anthropic 1.74.0 → 1.76.0

data/rbi/anthropic/resources/organization/federation/rules.rbi

@@ -0,0 +1,247 @@
+# typed: strong
+
+module Anthropic
+  module Resources
+    class Organization
+      class Federation
+        class Rules
+          sig do
+            returns(
+              Anthropic::Resources::Organization::Federation::Rules::Workspaces
+            )
+          end
+          attr_reader :workspaces
+
+          # **Requires an OAuth access token with the `org:admin` scope**, from
+          # `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+          # API keys are not accepted. See
+          # [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+          #
+          # Create a federation rule owned by your organization.
+          #
+          # The referenced issuer and the target service account must already exist in the
+          # same organization; invalid references are rejected with a 400 error. The
+          # workspace reference is validated. Membership is not checked at rule creation:
+          # token exchange resolves a single enabled workspace per call and is rejected
+          # unless the target service account is a member of that workspace (it is
+          # implicitly a member of the default workspace). Rules on well-known shared
+          # issuers (GitHub Actions, GitLab, Buildkite, Terraform Cloud, Google) must
+          # constrain tenant identity via an identity-bearing claim, a tenant-pinning
+          # subject prefix (such as `repo:YOUR_ORG/...`), or a CEL condition referencing one
+          # of those identity claims (e.g. `claims.repository_owner`). OAuth callers may
+          # only manage rules whose `oauth_scope` is `workspace:developer` or
+          # `workspace:inference`; other scopes require a Console session.
+          sig do
+            params(
+              issuer_id: String,
+              match:
+                Anthropic::Organization::Federation::FederationRuleMatch::OrHash,
+              name: String,
+              oauth_scope: String,
+              target:
+                Anthropic::Organization::Federation::ServiceAccountTarget::OrHash,
+              applies_to_all_workspaces: T::Boolean,
+              description: T.nilable(String),
+              token_lifetime_seconds: Integer,
+              workspace_id: T.nilable(String),
+              request_options: Anthropic::RequestOptions::OrHash
+            ).returns(Anthropic::Organization::Federation::FederationRule)
+          end
+          def create(
+            # Tagged ID of the federation issuer.
+            issuer_id:,
+            # Conditions the verified JWT must satisfy for this rule to apply. At least one of
+            # `subject_prefix` (other than a wildcard-only value like `*`), `claims`, or
+            # `condition` is required; `audience` alone is not sufficient.
+            match:,
+            # Slug identifier (lowercase, digits, hyphens). Unique within the organization; a
+            # duplicate name returns 409.
+            name:,
+            # Space-separated OAuth scopes. OAuth callers may only set `workspace:developer`
+            # or `workspace:inference`; other scopes (such as `org:admin`) require a Console
+            # session.
+            oauth_scope:,
+            # Identity that tokens minted via this rule act as. Currently always a
+            # `service_account` target.
+            target:,
+            # When true, enable this rule for every workspace in the org (including workspaces
+            # created later).
+            applies_to_all_workspaces: nil,
+            # Optional free-text description.
+            description: nil,
+            # Lifetime in seconds for access tokens minted via this rule (60-86400). Defaults
+            # to 3600 (1h). Minted tokens are capped at
+            # `max(60, min(this value, 2 × remaining assertion validity))` seconds.
+            token_lifetime_seconds: nil,
+            # Tagged ID of the workspace to enable this rule for. Required unless
+            # `applies_to_all_workspaces` is true. Additional workspaces can be added via the
+            # `/federation_rules/{federation_rule_id}/workspaces` sub-resource.
+            workspace_id: nil,
+            request_options: {}
+          )
+          end
+
+          # **Requires an OAuth access token with the `org:admin` scope**, from
+          # `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+          # API keys are not accepted. See
+          # [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+          #
+          # Retrieve a federation rule by its ID (`fdrl_...`).
+          sig do
+            params(
+              federation_rule_id: String,
+              request_options: Anthropic::RequestOptions::OrHash
+            ).returns(Anthropic::Organization::Federation::FederationRule)
+          end
+          def retrieve(
+            # ID of the federation rule.
+            federation_rule_id,
+            request_options: {}
+          )
+          end
+
+          # **Requires an OAuth access token with the `org:admin` scope**, from
+          # `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+          # API keys are not accepted. See
+          # [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+          #
+          # Partially update a federation rule.
+          #
+          # `issuer_id` is immutable. `match` and `target` are replaced as whole objects
+          # when set. Referenced service accounts and workspaces must exist in your
+          # organization; invalid references are rejected with a 400 error. Archived rules
+          # cannot be updated; this returns 400. Create a new rule instead. Rules on
+          # well-known shared issuers (GitHub Actions, GitLab, Buildkite, Terraform Cloud,
+          # Google) must constrain tenant identity via an identity-bearing claim, a
+          # tenant-pinning subject prefix (such as `repo:YOUR_ORG/...`), or a CEL condition
+          # referencing one of those identity claims (e.g. `claims.repository_owner`). On
