---
title: 使用 Admin API 管理 WIF
url: https://platform.claude.com/docs/zh-TW/manage-claude/wif-admin-api
description: 以程式化方式建立和管理 Workload Identity Federation 服務帳戶、簽發者和規則，適用於基礎架構即程式碼和 CI 工作流程。
---

Admin API 讓您能以程式化方式建立和管理 [Workload Identity Federation](https://platform.claude.com/docs/zh-TW/manage-claude/workload-identity-federation)（工作負載身分聯合）資源，包括「service account」（服務帳戶）、「federation issuer」（聯合簽發者）和「federation rule」（聯合規則）。您可以用它將聯合設定保存在「infrastructure as code」（基礎架構即程式碼）中、從 CI 佈建設定，並在多個組織之間重現相同設定，而不必在 Claude Console 中逐一點選操作。這些端點與 [Admin API](https://platform.claude.com/docs/zh-TW/manage-claude/admin-api) 的其餘部分共用 `/v1/organizations` 路徑前綴。

## 先決條件

本頁上的每個請求都使用帶有 `org:admin` 範圍的 OAuth「bearer token」（持有人權杖）進行驗證。此範圍僅授予具有管理員、擁有者或主要擁有者角色的組織成員。它授予的是整個組織的存取權，因此任何工作區綁定都會被忽略。取得權杖的方式有兩種，兩者的權限不同：透過您自己登入取得的權杖以使用者身分運作；聯合權杖則以服務帳戶身分運作，無法執行本頁上的所有操作。

### 互動式（您的終端機）

使用 [`ant` CLI](https://platform.claude.com/docs/zh-TW/cli-sdks-libraries/cli/quickstart) 以專用設定檔登入並請求 `org:admin` 範圍（請參閱[管理員存取](https://platform.claude.com/docs/zh-TW/cli-sdks-libraries/cli/authentication#admin-access)），然後匯出持有人權杖。使用 `--profile admin` 登入時，`org:admin` 憑證會儲存在該設定檔名稱下，該設定檔也會成為 CLI 的作用中設定檔。此外，匯出的變數會套用至該 shell 中的每個 SDK 和 CLI 呼叫。因此，請使用專門保留給管理工作的 shell，完成後取消設定該變數，並使用 `ant profile activate default` 將 CLI 切換回預設設定檔：

```bash CLI
ant auth login --profile admin --scope "org:admin"
export ANTHROPIC_AUTH_TOKEN=$(ant auth print-credentials --profile admin --access-token)
```

互動式權杖的有效期很短。如果請求開始傳回 401，請重新執行匯出命令，它會自動重新整理權杖。

SDK 和 `ant` CLI 會自動讀取 `ANTHROPIC_AUTH_TOKEN`。請勿在同一個 shell 中設定 `ANTHROPIC_API_KEY`，因為這些端點會拒絕 API 金鑰，而某些用戶端在兩者都已設定時會優先使用金鑰。

### 工作負載（CI 與自動化）

建立一條 `oauth_scope: org:admin` 的聯合規則，並以 `organization_role` 為 `admin` 的服務帳戶作為目標。這條規則本身必須在 Claude Console 中建立：授予工作負載組織管理員存取權必須由人員刻意執行，自動化流程無法自行完成這項引導設定。下一節將逐步說明這項每個組織只需執行一次的設定。

## 引導工作負載以管理 WIF

只需一條在 Console 中建立的規則，就能將其餘的聯合設定納入基礎架構即程式碼管理。做法是授予單一受信任的工作負載 `org:admin` 範圍，再由該工作負載透過此 API 管理聯合簽發者和所有工作區範圍的聯合規則。

<Steps>
  <Step title="在 Console 中建立 org:admin 規則">
    在 Claude Console 中，前往 [Workload identity](https://platform.claude.com/settings/workload-identity-federation) 頁面（`platform.claude.com/settings/workload-identity-federation`），然後選取 **Connect workload**，為您的自動化工作負載建立一條聯合規則，例如您基礎架構儲存庫中的 GitHub Actions 工作流程。在 **Advanced rule options** 下，將規則的 OAuth 範圍設定為 `org:admin`：精靈接著會以 Admin 組織角色建立新的服務帳戶（或要求您選擇現有的管理員服務帳戶作為目標）。

    <Warning>
      請將規則比對至單一確切的工作負載身分，而非廣泛的模式。除非 `subject_prefix` 以 `*` 結尾，否則它採用完全比對。對於 GitHub Actions，請將 subject 固定到受保護的分支，例如 `repo:my-org/my-repo:ref:refs/heads/main`。像 `repo:my-org/my-repo:*` 這樣的尾端萬用字元也會比對到 `pull_request` 執行，包括從 fork 觸發的執行。如此一來，任何能對該儲存庫開啟 pull request 的人都可能鑄造 `org:admin` 權杖。請參閱[限制哪些工作流程可以進行驗證](https://platform.claude.com/docs/zh-TW/manage-claude/wif-providers/github-actions#restrict-which-workflows-can-authenticate)。
    </Warning>
  </Step>

  <Step title="交換工作負載的身分權杖">
    使用 SDK 或 `ant` CLI 的工作負載不需要自行執行交換。請透過聯合環境變數將用戶端指向該規則，並以不帶任何引數的方式建構用戶端，做法與[建構 SDK 用戶端](https://platform.claude.com/docs/zh-TW/manage-claude/workload-identity-federation#construct-the-sdk-client)中的推論用法完全相同。用戶端會在第一個請求時交換身分權杖，並在取得的存取權杖到期前重新讀取身分權杖並再次交換：

    ```bash
    export ANTHROPIC_FEDERATION_RULE_ID=fdrl_...        # the org:admin rule from step 1
    export ANTHROPIC_ORGANIZATION_ID=00000000-0000-0000-0000-000000000000
    export ANTHROPIC_SERVICE_ACCOUNT_ID=svac_...       # the rule's target service account
    export ANTHROPIC_IDENTITY_TOKEN_FILE=/path/to/jwt  # or ANTHROPIC_IDENTITY_TOKEN
    # 僅當規則對所有工作區或多個工作區啟用時，才需要 ANTHROPIC_WORKSPACE_ID；
    # org:admin 端點會忽略此繫結。
    unset ANTHROPIC_API_KEY ANTHROPIC_AUTH_TOKEN       # both take precedence over federation
    ```

