anthropic 1.74.0 → 1.75.0

data/lib/anthropic/resources/organization/federation/issuers.rb

@@ -0,0 +1,206 @@
+# frozen_string_literal: true
+
+module Anthropic
+  module Resources
+    class Organization
+      class Federation
+        class Issuers
+          # **Requires an OAuth access token with the `org:admin` scope**, from
+          # `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+          # API keys are not accepted. See
+          # [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+          #
+          # Register an OIDC issuer that Anthropic will trust for workload identity
+          # federation in your organization.
+          #
+          # The `jwks` field controls how the issuer's signing keys are obtained and takes
+          # one of three shapes selected by `type`: `discovery` (resolve keys through OIDC
+          # discovery), `explicit_url` (fetch keys from a fixed JWKS URL), or `inline`
+          # (provide a static key set). When `jwks.type` is `discovery` and no
+          # `discovery_base` is set, the issuer URL must be publicly reachable over HTTPS so
+          # Anthropic can fetch the discovery document; for `explicit_url` and `inline`
+          # modes the issuer URL is only matched as the JWT's `iss` claim and is not
+          # fetched.
+          #
+          # Some parameter documentations has been truncated, see
+          # {Anthropic::Models::Organization::Federation::IssuerCreateParams} for more
+          # details.
+          #
+          # @overload create(issuer_url:, name:, check_jti: nil, jwks: nil, max_jwt_lifetime_seconds: nil, request_options: {})
+          #
+          # @param issuer_url [String] The `iss` claim value to match against.
+          #
+          # @param name [String] Slug identifier (lowercase, digits, hyphens). Unique within the organization; a
+          #
+          # @param check_jti [Boolean, nil] Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for
+          #
+          # @param jwks [Anthropic::Models::Organization::Federation::JWKSDiscovery, Anthropic::Models::Organization::Federation::JWKSExplicitURL, Anthropic::Models::Organization::Federation::JWKSInline] How signing keys are obtained. Defaults to OIDC discovery.
+          #
+          # @param max_jwt_lifetime_seconds [Integer, nil] Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds
+          #
+          # @param request_options [Anthropic::RequestOptions, Hash{Symbol=>Object}, nil]
+          #
+          # @return [Anthropic::Models::Organization::Federation::FederationIssuer]
+          #
+          # @see Anthropic::Models::Organization::Federation::IssuerCreateParams
+          def create(params)
+            parsed, options = Anthropic::Organization::Federation::IssuerCreateParams.dump_request(params)
+            @client.request(
+              method: :post,
+              path: "v1/organizations/federation_issuers",
+              body: parsed,
+              model: Anthropic::Organization::Federation::FederationIssuer,
+              options: options
+            )
+          end
+
+          # **Requires an OAuth access token with the `org:admin` scope**, from
+          # `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+          # API keys are not accepted. See
+          # [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+          #
+          # Retrieve a federation issuer by its ID (`fdis_...`).
+          #
+          # @overload retrieve(federation_issuer_id, request_options: {})
+          #
+          # @param federation_issuer_id [String] ID of the federation issuer.
+          #
+          # @param request_options [Anthropic::RequestOptions, Hash{Symbol=>Object}, nil]
+          #
+          # @return [Anthropic::Models::Organization::Federation::FederationIssuer]
+          #
+          # @see Anthropic::Models::Organization::Federation::IssuerRetrieveParams
+          def retrieve(federation_issuer_id, params = {})
+            @client.request(
+              method: :get,
+              path: ["v1/organizations/federation_issuers/%1$s", federation_issuer_id],
+              model: Anthropic::Organization::Federation::FederationIssuer,
+              options: params[:request_options]
+            )
+          end
+
+          # **Requires an OAuth access token with the `org:admin` scope**, from
+          # `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+          # API keys are not accepted. See
+          # [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+          #
+          # Partially update a federation issuer.
+          #
+          # Setting `jwks` replaces the full JWKS shape at once. Archived issuers cannot be
+          # updated; this returns 400. Create a new issuer instead.
+          #
+          # Updating an issuer that backs a rule with a scope outside `workspace:developer`
+          # or `workspace:inference` requires a Console session.
+          #
+          # Some parameter documentations has been truncated, see
+          # {Anthropic::Models::Organization::Federation::IssuerUpdateParams} for more
+          # details.