+          # these issuers the requirement is re-checked on every update; if an existing
+          # rule's stored match does not yet constrain tenant identity, any update (even a
+          # rename or description change) must also supply a conforming `match` in the same
+          # request. OAuth callers may only manage rules whose `oauth_scope` is
+          # `workspace:developer` or `workspace:inference`; other scopes require a Console
+          # session.
+          sig do
+            params(
+              federation_rule_id: String,
+              applies_to_all_workspaces: T.nilable(T::Boolean),
+              description: T.nilable(String),
+              match:
+                T.nilable(
+                  Anthropic::Organization::Federation::FederationRuleMatch::OrHash
+                ),
+              name: T.nilable(String),
+              oauth_scope: T.nilable(String),
+              target:
+                T.nilable(
+                  Anthropic::Organization::Federation::ServiceAccountTarget::OrHash
+                ),
+              token_lifetime_seconds: T.nilable(Integer),
+              workspace_id: T.nilable(String),
+              request_options: Anthropic::RequestOptions::OrHash
+            ).returns(Anthropic::Organization::Federation::FederationRule)
+          end
+          def update(
+            # ID of the federation rule to update.
+            federation_rule_id,
+            # When true, enables this rule for every workspace in the org (including
+            # workspaces created later). Setting `false` is rejected with 400 if no workspace
+            # would remain enabled; a rule with only a legacy `workspace_id` binding continues
+            # to mint.
+            applies_to_all_workspaces: nil,
+            # Replaces the description. Omit to leave unchanged; send `null` to clear (the
+            # field is stored as an empty string).
+            description: nil,
+            # Replaces the entire match object. All populated matcher fields must pass.
+            match: nil,
+            # Replaces the slug identifier (lowercase, digits, hyphens). Unique within the
+            # organization; a duplicate name returns 409.
+            name: nil,
+            # Replaces the space-separated OAuth scopes granted on minted tokens. OAuth
+            # callers may only set `workspace:developer` or `workspace:inference`; other
+            # scopes (such as `org:admin`) require a Console session.
+            oauth_scope: nil,
+            # Replaces the entire target object. Currently always a `service_account` target.
+            target: nil,
+            # Replaces the lifetime in seconds for access tokens minted via this rule
+            # (60-86400). Minted tokens are capped at
+            # `max(60, min(this value, 2 × remaining assertion validity))` seconds.
+            token_lifetime_seconds: nil,
+            # Replaces the existing single workspace enablement (the previous one is removed).
+            # Rejected with 400 if the rule is enabled for more than one workspace; use the
+            # `/federation_rules/{federation_rule_id}/workspaces` sub-resource instead.
+            workspace_id: nil,
+            request_options: {}
+          )
+          end
+
+          # **Requires an OAuth access token with the `org:admin` scope**, from
+          # `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+          # API keys are not accepted. See
+          # [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+          #
+          # List federation rules in your organization.
+          #
+          # Optionally filter by issuer with `issuer_id`. Archived rules are excluded unless
+          # `include_archived=true`.
+          sig do
+            params(
+              include_archived: T::Boolean,
+              issuer_id: T.nilable(String),
+              limit: Integer,
+              page: T.nilable(String),
+              request_options: Anthropic::RequestOptions::OrHash
+            ).returns(
+              Anthropic::Internal::PageCursor[
+                Anthropic::Organization::Federation::FederationRule
+              ]
+            )
+          end
+          def list(
+            # Include archived resources. Defaults to false.
+            include_archived: nil,
+            # Filter to rules referencing this federation issuer.
+            issuer_id: nil,
+            # Number of results per page.
+            limit: nil,
+            # Opaque cursor from a previous response's `next_page`.
+            page: nil,
+            request_options: {}
+          )
+          end
+
+          # **Requires an OAuth access token with the `org:admin` scope**, from
+          # `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+          # API keys are not accepted. See
+          # [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+          #
+          # Archive a federation rule.
+          #
+          # Token exchange through this rule stops immediately. Idempotent; re-archiving
+          # returns the rule with its original `archived_at`. Archiving clears the rule's
+          # workspace targeting (`workspace_id` and `workspace_ids` are emptied). Tokens
+          # already minted before archive remain valid until they expire. OAuth callers may
+          # only manage rules whose `oauth_scope` is `workspace:developer` or
+          # `workspace:inference`; other scopes require a Console session.
+          sig do
+            params(
+              federation_rule_id: String,
+              request_options: Anthropic::RequestOptions::OrHash
+            ).returns(Anthropic::Organization::Federation::FederationRule)
+          end
+          def archive(
+            # ID of the federation rule to archive.
+            federation_rule_id,
+            request_options: {}
+          )
+          end
+
+          # @api private
+          sig { params(client: Anthropic::Client).returns(T.attached_class) }
+          def self.new(client:)
+          end
+        end
+      end
+    end
+  end
+end