    `ant` CLI 會讀取相同的變數，也可以改用 `--federation-rule`、`--organization-id`、`--service-account-id` 和 `--identity-token-file` 旗標。如果工作負載會執行多個 `ant` 命令，請使用[聯合設定檔](https://platform.claude.com/docs/zh-TW/manage-claude/wif-reference#profile-configuration-file)，而非旗標或環境變數，原因有二：

    * 使用旗標或變數時，CLI 會在每個程序中重新交換身分權杖。帶有 `jti` 宣告的身分權杖（例如 GitHub Actions 權杖）只會被接受一次，因此第二個命令會遭到拒絕。
    * 當規則對所有工作區或多個工作區啟用時，設定檔是為 CLI 提供交換所需 `workspace_id` 的唯一方式。與 SDK 不同，CLI 不會將 `ANTHROPIC_WORKSPACE_ID` 或 `--workspace-id` 傳入交換。

    每個 SDK 也接受以明確建構函式引數提供相同設定，各語言的寫法請參閱[建構 SDK 用戶端](https://platform.claude.com/docs/zh-TW/manage-claude/workload-identity-federation#construct-the-sdk-client)。完整清單和優先順序請參閱[環境變數](https://platform.claude.com/docs/zh-TW/manage-claude/wif-reference#environment-variables)和[憑證優先順序](https://platform.claude.com/docs/zh-TW/manage-claude/wif-reference#credential-precedence)。

    使用 curl 呼叫 API 的工作負載則需自行將 JWT 交換為短期的 `org:admin` 持有人權杖，所用的[權杖交換](https://platform.claude.com/docs/zh-TW/manage-claude/workload-identity-federation#authenticate-from-your-workload)與其他聯合工作負載相同，並在 `authorization: Bearer` 標頭中傳送該權杖。
  </Step>

  <Step title="透過 API 管理簽發者和工作區範圍的規則">
    設定好用戶端後（若使用 curl，則將鑄造的權杖放入 `ANTHROPIC_AUTH_TOKEN`），工作負載即可使用本頁上的端點建立和管理您的聯合設定。
  </Step>
</Steps>

關於工作負載鑄造的權杖能執行和不能執行哪些操作，請參閱[權限與限制](https://platform.claude.com/docs/zh-TW/manage-claude/wif-admin-api#permissions-and-constraints)。如果您已經使用 **Connect workload** 精靈建立了簽發者、服務帳戶或規則，請使用下列端點列出這些資源，並將其匯入您的基礎架構即程式碼狀態，而不要重新建立。

## 驗證

所有端點都位於 `https://api.anthropic.com/v1/organizations/` 之下。對聯合和服務帳戶端點的每個請求都需要 API 版本標頭和持有人權杖：

在 SDK 中，這些端點為 `client.organization.service_accounts` (typescript: `client.organization.serviceAccounts`; csharp, go: `client.Organization.ServiceAccounts`; java: `client.organization().serviceAccounts()`; php: `$client->organization->serviceAccounts`)、`client.organization.federation.issuers` (csharp, go: `client.Organization.Federation.Issuers`; java: `client.organization().federation().issuers()`; php: `$client->organization->federation->issuers`) 和 `client.organization.federation.rules` (csharp, go: `client.Organization.Federation.Rules`; java: `client.organization().federation().rules()`; php: `$client->organization->federation->rules`)（在 CLI 中為 `ant organization:service-accounts`、`federation:issuers` 和 `federation:rules`）。SDK 和 CLI 範例會建構預設用戶端，該用戶端會傳送來自 `ANTHROPIC_AUTH_TOKEN` 的持有人權杖，或者在自動化工作負載中，如[引導工作負載以管理 WIF](https://platform.claude.com/docs/zh-TW/manage-claude/wif-admin-api#bootstrap-a-workload-to-manage-wif) 所述自行執行聯合交換。SDK 的列出方法會視需要擷取後續頁面，因此 `limit` 設定的是頁面大小；PHP 和 Ruby 範例只讀取一頁。

<CodeGroup>
  ```bash cURL
  curl --fail-with-body -sS "https://api.anthropic.com/v1/organizations/service_accounts" \
    -H "authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
    -H "anthropic-version: 2023-06-01"
  ```

  ```bash CLI
  ant organization:service-accounts list
  ```

  ```python Python
  client = anthropic.Anthropic()

  service_accounts = client.organization.service_accounts.list()

  for service_account in service_accounts:
      print(f"{service_account.id}: {service_account.name}")
  ```

  ```typescript TypeScript
  const client = new Anthropic();

  for await (const serviceAccount of client.organization.serviceAccounts.list()) {
    console.log(`${serviceAccount.id}: ${serviceAccount.name}`);
  }
  ```

  ```csharp C#
  AnthropicClient client = new();

  var page = await client.Organization.ServiceAccounts.List();

  await foreach (var serviceAccount in page.Paginate())
  {
      Console.WriteLine($"{serviceAccount.ID}: {serviceAccount.Name}");
  }
  ```

  ```go Go
  client := anthropic.NewClient()

  serviceAccounts := client.Organization.ServiceAccounts.ListAutoPaging(context.Background(), anthropic.OrganizationServiceAccountListParams{})

  for serviceAccounts.Next() {
  	serviceAccount := serviceAccounts.Current()
  	fmt.Printf("%s: %s\n", serviceAccount.ID, serviceAccount.Name)
  }
  if err := serviceAccounts.Err(); err != nil {
  	log.Fatal(err)
  }
  ```

  ```java Java
  AnthropicClient client = AnthropicOkHttpClient.fromEnv();

  var serviceAccounts = client.organization().serviceAccounts().list();

  for (var serviceAccount : serviceAccounts.autoPager()) {
      IO.println(serviceAccount.id() + ": " + serviceAccount.name());
  }
  ```

  ```php PHP
  $client = new Client();

  $serviceAccounts = $client->organization->serviceAccounts->list();

  foreach ($serviceAccounts->getItems() as $serviceAccount) {
      echo "{$serviceAccount->id}: {$serviceAccount->name}\n";
  }
  ```

  ```ruby Ruby
  client = Anthropic::Client.new

  service_accounts = client.organization.service_accounts.list

  service_accounts.data.each do |service_account|
    puts "#{service_account.id}: #{service_account.name}"
  end
  ```
</CodeGroup>

