---
title: Gestisci WIF con l'Admin API
url: https://platform.claude.com/docs/it/manage-claude/wif-admin-api
description: Crea e gestisci in modo programmatico service account, issuer e regole di Workload Identity Federation per flussi di lavoro infrastructure-as-code e CI.
---
L'Admin API ti consente di creare e gestire in modo programmatico le risorse di [Workload Identity Federation](https://platform.claude.com/docs/it/manage-claude/workload-identity-federation): service account, federation issuer e federation rule. Usala per mantenere la configurazione della federazione come "infrastructure as code" (infrastruttura come codice), effettuarne il provisioning dalla CI e riprodurla tra organizzazioni invece di fare clic attraverso la Claude Console. Questi endpoint condividono il prefisso di percorso `/v1/organizations` con il resto dell'[Admin API](https://platform.claude.com/docs/it/manage-claude/admin-api).
## Prerequisiti
Ogni richiesta in questa pagina si autentica con un bearer token OAuth che porta lo scope `org:admin`. Lo scope viene concesso solo ai membri dell'organizzazione con il ruolo admin, owner o primary owner, e concede l'accesso all'intera organizzazione: qualsiasi associazione a un workspace viene ignorata. Esistono due modi per ottenere un token, e comportano permessi diversi: un token ottenuto dal tuo login agisce come utente, mentre un token federato agisce come service account e non può eseguire tutte le operazioni descritte in questa pagina.
### Interattivo (il tuo terminale)
Accedi con la [CLI `ant`](https://platform.claude.com/docs/it/cli-sdks-libraries/cli/quickstart) sotto un profilo dedicato, richiedendo lo scope `org:admin` (vedi [Accesso admin](https://platform.claude.com/docs/it/cli-sdks-libraries/cli/authentication#admin-access)), quindi esporta il bearer token. L'accesso con `--profile admin` memorizza la credenziale `org:admin` sotto il proprio nome di profilo e la rende anche il profilo attivo della CLI, e la variabile esportata si applica a ogni chiamata SDK e CLI in quella shell; usa quindi una shell riservata all'amministrazione, rimuovi la variabile quando hai finito e riporta la CLI al profilo precedente con `ant profile activate default`:
```bash CLI
ant auth login --profile admin --scope "org:admin"
export ANTHROPIC_AUTH_TOKEN=$(ant auth print-credentials --profile admin --access-token)
```
I token interattivi hanno breve durata; se le richieste iniziano a restituire 401, esegui nuovamente il comando di export (aggiorna il token automaticamente).
Gli SDK e la CLI `ant` leggono `ANTHROPIC_AUTH_TOKEN` automaticamente; lascia `ANTHROPIC_API_KEY` non impostata nella stessa shell, perché questi endpoint rifiutano le chiavi API e alcuni client preferiscono la chiave quando entrambe sono impostate.
### Workload (CI e automazione)
Crea una federation rule con `oauth_scope: org:admin` che abbia come target un service account il cui `organization_role` sia `admin`. La regola stessa deve essere creata nella Claude Console: concedere a un workload l'accesso come admin dell'organizzazione è un'azione umana deliberata, non qualcosa che l'automazione può avviare da sola. La sezione successiva illustra questa configurazione da eseguire una sola volta per organizzazione.
## Avvia un workload per gestire WIF
Una sola regola creata nella Console è sufficiente per mettere il resto della configurazione della federazione sotto infrastructure as code: concedi a un singolo workload fidato lo scope `org:admin` e lascia che quel workload gestisca i federation issuer e ogni federation rule con scope di workspace tramite questa API.
Nella Claude Console, vai alla pagina [Workload identity](https://platform.claude.com/settings/workload-identity-federation) (`platform.claude.com/settings/workload-identity-federation`) e seleziona **Connect workload** per creare una federation rule per il tuo workload di automazione, ad esempio un workflow GitHub Actions nel tuo repository dell'infrastruttura. In **Advanced rule options**, imposta lo scope OAuth della regola su `org:admin`: la procedura guidata crea quindi il nuovo service account con il ruolo di organizzazione Admin (oppure ti chiede di scegliere un service account admin esistente come target).
Fai corrispondere la regola a un'unica identità di workload esatta, non a un pattern ampio. `subject_prefix` è una corrispondenza esatta a meno che non termini con `*`. Per GitHub Actions, vincola il subject a un branch protetto, come `repo:my-org/my-repo:ref:refs/heads/main`. Un wildcard finale come `repo:my-org/my-repo:*` corrisponde anche alle esecuzioni `pull_request`, incluse quelle attivate da fork, quindi chiunque possa aprire una pull request sul repository potrebbe emettere un token `org:admin`. Vedi [Limita quali workflow possono autenticarsi](https://platform.claude.com/docs/it/manage-claude/wif-providers/github-actions#restrict-which-workflows-can-authenticate).
Un workload che usa uno degli SDK o la CLI `ant` non esegue lo scambio da solo. Indirizza il client alla regola con le variabili d'ambiente della federazione e costruiscilo senza argomenti, esattamente come per l'inferenza in [Costruisci il client SDK](https://platform.claude.com/docs/it/manage-claude/workload-identity-federation#construct-the-sdk-client); il client scambia il token di identità alla prima richiesta e, prima che l'access token risultante scada, rilegge il token di identità e lo scambia di nuovo:
