ANanthropics

Update Federation Rule

Changed on

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Partially update a federation rule.

issuer_id is immutable. match and target are replaced as whole objects when set. Referenced service accounts and workspaces must exist in your organization; invalid references are rejected with a 400 error. Archived rules cannot be updated; this returns 400. Create a new rule instead. Rules on well-known shared issuers (GitHub Actions, GitLab, Buildkite, Terraform Cloud, Google) must constrain tenant identity via an identity-bearing claim, a tenant-pinning subject prefix (such as repo:YOUR_ORG/...), or a CEL condition referencing one of those identity claims (e.g. claims.repository_owner). On these issuers the requirement is re-checked on every update; if an existing rule's stored match does not yet constrain tenant identity, any update (even a rename or description change) must also supply a conforming match in the same request. OAuth callers may only manage rules whose oauth_scope is workspace:developer or workspace:inference; other scopes require a Console session.

post/v1/organizations/federation_rules/{federation_rule_id}

Request

  • Base URL
    https://api.anthropic.com
  • Auth
    none declared

Path parameters

federation_rule_idstring required

ID of the federation rule to update.

Headers

anthropic-versionstring

The version of the Claude API you want to use.

Read more about versioning and our version history here.

Request body

applies_to_all_workspacesboolean nullable

When true, enables this rule for every workspace in the org (including workspaces created later). Setting false is rejected with 400 if no workspace would remain enabled; a rule with only a legacy workspace_id binding continues to mint.

attributesobject nullable

Replaces the CEL expressions {name: expr} extracting named values from claims. Send null to clear them. Not yet supported; any non-empty value is rejected with 400.

descriptionstring nullable

Replaces the description. Omit to leave unchanged; send null to clear (the field is stored as an empty string).

namestring nullable

Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.

oauth_scopestring nullable

Replaces the space-separated OAuth scopes granted on minted tokens. OAuth callers may only set workspace:developer or workspace:inference; other scopes (such as org:admin) require a Console session.

token_lifetime_secondsinteger nullable

Replaces the lifetime in seconds for access tokens minted via this rule (60-86400). Minted tokens are capped at max(60, min(this value, 2 × remaining assertion validity)) seconds.

workspace_idstring nullable

Replaces the existing single workspace enablement (the previous one is removed). Rejected with 400 if the rule is enabled for more than one workspace; use the /federation_rules/{federation_rule_id}/workspaces sub-resource instead.

Example request

{
  "target": {
    "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK"
  }
}

Response

Successful Response

applies_to_all_workspacesboolean required

When true, this rule is enabled for every workspace in the org (including ones created after the rule). workspace_ids is ignored at exchange time.

archived_atstring date-time nullable required

If set, this rule is archived and rejects token exchange.

archived_by_actor_idstring nullable required

Tagged ID (user_/svac_) of the actor that archived this rule.

attributesobject nullable required

CEL expressions extracting named values from claims. Not yet supported; always null.

created_atstring date-time required

When this rule was created.

created_by_actor_idstring nullable required

Tagged ID (user_/svac_) of the actor that created this rule.

descriptionstring nullable required

Optional free-text description.

idstring required

Tagged ID of the federation rule.

issuer_idstring required

Tagged ID of the issuer whose tokens this rule accepts.

issuer_namestring nullable required

Issuer's display name at read time.

namestring required

Admin-chosen slug identifier.

oauth_scopestring required

Space-separated OAuth scopes granted on the minted token.

token_lifetime_secondsinteger required

Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at max(60, min(this value, 2 × remaining assertion validity)) seconds.

type'federation_rule' required
updated_atstring date-time required

When this rule was last updated.

updated_by_actor_idstring nullable required

Tagged ID (user_/svac_) of the actor that last updated this rule.

workspace_idstring nullable required

Legacy single-workspace binding. Prefer workspace_ids and the /federation_rules/{federation_rule_id}/workspaces sub-resource for managing workspace enablement.

workspace_idsstring[] required

Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy workspace_id binding. Ignored at exchange time when applies_to_all_workspaces is true (the list may still be non-empty).

Example response

{
  "created_at": "2024-10-30T23:58:27.427722Z",
  "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
  "name": "prod-deploy-pipeline",
  "target": {
    "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK"
  },
  "updated_at": "2024-10-30T23:58:27.427722Z"
}

Changes