+          #
+          # @overload update(federation_issuer_id, check_jti: nil, issuer_url: nil, jwks: nil, jwks_polling_disabled: nil, max_jwt_lifetime_seconds: nil, name: nil, request_options: {})
+          #
+          # @param federation_issuer_id [String] ID of the federation issuer to update.
+          #
+          # @param check_jti [Boolean, nil] Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for
+          #
+          # @param issuer_url [String, nil] Replaces the `iss` claim value to match against. For discovery-mode issuers with
+          #
+          # @param jwks [Anthropic::Models::Organization::Federation::JWKSDiscovery, Anthropic::Models::Organization::Federation::JWKSExplicitURL, Anthropic::Models::Organization::Federation::JWKSInline, nil] Replaces the entire JWKS configuration.
+          #
+          # @param jwks_polling_disabled [Boolean, nil] Only `false` is accepted, to re-enable polling after the system pauses it. Polli
+          #
+          # @param max_jwt_lifetime_seconds [Integer, nil] Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds
+          #
+          # @param name [String, nil] Replaces the slug identifier (lowercase, digits, hyphens). Unique within the org
+          #
+          # @param request_options [Anthropic::RequestOptions, Hash{Symbol=>Object}, nil]
+          #
+          # @return [Anthropic::Models::Organization::Federation::FederationIssuer]
+          #
+          # @see Anthropic::Models::Organization::Federation::IssuerUpdateParams
+          def update(federation_issuer_id, params = {})
+            parsed, options = Anthropic::Organization::Federation::IssuerUpdateParams.dump_request(params)
+            @client.request(
+              method: :post,
+              path: ["v1/organizations/federation_issuers/%1$s", federation_issuer_id],
+              body: parsed,
+              model: Anthropic::Organization::Federation::FederationIssuer,
+              options: options
+            )
+          end
+
+          # **Requires an OAuth access token with the `org:admin` scope**, from
+          # `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+          # API keys are not accepted. See
+          # [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+          #
+          # List federation issuers in your organization.
+          #
+          # Archived issuers are excluded unless `include_archived=true`.
+          #
+          # @overload list(include_archived: nil, limit: nil, page: nil, request_options: {})
+          #
+          # @param include_archived [Boolean] Include archived resources. Defaults to false.
+          #
+          # @param limit [Integer] Number of results per page.
+          #
+          # @param page [String, nil] Opaque cursor from a previous response's `next_page`.
+          #
+          # @param request_options [Anthropic::RequestOptions, Hash{Symbol=>Object}, nil]
+          #
+          # @return [Anthropic::Internal::PageCursor<Anthropic::Models::Organization::Federation::FederationIssuer>]
+          #
+          # @see Anthropic::Models::Organization::Federation::IssuerListParams
+          def list(params = {})
+            parsed, options = Anthropic::Organization::Federation::IssuerListParams.dump_request(params)
+            query = Anthropic::Internal::Util.encode_query_params(parsed)
+            @client.request(
+              method: :get,
+              path: "v1/organizations/federation_issuers",
+              query: query,
+              page: Anthropic::Internal::PageCursor,
+              model: Anthropic::Organization::Federation::FederationIssuer,
+              options: options
+            )
+          end
+
+          # **Requires an OAuth access token with the `org:admin` scope**, from
+          # `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+          # API keys are not accepted. See
+          # [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+          #
+          # Archive a federation issuer.
+          #
+          # Idempotent; re-archiving returns the issuer with its original `archived_at`.
+          # Rejected with 400 if any live (non-archived) federation rule still references
+          # the issuer; archive those rules first (a rule's issuer cannot be changed), or
+          # recreate them against another issuer.
+          #
+          # @overload archive(federation_issuer_id, request_options: {})
+          #
+          # @param federation_issuer_id [String] ID of the federation issuer to archive.