```bash
export ANTHROPIC_FEDERATION_RULE_ID=fdrl_... # the org:admin rule from step 1
export ANTHROPIC_ORGANIZATION_ID=00000000-0000-0000-0000-000000000000
export ANTHROPIC_SERVICE_ACCOUNT_ID=svac_... # the rule's target service account
export ANTHROPIC_IDENTITY_TOKEN_FILE=/path/to/jwt # or ANTHROPIC_IDENTITY_TOKEN
# ANTHROPIC_WORKSPACE_ID è richiesto solo se la regola è abilitata per tutti
# i workspace o per più di uno; gli endpoint org:admin ignorano l'associazione.
unset ANTHROPIC_API_KEY ANTHROPIC_AUTH_TOKEN # both take precedence over federation
```
La CLI `ant` legge le stesse variabili, oppure accetta i flag `--federation-rule`, `--organization-id`, `--service-account-id` e `--identity-token-file`. Per un workload che esegue più di un comando `ant`, usa un [profilo di federazione](https://platform.claude.com/docs/it/manage-claude/wif-reference#profile-configuration-file) invece di flag o variabili d'ambiente: con flag o variabili la CLI scambia nuovamente il token di identità in ogni processo, e i token di identità che portano un claim `jti` (i token di GitHub Actions lo fanno) vengono accettati una sola volta, quindi un secondo comando verrebbe rifiutato; un profilo è anche l'unico modo per fornire alla CLI un `workspace_id` per lo scambio quando la regola è abilitata per tutti i workspace o per più di uno, perché a differenza degli SDK la CLI non passa `ANTHROPIC_WORKSPACE_ID` o `--workspace-id` nello scambio. Ogni SDK accetta inoltre le stesse impostazioni come argomenti espliciti del costruttore, mostrati per ciascun linguaggio in [Costruisci il client SDK](https://platform.claude.com/docs/it/manage-claude/workload-identity-federation#construct-the-sdk-client). Vedi [Variabili d'ambiente](https://platform.claude.com/docs/it/manage-claude/wif-reference#environment-variables) e [Precedenza delle credenziali](https://platform.claude.com/docs/it/manage-claude/wif-reference#credential-precedence) per l'elenco completo e l'ordinamento.
Un workload che chiama l'API con curl scambia da solo il JWT con un bearer token `org:admin` di breve durata, usando lo stesso [scambio di token](https://platform.claude.com/docs/it/manage-claude/workload-identity-federation#authenticate-from-your-workload) di qualsiasi altro workload federato, e lo invia nell'header `authorization: Bearer`.
Con il client configurato (oppure, per curl, con il token emesso in `ANTHROPIC_AUTH_TOKEN`), il workload crea e gestisce la configurazione della federazione usando gli endpoint di questa pagina.
Per le operazioni che un token emesso da un workload può e non può eseguire, vedi [Permessi e vincoli](https://platform.claude.com/docs/it/manage-claude/wif-admin-api#permissions-and-constraints). Se hai già creato issuer, service account o regole con la procedura guidata **Connect workload**, elencali con gli endpoint seguenti e importali nello stato della tua infrastructure-as-code invece di ricrearli.
## Autenticazione
Tutti gli endpoint si trovano sotto `https://api.anthropic.com/v1/organizations/`. Ogni richiesta agli endpoint di federazione e dei service account richiede l'header della versione API e il bearer token:
Negli SDK questi endpoint sono `client.organization.service_accounts` (typescript: `client.organization.serviceAccounts`; csharp, go: `client.Organization.ServiceAccounts`; java: `client.organization().serviceAccounts()`; php: `$client->organization->serviceAccounts`), `client.organization.federation.issuers` (csharp, go: `client.Organization.Federation.Issuers`; java: `client.organization().federation().issuers()`; php: `$client->organization->federation->issuers`) e `client.organization.federation.rules` (csharp, go: `client.Organization.Federation.Rules`; java: `client.organization().federation().rules()`; php: `$client->organization->federation->rules`) (`ant organization:service-accounts`, `federation:issuers` e `federation:rules` nella CLI). Gli esempi SDK e CLI costruiscono il client predefinito, che invia il bearer token da `ANTHROPIC_AUTH_TOKEN` oppure, in un workload automatizzato, esegue da solo lo scambio di federazione come descritto in [Avvia un workload per gestire WIF](https://platform.claude.com/docs/it/manage-claude/wif-admin-api#bootstrap-a-workload-to-manage-wif). I metodi di elenco degli SDK recuperano ulteriori pagine su richiesta, quindi `limit` imposta la dimensione della pagina; gli esempi PHP e Ruby leggono una sola pagina.
```bash cURL
curl --fail-with-body -sS "https://api.anthropic.com/v1/organizations/service_accounts" \
-H "authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
-H "anthropic-version: 2023-06-01"
```
```bash CLI
ant organization:service-accounts list
```
```python Python
client = anthropic.Anthropic()
service_accounts = client.organization.service_accounts.list()
for service_account in service_accounts:
print(f"{service_account.id}: {service_account.name}")
```
```typescript TypeScript
const client = new Anthropic();
for await (const serviceAccount of client.organization.serviceAccounts.list()) {
console.log(`${serviceAccount.id}: ${serviceAccount.name}`);
}
```
```csharp C#
AnthropicClient client = new();
var page = await client.Organization.ServiceAccounts.List();
await foreach (var serviceAccount in page.Paginate())
{
Console.WriteLine($"{serviceAccount.ID}: {serviceAccount.Name}");
}
```
```go Go
client := anthropic.NewClient()
serviceAccounts := client.Organization.ServiceAccounts.ListAutoPaging(context.Background(), anthropic.OrganizationServiceAccountListParams{})
for serviceAccounts.Next() {
serviceAccount := serviceAccounts.Current()
fmt.Printf("%s: %s\n", serviceAccount.ID, serviceAccount.Name)
}
if err := serviceAccounts.Err(); err != nil {
log.Fatal(err)
}
```
```java Java
AnthropicClient client = AnthropicOkHttpClient.fromEnv();
var serviceAccounts = client.organization().serviceAccounts().list();
for (var serviceAccount : serviceAccounts.autoPager()) {
IO.println(serviceAccount.id() + ": " + serviceAccount.name());
}
```
```php PHP
$client = new Client();
$serviceAccounts = $client->organization->serviceAccounts->list();
foreach ($serviceAccounts->getItems() as $serviceAccount) {
echo "{$serviceAccount->id}: {$serviceAccount->name}\n";
}
```
```ruby Ruby
client = Anthropic::Client.new
service_accounts = client.organization.service_accounts.list
service_accounts.data.each do |service_account|
puts "#{service_account.id}: #{service_account.name}"
end
```
Le chiavi Admin API non sono accettate su questi endpoint; gli esempi `x-api-key` della pagina dell'Admin API non si applicano qui.
