: Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`. - `name` string, required: Admin-chosen slug identifier. - `oauth_scope` string, required: Space-separated OAuth scopes granted on the minted token. - `target` BetaServiceAccountTarget, required: Bind to a fixed service account by ID. - `service_account_id` string, required: Tagged ID of the service account to mint tokens for. - `service_account_name` string, nullable: Service account's display name at read time. Ignored on writes. - `type` 'service_account', required - `token_lifetime_seconds` integer, required: Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds. - `type` 'federation_rule', required - `updated_at` string, date-time, required: When this rule was last updated. - `updated_by_actor_id` string, nullable, required: Tagged ID (`user_`/`svac_`) of the actor that last updated this rule. - `workspace_id` string, nullable, required: Legacy single-workspace binding. Prefer `workspace_ids` and the `/federation_rules/{federation_rule_id}/workspaces` sub-resource for managing workspace enablement. - `workspace_ids` string[], required: Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty). ## Other responses - `400`: Invalid argument - The client specified an invalid argument - `401`: Unauthenticated - The request does not have valid authentication credentials - `403`: Permission denied - The caller does not have permission to execute the specified operation - `404`: Not found - Some requested entity was not found - `408`: Deadline exceeded - The deadline expired before the operation could complete - `409`: Aborted - The operation was aborted due to concurrency issue - `412`: Failed precondition - Operation was rejected because the system is not in required state - `413`: Out of range - Operation was attempted past the valid range - `429`: Resource exhausted - Some resource has been exhausted (rate limiting) - `431`: Request header fields too large - Request metadata was too large - `499`: Cancelled - The operation was cancelled by the client - `500`: Internal - Internal server error - `501`: Unimplemented - The operation is not implemented or supported - `503`: Unavailable - The service is currently unavailable - `504`: Deadline exceeded - Upstream service did not respond in time - `529`: Overloaded - The service is temporarily overloaded ## Changes - **2026-11-05** `037a593978dc`: 1 info - added the enum value `admin-user-sign-out-2026-10-08` to the property `items/anyOf[subschema #2]/` of the `header` request parameter `anthropic-beta` - **2026-10-23** `f538a797852c`: 1 info - added the enum value `experimental-claude-tag-2026-10-21` to the property `items/anyOf[subschema #2]/` of the `header` request parameter `anthropic-beta` - **2026-10-23** `8071e43a8476`: 1 info - added the enum value `analytics-usage-cost-2026-08-24` to the property `items/anyOf[subschema #2]/` of the `header` request parameter `anthropic-beta` - **2026-10-22** `376dea998624`: 1 info - added the enum value `message-threads-2026-08-12` to the property `items/anyOf[subschema #2]/` of the `header` request parameter `anthropic-beta` - **2026-10-21** `94c83daca660`: 1 warning - deleted the `header` request parameter `x-api-key` [Operation history](https://skmtc.dev/anthropics/apis/anthropic-api/changes/v1/organizations/federation_rules/:federation_rule_id%3Fbeta=true/get.md) --- [API](https://skmtc.dev/anthropics/apis/anthropic-api.md) - [All operations](https://skmtc.dev/anthropics/apis/anthropic-api/llms.txt) - [OpenAPI document](https://skmtc.dev/anthropics/apis/anthropic-api/revisions/690622377a5e?raw)