這些端點不接受 Admin API 金鑰；Admin API 頁面中的 `x-api-key` 範例不適用於此處。

## 服務帳戶

[服務帳戶](https://platform.claude.com/docs/zh-TW/manage-claude/workload-identity-federation#service-accounts)（`svac_...`）是聯合權杖所代表的非人類身分。請將 `organization_role` 設為 `developer`。

建立服務帳戶：

<CodeGroup>
  ```bash cURL
  curl --fail-with-body -sS "https://api.anthropic.com/v1/organizations/service_accounts" \
    -H "authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
    -H "anthropic-version: 2023-06-01" \
    -H "content-type: application/json" \
    -d '{
      "name": "inference-worker",
      "organization_role": "developer"
    }'
  ```

  ```bash CLI
  ant organization:service-accounts create \
    --name inference-worker \
    --organization-role developer
  ```

  ```python Python
  client = anthropic.Anthropic()

  service_account = client.organization.service_accounts.create(
      name="inference-worker", organization_role="developer"
  )

  print(f"id: {service_account.id}")
  print(f"name: {service_account.name}")
  ```

  ```typescript TypeScript
  const client = new Anthropic();

  const serviceAccount = await client.organization.serviceAccounts.create({
    name: "inference-worker",
    organization_role: "developer"
  });

  console.log(`id: ${serviceAccount.id}`);
  console.log(`name: ${serviceAccount.name}`);
  ```

  ```csharp C#
  using Anthropic.Models.Organization.ServiceAccounts;

  AnthropicClient client = new();

  var serviceAccount = await client.Organization.ServiceAccounts.Create(new()
  {
      Name = "inference-worker",
      OrganizationRole = OrganizationRole.Developer
  });

  Console.WriteLine($"id: {serviceAccount.ID}");
  Console.WriteLine($"name: {serviceAccount.Name}");
  ```

  ```go Go
  client := anthropic.NewClient()

  serviceAccount, err := client.Organization.ServiceAccounts.New(context.Background(), anthropic.OrganizationServiceAccountNewParams{
  	Name:             "inference-worker",
  	OrganizationRole: anthropic.OrganizationServiceAccountNewParamsOrganizationRoleDeveloper,
  })
  if err != nil {
  	log.Fatal(err)
  }

  fmt.Printf("id: %s\n", serviceAccount.ID)
  fmt.Printf("name: %s\n", serviceAccount.Name)
  ```

  ```java Java
  import com.anthropic.models.organization.serviceaccounts.ServiceAccountCreateParams;

  void main() {
      AnthropicClient client = AnthropicOkHttpClient.fromEnv();

      var params = ServiceAccountCreateParams.builder()
          .name("inference-worker")
          .organizationRole(ServiceAccountCreateParams.OrganizationRole.DEVELOPER)
          .build();
      var serviceAccount = client.organization().serviceAccounts().create(params);

      IO.println("id: " + serviceAccount.id());
      IO.println("name: " + serviceAccount.name());
  }
  ```

  ```php PHP
  use Anthropic\Organization\ServiceAccounts\ServiceAccountCreateParams\OrganizationRole;
  // ...

  $client = new Client();

  $serviceAccount = $client->organization->serviceAccounts->create(
      name: 'inference-worker',
      organizationRole: OrganizationRole::DEVELOPER,
  );

  echo "id: {$serviceAccount->id}\n";
  echo "name: {$serviceAccount->name}\n";
  ```

  ```ruby Ruby
  client = Anthropic::Client.new

  service_account = client.organization.service_accounts.create(
    name: "inference-worker",
    organization_role: :developer
  )

  puts "id: #{service_account.id}"
  puts "name: #{service_account.name}"
  ```
</CodeGroup>

列出服務帳戶：

<CodeGroup>
  ```bash cURL
  curl --fail-with-body -sS "https://api.anthropic.com/v1/organizations/service_accounts?limit=20" \
    -H "authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
    -H "anthropic-version: 2023-06-01"
  ```

  ```bash CLI
  ant organization:service-accounts list --limit 20
  ```

  ```python Python
  client = anthropic.Anthropic()

  service_accounts = client.organization.service_accounts.list(limit=20)

  for service_account in service_accounts:
      print(f"{service_account.id}: {service_account.name}")
  ```

  ```typescript TypeScript
  const client = new Anthropic();

  for await (const serviceAccount of client.organization.serviceAccounts.list({
    limit: 20
  })) {
    console.log(`${serviceAccount.id}: ${serviceAccount.name}`);
  }
  ```

  ```csharp C#
  AnthropicClient client = new();

  var page = await client.Organization.ServiceAccounts.List(new() { Limit = 20 });

  await foreach (var serviceAccount in page.Paginate())
  {
      Console.WriteLine($"{serviceAccount.ID}: {serviceAccount.Name}");
  }
  ```

  ```go Go
  client := anthropic.NewClient()

  serviceAccounts := client.Organization.ServiceAccounts.ListAutoPaging(context.Background(), anthropic.OrganizationServiceAccountListParams{
  	Limit: anthropic.Int(20),
  })

  for serviceAccounts.Next() {
  	serviceAccount := serviceAccounts.Current()
  	fmt.Printf("%s: %s\n", serviceAccount.ID, serviceAccount.Name)
  }
  if err := serviceAccounts.Err(); err != nil {
  	log.Fatal(err)
  }
  ```

  ```java Java
  import com.anthropic.models.organization.serviceaccounts.ServiceAccountListParams;

  void main() {
      AnthropicClient client = AnthropicOkHttpClient.fromEnv();

      var params = ServiceAccountListParams.builder()
          .limit(20)
          .build();
      var serviceAccounts = client.organization().serviceAccounts().list(params);

      for (var serviceAccount : serviceAccounts.autoPager()) {
          IO.println(serviceAccount.id() + ": " + serviceAccount.name());
      }
  }
  ```

  ```php PHP
  $client = new Client();

  $serviceAccounts = $client->organization->serviceAccounts->list(limit: 20);

  foreach ($serviceAccounts->getItems() as $serviceAccount) {
      echo "{$serviceAccount->id}: {$serviceAccount->name}\n";
  }
  ```

  ```ruby Ruby
  client = Anthropic::Client.new

  service_accounts = client.organization.service_accounts.list(limit: 20)

  service_accounts.data.each do |service_account|
    puts "#{service_account.id}: #{service_account.name}"
  end
  ```
</CodeGroup>