+          #
+          # @param request_options [Anthropic::RequestOptions, Hash{Symbol=>Object}, nil]
+          #
+          # @return [Anthropic::Models::Organization::Federation::FederationIssuer]
+          #
+          # @see Anthropic::Models::Organization::Federation::IssuerArchiveParams
+          def archive(federation_issuer_id, params = {})
+            @client.request(
+              method: :post,
+              path: ["v1/organizations/federation_issuers/%1$s/archive", federation_issuer_id],
+              model: Anthropic::Organization::Federation::FederationIssuer,
+              options: params[:request_options]
+            )
+          end
+
+          # @api private
+          #
+          # @param client [Anthropic::Client]
+          def initialize(client:)
+            @client = client
+          end
+        end
+      end
+    end
+  end
+end

data/lib/anthropic/resources/organization/federation/rules/workspaces.rb

@@ -0,0 +1,136 @@
+# frozen_string_literal: true
+
+module Anthropic
+  module Resources
+    class Organization
+      class Federation
+        class Rules
+          class Workspaces
+            # **Requires an OAuth access token with the `org:admin` scope**, from
+            # `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+            # API keys are not accepted. See
+            # [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+            #
+            # List workspaces where this federation rule is enabled.
+            #
+            # Returns all workspace enablements in a single response; the `limit` and `page`
+            # parameters are accepted but have no effect, and `next_page` is always `null`.
+            # Returns explicit per-workspace enablements only; for rules with
+            # `applies_to_all_workspaces` or a legacy single `workspace_id`, check those
+            # fields on the rule itself.
+            #
+            # @overload list(federation_rule_id, limit: nil, page: nil, request_options: {})
+            #
+            # @param federation_rule_id [String] ID of the federation rule.
+            #
+            # @param limit [Integer] Number of results per page.
+            #
+            # @param page [String, nil] Opaque cursor from a previous response's `next_page`.
+            #
+            # @param request_options [Anthropic::RequestOptions, Hash{Symbol=>Object}, nil]
+            #
+            # @return [Anthropic::Internal::PageCursor<Anthropic::Models::Organization::Federation::FederationRuleWorkspace>]
+            #
+            # @see Anthropic::Models::Organization::Federation::Rules::WorkspaceListParams
+            def list(federation_rule_id, params = {})
+              parsed, options = Anthropic::Organization::Federation::Rules::WorkspaceListParams.dump_request(params)
+              query = Anthropic::Internal::Util.encode_query_params(parsed)
+              @client.request(
+                method: :get,
+                path: ["v1/organizations/federation_rules/%1$s/workspaces", federation_rule_id],
+                query: query,
+                page: Anthropic::Internal::PageCursor,
+                model: Anthropic::Organization::Federation::FederationRuleWorkspace,
+                options: options
+              )
+            end
+
+            # **Requires an OAuth access token with the `org:admin` scope**, from
+            # `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+            # API keys are not accepted. See
+            # [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+            #
+            # Enable a federation rule for a workspace.
+            #
+            # Idempotent; re-enabling returns the existing enablement. The rule and workspace
+            # must both belong to your organization. Membership of the rule's target service
+            # account in this workspace is not checked at enablement: token exchange into this
+            # workspace is rejected unless the target is a member (it is implicitly a member
+            # of the default workspace). Archived rules are rejected with 400. OAuth callers
+            # may only manage rules whose `oauth_scope` is `workspace:developer` or
+            # `workspace:inference`; other scopes require a Console session.
+            #
+            # @overload add(federation_rule_id, workspace_id:, request_options: {})
+            #
+            # @param federation_rule_id [String] ID of the federation rule.
+            #
+            # @param workspace_id [String] Tagged ID of the workspace to enable this rule for.
+            #
+            # @param request_options [Anthropic::RequestOptions, Hash{Symbol=>Object}, nil]
+            #
+            # @return [Anthropic::Models::Organization::Federation::FederationRuleWorkspace]
+            #
+            # @see Anthropic::Models::Organization::Federation::Rules::WorkspaceAddParams
+            def add(federation_rule_id, params)
+              parsed, options = Anthropic::Organization::Federation::Rules::WorkspaceAddParams.dump_request(params)
+              @client.request(
+                method: :post,
+                path: ["v1/organizations/federation_rules/%1$s/workspaces", federation_rule_id],
+                body: parsed,
+                model: Anthropic::Organization::Federation::FederationRuleWorkspace,
+                options: options
+              )
+            end
+
+            # **Requires an OAuth access token with the `org:admin` scope**, from
+            # `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+            # API keys are not accepted. See
+            # [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+            #
+            # Disable a federation rule for a workspace.
+            #
+            # Idempotent; succeeds even if the enablement was already removed. OAuth callers
+            # may only manage rules whose `oauth_scope` is `workspace:developer` or
+            # `workspace:inference`; other scopes require a Console session.