## Service account
Un [service account](https://platform.claude.com/docs/it/manage-claude/workload-identity-federation#service-accounts) (`svac_...`) è l'identità non umana come cui agisce un token federato. Imposta `organization_role` su `developer`.
Crea un service account:
```bash cURL
curl --fail-with-body -sS "https://api.anthropic.com/v1/organizations/service_accounts" \
-H "authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
-H "anthropic-version: 2023-06-01" \
-H "content-type: application/json" \
-d '{
"name": "inference-worker",
"organization_role": "developer"
}'
```
```bash CLI
ant organization:service-accounts create \
--name inference-worker \
--organization-role developer
```
```python Python
client = anthropic.Anthropic()
service_account = client.organization.service_accounts.create(
name="inference-worker", organization_role="developer"
)
print(f"id: {service_account.id}")
print(f"name: {service_account.name}")
```
```typescript TypeScript
const client = new Anthropic();
const serviceAccount = await client.organization.serviceAccounts.create({
name: "inference-worker",
organization_role: "developer"
});
console.log(`id: ${serviceAccount.id}`);
console.log(`name: ${serviceAccount.name}`);
```
```csharp C#
using Anthropic.Models.Organization.ServiceAccounts;
AnthropicClient client = new();
var serviceAccount = await client.Organization.ServiceAccounts.Create(new()
{
Name = "inference-worker",
OrganizationRole = OrganizationRole.Developer
});
Console.WriteLine($"id: {serviceAccount.ID}");
Console.WriteLine($"name: {serviceAccount.Name}");
```
```go Go
client := anthropic.NewClient()
serviceAccount, err := client.Organization.ServiceAccounts.New(context.Background(), anthropic.OrganizationServiceAccountNewParams{
Name: "inference-worker",
OrganizationRole: anthropic.OrganizationServiceAccountNewParamsOrganizationRoleDeveloper,
})
if err != nil {
log.Fatal(err)
}
fmt.Printf("id: %s\n", serviceAccount.ID)
fmt.Printf("name: %s\n", serviceAccount.Name)
```
```java Java
import com.anthropic.models.organization.serviceaccounts.ServiceAccountCreateParams;
void main() {
AnthropicClient client = AnthropicOkHttpClient.fromEnv();
var params = ServiceAccountCreateParams.builder()
.name("inference-worker")
.organizationRole(ServiceAccountCreateParams.OrganizationRole.DEVELOPER)
.build();
var serviceAccount = client.organization().serviceAccounts().create(params);
IO.println("id: " + serviceAccount.id());
IO.println("name: " + serviceAccount.name());
}
```
```php PHP
use Anthropic\Organization\ServiceAccounts\ServiceAccountCreateParams\OrganizationRole;
// ...
$client = new Client();
$serviceAccount = $client->organization->serviceAccounts->create(
name: 'inference-worker',
organizationRole: OrganizationRole::DEVELOPER,
);
echo "id: {$serviceAccount->id}\n";
echo "name: {$serviceAccount->name}\n";
```
```ruby Ruby
client = Anthropic::Client.new
service_account = client.organization.service_accounts.create(
name: "inference-worker",
organization_role: :developer
)
puts "id: #{service_account.id}"
puts "name: #{service_account.name}"
```
Elenca i service account:
```bash cURL
curl --fail-with-body -sS "https://api.anthropic.com/v1/organizations/service_accounts?limit=20" \
-H "authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
-H "anthropic-version: 2023-06-01"
```
```bash CLI
ant organization:service-accounts list --limit 20
```
```python Python
client = anthropic.Anthropic()
service_accounts = client.organization.service_accounts.list(limit=20)
for service_account in service_accounts:
print(f"{service_account.id}: {service_account.name}")
```
```typescript TypeScript
const client = new Anthropic();
for await (const serviceAccount of client.organization.serviceAccounts.list({
limit: 20
})) {
console.log(`${serviceAccount.id}: ${serviceAccount.name}`);
}
```
```csharp C#
AnthropicClient client = new();
var page = await client.Organization.ServiceAccounts.List(new() { Limit = 20 });
await foreach (var serviceAccount in page.Paginate())
{
Console.WriteLine($"{serviceAccount.ID}: {serviceAccount.Name}");
}
```
```go Go
client := anthropic.NewClient()
serviceAccounts := client.Organization.ServiceAccounts.ListAutoPaging(context.Background(), anthropic.OrganizationServiceAccountListParams{
Limit: anthropic.Int(20),
})
for serviceAccounts.Next() {
serviceAccount := serviceAccounts.Current()
fmt.Printf("%s: %s\n", serviceAccount.ID, serviceAccount.Name)
}
if err := serviceAccounts.Err(); err != nil {
log.Fatal(err)
}
```
```java Java
import com.anthropic.models.organization.serviceaccounts.ServiceAccountListParams;
void main() {
AnthropicClient client = AnthropicOkHttpClient.fromEnv();
var params = ServiceAccountListParams.builder()
.limit(20)
.build();
var serviceAccounts = client.organization().serviceAccounts().list(params);
for (var serviceAccount : serviceAccounts.autoPager()) {
IO.println(serviceAccount.id() + ": " + serviceAccount.name());
}
}
```
```php PHP
$client = new Client();
$serviceAccounts = $client->organization->serviceAccounts->list(limit: 20);
foreach ($serviceAccounts->getItems() as $serviceAccount) {
echo "{$serviceAccount->id}: {$serviceAccount->name}\n";
}
```
```ruby Ruby
client = Anthropic::Client.new
service_accounts = client.organization.service_accounts.list(limit: 20)
service_accounts.data.each do |service_account|
puts "#{service_account.id}: #{service_account.name}"
end
```
Archivia un service account:
```bash cURL
curl --fail-with-body -sS -X POST "https://api.anthropic.com/v1/organizations/service_accounts/svac_01ABCDEFabcdef0123456789XY/archive" \
-H "authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
-H "anthropic-version: 2023-06-01"
```
```bash CLI
ant organization:service-accounts archive svac_01ABCDEFabcdef0123456789XY
```
```python Python
client = anthropic.Anthropic()