封存服務帳戶：

<CodeGroup>
  ```bash cURL
  curl --fail-with-body -sS -X POST "https://api.anthropic.com/v1/organizations/service_accounts/svac_01ABCDEFabcdef0123456789XY/archive" \
    -H "authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
    -H "anthropic-version: 2023-06-01"
  ```

  ```bash CLI
  ant organization:service-accounts archive svac_01ABCDEFabcdef0123456789XY
  ```

  ```python Python
  client = anthropic.Anthropic()

  service_account = client.organization.service_accounts.archive(
      "svac_01ABCDEFabcdef0123456789XY"
  )

  print(f"id: {service_account.id}")
  print(f"archived_at: {service_account.archived_at}")
  ```

  ```typescript TypeScript
  const client = new Anthropic();

  const serviceAccount = await client.organization.serviceAccounts.archive(
    "svac_01ABCDEFabcdef0123456789XY"
  );

  console.log(`id: ${serviceAccount.id}`);
  console.log(`archived_at: ${serviceAccount.archived_at}`);
  ```

  ```csharp C#
  AnthropicClient client = new();

  var serviceAccount = await client.Organization.ServiceAccounts.Archive(
      "svac_01ABCDEFabcdef0123456789XY"
  );

  Console.WriteLine($"id: {serviceAccount.ID}");
  Console.WriteLine($"archived_at: {serviceAccount.ArchivedAt:O}");
  ```

  ```go Go
  client := anthropic.NewClient()

  serviceAccount, err := client.Organization.ServiceAccounts.Archive(
  	context.Background(),
  	"svac_01ABCDEFabcdef0123456789XY",
  )
  if err != nil {
  	log.Fatal(err)
  }

  fmt.Printf("id: %s\n", serviceAccount.ID)
  fmt.Printf("archived_at: %s\n", serviceAccount.ArchivedAt)
  ```

  ```java Java
  AnthropicClient client = AnthropicOkHttpClient.fromEnv();

  var serviceAccount = client.organization().serviceAccounts()
      .archive("svac_01ABCDEFabcdef0123456789XY");

  IO.println("id: " + serviceAccount.id());
  IO.println("archived_at: " + serviceAccount.archivedAt().orElseThrow());
  ```

  ```php PHP
  $client = new Client();

  $serviceAccount = $client->organization->serviceAccounts->archive(
      serviceAccountID: 'svac_01ABCDEFabcdef0123456789XY',
  );

  echo "id: {$serviceAccount->id}\n";
  echo "archived_at: {$serviceAccount->archivedAt?->format(DATE_ATOM)}\n";
  ```

  ```ruby Ruby
  client = Anthropic::Client.new

  service_account_id = "svac_01ABCDEFabcdef0123456789XY"
  service_account = client.organization.service_accounts.archive(service_account_id)

  puts "id: #{service_account.id}"
  puts "archived_at: #{service_account.archived_at}"
  ```
</CodeGroup>

建立端點會傳回新的服務帳戶：

```json
{
  "id": "svac_...",
  "name": "inference-worker",
  "organization_role": "developer",
  "created_at": "...",
  "type": "service_account",
  "...": "..."
}
```

若要讀取或更新單一服務帳戶，請對 `/v1/organizations/service_accounts/{service_account_id}` 使用 `GET` 和 `POST`。服務帳戶必須是某個工作區的成員，聯合權杖才能在該工作區中運作。每個服務帳戶都隱含地是您組織預設工作區的成員；若要為其他工作區新增明確的成員資格，請對 `/v1/organizations/service_accounts/{service_account_id}/workspaces` 使用 `GET`、`POST` 和 `DELETE`，其中 `DELETE` 的目標為 `.../workspaces/{workspace_id}`。

如需完整的參數詳細資訊和回應結構描述，請參閱[服務帳戶 API 參考](https://platform.claude.com/docs/zh-TW/api/organization/service_accounts)。

## 聯合簽發者

[聯合簽發者](https://platform.claude.com/docs/zh-TW/manage-claude/workload-identity-federation#federation-issuers)（`fdis_...`）會向您的組織註冊一個 OIDC 身分提供者。`jwks` 欄位是一個可辨識聯集（discriminated union），用於控制 Anthropic 如何擷取提供者的簽署金鑰：

| `jwks` 值                                 | 使用時機                                                |
| ---------------------------------------- | --------------------------------------------------- |
| `{"type": "discovery"}`                  | 提供者在簽發者 URL 提供 `/.well-known/openid-configuration`。 |
| `{"type": "explicit_url", "url": "..."}` | 直接指向 JWKS 端點。                                       |
| `{"type": "inline", "keys": [...]}`      | 為無法從公用網際網路存取的提供者上傳金鑰集。                              |