+            #
+            # @overload remove(workspace_id, federation_rule_id:, request_options: {})
+            #
+            # @param workspace_id [String] ID of the workspace to disable for.
+            #
+            # @param federation_rule_id [String] ID of the federation rule.
+            #
+            # @param request_options [Anthropic::RequestOptions, Hash{Symbol=>Object}, nil]
+            #
+            # @return [Anthropic::Models::Organization::Federation::Rules::WorkspaceRemoveResponse]
+            #
+            # @see Anthropic::Models::Organization::Federation::Rules::WorkspaceRemoveParams
+            def remove(workspace_id, params)
+              parsed, options = Anthropic::Organization::Federation::Rules::WorkspaceRemoveParams.dump_request(params)
+              federation_rule_id =
+                parsed.delete(:federation_rule_id) do
+                  raise ArgumentError.new("missing required path argument #{_1}")
+                end
+              @client.request(
+                method: :delete,
+                path: [
+                  "v1/organizations/federation_rules/%1$s/workspaces/%2$s",
+                  federation_rule_id,
+                  workspace_id
+                ],
+                model: Anthropic::Models::Organization::Federation::Rules::WorkspaceRemoveResponse,
+                options: options
+              )
+            end
+
+            # @api private
+            #
+            # @param client [Anthropic::Client]
+            def initialize(client:)
+              @client = client
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/anthropic/resources/organization/federation/rules.rb

@@ -0,0 +1,239 @@
+# frozen_string_literal: true
+
+module Anthropic
+  module Resources
+    class Organization
+      class Federation
+        class Rules
+          # @return [Anthropic::Resources::Organization::Federation::Rules::Workspaces]
+          attr_reader :workspaces
+
+          # **Requires an OAuth access token with the `org:admin` scope**, from
+          # `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+          # API keys are not accepted. See
+          # [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+          #
+          # Create a federation rule owned by your organization.
+          #
+          # The referenced issuer and the target service account must already exist in the
+          # same organization; invalid references are rejected with a 400 error. The
+          # workspace reference is validated. Membership is not checked at rule creation:
+          # token exchange resolves a single enabled workspace per call and is rejected
+          # unless the target service account is a member of that workspace (it is
+          # implicitly a member of the default workspace). Rules on well-known shared
+          # issuers (GitHub Actions, GitLab, Buildkite, Terraform Cloud, Google) must
+          # constrain tenant identity via an identity-bearing claim, a tenant-pinning
+          # subject prefix (such as `repo:YOUR_ORG/...`), or a CEL condition referencing one
+          # of those identity claims (e.g. `claims.repository_owner`). OAuth callers may
+          # only manage rules whose `oauth_scope` is `workspace:developer` or
+          # `workspace:inference`; other scopes require a Console session.
+          #
+          # Some parameter documentations has been truncated, see
+          # {Anthropic::Models::Organization::Federation::RuleCreateParams} for more
+          # details.
+          #
+          # @overload create(issuer_id:, match:, name:, oauth_scope:, target:, applies_to_all_workspaces: nil, description: nil, token_lifetime_seconds: nil, workspace_id: nil, request_options: {})
+          #
+          # @param issuer_id [String] Tagged ID of the federation issuer.
+          #
+          # @param match [Anthropic::Models::Organization::Federation::FederationRuleMatch] Conditions the verified JWT must satisfy for this rule to apply. At least one of
+          #
+          # @param name [String] Slug identifier (lowercase, digits, hyphens). Unique within the organization; a
+          #
+          # @param oauth_scope [String] Space-separated OAuth scopes. OAuth callers may only set `workspace:developer` o
+          #
+          # @param target [Anthropic::Models::Organization::Federation::ServiceAccountTarget] Identity that tokens minted via this rule act as. Currently always a `service_ac
+          #
+          # @param applies_to_all_workspaces [Boolean] When true, enable this rule for every workspace in the org (including workspaces
+          #
+          # @param description [String, nil] Optional free-text description.