service_account = client.organization.service_accounts.archive(
"svac_01ABCDEFabcdef0123456789XY"
)
print(f"id: {service_account.id}")
print(f"archived_at: {service_account.archived_at}")
```
```typescript TypeScript
const client = new Anthropic();
const serviceAccount = await client.organization.serviceAccounts.archive(
"svac_01ABCDEFabcdef0123456789XY"
);
console.log(`id: ${serviceAccount.id}`);
console.log(`archived_at: ${serviceAccount.archived_at}`);
```
```csharp C#
AnthropicClient client = new();
var serviceAccount = await client.Organization.ServiceAccounts.Archive(
"svac_01ABCDEFabcdef0123456789XY"
);
Console.WriteLine($"id: {serviceAccount.ID}");
Console.WriteLine($"archived_at: {serviceAccount.ArchivedAt:O}");
```
```go Go
client := anthropic.NewClient()
serviceAccount, err := client.Organization.ServiceAccounts.Archive(
context.Background(),
"svac_01ABCDEFabcdef0123456789XY",
)
if err != nil {
log.Fatal(err)
}
fmt.Printf("id: %s\n", serviceAccount.ID)
fmt.Printf("archived_at: %s\n", serviceAccount.ArchivedAt)
```
```java Java
AnthropicClient client = AnthropicOkHttpClient.fromEnv();
var serviceAccount = client.organization().serviceAccounts()
.archive("svac_01ABCDEFabcdef0123456789XY");
IO.println("id: " + serviceAccount.id());
IO.println("archived_at: " + serviceAccount.archivedAt().orElseThrow());
```
```php PHP
$client = new Client();
$serviceAccount = $client->organization->serviceAccounts->archive(
serviceAccountID: 'svac_01ABCDEFabcdef0123456789XY',
);
echo "id: {$serviceAccount->id}\n";
echo "archived_at: {$serviceAccount->archivedAt?->format(DATE_ATOM)}\n";
```
```ruby Ruby
client = Anthropic::Client.new
service_account_id = "svac_01ABCDEFabcdef0123456789XY"
service_account = client.organization.service_accounts.archive(service_account_id)
puts "id: #{service_account.id}"
puts "archived_at: #{service_account.archived_at}"
```
L'endpoint di creazione restituisce il nuovo service account:
```json
{
"id": "svac_...",
"name": "inference-worker",
"organization_role": "developer",
"created_at": "...",
"type": "service_account",
"...": "..."
}
```
Per leggere o aggiornare un singolo service account, usa `GET` e `POST` su `/v1/organizations/service_accounts/{service_account_id}`. Un service account deve essere membro di un workspace prima che i token federati possano agire al suo interno. Ogni service account ha un'appartenenza implicita al workspace predefinito della tua organizzazione; aggiungi appartenenze esplicite per altri workspace con `GET`, `POST` e `DELETE` su `/v1/organizations/service_accounts/{service_account_id}/workspaces`, dove `DELETE` ha come target `.../workspaces/{workspace_id}`.
Per i dettagli completi sui parametri e gli schemi di risposta, consulta il [riferimento API dei service account](https://platform.claude.com/docs/it/api/organization/service_accounts).
## Federation issuer
Un [federation issuer](https://platform.claude.com/docs/it/manage-claude/workload-identity-federation#federation-issuers) (`fdis_...`) registra un identity provider OIDC presso la tua organizzazione. Il campo `jwks` è una discriminated union che controlla il modo in cui Anthropic recupera le chiavi di firma del provider:
| Valore `jwks` | Quando usarlo |
| ---------------------------------------- | ------------------------------------------------------------------------------ |
| `{"type": "discovery"}` | Il provider serve `/.well-known/openid-configuration` all'URL dell'issuer. |
| `{"type": "explicit_url", "url": "..."}` | Punta direttamente a un endpoint JWKS. |
| `{"type": "inline", "keys": [...]}` | Carica il set di chiavi per i provider non raggiungibili da internet pubblico. |
Registra un issuer. Questo esempio registra GitHub Actions con discovery JWKS:
```bash cURL
curl --fail-with-body -sS "https://api.anthropic.com/v1/organizations/federation_issuers" \
-H "authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
-H "anthropic-version: 2023-06-01" \
-H "content-type: application/json" \
-d '{
"name": "github-actions",
"issuer_url": "https://token.actions.githubusercontent.com",
"jwks": {"type": "discovery"}
}'
```
```bash CLI
ant organization:federation:issuers create \
--name github-actions \
--issuer-url https://token.actions.githubusercontent.com \
--jwks '{type: discovery}'
```
```python Python
client = anthropic.Anthropic()
issuer = client.organization.federation.issuers.create(
name="github-actions",
issuer_url="https://token.actions.githubusercontent.com",
jwks={"type": "discovery"},
)
print(f"id: {issuer.id}")
print(f"name: {issuer.name}")
print(f"issuer_url: {issuer.issuer_url}")
```
```typescript TypeScript
const client = new Anthropic();
const issuer = await client.organization.federation.issuers.create({
name: "github-actions",
issuer_url: "https://token.actions.githubusercontent.com",
jwks: { type: "discovery" }
});
console.log(`id: ${issuer.id}`);
console.log(`name: ${issuer.name}`);
console.log(`issuer_url: ${issuer.issuer_url}`);
```
```csharp C#
using Anthropic.Models.Organization.Federation.Issuers;
AnthropicClient client = new();
var issuer = await client.Organization.Federation.Issuers.Create(new()
{
Name = "github-actions",
IssuerUrl = "https://token.actions.githubusercontent.com",
Jwks = new JwksDiscovery()
});
Console.WriteLine($"id: {issuer.ID}");
Console.WriteLine($"name: {issuer.Name}");
Console.WriteLine($"issuer_url: {issuer.IssuerUrl}");
```
```go Go
client := anthropic.NewClient()
issuer, err := client.Organization.Federation.Issuers.New(context.Background(), anthropic.OrganizationFederationIssuerNewParams{
Name: "github-actions",
IssuerURL: "https://token.actions.githubusercontent.com",
JWKS: anthropic.OrganizationFederationIssuerNewParamsJWKSUnion{
OfDiscovery: &anthropic.JWKSDiscoveryParam{},
},
})
if err != nil {
log.Fatal(err)
}
fmt.Printf("id: %s\n", issuer.ID)
fmt.Printf("name: %s\n", issuer.Name)