註冊簽發者。此範例使用 JWKS 探索註冊 GitHub Actions：

<CodeGroup>
  ```bash cURL
  curl --fail-with-body -sS "https://api.anthropic.com/v1/organizations/federation_issuers" \
    -H "authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
    -H "anthropic-version: 2023-06-01" \
    -H "content-type: application/json" \
    -d '{
      "name": "github-actions",
      "issuer_url": "https://token.actions.githubusercontent.com",
      "jwks": {"type": "discovery"}
    }'
  ```

  ```bash CLI
  ant organization:federation:issuers create \
    --name github-actions \
    --issuer-url https://token.actions.githubusercontent.com \
    --jwks '{type: discovery}'
  ```

  ```python Python
  client = anthropic.Anthropic()

  issuer = client.organization.federation.issuers.create(
      name="github-actions",
      issuer_url="https://token.actions.githubusercontent.com",
      jwks={"type": "discovery"},
  )

  print(f"id: {issuer.id}")
  print(f"name: {issuer.name}")
  print(f"issuer_url: {issuer.issuer_url}")
  ```

  ```typescript TypeScript
  const client = new Anthropic();

  const issuer = await client.organization.federation.issuers.create({
    name: "github-actions",
    issuer_url: "https://token.actions.githubusercontent.com",
    jwks: { type: "discovery" }
  });

  console.log(`id: ${issuer.id}`);
  console.log(`name: ${issuer.name}`);
  console.log(`issuer_url: ${issuer.issuer_url}`);
  ```

  ```csharp C#
  using Anthropic.Models.Organization.Federation.Issuers;

  AnthropicClient client = new();

  var issuer = await client.Organization.Federation.Issuers.Create(new()
  {
      Name = "github-actions",
      IssuerUrl = "https://token.actions.githubusercontent.com",
      Jwks = new JwksDiscovery()
  });

  Console.WriteLine($"id: {issuer.ID}");
  Console.WriteLine($"name: {issuer.Name}");
  Console.WriteLine($"issuer_url: {issuer.IssuerUrl}");
  ```

  ```go Go
  client := anthropic.NewClient()

  issuer, err := client.Organization.Federation.Issuers.New(context.Background(), anthropic.OrganizationFederationIssuerNewParams{
  	Name:      "github-actions",
  	IssuerURL: "https://token.actions.githubusercontent.com",
  	JWKS: anthropic.OrganizationFederationIssuerNewParamsJWKSUnion{
  		OfDiscovery: &anthropic.JWKSDiscoveryParam{},
  	},
  })
  if err != nil {
  	log.Fatal(err)
  }

  fmt.Printf("id: %s\n", issuer.ID)
  fmt.Printf("name: %s\n", issuer.Name)
  fmt.Printf("issuer_url: %s\n", issuer.IssuerURL)
  ```

  ```java Java
  import com.anthropic.models.organization.federation.issuers.JwksDiscovery;
  import com.anthropic.models.organization.federation.issuers.IssuerCreateParams;

  void main() {
      AnthropicClient client = AnthropicOkHttpClient.fromEnv();

      var params = IssuerCreateParams.builder()
          .name("github-actions")
          .issuerUrl("https://token.actions.githubusercontent.com")
          .jwks(JwksDiscovery.builder().build())
          .build();
      var issuer = client.organization().federation().issuers().create(params);

      IO.println("id: " + issuer.id());
      IO.println("name: " + issuer.name());
      IO.println("issuer_url: " + issuer.issuerUrl());
  }
  ```

  ```php PHP
  $client = new Client();

  $issuer = $client->organization->federation->issuers->create(
      name: 'github-actions',
      issuerURL: 'https://token.actions.githubusercontent.com',
      jwks: ['type' => 'discovery'],
  );

  echo "id: {$issuer->id}\n";
  echo "name: {$issuer->name}\n";
  echo "issuer_url: {$issuer->issuerURL}\n";
  ```

  ```ruby Ruby
  client = Anthropic::Client.new

  issuer = client.organization.federation.issuers.create(
    name: "github-actions",
    issuer_url: "https://token.actions.githubusercontent.com",
    jwks: {type: :discovery}
  )

  puts "id: #{issuer.id}"
  puts "name: #{issuer.name}"
  puts "issuer_url: #{issuer.issuer_url}"
  ```
</CodeGroup>

列出簽發者：

<CodeGroup>
  ```bash cURL
  curl --fail-with-body -sS "https://api.anthropic.com/v1/organizations/federation_issuers?limit=20" \
    -H "authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
    -H "anthropic-version: 2023-06-01"
  ```

  ```bash CLI
  ant organization:federation:issuers list --limit 20
  ```

  ```python Python
  client = anthropic.Anthropic()

  issuers = client.organization.federation.issuers.list(limit=20)

  for issuer in issuers:
      print(f"{issuer.id}: {issuer.name}")
  ```

  ```typescript TypeScript
  const client = new Anthropic();

  for await (const issuer of client.organization.federation.issuers.list({ limit: 20 })) {
    console.log(`${issuer.id}: ${issuer.name}`);
  }
  ```

  ```csharp C#
  AnthropicClient client = new();

  var page = await client.Organization.Federation.Issuers.List(new() { Limit = 20 });

  await foreach (var issuer in page.Paginate())
  {
      Console.WriteLine($"{issuer.ID}: {issuer.Name}");
  }
  ```

  ```go Go
  client := anthropic.NewClient()

  issuers := client.Organization.Federation.Issuers.ListAutoPaging(context.Background(), anthropic.OrganizationFederationIssuerListParams{
  	Limit: anthropic.Int(20),
  })

  for issuers.Next() {
  	issuer := issuers.Current()
  	fmt.Printf("%s: %s\n", issuer.ID, issuer.Name)
  }
  if err := issuers.Err(); err != nil {
  	log.Fatal(err)
  }
  ```

  ```java Java
  import com.anthropic.models.organization.federation.issuers.IssuerListParams;

  void main() {
      AnthropicClient client = AnthropicOkHttpClient.fromEnv();

      var params = IssuerListParams.builder()
          .limit(20)
          .build();
      var issuers = client.organization().federation().issuers().list(params);

      for (var issuer : issuers.autoPager()) {
          IO.println(issuer.id() + ": " + issuer.name());
      }
  }
  ```

  ```php PHP
  $client = new Client();

  $issuers = $client->organization->federation->issuers->list(limit: 20);

  foreach ($issuers->getItems() as $issuer) {
      echo "{$issuer->id}: {$issuer->name}\n";
  }
  ```

  ```ruby Ruby
  client = Anthropic::Client.new

  issuers = client.organization.federation.issuers.list(limit: 20)

  issuers.data.each do |issuer|
    puts "#{issuer.id}: #{issuer.name}"
  end
  ```
</CodeGroup>