data/rbi/anthropic/resources/organization/federation.rbi

@@ -0,0 +1,20 @@
+# typed: strong
+
+module Anthropic
+  module Resources
+    class Organization
+      class Federation
+        sig { returns(Anthropic::Resources::Organization::Federation::Issuers) }
+        attr_reader :issuers
+
+        sig { returns(Anthropic::Resources::Organization::Federation::Rules) }
+        attr_reader :rules
+
+        # @api private
+        sig { params(client: Anthropic::Client).returns(T.attached_class) }
+        def self.new(client:)
+        end
+      end
+    end
+  end
+end

data/rbi/anthropic/resources/organization/invites.rbi

@@ -0,0 +1,122 @@
+# typed: strong
+
+module Anthropic
+  module Resources
+    class Organization
+      class Invites
+        # Invite a user to join the organization by email.
+        #
+        # On plans that draw members from a finite pool of purchased seats, the invite
+        # automatically consumes a seat from the lowest tier with availability; there is
+        # no seat-tier parameter. When no seat is free the request fails with a 400 error
+        # rather than purchasing a seat.
+        sig do
+          params(
+            email: String,
+            role: Anthropic::Organization::InviteCreateParams::Role::OrSymbol,
+            rbac_group_ids: T::Array[String],
+            request_options: Anthropic::RequestOptions::OrHash
+          ).returns(Anthropic::Organization::OrganizationInvite)
+        end
+        def create(
+          # Email of the User.
+          email:,
+          # Role for the invited User.
+          #
+          # The accepted values depend on the organization type. Console and API
+          # organizations accept `user`, `developer`, `billing`, and `claude_code_user`;
+          # `admin` cannot be assigned through the API. Claude Enterprise organizations
+          # accept `user` and `managed`.
+          role:,
+          # RBAC group IDs to assign to the User when the Invite is accepted. A non-empty
+          # array is accepted only for a Claude Enterprise organization with RBAC groups,
+          # and requires the key to carry the `write:rbac_groups` scope.
+          rbac_group_ids: nil,
+          request_options: {}
+        )
+        end
+
+        # Retrieve an invite by ID.
+        sig do
+          params(
+            invite_id: String,
+            request_options: Anthropic::RequestOptions::OrHash
+          ).returns(Anthropic::Organization::OrganizationInvite)
+        end
+        def retrieve(
+          # ID of the Invite.
+          invite_id,
+          request_options: {}
+        )
+        end
+
+        # List the organization's invites.
+        sig do
+          params(
+            after_id: String,
+            before_id: String,
+            email: String,
+            limit: Integer,
+            roles: T::Array[String],
+            statuses:
+              T::Array[
+                Anthropic::Organization::InviteListParams::Status::OrSymbol
+              ],
+            request_options: Anthropic::RequestOptions::OrHash
+          ).returns(
+            Anthropic::Internal::Page[
+              Anthropic::Organization::OrganizationInvite
+            ]
+          )
+        end
+        def list(
+          # ID of the object to use as a cursor for pagination. When provided, returns the
+          # page of results immediately after this object.
+          after_id: nil,
+          # ID of the object to use as a cursor for pagination. When provided, returns the
+          # page of results immediately before this object.
+          before_id: nil,