fmt.Printf("issuer_url: %s\n", issuer.IssuerURL)
```
```java Java
import com.anthropic.models.organization.federation.issuers.JwksDiscovery;
import com.anthropic.models.organization.federation.issuers.IssuerCreateParams;
void main() {
AnthropicClient client = AnthropicOkHttpClient.fromEnv();
var params = IssuerCreateParams.builder()
.name("github-actions")
.issuerUrl("https://token.actions.githubusercontent.com")
.jwks(JwksDiscovery.builder().build())
.build();
var issuer = client.organization().federation().issuers().create(params);
IO.println("id: " + issuer.id());
IO.println("name: " + issuer.name());
IO.println("issuer_url: " + issuer.issuerUrl());
}
```
```php PHP
$client = new Client();
$issuer = $client->organization->federation->issuers->create(
name: 'github-actions',
issuerURL: 'https://token.actions.githubusercontent.com',
jwks: ['type' => 'discovery'],
);
echo "id: {$issuer->id}\n";
echo "name: {$issuer->name}\n";
echo "issuer_url: {$issuer->issuerURL}\n";
```
```ruby Ruby
client = Anthropic::Client.new
issuer = client.organization.federation.issuers.create(
name: "github-actions",
issuer_url: "https://token.actions.githubusercontent.com",
jwks: {type: :discovery}
)
puts "id: #{issuer.id}"
puts "name: #{issuer.name}"
puts "issuer_url: #{issuer.issuer_url}"
```
Elenca gli issuer:
```bash cURL
curl --fail-with-body -sS "https://api.anthropic.com/v1/organizations/federation_issuers?limit=20" \
-H "authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
-H "anthropic-version: 2023-06-01"
```
```bash CLI
ant organization:federation:issuers list --limit 20
```
```python Python
client = anthropic.Anthropic()
issuers = client.organization.federation.issuers.list(limit=20)
for issuer in issuers:
print(f"{issuer.id}: {issuer.name}")
```
```typescript TypeScript
const client = new Anthropic();
for await (const issuer of client.organization.federation.issuers.list({ limit: 20 })) {
console.log(`${issuer.id}: ${issuer.name}`);
}
```
```csharp C#
AnthropicClient client = new();
var page = await client.Organization.Federation.Issuers.List(new() { Limit = 20 });
await foreach (var issuer in page.Paginate())
{
Console.WriteLine($"{issuer.ID}: {issuer.Name}");
}
```
```go Go
client := anthropic.NewClient()
issuers := client.Organization.Federation.Issuers.ListAutoPaging(context.Background(), anthropic.OrganizationFederationIssuerListParams{
Limit: anthropic.Int(20),
})
for issuers.Next() {
issuer := issuers.Current()
fmt.Printf("%s: %s\n", issuer.ID, issuer.Name)
}
if err := issuers.Err(); err != nil {
log.Fatal(err)
}
```
```java Java
import com.anthropic.models.organization.federation.issuers.IssuerListParams;
void main() {
AnthropicClient client = AnthropicOkHttpClient.fromEnv();
var params = IssuerListParams.builder()
.limit(20)
.build();
var issuers = client.organization().federation().issuers().list(params);
for (var issuer : issuers.autoPager()) {
IO.println(issuer.id() + ": " + issuer.name());
}
}
```
```php PHP
$client = new Client();
$issuers = $client->organization->federation->issuers->list(limit: 20);
foreach ($issuers->getItems() as $issuer) {
echo "{$issuer->id}: {$issuer->name}\n";
}
```
```ruby Ruby
client = Anthropic::Client.new
issuers = client.organization.federation.issuers.list(limit: 20)
issuers.data.each do |issuer|
puts "#{issuer.id}: #{issuer.name}"
end
```
Archivia un issuer:
```bash cURL
curl --fail-with-body -sS -X POST "https://api.anthropic.com/v1/organizations/federation_issuers/fdis_01ABCDEFabcdef0123456789XY/archive" \
-H "authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
-H "anthropic-version: 2023-06-01"
```
```bash CLI
ant organization:federation:issuers archive \
--federation-issuer-id fdis_01ABCDEFabcdef0123456789XY
```
```python Python
client = anthropic.Anthropic()
issuer = client.organization.federation.issuers.archive(
"fdis_01ABCDEFabcdef0123456789XY"
)
print(f"id: {issuer.id}")
print(f"archived_at: {issuer.archived_at}")
```
```typescript TypeScript
const client = new Anthropic();
const issuer = await client.organization.federation.issuers.archive(
"fdis_01ABCDEFabcdef0123456789XY"
);
console.log(`id: ${issuer.id}`);
console.log(`archived_at: ${issuer.archived_at}`);
```
```csharp C#
AnthropicClient client = new();
var issuer = await client.Organization.Federation.Issuers.Archive(
"fdis_01ABCDEFabcdef0123456789XY"
);
Console.WriteLine($"id: {issuer.ID}");
Console.WriteLine($"archived_at: {issuer.ArchivedAt:O}");
```
```go Go
client := anthropic.NewClient()
issuer, err := client.Organization.Federation.Issuers.Archive(
context.Background(),
"fdis_01ABCDEFabcdef0123456789XY",
)
if err != nil {
log.Fatal(err)
}
fmt.Printf("id: %s\n", issuer.ID)
fmt.Printf("archived_at: %s\n", issuer.ArchivedAt)
```
```java Java
AnthropicClient client = AnthropicOkHttpClient.fromEnv();
var issuer = client.organization().federation().issuers()
.archive("fdis_01ABCDEFabcdef0123456789XY");
IO.println("id: " + issuer.id());
IO.println("archived_at: " + issuer.archivedAt().orElseThrow());
```
```php PHP
$client = new Client();
$issuer = $client->organization->federation->issuers->archive(
federationIssuerID: 'fdis_01ABCDEFabcdef0123456789XY',
);
echo "id: {$issuer->id}\n";
echo "archived_at: {$issuer->archivedAt?->format(DATE_ATOM)}\n";
```
```ruby Ruby
client = Anthropic::Client.new
issuer_id = "fdis_01ABCDEFabcdef0123456789XY"
issuer = client.organization.federation.issuers.archive(issuer_id)
puts "id: #{issuer.id}"
puts "archived_at: #{issuer.archived_at}"
```
Per leggere o aggiornare un singolo issuer, usa `GET` e `POST` su `/v1/organizations/federation_issuers/{issuer_id}`. Un chiamante OAuth non può aggiornare un issuer che supporta una regola il cui `oauth_scope` sia diverso da `workspace:developer` o `workspace:inference`; vedi [Permessi e vincoli](https://platform.claude.com/docs/it/manage-claude/wif-admin-api#permissions-and-constraints).