封存簽發者：

<CodeGroup>
  ```bash cURL
  curl --fail-with-body -sS -X POST "https://api.anthropic.com/v1/organizations/federation_issuers/fdis_01ABCDEFabcdef0123456789XY/archive" \
    -H "authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
    -H "anthropic-version: 2023-06-01"
  ```

  ```bash CLI
  ant organization:federation:issuers archive \
    --federation-issuer-id fdis_01ABCDEFabcdef0123456789XY
  ```

  ```python Python
  client = anthropic.Anthropic()

  issuer = client.organization.federation.issuers.archive(
      "fdis_01ABCDEFabcdef0123456789XY"
  )

  print(f"id: {issuer.id}")
  print(f"archived_at: {issuer.archived_at}")
  ```

  ```typescript TypeScript
  const client = new Anthropic();

  const issuer = await client.organization.federation.issuers.archive(
    "fdis_01ABCDEFabcdef0123456789XY"
  );

  console.log(`id: ${issuer.id}`);
  console.log(`archived_at: ${issuer.archived_at}`);
  ```

  ```csharp C#
  AnthropicClient client = new();

  var issuer = await client.Organization.Federation.Issuers.Archive(
      "fdis_01ABCDEFabcdef0123456789XY"
  );

  Console.WriteLine($"id: {issuer.ID}");
  Console.WriteLine($"archived_at: {issuer.ArchivedAt:O}");
  ```

  ```go Go
  client := anthropic.NewClient()

  issuer, err := client.Organization.Federation.Issuers.Archive(
  	context.Background(),
  	"fdis_01ABCDEFabcdef0123456789XY",
  )
  if err != nil {
  	log.Fatal(err)
  }

  fmt.Printf("id: %s\n", issuer.ID)
  fmt.Printf("archived_at: %s\n", issuer.ArchivedAt)
  ```

  ```java Java
  AnthropicClient client = AnthropicOkHttpClient.fromEnv();

  var issuer = client.organization().federation().issuers()
      .archive("fdis_01ABCDEFabcdef0123456789XY");

  IO.println("id: " + issuer.id());
  IO.println("archived_at: " + issuer.archivedAt().orElseThrow());
  ```

  ```php PHP
  $client = new Client();

  $issuer = $client->organization->federation->issuers->archive(
      federationIssuerID: 'fdis_01ABCDEFabcdef0123456789XY',
  );

  echo "id: {$issuer->id}\n";
  echo "archived_at: {$issuer->archivedAt?->format(DATE_ATOM)}\n";
  ```

  ```ruby Ruby
  client = Anthropic::Client.new

  issuer_id = "fdis_01ABCDEFabcdef0123456789XY"
  issuer = client.organization.federation.issuers.archive(issuer_id)

  puts "id: #{issuer.id}"
  puts "archived_at: #{issuer.archived_at}"
  ```
</CodeGroup>

若要讀取或更新單一簽發者，請對 `/v1/organizations/federation_issuers/{issuer_id}` 使用 `GET` 和 `POST`。如果某個簽發者所支援的規則中，有任何規則的 `oauth_scope` 不是 `workspace:developer` 或 `workspace:inference`，OAuth 呼叫者就無法更新該簽發者；請參閱[權限與限制](https://platform.claude.com/docs/zh-TW/manage-claude/wif-admin-api#permissions-and-constraints)。

如需完整的參數詳細資訊和回應結構描述，請參閱[聯合簽發者 API 參考](https://platform.claude.com/docs/zh-TW/api/organization/federation/issuers)。

## 聯合規則

[聯合規則](https://platform.claude.com/docs/zh-TW/manage-claude/workload-identity-federation#federation-rules)（`fdrl_...`）會將簽發者綁定到服務帳戶：來自該簽發者且符合規則比對條件的 JWT，可以鑄造以規則目標身分運作的權杖。建立請求中的 `workspace_id` 會在建立時於該工作區中啟用規則；之後可透過 `/federation_rules/{rule_id}/workspaces` 子資源新增更多工作區。建立時必須提供 `workspace_id` 或 `applies_to_all_workspaces: true` 其中之一。