+          # Filter by the email address the Invite was sent to. Matches the same way as the
+          # Users list's `email` filter (normalized, case-insensitive).
+          email: nil,
+          # Number of items to return per page.
+          #
+          # Defaults to `20`. Ranges from `1` to `1000`.
+          limit: nil,
+          # Filter to items whose `role` equals one of the supplied values. Repeatable;
+          # values are OR'ed together.
+          #
+          # Accepted values depend on the organization type: Console and API organizations
+          # accept `user`, `developer`, `billing`, `admin`, and `claude_code_user`; Claude
+          # Enterprise organizations accept `user`, `owner`, `primary_owner`,
+          # `membership_admin`, and `managed`.
+          roles: nil,
+          # Filter by Invite status. Repeatable; values are OR'ed together. Omit to return
+          # `pending`, `accepted`, and `expired` Invites alike.
+          statuses: nil,
+          request_options: {}
+        )
+        end
+
+        # Delete a pending invite.
+        sig do
+          params(
+            invite_id: String,
+            request_options: Anthropic::RequestOptions::OrHash
+          ).returns(Anthropic::Models::Organization::InviteDeleteResponse)
+        end
+        def delete(
+          # ID of the Invite.
+          invite_id,
+          request_options: {}
+        )
+        end
+
+        # @api private
+        sig { params(client: Anthropic::Client).returns(T.attached_class) }
+        def self.new(client:)
+        end
+      end
+    end
+  end
+end

data/rbi/anthropic/resources/organization/rate_limits.rbi

@@ -0,0 +1,56 @@
+# typed: strong
+
+module Anthropic
+  module Resources
+    class Organization
+      class RateLimits
+        # List Messages API rate limits for your organization.
+        #
+        # Each entry corresponds to one rate-limit group (either a model family or an
+        # API-surface category such as the Files API or Message Batches) and contains the
+        # set of limiter values that apply to it.
+        #
+        # When `limit` is omitted, every matching entry is returned in a single page; when
+        # `limit` truncates the result, follow `next_page` to fetch the remaining entries.
+        sig do
+          params(
+            group_type:
+              T.nilable(
+                Anthropic::Organization::RateLimitListParams::GroupType::OrSymbol
+              ),
+            limit: T.nilable(Integer),
+            model: T.nilable(String),
+            page: T.nilable(String),
+            request_options: Anthropic::RequestOptions::OrHash
+          ).returns(
+            Anthropic::Internal::PageCursor[
+              Anthropic::Organization::OrganizationRateLimit
+            ]
+          )
+        end
+        def list(
+          # Filter by group type.
+          group_type: nil,
+          # Maximum number of items to return per page. Ranges from `1` to `1000`.
+          #
+          # When omitted, every remaining entry is returned in a single page and `next_page`
+          # is `null`.
+          limit: nil,
+          # Filter to the single entry containing this model. Accepts full model names and
+          # aliases. Returns 404 if the model is not found or has no rate limits for this
+          # organization.
+          model: nil,
+          # Opaque cursor from a previous response's `next_page`.
+          page: nil,
+          request_options: {}
+        )
+        end
+
+        # @api private
+        sig { params(client: Anthropic::Client).returns(T.attached_class) }
+        def self.new(client:)
+        end
+      end
+    end
+  end
+end