+          #
+          # @param token_lifetime_seconds [Integer] Lifetime in seconds for access tokens minted via this rule (60-86400). Defaults
+          #
+          # @param workspace_id [String, nil] Tagged ID of the workspace to enable this rule for. Required unless `applies*to*
+          #
+          # @param request_options [Anthropic::RequestOptions, Hash{Symbol=>Object}, nil]
+          #
+          # @return [Anthropic::Models::Organization::Federation::FederationRule]
+          #
+          # @see Anthropic::Models::Organization::Federation::RuleCreateParams
+          def create(params)
+            parsed, options = Anthropic::Organization::Federation::RuleCreateParams.dump_request(params)
+            @client.request(
+              method: :post,
+              path: "v1/organizations/federation_rules",
+              body: parsed,
+              model: Anthropic::Organization::Federation::FederationRule,
+              options: options
+            )
+          end
+
+          # **Requires an OAuth access token with the `org:admin` scope**, from
+          # `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+          # API keys are not accepted. See
+          # [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+          #
+          # Retrieve a federation rule by its ID (`fdrl_...`).
+          #
+          # @overload retrieve(federation_rule_id, request_options: {})
+          #
+          # @param federation_rule_id [String] ID of the federation rule.
+          #
+          # @param request_options [Anthropic::RequestOptions, Hash{Symbol=>Object}, nil]
+          #
+          # @return [Anthropic::Models::Organization::Federation::FederationRule]
+          #
+          # @see Anthropic::Models::Organization::Federation::RuleRetrieveParams
+          def retrieve(federation_rule_id, params = {})
+            @client.request(
+              method: :get,
+              path: ["v1/organizations/federation_rules/%1$s", federation_rule_id],
+              model: Anthropic::Organization::Federation::FederationRule,
+              options: params[:request_options]
+            )
+          end
+
+          # **Requires an OAuth access token with the `org:admin` scope**, from
+          # `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+          # API keys are not accepted. See
+          # [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+          #
+          # Partially update a federation rule.
+          #
+          # `issuer_id` is immutable. `match` and `target` are replaced as whole objects
+          # when set. Referenced service accounts and workspaces must exist in your
+          # organization; invalid references are rejected with a 400 error. Archived rules
+          # cannot be updated; this returns 400. Create a new rule instead. Rules on
+          # well-known shared issuers (GitHub Actions, GitLab, Buildkite, Terraform Cloud,
+          # Google) must constrain tenant identity via an identity-bearing claim, a
+          # tenant-pinning subject prefix (such as `repo:YOUR_ORG/...`), or a CEL condition
+          # referencing one of those identity claims (e.g. `claims.repository_owner`). On
+          # these issuers the requirement is re-checked on every update; if an existing
+          # rule's stored match does not yet constrain tenant identity, any update (even a
+          # rename or description change) must also supply a conforming `match` in the same
+          # request. OAuth callers may only manage rules whose `oauth_scope` is
+          # `workspace:developer` or `workspace:inference`; other scopes require a Console
+          # session.
+          #
+          # Some parameter documentations has been truncated, see
+          # {Anthropic::Models::Organization::Federation::RuleUpdateParams} for more
+          # details.
+          #
+          # @overload update(federation_rule_id, applies_to_all_workspaces: nil, description: nil, match: nil, name: nil, oauth_scope: nil, target: nil, token_lifetime_seconds: nil, workspace_id: nil, request_options: {})
+          #
+          # @param federation_rule_id [String] ID of the federation rule to update.
+          #
+          # @param applies_to_all_workspaces [Boolean, nil] When true, enables this rule for every workspace in the org (including workspace
+          #
+          # @param description [String, nil] Replaces the description. Omit to leave unchanged; send `null` to clear (the fie
+          #
+          # @param match [Anthropic::Models::Organization::Federation::FederationRuleMatch, nil] Replaces the entire match object. All populated matcher fields must pass.
+          #
+          # @param name [String, nil] Replaces the slug identifier (lowercase, digits, hyphens). Unique within the org
+          #
+          # @param oauth_scope [String, nil] Replaces the space-separated OAuth scopes granted on minted tokens. OAuth caller
+          #
+          # @param target [Anthropic::Models::Organization::Federation::ServiceAccountTarget, nil] Replaces the entire target object. Currently always a `service_account` target.
+          #
+          # @param token_lifetime_seconds [Integer, nil] Replaces the lifetime in seconds for access tokens minted via this rule (60-8640
+          #
+          # @param workspace_id [String, nil] Replaces the existing single workspace enablement (the previous one is removed).