Per i dettagli completi sui parametri e gli schemi di risposta, consulta il [riferimento API dei federation issuer](https://platform.claude.com/docs/it/api/organization/federation/issuers).
## Federation rule
Una [federation rule](https://platform.claude.com/docs/it/manage-claude/workload-identity-federation#federation-rules) (`fdrl_...`) associa un issuer a un service account: i JWT dell'issuer che soddisfano le condizioni di corrispondenza della regola possono emettere token che agiscono come il target della regola. Il `workspace_id` nella richiesta di creazione abilita la regola in quel workspace al momento della creazione; aggiungi altri workspace in seguito tramite la sotto-risorsa `/federation_rules/{rule_id}/workspaces`. In fase di creazione è richiesto `workspace_id` oppure `applies_to_all_workspaces: true`.
Crea una regola. Questo esempio consente ai deploy di GitHub Actions dal branch main di agire come il service account:
```bash cURL
curl --fail-with-body -sS "https://api.anthropic.com/v1/organizations/federation_rules" \
-H "authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
-H "anthropic-version: 2023-06-01" \
-H "content-type: application/json" \
-d '{
"name": "gha-deploy",
"issuer_id": "fdis_01ABCDEFabcdef0123456789XY",
"match": {
"subject_prefix": "repo:my-org/my-repo:ref:refs/heads/main",
"claims": {"repository_owner": "my-org"}
},
"target": {
"type": "service_account",
"service_account_id": "svac_01ABCDEFabcdef0123456789XY"
},
"workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
"oauth_scope": "workspace:developer",
"token_lifetime_seconds": 600
}'
```
```bash CLI
ant organization:federation:rules create <<'YAML'
name: gha-deploy
issuer_id: fdis_01ABCDEFabcdef0123456789XY
match:
subject_prefix: "repo:my-org/my-repo:ref:refs/heads/main"
claims:
repository_owner: my-org
target:
type: service_account
service_account_id: svac_01ABCDEFabcdef0123456789XY
workspace_id: wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ
oauth_scope: "workspace:developer"
token_lifetime_seconds: 600
YAML
```
```python Python
client = anthropic.Anthropic()
rule = client.organization.federation.rules.create(
name="gha-deploy",
issuer_id="fdis_01ABCDEFabcdef0123456789XY",
match={
"subject_prefix": "repo:my-org/my-repo:ref:refs/heads/main",
"claims": {"repository_owner": "my-org"},
},
target={
"type": "service_account",
"service_account_id": "svac_01ABCDEFabcdef0123456789XY",
},
workspace_id="wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
oauth_scope="workspace:developer",
token_lifetime_seconds=600,
)
print(f"id: {rule.id}")
print(f"name: {rule.name}")
```
```typescript TypeScript
const client = new Anthropic();
const rule = await client.organization.federation.rules.create({
name: "gha-deploy",
issuer_id: "fdis_01ABCDEFabcdef0123456789XY",
match: {
subject_prefix: "repo:my-org/my-repo:ref:refs/heads/main",
claims: { repository_owner: "my-org" }
},
target: {
type: "service_account",
service_account_id: "svac_01ABCDEFabcdef0123456789XY"
},
workspace_id: "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
oauth_scope: "workspace:developer",
token_lifetime_seconds: 600
});
console.log(`id: ${rule.id}`);
console.log(`name: ${rule.name}`);
```
```csharp C#
AnthropicClient client = new();
var rule = await client.Organization.Federation.Rules.Create(new()
{
Name = "gha-deploy",
IssuerID = "fdis_01ABCDEFabcdef0123456789XY",
Match = new()
{
SubjectPrefix = "repo:my-org/my-repo:ref:refs/heads/main",
Claims = new Dictionary { ["repository_owner"] = "my-org" }
},
Target = new() { ServiceAccountID = "svac_01ABCDEFabcdef0123456789XY" },
WorkspaceID = "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
OAuthScope = "workspace:developer",
TokenLifetimeSeconds = 600
});
Console.WriteLine($"id: {rule.ID}");
Console.WriteLine($"name: {rule.Name}");
```
```go Go
client := anthropic.NewClient()
rule, err := client.Organization.Federation.Rules.New(context.Background(), anthropic.OrganizationFederationRuleNewParams{
Name: "gha-deploy",
IssuerID: "fdis_01ABCDEFabcdef0123456789XY",
Match: anthropic.FederationRuleMatchParam{
SubjectPrefix: anthropic.String("repo:my-org/my-repo:ref:refs/heads/main"),
Claims: map[string]string{"repository_owner": "my-org"},
},
Target: anthropic.ServiceAccountTargetParam{
ServiceAccountID: "svac_01ABCDEFabcdef0123456789XY",
},
WorkspaceID: anthropic.String("wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"),
OAuthScope: "workspace:developer",
TokenLifetimeSeconds: anthropic.Int(600),
})
if err != nil {
log.Fatal(err)
}
fmt.Printf("id: %s\n", rule.ID)
fmt.Printf("name: %s\n", rule.Name)
```
```java Java
import com.anthropic.core.JsonValue;
import com.anthropic.models.organization.federation.rules.FederationRuleMatch;
import com.anthropic.models.organization.federation.rules.ServiceAccountTarget;
import com.anthropic.models.organization.federation.rules.RuleCreateParams;