建立規則。此範例讓來自 main 分支的 GitHub Actions 部署以該服務帳戶身分運作：

<CodeGroup>
  ```bash cURL
  curl --fail-with-body -sS "https://api.anthropic.com/v1/organizations/federation_rules" \
    -H "authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
    -H "anthropic-version: 2023-06-01" \
    -H "content-type: application/json" \
    -d '{
      "name": "gha-deploy",
      "issuer_id": "fdis_01ABCDEFabcdef0123456789XY",
      "match": {
        "subject_prefix": "repo:my-org/my-repo:ref:refs/heads/main",
        "claims": {"repository_owner": "my-org"}
      },
      "target": {
        "type": "service_account",
        "service_account_id": "svac_01ABCDEFabcdef0123456789XY"
      },
      "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
      "oauth_scope": "workspace:developer",
      "token_lifetime_seconds": 600
    }'
  ```

  ```bash CLI
  ant organization:federation:rules create <<'YAML'
  name: gha-deploy
  issuer_id: fdis_01ABCDEFabcdef0123456789XY
  match:
    subject_prefix: "repo:my-org/my-repo:ref:refs/heads/main"
    claims:
      repository_owner: my-org
  target:
    type: service_account
    service_account_id: svac_01ABCDEFabcdef0123456789XY
  workspace_id: wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ
  oauth_scope: "workspace:developer"
  token_lifetime_seconds: 600
  YAML
  ```

  ```python Python
  client = anthropic.Anthropic()

  rule = client.organization.federation.rules.create(
      name="gha-deploy",
      issuer_id="fdis_01ABCDEFabcdef0123456789XY",
      match={
          "subject_prefix": "repo:my-org/my-repo:ref:refs/heads/main",
          "claims": {"repository_owner": "my-org"},
      },
      target={
          "type": "service_account",
          "service_account_id": "svac_01ABCDEFabcdef0123456789XY",
      },
      workspace_id="wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
      oauth_scope="workspace:developer",
      token_lifetime_seconds=600,
  )

  print(f"id: {rule.id}")
  print(f"name: {rule.name}")
  ```

  ```typescript TypeScript
  const client = new Anthropic();

  const rule = await client.organization.federation.rules.create({
    name: "gha-deploy",
    issuer_id: "fdis_01ABCDEFabcdef0123456789XY",
    match: {
      subject_prefix: "repo:my-org/my-repo:ref:refs/heads/main",
      claims: { repository_owner: "my-org" }
    },
    target: {
      type: "service_account",
      service_account_id: "svac_01ABCDEFabcdef0123456789XY"
    },
    workspace_id: "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
    oauth_scope: "workspace:developer",
    token_lifetime_seconds: 600
  });

  console.log(`id: ${rule.id}`);
  console.log(`name: ${rule.name}`);
  ```

  ```csharp C#
  AnthropicClient client = new();

  var rule = await client.Organization.Federation.Rules.Create(new()
  {
      Name = "gha-deploy",
      IssuerID = "fdis_01ABCDEFabcdef0123456789XY",
      Match = new()
      {
          SubjectPrefix = "repo:my-org/my-repo:ref:refs/heads/main",
          Claims = new Dictionary<string, string> { ["repository_owner"] = "my-org" }
      },
      Target = new() { ServiceAccountID = "svac_01ABCDEFabcdef0123456789XY" },
      WorkspaceID = "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
      OAuthScope = "workspace:developer",
      TokenLifetimeSeconds = 600
  });

  Console.WriteLine($"id: {rule.ID}");
  Console.WriteLine($"name: {rule.Name}");
  ```

  ```go Go
  client := anthropic.NewClient()

  rule, err := client.Organization.Federation.Rules.New(context.Background(), anthropic.OrganizationFederationRuleNewParams{
  	Name:     "gha-deploy",
  	IssuerID: "fdis_01ABCDEFabcdef0123456789XY",
  	Match: anthropic.FederationRuleMatchParam{
  		SubjectPrefix: anthropic.String("repo:my-org/my-repo:ref:refs/heads/main"),
  		Claims:        map[string]string{"repository_owner": "my-org"},
  	},
  	Target: anthropic.ServiceAccountTargetParam{
  		ServiceAccountID: "svac_01ABCDEFabcdef0123456789XY",
  	},
  	WorkspaceID:          anthropic.String("wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"),
  	OAuthScope:           "workspace:developer",
  	TokenLifetimeSeconds: anthropic.Int(600),
  })
  if err != nil {
  	log.Fatal(err)
  }

  fmt.Printf("id: %s\n", rule.ID)
  fmt.Printf("name: %s\n", rule.Name)
  ```

  ```java Java
  import com.anthropic.core.JsonValue;
  import com.anthropic.models.organization.federation.rules.FederationRuleMatch;
  import com.anthropic.models.organization.federation.rules.ServiceAccountTarget;
  import com.anthropic.models.organization.federation.rules.RuleCreateParams;

  void main() {
      AnthropicClient client = AnthropicOkHttpClient.fromEnv();

      var match = FederationRuleMatch.builder()
          .subjectPrefix("repo:my-org/my-repo:ref:refs/heads/main")
          .claims(FederationRuleMatch.Claims.builder()
              .putAdditionalProperty("repository_owner", JsonValue.from("my-org"))
              .build())
          .build();
      var params = RuleCreateParams.builder()
          .name("gha-deploy")
          .issuerId("fdis_01ABCDEFabcdef0123456789XY")
          .match(match)
          .target(ServiceAccountTarget.of("svac_01ABCDEFabcdef0123456789XY"))
          .workspaceId("wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ")
          .oauthScope("workspace:developer")
          .tokenLifetimeSeconds(600)
          .build();
      var rule = client.organization().federation().rules().create(params);

      IO.println("id: " + rule.id());
      IO.println("name: " + rule.name());
  }
  ```

  ```php PHP
  $client = new Client();

  $rule = $client->organization->federation->rules->create(
      name: 'gha-deploy',
      issuerID: 'fdis_01ABCDEFabcdef0123456789XY',
      match: [
          'subjectPrefix' => 'repo:my-org/my-repo:ref:refs/heads/main',
          'claims' => ['repository_owner' => 'my-org'],
      ],
      target: [
          'type' => 'service_account',
          'serviceAccountID' => 'svac_01ABCDEFabcdef0123456789XY',
      ],
      workspaceID: 'wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ',
      oauthScope: 'workspace:developer',
      tokenLifetimeSeconds: 600,
  );

  echo "id: {$rule->id}\n";
  echo "name: {$rule->name}\n";
  ```

  ```ruby Ruby
  client = Anthropic::Client.new

  rule = client.organization.federation.rules.create(
    name: "gha-deploy",
    issuer_id: "fdis_01ABCDEFabcdef0123456789XY",
    match: {
      subject_prefix: "repo:my-org/my-repo:ref:refs/heads/main",
      claims: {repository_owner: "my-org"}
    },
    target: {
      type: :service_account,
      service_account_id: "svac_01ABCDEFabcdef0123456789XY"
    },
    workspace_id: "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
    oauth_scope: "workspace:developer",
    token_lifetime_seconds: 600
  )

  puts "id: #{rule.id}"
  puts "name: #{rule.name}"
  ```
</CodeGroup>

列出規則，可選擇依簽發者篩選：

<CodeGroup>
  ```bash cURL
  curl --fail-with-body -sS "https://api.anthropic.com/v1/organizations/federation_rules?issuer_id=fdis_01ABCDEFabcdef0123456789XY" \
    -H "authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
    -H "anthropic-version: 2023-06-01"
  ```

  ```bash CLI
  ant organization:federation:rules list \
    --issuer-id fdis_01ABCDEFabcdef0123456789XY
  ```

  ```python Python
  client = anthropic.Anthropic()

  rules = client.organization.federation.rules.list(
      issuer_id="fdis_01ABCDEFabcdef0123456789XY"
  )

  for rule in rules:
      print(f"{rule.id}: {rule.name}")
  ```

  ```typescript TypeScript
  const client = new Anthropic();

  for await (const rule of client.organization.federation.rules.list({
    issuer_id: "fdis_01ABCDEFabcdef0123456789XY"
  })) {
    console.log(`${rule.id}: ${rule.name}`);
  }
  ```

  ```csharp C#
  AnthropicClient client = new();

  var page = await client.Organization.Federation.Rules.List(new()
  {
      IssuerID = "fdis_01ABCDEFabcdef0123456789XY"
  });

  await foreach (var rule in page.Paginate())
  {
      Console.WriteLine($"{rule.ID}: {rule.Name}");
  }
  ```

  ```go Go
  client := anthropic.NewClient()

  rules := client.Organization.Federation.Rules.ListAutoPaging(context.Background(), anthropic.OrganizationFederationRuleListParams{
  	IssuerID: anthropic.String("fdis_01ABCDEFabcdef0123456789XY"),
  })

  for rules.Next() {
  	rule := rules.Current()
  	fmt.Printf("%s: %s\n", rule.ID, rule.Name)
  }
  if err := rules.Err(); err != nil {
  	log.Fatal(err)
  }
  ```

  ```java Java
  import com.anthropic.models.organization.federation.rules.RuleListParams;

  void main() {
      AnthropicClient client = AnthropicOkHttpClient.fromEnv();

      var params = RuleListParams.builder()
          .issuerId("fdis_01ABCDEFabcdef0123456789XY")
          .build();
      var rules = client.organization().federation().rules().list(params);

      for (var rule : rules.autoPager()) {
          IO.println(rule.id() + ": " + rule.name());
      }
  }
  ```

  ```php PHP
  $client = new Client();

  $rules = $client->organization->federation->rules->list(
      issuerID: 'fdis_01ABCDEFabcdef0123456789XY',
  );

  foreach ($rules->getItems() as $rule) {
      echo "{$rule->id}: {$rule->name}\n";
  }
  ```

  ```ruby Ruby
  client = Anthropic::Client.new

  rules = client.organization.federation.rules.list(
    issuer_id: "fdis_01ABCDEFabcdef0123456789XY"
  )

  rules.data.each do |rule|
    puts "#{rule.id}: #{rule.name}"
  end
  ```
</CodeGroup>

