Claude Platform Docs

更新聯合規則

$ ant organization:federation:rules update
POST/v1/organizations/federation_rules/{federation_rule_id}

需要具有 org:admin 範圍的 OAuth 存取權杖，可透過 ant auth login --scope org:admin 或工作負載身分聯合（workload identity federation）規則取得；不接受 Admin API 金鑰。請參閱使用 Admin API 管理 WIF。

部分更新聯合規則。

issuer_id 無法變更。設定 match 和 target 時，會以整個物件取代。所參照的服務帳戶與工作區必須存在於您的組織中；無效的參照會以 400 錯誤拒絕。已封存的規則無法更新；此操作會傳回 400。請改為建立新的規則。位於知名共用簽發者（GitHub Actions、GitLab、Buildkite、Terraform Cloud、Google）上的規則，必須透過帶有身分的宣告、固定租用戶的主體前綴（例如 repo:YOUR_ORG/...），或參照上述身分宣告之一的 CEL 條件（例如 claims.repository_owner）來限制租用戶身分。在這些簽發者上，每次更新都會重新檢查此要求；若現有規則儲存的比對條件尚未限制租用戶身分，則任何更新（即使只是重新命名或變更描述）都必須在同一請求中一併提供符合規定的 match。OAuth 呼叫者只能管理 oauth_scope 為 workspace:developer 或 workspace:inference 的規則；其他範圍需要 Console 工作階段。

Parameters
--federation-rule-id: string⁠Path parameter

ID of the federation rule to update.

--applies-to-all-workspaces: optional boolean

When true, enables this rule for every workspace in the org (including workspaces created later). Setting false is rejected with 400 if no workspace would remain enabled; a rule with only a legacy workspace_id binding continues to mint.

--description: optional string

Replaces the description. Omit to leave unchanged; send null to clear (the field is stored as an empty string).

maxLength2000
--match: optional object{ audience, claims, condition, subject_prefix }

Replaces the entire match object. All populated matcher fields must pass.

--name: optional string

Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.

minLength1
maxLength255
--oauth-scope: optional string

Replaces the space-separated OAuth scopes granted on minted tokens. OAuth callers may only set workspace:developer or workspace:inference; other scopes (such as org:admin) require a Console session.

minLength1
--target: optional object{ service_account_id, type, service_account_name }

Replaces the entire target object. Currently always a service_account target.

--token-lifetime-seconds: optional number

Replaces the lifetime in seconds for access tokens minted via this rule (60-86400). Minted tokens are capped at max(60, min(this value, 2 × remaining assertion validity)) seconds.

minimum60
maximum86400
--workspace-id: optional string

Replaces the existing single workspace enablement (the previous one is removed). Rejected with 400 if the rule is enabled for more than one workspace; use the /federation_rules/{federation_rule_id}/workspaces sub-resource instead.

Returns
federation_rule: object{ type: "federation_rule", id, applies_to_all_workspaces, 15 more }

Authorization rule binding an external OIDC identity to Anthropic.

Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to a single workspace where the rule is enabled (chosen by the caller at exchange time when the rule is enabled for more than one). For rules enabled via workspace_ids or applies_to_all_workspaces, the target service account must be a member of that workspace (it is implicitly a member of the default workspace); rules carrying only the legacy workspace_id binding do not enforce this.

type: "federation_rule"
id: string

Tagged ID of the federation rule.

applies_to_all_workspaces: boolean

When true, this rule is enabled for every workspace in the org (including ones created after the rule). workspace_ids is ignored at exchange time.

archived_at: string

If set, this rule is archived and rejects token exchange.

formatdate-time
archived_by_actor_id: string

Tagged ID (user_/svac_) of the actor that archived this rule.

created_at: string

When this rule was created.

formatdate-time
created_by_actor_id: string

Tagged ID (user_/svac_) of the actor that created this rule.

description: string

Optional free-text description.

issuer_id: string

Tagged ID of the issuer whose tokens this rule accepts.

issuer_name: string

Issuer's display name at read time.

match: object{ audience, claims, condition, subject_prefix }

Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.

audience: optional string

Exact match against the aud claim (any element if array). When omitted, the JWT's aud must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.

maxLength1024
claims: optional map[string]

Exact-match {claim: value} pairs against top-level claims. Only string-valued claims can be matched; use condition for non-string claims.

condition: optional string

CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the claims variable; a constant-true expression (such as true) is rejected with 400.

maxLength4096
subject_prefix: optional string

Match the verified JWT sub claim. Exact match unless the value ends with *, in which case it is a prefix match. Example: repo:my-org/my-repo:ref:refs/heads/main.

maxLength1024
name: string

Admin-chosen slug identifier.

oauth_scope: string

Space-separated OAuth scopes granted on the minted token.

target: object{ type: "service_account", service_account_id, service_account_name }

What this rule targets. Check type before reading the other fields. Tokens minted via a rule whose target type is service_account act as that service account.

type: "service_account"
service_account_id: string

Tagged ID of the service account to mint tokens for.

service_account_name: optional string

Service account's display name at read time. Ignored on writes.

token_lifetime_seconds: number

Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at max(60, min(this value, 2 × remaining assertion validity)) seconds.

updated_at: string

When this rule was last updated.

formatdate-time
updated_by_actor_id: string

Tagged ID (user_/svac_) of the actor that last updated this rule.

workspace_ids: array of string

Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy workspace_id binding. Ignored at exchange time when applies_to_all_workspaces is true (the list may still be non-empty).

更新聯合規則
ant organization:federation:rules update \
  --api-key my-anthropic-api-key \
  --federation-rule-id federation_rule_id
Returns Examples
Response 200
{
  "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
  "applies_to_all_workspaces": true,
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "attributes": {
    "foo": "string"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "issuer_id": "issuer_id",
  "issuer_name": "issuer_name",
  "match": {
    "audience": "audience",
    "claims": {
      "foo": "string"
    },
    "condition": "condition",
    "subject_prefix": "subject_prefix"
  },
  "name": "prod-deploy-pipeline",
  "oauth_scope": "oauth_scope",
  "target": {
    "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
    "type": "service_account",
    "service_account_name": "service_account_name"
  },
  "token_lifetime_seconds": 0,
  "type": "federation_rule",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id",
  "workspace_id": "workspace_id",
  "workspace_ids": [
    "string"
  ]
}