Claude Platform Docs

Federation-Issuer erstellen

$ ant beta:organization:federation:issuers create
POST/v1/organizations/federation_issuers

Erfordert ein OAuth-Zugriffstoken mit dem Scope org:admin, über ant auth login --scope org:admin oder eine Workload-Identity-Federation-Regel; Admin-API-Keys werden nicht akzeptiert. Siehe WIF mit der Admin API verwalten.

Registriert einen OIDC-Issuer, dem Anthropic für die Workload Identity Federation in deiner Organisation vertraut.

Das Feld jwks steuert, wie die Signaturschlüssel des Issuers bezogen werden, und nimmt eine von drei Formen an, die über type ausgewählt werden: discovery (Schlüssel über OIDC Discovery auflösen), explicit_url (Schlüssel von einer festen JWKS-URL abrufen) oder inline (einen statischen Schlüsselsatz bereitstellen). Wenn jwks.type discovery ist und kein discovery_base gesetzt ist, muss die Issuer-URL öffentlich über HTTPS erreichbar sein, damit Anthropic das Discovery-Dokument abrufen kann; in den Modi explicit_url und inline wird die Issuer-URL nur mit dem iss-Claim des JWT abgeglichen und nicht abgerufen.

Parameters
--issuer-url: string

The iss claim value to match against.

minLength1
--name: string

Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.

minLength1
maxLength255
--check-jti: optional boolean

Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Defaults to true. Applies only to assertions carrying a jti claim; tokens without one are accepted without single-use enforcement.

--jwks: optional BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline

How signing keys are obtained. Defaults to OIDC discovery.

--max-jwt-lifetime-seconds: optional number

Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Defaults to 3600 (1h). Assertions must carry both iat and exp; a missing iat is rejected.

minimum1
maximum176400
--beta: optional array of AnthropicBeta⁠Header parameter

Optional header to specify the beta version(s) you want to use.

Returns
beta_federation_issuer: object{ type: "federation_issuer", id, archived_at, 12 more }

Registered external OIDC identity provider.

Records an external IdP the organization trusts for the RFC 7523 jwt-bearer grant. The issuer_url must match the JWT iss claim exactly.

type: "federation_issuer"
id: string

Tagged ID of the federation issuer.

archived_at: string

If set, all rules referencing this issuer reject token exchange.

formatdate-time
archived_by_actor_id: string

Tagged ID (user_/svac_) of the actor that archived this issuer.

check_jti: boolean

Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a jti claim; tokens without one are accepted without single-use enforcement.

created_at: string

When this issuer was created.

formatdate-time
created_by_actor_id: string

Tagged ID (user_/svac_) of the actor that created this issuer.

issuer_url: string

The iss claim value. Incoming JWTs must match exactly.

jwks: BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline

How signing keys are obtained for signature verification.

One of the following:
beta_jwks_discovery: object{ type: "discovery", ca_cert_pem, discovery_base }

JWKS via the issuer's OIDC discovery document.

type: "discovery"
ca_cert_pem: optional string

Optional custom CA (PEM) for TLS verification of the JWKS fetch.

maxLength8192
discovery_base: optional string

Set when the discovery URL differs from issuer_url.

beta_jwks_explicit_url: object{ type: "explicit_url", url, ca_cert_pem }

JWKS fetched from a fixed endpoint.

type: "explicit_url"
url: string

JWKS endpoint.

minLength1
ca_cert_pem: optional string

Optional custom CA (PEM) for TLS verification of the JWKS fetch.

maxLength8192
beta_jwks_inline: object{ type: "inline", keys }

JWKS supplied directly; no network fetch.

type: "inline"
keys: array of map[unknown]

Inline JWK objects.

minItems1
jwks_polling_disabled_at: string

If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending jwks_polling_disabled: false via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than workspace:developer or workspace:inference; use a Console session.

formatdate-time
max_jwt_lifetime_seconds: number

Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both iat and exp; a missing iat is rejected.

name: string

Admin-chosen slug identifier.

poll_status: object{ consecutive_failures, last_fetched_at, next_poll_at }

Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet.

consecutive_failures: number

Consecutive fetch failures since the last success.

last_fetched_at: string

When the last successful fetch completed.

formatdate-time
next_poll_at: string

When the next fetch is scheduled. Null if paused.

formatdate-time
updated_at: string

When this issuer was last updated.

formatdate-time
updated_by_actor_id: string

Tagged ID (user_/svac_) of the actor that last updated this issuer.

Federation-Issuer erstellen
ant beta:organization:federation:issuers create \
  --api-key my-anthropic-api-key \
  --issuer-url x \
  --name x
Returns Examples
Response 200
{
  "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "check_jti": true,
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "issuer_url": "https://token.actions.githubusercontent.com",
  "jwks": {
    "type": "discovery",
    "ca_cert_pem": "ca_cert_pem",
    "discovery_base": "discovery_base"
  },
  "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",
  "max_jwt_lifetime_seconds": 0,
  "name": "github-actions",
  "poll_status": {
    "consecutive_failures": 0,
    "last_fetched_at": "2019-12-27T18:11:19.117Z",
    "next_poll_at": "2019-12-27T18:11:19.117Z"
  },
  "type": "federation_issuer",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id"
}