void main() {
AnthropicClient client = AnthropicOkHttpClient.fromEnv();
var match = FederationRuleMatch.builder()
.subjectPrefix("repo:my-org/my-repo:ref:refs/heads/main")
.claims(FederationRuleMatch.Claims.builder()
.putAdditionalProperty("repository_owner", JsonValue.from("my-org"))
.build())
.build();
var params = RuleCreateParams.builder()
.name("gha-deploy")
.issuerId("fdis_01ABCDEFabcdef0123456789XY")
.match(match)
.target(ServiceAccountTarget.of("svac_01ABCDEFabcdef0123456789XY"))
.workspaceId("wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ")
.oauthScope("workspace:developer")
.tokenLifetimeSeconds(600)
.build();
var rule = client.organization().federation().rules().create(params);
IO.println("id: " + rule.id());
IO.println("name: " + rule.name());
}
```
```php PHP
$client = new Client();
$rule = $client->organization->federation->rules->create(
name: 'gha-deploy',
issuerID: 'fdis_01ABCDEFabcdef0123456789XY',
match: [
'subjectPrefix' => 'repo:my-org/my-repo:ref:refs/heads/main',
'claims' => ['repository_owner' => 'my-org'],
],
target: [
'type' => 'service_account',
'serviceAccountID' => 'svac_01ABCDEFabcdef0123456789XY',
],
workspaceID: 'wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ',
oauthScope: 'workspace:developer',
tokenLifetimeSeconds: 600,
);
echo "id: {$rule->id}\n";
echo "name: {$rule->name}\n";
```
```ruby Ruby
client = Anthropic::Client.new
rule = client.organization.federation.rules.create(
name: "gha-deploy",
issuer_id: "fdis_01ABCDEFabcdef0123456789XY",
match: {
subject_prefix: "repo:my-org/my-repo:ref:refs/heads/main",
claims: {repository_owner: "my-org"}
},
target: {
type: :service_account,
service_account_id: "svac_01ABCDEFabcdef0123456789XY"
},
workspace_id: "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
oauth_scope: "workspace:developer",
token_lifetime_seconds: 600
)
puts "id: #{rule.id}"
puts "name: #{rule.name}"
```
Elenca le regole, facoltativamente filtrate per issuer:
```bash cURL
curl --fail-with-body -sS "https://api.anthropic.com/v1/organizations/federation_rules?issuer_id=fdis_01ABCDEFabcdef0123456789XY" \
-H "authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
-H "anthropic-version: 2023-06-01"
```
```bash CLI
ant organization:federation:rules list \
--issuer-id fdis_01ABCDEFabcdef0123456789XY
```
```python Python
client = anthropic.Anthropic()
rules = client.organization.federation.rules.list(
issuer_id="fdis_01ABCDEFabcdef0123456789XY"
)
for rule in rules:
print(f"{rule.id}: {rule.name}")
```
```typescript TypeScript
const client = new Anthropic();
for await (const rule of client.organization.federation.rules.list({
issuer_id: "fdis_01ABCDEFabcdef0123456789XY"
})) {
console.log(`${rule.id}: ${rule.name}`);
}
```
```csharp C#
AnthropicClient client = new();
var page = await client.Organization.Federation.Rules.List(new()
{
IssuerID = "fdis_01ABCDEFabcdef0123456789XY"
});
await foreach (var rule in page.Paginate())
{
Console.WriteLine($"{rule.ID}: {rule.Name}");
}
```
```go Go
client := anthropic.NewClient()
rules := client.Organization.Federation.Rules.ListAutoPaging(context.Background(), anthropic.OrganizationFederationRuleListParams{
IssuerID: anthropic.String("fdis_01ABCDEFabcdef0123456789XY"),
})
for rules.Next() {
rule := rules.Current()
fmt.Printf("%s: %s\n", rule.ID, rule.Name)
}
if err := rules.Err(); err != nil {
log.Fatal(err)
}
```
```java Java
import com.anthropic.models.organization.federation.rules.RuleListParams;
void main() {
AnthropicClient client = AnthropicOkHttpClient.fromEnv();
var params = RuleListParams.builder()
.issuerId("fdis_01ABCDEFabcdef0123456789XY")
.build();
var rules = client.organization().federation().rules().list(params);
for (var rule : rules.autoPager()) {
IO.println(rule.id() + ": " + rule.name());
}
}
```
```php PHP
$client = new Client();
$rules = $client->organization->federation->rules->list(
issuerID: 'fdis_01ABCDEFabcdef0123456789XY',
);
foreach ($rules->getItems() as $rule) {
echo "{$rule->id}: {$rule->name}\n";
}
```
```ruby Ruby
client = Anthropic::Client.new
rules = client.organization.federation.rules.list(
issuer_id: "fdis_01ABCDEFabcdef0123456789XY"
)
rules.data.each do |rule|
puts "#{rule.id}: #{rule.name}"
end
```
Archivia una regola:
```bash cURL
curl --fail-with-body -sS -X POST "https://api.anthropic.com/v1/organizations/federation_rules/fdrl_01ABCDEFabcdef0123456789XY/archive" \
-H "authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
-H "anthropic-version: 2023-06-01"
```
```bash CLI
ant organization:federation:rules archive \
--federation-rule-id fdrl_01ABCDEFabcdef0123456789XY
```
```python Python
client = anthropic.Anthropic()
rule = client.organization.federation.rules.archive("fdrl_01ABCDEFabcdef0123456789XY")
print(f"id: {rule.id}")
print(f"archived_at: {rule.archived_at}")
```
```typescript TypeScript
const client = new Anthropic();