+          #
+          # @param request_options [Anthropic::RequestOptions, Hash{Symbol=>Object}, nil]
+          #
+          # @return [Anthropic::Models::Organization::Federation::FederationRule]
+          #
+          # @see Anthropic::Models::Organization::Federation::RuleUpdateParams
+          def update(federation_rule_id, params = {})
+            parsed, options = Anthropic::Organization::Federation::RuleUpdateParams.dump_request(params)
+            @client.request(
+              method: :post,
+              path: ["v1/organizations/federation_rules/%1$s", federation_rule_id],
+              body: parsed,
+              model: Anthropic::Organization::Federation::FederationRule,
+              options: options
+            )
+          end
+
+          # **Requires an OAuth access token with the `org:admin` scope**, from
+          # `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+          # API keys are not accepted. See
+          # [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+          #
+          # List federation rules in your organization.
+          #
+          # Optionally filter by issuer with `issuer_id`. Archived rules are excluded unless
+          # `include_archived=true`.
+          #
+          # @overload list(include_archived: nil, issuer_id: nil, limit: nil, page: nil, request_options: {})
+          #
+          # @param include_archived [Boolean] Include archived resources. Defaults to false.
+          #
+          # @param issuer_id [String, nil] Filter to rules referencing this federation issuer.
+          #
+          # @param limit [Integer] Number of results per page.
+          #
+          # @param page [String, nil] Opaque cursor from a previous response's `next_page`.
+          #
+          # @param request_options [Anthropic::RequestOptions, Hash{Symbol=>Object}, nil]
+          #
+          # @return [Anthropic::Internal::PageCursor<Anthropic::Models::Organization::Federation::FederationRule>]
+          #
+          # @see Anthropic::Models::Organization::Federation::RuleListParams
+          def list(params = {})
+            parsed, options = Anthropic::Organization::Federation::RuleListParams.dump_request(params)
+            query = Anthropic::Internal::Util.encode_query_params(parsed)
+            @client.request(
+              method: :get,
+              path: "v1/organizations/federation_rules",
+              query: query,
+              page: Anthropic::Internal::PageCursor,
+              model: Anthropic::Organization::Federation::FederationRule,
+              options: options
+            )
+          end
+
+          # **Requires an OAuth access token with the `org:admin` scope**, from
+          # `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+          # API keys are not accepted. See
+          # [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+          #
+          # Archive a federation rule.
+          #
+          # Token exchange through this rule stops immediately. Idempotent; re-archiving
+          # returns the rule with its original `archived_at`. Archiving clears the rule's
+          # workspace targeting (`workspace_id` and `workspace_ids` are emptied). Tokens
+          # already minted before archive remain valid until they expire. OAuth callers may
+          # only manage rules whose `oauth_scope` is `workspace:developer` or
+          # `workspace:inference`; other scopes require a Console session.
+          #
+          # @overload archive(federation_rule_id, request_options: {})
+          #
+          # @param federation_rule_id [String] ID of the federation rule to archive.
+          #
+          # @param request_options [Anthropic::RequestOptions, Hash{Symbol=>Object}, nil]
+          #
+          # @return [Anthropic::Models::Organization::Federation::FederationRule]
+          #
+          # @see Anthropic::Models::Organization::Federation::RuleArchiveParams
+          def archive(federation_rule_id, params = {})
+            @client.request(
+              method: :post,
+              path: ["v1/organizations/federation_rules/%1$s/archive", federation_rule_id],
+              model: Anthropic::Organization::Federation::FederationRule,
+              options: params[:request_options]
+            )
+          end
+
+          # @api private
+          #
+          # @param client [Anthropic::Client]
+          def initialize(client:)
+            @client = client
+            @workspaces = Anthropic::Resources::Organization::Federation::Rules::Workspaces.new(client: client)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/anthropic/resources/organization/federation.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module Anthropic
+  module Resources
+    class Organization
+      class Federation
+        # @return [Anthropic::Resources::Organization::Federation::Issuers]
+        attr_reader :issuers
+
+        # @return [Anthropic::Resources::Organization::Federation::Rules]
+        attr_reader :rules
+
+        # @api private
+        #
+        # @param client [Anthropic::Client]
+        def initialize(client:)
+          @client = client
+          @issuers = Anthropic::Resources::Organization::Federation::Issuers.new(client: client)
+          @rules = Anthropic::Resources::Organization::Federation::Rules.new(client: client)
+        end
+      end
+    end
+  end
+end