封存規則：

<CodeGroup>
  ```bash cURL
  curl --fail-with-body -sS -X POST "https://api.anthropic.com/v1/organizations/federation_rules/fdrl_01ABCDEFabcdef0123456789XY/archive" \
    -H "authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
    -H "anthropic-version: 2023-06-01"
  ```

  ```bash CLI
  ant organization:federation:rules archive \
    --federation-rule-id fdrl_01ABCDEFabcdef0123456789XY
  ```

  ```python Python
  client = anthropic.Anthropic()

  rule = client.organization.federation.rules.archive("fdrl_01ABCDEFabcdef0123456789XY")

  print(f"id: {rule.id}")
  print(f"archived_at: {rule.archived_at}")
  ```

  ```typescript TypeScript
  const client = new Anthropic();

  const rule = await client.organization.federation.rules.archive(
    "fdrl_01ABCDEFabcdef0123456789XY"
  );

  console.log(`id: ${rule.id}`);
  console.log(`archived_at: ${rule.archived_at}`);
  ```

  ```csharp C#
  AnthropicClient client = new();

  var rule = await client.Organization.Federation.Rules.Archive(
      "fdrl_01ABCDEFabcdef0123456789XY"
  );

  Console.WriteLine($"id: {rule.ID}");
  Console.WriteLine($"archived_at: {rule.ArchivedAt:O}");
  ```

  ```go Go
  client := anthropic.NewClient()

  rule, err := client.Organization.Federation.Rules.Archive(
  	context.Background(),
  	"fdrl_01ABCDEFabcdef0123456789XY",
  )
  if err != nil {
  	log.Fatal(err)
  }

  fmt.Printf("id: %s\n", rule.ID)
  fmt.Printf("archived_at: %s\n", rule.ArchivedAt)
  ```

  ```java Java
  AnthropicClient client = AnthropicOkHttpClient.fromEnv();

  var rule = client.organization().federation().rules()
      .archive("fdrl_01ABCDEFabcdef0123456789XY");

  IO.println("id: " + rule.id());
  IO.println("archived_at: " + rule.archivedAt().orElseThrow());
  ```

  ```php PHP
  $client = new Client();

  $rule = $client->organization->federation->rules->archive(
      federationRuleID: 'fdrl_01ABCDEFabcdef0123456789XY',
  );

  echo "id: {$rule->id}\n";
  echo "archived_at: {$rule->archivedAt?->format(DATE_ATOM)}\n";
  ```

  ```ruby Ruby
  client = Anthropic::Client.new

  rule_id = "fdrl_01ABCDEFabcdef0123456789XY"
  rule = client.organization.federation.rules.archive(rule_id)

  puts "id: #{rule.id}"
  puts "archived_at: #{rule.archived_at}"
  ```
</CodeGroup>

列出端點會傳回一頁規則以及下一頁的游標：

```json
{
  "data": [{ "id": "fdrl_...", "name": "gha-deploy", "...": "..." }],
  "next_page": "..."
}
```

若要讀取或更新單一規則，請對 `/v1/organizations/federation_rules/{rule_id}` 使用 `GET` 和 `POST`。若要管理規則可在其中鑄造權杖的工作區，請對 `/v1/organizations/federation_rules/{rule_id}/workspaces` 使用 `GET` 和 `POST`，並對 `/v1/organizations/federation_rules/{rule_id}/workspaces/{workspace_id}` 使用 `DELETE`。

如需完整的參數詳細資訊和回應結構描述，請參閱[聯合規則 API 參考](https://platform.claude.com/docs/zh-TW/api/organization/federation/rules)。

## 權限與限制

<Note>
  * 經 OAuth 驗證的呼叫者只能建立或修改 `oauth_scope` 為 `workspace:developer` 或 `workspace:inference` 的規則。若要建立或修改具有其他範圍（例如 `org:admin` 或 `workspace:manage_tunnels`）的規則，請使用 Console。
  * 如果某個聯合簽發者支援的規則中，有任何規則的 `oauth_scope` 不是 `workspace:developer` 或 `workspace:inference`（例如 `org:admin` 或 `workspace:manage_tunnels`），OAuth 呼叫者就無法更新該簽發者。建議為引導規則註冊專用的簽發者，讓工作區範圍規則所使用的簽發者仍可透過 API 更新。
  * 這些端點不接受 Admin API 金鑰，讀取和寫入皆然；請使用 `org:admin` OAuth 權杖。
</Note>

`oauth_scope: org:admin` 的規則必須以 `organization_role` 為 `admin` 的服務帳戶作為目標。

資源名稱必須符合下列條件：

* 符合 `^[a-z0-9-]+$`。
* 長度為 1 到 255 個字元。
* 在組織內的同一資源類型中不得重複。

完整的欄位層級限制，請參閱[驗證規則](https://platform.claude.com/docs/zh-TW/manage-claude/wif-reference#validation-rules)。

## 分頁與封存

服務帳戶、聯合簽發者和聯合規則的列表端點接受 `limit`（1 到 100，預設為 20）以及取自前一個回應的 `page` 游標。發出下一個請求時，請將回應中的 `next_page` 值作為 `page` 查詢參數傳入。規則工作區子資源的列表會一次傳回完整集合，不進行分頁。已封存的資源預設不會出現在列表中；若要包含這些資源，請傳入 `include_archived=true`。

封存是一種軟刪除，且具有冪等性：封存已封存的資源同樣會成功。如果仍有有效的聯合規則參照某個簽發者或服務帳戶，封存該簽發者或服務帳戶會傳回 `400`；請先封存該規則。

## 另請參閱

* [Workload Identity Federation](https://platform.claude.com/docs/zh-TW/manage-claude/workload-identity-federation)：概念與 Console 設定逐步說明
* [WIF 參考](https://platform.claude.com/docs/zh-TW/manage-claude/wif-reference)：環境變數、驗證規則、OAuth 範圍和錯誤代碼
* [Admin API](https://platform.claude.com/docs/zh-TW/manage-claude/admin-api)：組織管理功能的其餘部分
* [Admin API 參考](https://platform.claude.com/docs/zh-TW/api/organization)：服務帳戶和聯合端點的自動產生請求與回應結構描述