const rule = await client.organization.federation.rules.archive(
"fdrl_01ABCDEFabcdef0123456789XY"
);
console.log(`id: ${rule.id}`);
console.log(`archived_at: ${rule.archived_at}`);
```
```csharp C#
AnthropicClient client = new();
var rule = await client.Organization.Federation.Rules.Archive(
"fdrl_01ABCDEFabcdef0123456789XY"
);
Console.WriteLine($"id: {rule.ID}");
Console.WriteLine($"archived_at: {rule.ArchivedAt:O}");
```
```go Go
client := anthropic.NewClient()
rule, err := client.Organization.Federation.Rules.Archive(
context.Background(),
"fdrl_01ABCDEFabcdef0123456789XY",
)
if err != nil {
log.Fatal(err)
}
fmt.Printf("id: %s\n", rule.ID)
fmt.Printf("archived_at: %s\n", rule.ArchivedAt)
```
```java Java
AnthropicClient client = AnthropicOkHttpClient.fromEnv();
var rule = client.organization().federation().rules()
.archive("fdrl_01ABCDEFabcdef0123456789XY");
IO.println("id: " + rule.id());
IO.println("archived_at: " + rule.archivedAt().orElseThrow());
```
```php PHP
$client = new Client();
$rule = $client->organization->federation->rules->archive(
federationRuleID: 'fdrl_01ABCDEFabcdef0123456789XY',
);
echo "id: {$rule->id}\n";
echo "archived_at: {$rule->archivedAt?->format(DATE_ATOM)}\n";
```
```ruby Ruby
client = Anthropic::Client.new
rule_id = "fdrl_01ABCDEFabcdef0123456789XY"
rule = client.organization.federation.rules.archive(rule_id)
puts "id: #{rule.id}"
puts "archived_at: #{rule.archived_at}"
```
L'endpoint di elenco restituisce una pagina di regole e il cursore per la pagina successiva:
```json
{
"data": [{ "id": "fdrl_...", "name": "gha-deploy", "...": "..." }],
"next_page": "..."
}
```
Per leggere o aggiornare una singola regola, usa `GET` e `POST` su `/v1/organizations/federation_rules/{rule_id}`. Per gestire i workspace in cui una regola può emettere token, usa `GET` e `POST` su `/v1/organizations/federation_rules/{rule_id}/workspaces`, e `DELETE` su `/v1/organizations/federation_rules/{rule_id}/workspaces/{workspace_id}`.
Per i dettagli completi sui parametri e gli schemi di risposta, consulta il [riferimento API delle federation rule](https://platform.claude.com/docs/it/api/organization/federation/rules).
## Permessi e vincoli
* I chiamanti autenticati tramite OAuth possono creare o modificare solo regole il cui `oauth_scope` sia `workspace:developer` o `workspace:inference`. Per creare o modificare una regola con qualsiasi altro scope (come `org:admin` o `workspace:manage_tunnels`), usa la Console.
* Un chiamante OAuth non può aggiornare un federation issuer che supporta una regola il cui `oauth_scope` sia diverso da `workspace:developer` o `workspace:inference` (come `org:admin` o `workspace:manage_tunnels`). Valuta di registrare un issuer dedicato per la regola di bootstrap, in modo che gli issuer dietro le regole con scope di workspace restino aggiornabili tramite l'API.
* Le chiavi Admin API non sono accettate su questi endpoint, né per le letture né per le scritture; usa un token OAuth `org:admin`.
Una regola con `oauth_scope: org:admin` deve avere come target un service account il cui `organization_role` sia `admin`. I nomi delle risorse devono corrispondere a `^[a-z0-9-]+$`, avere da 1 a 255 caratteri ed essere univoci all'interno di un'organizzazione per ciascun tipo di risorsa; per i vincoli completi a livello di campo, vedi [Regole di validazione](https://platform.claude.com/docs/it/manage-claude/wif-reference#validation-rules).
## Paginazione e archiviazione
Gli endpoint di elenco dei service account, dei federation issuer e delle federation rule accettano `limit` (da 1 a 100, predefinito 20) e un cursore `page` preso dalla risposta precedente. Passa il valore `next_page` della risposta come parametro di query `page` nella richiesta successiva. L'elenco della sotto-risorsa dei workspace di una regola restituisce l'insieme completo senza paginazione. Le risorse archiviate sono nascoste dagli elenchi per impostazione predefinita; passa `include_archived=true` per includerle.
L'archiviazione è un soft delete ed è idempotente: archiviare una risorsa già archiviata ha esito positivo. L'archiviazione di un issuer o di un service account restituisce `400` finché una federation rule attiva vi fa ancora riferimento; archivia prima la regola.
## Vedi anche
* [Workload Identity Federation](https://platform.claude.com/docs/it/manage-claude/workload-identity-federation): concetti e procedura guidata di configurazione nella Console
* [Riferimento WIF](https://platform.claude.com/docs/it/manage-claude/wif-reference): variabili d'ambiente, regole di validazione, scope OAuth e codici di errore
* [Admin API](https://platform.claude.com/docs/it/manage-claude/admin-api): il resto della superficie di gestione dell'organizzazione
* [Riferimento dell'Admin API](https://platform.claude.com/docs/it/api/organization): schemi di richiesta e risposta generati per gli endpoint dei service account e di federazione