規則

建立聯合規則

$ ant organization:federation:rules create

POST/v1/organizations/federation_rules

需要具有 org:admin 範圍的 OAuth 存取權杖，可透過 ant auth login --scope org:admin 或工作負載身分聯合（workload identity federation）規則取得；不接受 Admin API 金鑰。請參閱使用 Admin API 管理 WIF。

列出聯合規則

$ ant organization:federation:rules list

GET/v1/organizations/federation_rules

取得聯合規則

$ ant organization:federation:rules retrieve

GET/v1/organizations/federation_rules/{federation_rule_id}

更新聯合規則

$ ant organization:federation:rules update

POST/v1/organizations/federation_rules/{federation_rule_id}

封存聯合規則

$ ant organization:federation:rules archive

POST/v1/organizations/federation_rules/{federation_rule_id}/archive

Models

federation_rule: object{ type: "federation_rule", id, applies_to_all_workspaces, 15 more }

Authorization rule binding an external OIDC identity to Anthropic.

Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to a single workspace where the rule is enabled (chosen by the caller at exchange time when the rule is enabled for more than one). For rules enabled via workspace_ids or applies_to_all_workspaces, the target service account must be a member of that workspace (it is implicitly a member of the default workspace); rules carrying only the legacy workspace_id binding do not enforce this.

federation_rule_match: object{ audience, claims, condition, subject_prefix }

Does the incoming JWT qualify?

All populated fields must pass; omitted fields are skipped. At least one of subject_prefix (other than a wildcard-only value like *), claims, or condition is required; audience alone is not sufficient.

audience: optional string

Exact match against the aud claim (any element if array). When omitted, the JWT's aud must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.

maxLength1024

claims: optional map[string]

Exact-match {claim: value} pairs against top-level claims. Only string-valued claims can be matched; use condition for non-string claims.

condition: optional string

CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the claims variable; a constant-true expression (such as true) is rejected with 400.

maxLength4096

subject_prefix: optional string

Match the verified JWT sub claim. Exact match unless the value ends with *, in which case it is a prefix match. Example: repo:my-org/my-repo:ref:refs/heads/main.

maxLength1024

federation_rule_workspace: object{ type: "federation_rule_workspace", created_at, created_by_actor_id, 3 more }

type: "federation_rule_workspace"

created_at: string

When this workspace was enabled for the rule.

formatdate-time

created_by_actor_id: string

Tagged ID (user_... or svac_...) of the actor that enabled this workspace for the rule, if known.

federation_rule_id: string

Tagged ID of the federation rule.

workspace_id: string

Tagged ID of the workspace this rule is enabled for.

workspace_name: string

Workspace display name. Populated when listing; null in the enable response.

service_account_target: object{ type: "service_account", service_account_id, service_account_name }

Bind to a fixed service account by ID.

type: "service_account"

service_account_id: string

Tagged ID of the service account to mint tokens for.

service_account_name: optional string

Service account's display name at read time. Ignored on writes.

規則

建立聯合規則

列出聯合規則

取得聯合規則

更新聯合規則

封存聯合規則

Models

規則工作區

新增聯合規則工作區

列出聯合規則工作區

移除聯合規則工作區

規則

Models

規則工作區

規則工作區