data/rbi/anthropic/resources/organization/service_accounts/workspaces.rbi

@@ -0,0 +1,121 @@
+# typed: strong
+
+module Anthropic
+  module Resources
+    class Organization
+      class ServiceAccounts
+        class Workspaces
+          # **Requires an OAuth access token with the `org:admin` scope**, from
+          # `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+          # API keys are not accepted. See
+          # [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+          #
+          # List the workspaces a service account is a member of.
+          #
+          # Each entry includes the service account's `workspace_role` in that workspace.
+          # Use `limit` and the `next_page` cursor to paginate. When the service account has
+          # no explicit default-workspace membership, the implicit (`implicit: true`)
+          # membership is returned as the first entry on the first page; with `limit=1` the
+          # first page may return up to 2 entries (the implicit entry plus one explicit
+          # membership) so a pagination cursor can be derived. Memberships are returned only
+          # while the service account is active. Without a `page` cursor, an archived
+          # service account returns an empty list. A `page` cursor that does not match an
+          # active membership returns a 400 invalid-request error. A cursor stops matching
+          # when the membership is removed, the workspace is deleted, or the service account
+          # is archived. Restart pagination from the first page to recover.
+          sig do
+            params(
+              service_account_id: String,
+              limit: Integer,
+              page: T.nilable(String),
+              request_options: Anthropic::RequestOptions::OrHash
+            ).returns(
+              Anthropic::Internal::PageCursor[
+                Anthropic::Organization::ServiceAccountWorkspaceMember
+              ]
+            )
+          end
+          def list(
+            # ID of the service account.
+            service_account_id,
+            # Number of results per page.
+            limit: nil,
+            # Opaque cursor from a previous response's `next_page`.
+            page: nil,
+            request_options: {}
+          )
+          end
+
+          # **Requires an OAuth access token with the `org:admin` scope**, from
+          # `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+          # API keys are not accepted. See
+          # [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+          #
+          # Add a service account to a workspace with the given `workspace_role`.
+          #
+          # Mirror of `POST /workspaces/{workspace_id}/service_accounts`, addressed from the
+          # service-account side; both create the same membership. If the service account is
+          # already an explicit member of the workspace, its `workspace_role` is replaced
+          # with the value supplied here. Archived workspaces return 400. Archived service
+          # accounts cannot be added and are rejected.
+          sig do
+            params(
+              service_account_id: String,
+              workspace_id: String,
+              workspace_role:
+                Anthropic::Organization::NoBillingWorkspaceRole::OrSymbol,
+              request_options: Anthropic::RequestOptions::OrHash
+            ).returns(Anthropic::Organization::ServiceAccountWorkspaceMember)
+          end
+          def add(
+            # ID of the service account.
+            service_account_id,
+            # Tagged workspace ID to add the service account to.
+            workspace_id:,
+            # Role to assign to the service account in this workspace.
+            workspace_role:,
+            request_options: {}
+          )
+          end
+
+          # **Requires an OAuth access token with the `org:admin` scope**, from
+          # `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+          # API keys are not accepted. See
+          # [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+          #
+          # Remove a service account from a workspace.
+          #
+          # Mirror of
+          # `DELETE /workspaces/{workspace_id}/service_accounts/{service_account_id}`,
+          # addressed from the service-account side. Removal is idempotent (returns 200 even
+          # if the membership was already removed). A DELETE against the implicit
+          # default-workspace membership returns 200 but is a no-op and the membership
+          # persists; deleting an explicit default-workspace row reverts to the implicit
+          # `workspace_user` membership. Archived workspaces return 400.
+          sig do
+            params(
+              workspace_id: String,
+              service_account_id: String,
+              request_options: Anthropic::RequestOptions::OrHash
+            ).returns(
+              Anthropic::Models::Organization::ServiceAccounts::WorkspaceRemoveResponse
+            )
+          end
+          def remove(
+            # ID of the workspace.
+            workspace_id,
+            # ID of the service account.
+            service_account_id:,
+            request_options: {}
+          )
+          end
+
+          # @api private
+          sig { params(client: Anthropic::Client).returns(T.attached_class) }
+          def self.new(client:)
+          end
+        end
+      end
+    end
+  end
+end