--- title: "Update Federation Rule" method: POST path: "/v1/organizations/federation_rules/{federation_rule_id}" --- # Update Federation Rule `POST /v1/organizations/federation_rules/{federation_rule_id}` ## Request - Base URL: `https://api.anthropic.com` - URL: `https://api.anthropic.com/v1/organizations/federation_rules/{federation_rule_id}` - Auth: none declared **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api). Partially update a federation rule. `issuer_id` is immutable. `match` and `target` are replaced as whole objects when set. Referenced service accounts and workspaces must exist in your organization; invalid references are rejected with a 400 error. Archived rules cannot be updated; this returns 400. Create a new rule instead. Rules on well-known shared issuers (GitHub Actions, GitLab, Buildkite, Terraform Cloud, Google) must constrain tenant identity via an identity-bearing claim, a tenant-pinning subject prefix (such as `repo:YOUR_ORG/...`), or a CEL condition referencing one of those identity claims (e.g. `claims.repository_owner`). On these issuers the requirement is re-checked on every update; if an existing rule's stored match does not yet constrain tenant identity, any update (even a rename or description change) must also supply a conforming `match` in the same request. OAuth callers may only manage rules whose `oauth_scope` is `workspace:developer` or `workspace:inference`; other scopes require a Console session. ## Path parameters - `federation_rule_id` string, required: ID of the federation rule to update. ## Headers - `anthropic-version` string: The version of the Claude API you want to use. Read more about versioning and our version history [here](https://platform.claude.com/docs/en/api/versioning). ## Request body - FederationRuleUpdateParams: Partial update. Set fields are applied; omitted fields are unchanged. `issuer_id` is immutable. `match` and `target` are replaced as whole objects when set. Explicit `null` clears `description` and `attributes`; other fields can only be replaced, not cleared. - `applies_to_all_workspaces` boolean, nullable: When true, enables this rule for every workspace in the org (including workspaces created later). Setting `false` is rejected with 400 if no workspace would remain enabled; a rule with only a legacy `workspace_id` binding continues to mint. - `attributes` object, nullable: Replaces the CEL expressions `{name: expr}` extracting named values from claims. Send null to clear them. Not yet supported; any non-empty value is rejected with 400. - `description` string, nullable: Replaces the description. Omit to leave unchanged; send `null` to clear (the field is stored as an empty string). - `match` RuleMatch: Does the incoming JWT qualify? All populated fields must pass; omitted fields are skipped. At least one of `subject_prefix` (other than a wildcard-only value like `*`), `claims`, or `condition` is required; `audience` alone is not sufficient. - `audience` string, nullable: Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default. - `claims` object, nullable: Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims. - `condition` string, nullable: CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400. - `subject_prefix` string, nullable: Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`. - `name` string, nullable: Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409. - `oauth_scope` string, nullable: Replaces the space-separated OAuth scopes granted on minted tokens. OAuth callers may only set `workspace:developer` or `workspace:inference`; other scopes (such as `org:admin`) require a Console session. - `target` ServiceAccountTarget: Bind to a fixed service account by ID. - `service_account_id` string, required: Tagged ID of the service account to mint tokens for. - `service_account_name` string, nullable: Service account's display name at read time. Ignored on writes. - `type` 'service_account', required - `token_lifetime_seconds` integer, nullable: Replaces the lifetime in seconds for access tokens minted via this rule (60-86400). Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds. - `workspace_id` string, nullable: Replaces the existing single workspace enablement (the previous one is removed). Rejected with 400 if the rule is enabled for more than one workspace; use the `/federation_rules/{federation_rule_id}/workspaces` sub-resource instead. ## Response `200` Successful Response - FederationRule: Authorization rule binding an external OIDC identity to Anthropic. Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to a single workspace where the rule is enabled (chosen by the caller at exchange time when the rule is enabled for more than one). For rules enabled via `workspace_ids` or `applies_to_all_workspaces`, the target service account must be a member of that workspace (it is implicitly a member of the default workspace); rules carrying only the legacy `workspace_id` binding do not enforce this. - `applies_to_all_workspaces` boolean, required: When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time. - `archived_at` string, date-time, nullable, required: If set, this rule is archived and rejects token exchange. - `archived_by_actor_id` string, nullable, required: Tagged ID (`user_`/`svac_`) of the actor that archived this rule. - `attributes` object, nullable, required: CEL expressions extracting named values from claims. Not yet supported; always null. - `created_at` string, date-time, required: When this rule was created. - `created_by_actor_id` string, nullable, required: Tagged ID (`user_`/`svac_`) of the actor that created this rule. - `description` string, nullable, required: Optional free-text description. - `id` string, required: Tagged ID of the federation rule. - `issuer_id` string, required: Tagged ID of the issuer whose tokens this rule accepts. - `issuer_name` string, nullable, required: Issuer's display name at read time. - `match` RuleMatch, required: Does the incoming JWT qualify? All populated fields must pass; omitted fields are skipped. At least one of `subject_prefix` (other than a wildcard-only value like `*`), `claims`, or `condition` is required; `audience` alone is not sufficient. - `audience` string, nullable: Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default. - `claims` object, nullable: Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims. - `condition` string, nullable: CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400. - `subject_prefix` string, nullable: Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`. - `name` string, required: Admin-chosen slug identifier. - `oauth_scope` string, required: Space-separated OAuth scopes granted on the minted token. - `target` ServiceAccountTarget, required: Bind to a fixed service account by ID. - `service_account_id` string, required: Tagged ID of the service account to mint tokens for. - `service_account_name` string, nullable: Service account's display name at read time. Ignored on writes. - `type` 'service_account', required - `token_lifetime_seconds` integer, required: Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds. - `type` 'federation_rule', required - `updated_at` string, date-time, required: When this rule was last updated. - `updated_by_actor_id` string, nullable, required: Tagged ID (`user_`/`svac_`) of the actor that last updated this rule. - `workspace_id` string, nullable, required: Legacy single-workspace binding. Prefer `workspace_ids` and the `/federation_rules/{federation_rule_id}/workspaces` sub-resource for managing workspace enablement. - `workspace_ids` string[], required: Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty). ## Other responses - `400`: Invalid argument - The client specified an invalid argument - `401`: Unauthenticated - The request does not have valid authentication credentials - `403`: Permission denied - The caller does not have permission to execute the specified operation - `404`: Not found - Some requested entity was not found - `408`: Deadline exceeded - The deadline expired before the operation could complete - `409`: Aborted - The operation was aborted due to concurrency issue - `412`: Failed precondition - Operation was rejected because the system is not in required state - `413`: Out of range - Operation was attempted past the valid range - `429`: Resource exhausted - Some resource has been exhausted (rate limiting) - `431`: Request header fields too large - Request metadata was too large - `499`: Cancelled - The operation was cancelled by the client - `500`: Internal - Internal server error - `501`: Unimplemented - The operation is not implemented or supported - `503`: Unavailable - The service is currently unavailable - `504`: Deadline exceeded - Upstream service did not respond in time - `529`: Overloaded - The service is temporarily overloaded ## Changes - **2026-09-30** `51c5260134e8`: 1 info - endpoint added [Operation history](https://skmtc.dev/anthropics/apis/anthropic-api/changes/v1/organizations/federation_rules/:federation_rule_id/post.md) --- [API](https://skmtc.dev/anthropics/apis/anthropic-api.md) - [All operations](https://skmtc.dev/anthropics/apis/anthropic-api/llms.txt) - [OpenAPI document](https://skmtc.dev/anthropics/apis/anthropic-api/revisions/328591af84ad?raw)