anthropic 1.74.0 → 1.76.0

data/rbi/anthropic/models/organization/federation/federation_issuer.rbi

@@ -0,0 +1,304 @@
+# typed: strong
+
+module Anthropic
+  module Models
+    module Organization
+      FederationIssuer = Federation::FederationIssuer
+
+      module Federation
+        class FederationIssuer < Anthropic::Internal::Type::BaseModel
+          OrHash =
+            T.type_alias do
+              T.any(
+                Anthropic::Organization::Federation::FederationIssuer,
+                Anthropic::Internal::AnyHash
+              )
+            end
+
+          # Tagged ID of the federation issuer.
+          sig { returns(String) }
+          attr_accessor :id
+
+          # If set, all rules referencing this issuer reject token exchange.
+          sig { returns(T.nilable(Time)) }
+          attr_accessor :archived_at
+
+          # Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.
+          sig { returns(T.nilable(String)) }
+          attr_accessor :archived_by_actor_id
+
+          # Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for
+          # tokens from this issuer. Applies only to assertions carrying a `jti` claim;
+          # tokens without one are accepted without single-use enforcement.
+          sig { returns(T::Boolean) }
+          attr_accessor :check_jti
+
+          # When this issuer was created.
+          sig { returns(Time) }
+          attr_accessor :created_at
+
+          # Tagged ID (`user_`/`svac_`) of the actor that created this issuer.
+          sig { returns(T.nilable(String)) }
+          attr_accessor :created_by_actor_id
+
+          # The `iss` claim value. Incoming JWTs must match exactly.
+          sig { returns(String) }
+          attr_accessor :issuer_url
+
+          # How signing keys are obtained for signature verification.
+          sig do
+            returns(
+              Anthropic::Organization::Federation::FederationIssuer::JWKS::Variants
+            )
+          end
+          attr_accessor :jwks
+
+          # If set, Anthropic's JWKS poller has paused polling for this issuer after
+          # repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via
+          # the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An
+          # OAuth caller cannot send this when the issuer backs a rule with any scope other
+          # than `workspace:developer` or `workspace:inference`; use a Console session.
+          sig { returns(T.nilable(Time)) }
+          attr_accessor :jwks_polling_disabled_at
+
+          # Maximum allowed iat→exp spread for assertions from this issuer (1-176400
+          # seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing
+          # `iat` is rejected.
+          sig { returns(Integer) }
+          attr_accessor :max_jwt_lifetime_seconds
+
+          # Admin-chosen slug identifier.
+          sig { returns(String) }
+          attr_accessor :name
+
+          # Live state of Anthropic's JWKS polling for this issuer. Populated on both
+          # single-issuer retrieval and list responses, including archived issuers.
+          # Typically null for inline-key issuers (no polling), or when poll status is
+          # temporarily unavailable or polling has not started yet.
+          sig do
+            returns(
+              T.nilable(
+                Anthropic::Organization::Federation::FederationIssuerPollStatus
+              )
+            )
+          end
+          attr_reader :poll_status
+
+          sig do
+            params(
+              poll_status:
+                T.nilable(
+                  Anthropic::Organization::Federation::FederationIssuerPollStatus::OrHash
+                )
+            ).void
+          end
+          attr_writer :poll_status
+
+          sig { returns(Symbol) }
+          attr_accessor :type
+
+          # When this issuer was last updated.
+          sig { returns(Time) }
+          attr_accessor :updated_at
+
+          # Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.
+          sig { returns(T.nilable(String)) }
+          attr_accessor :updated_by_actor_id
+
+          # Registered external OIDC identity provider.
+          #
+          # Records an external IdP the organization trusts for the RFC 7523 jwt-bearer
+          # grant. The `issuer_url` must match the JWT `iss` claim exactly.
+          sig do
+            params(
+              id: String,
+              archived_at: T.nilable(Time),
+              archived_by_actor_id: T.nilable(String),
+              check_jti: T::Boolean,
+              created_at: Time,
+              created_by_actor_id: T.nilable(String),
+              issuer_url: String,
+              jwks:
+                T.any(
+                  Anthropic::Organization::Federation::JWKSDiscovery::OrHash,
+                  Anthropic::Organization::Federation::JWKSExplicitURL::OrHash,
+                  Anthropic::Organization::Federation::JWKSInline::OrHash
+                ),
+              jwks_polling_disabled_at: T.nilable(Time),
+              max_jwt_lifetime_seconds: Integer,
+              name: String,
+              poll_status:
+                T.nilable(
+                  Anthropic::Organization::Federation::FederationIssuerPollStatus::OrHash
+                ),
+              updated_at: Time,
+              updated_by_actor_id: T.nilable(String),
+              type: Symbol
+            ).returns(T.attached_class)
+          end
+          def self.new(
+            # Tagged ID of the federation issuer.
+            id:,
+            # If set, all rules referencing this issuer reject token exchange.
+            archived_at:,
+            # Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.
+            archived_by_actor_id:,
+            # Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for
+            # tokens from this issuer. Applies only to assertions carrying a `jti` claim;
+            # tokens without one are accepted without single-use enforcement.
+            check_jti:,
+            # When this issuer was created.
+            created_at:,
+            # Tagged ID (`user_`/`svac_`) of the actor that created this issuer.
+            created_by_actor_id:,
+            # The `iss` claim value. Incoming JWTs must match exactly.
+            issuer_url:,
+            # How signing keys are obtained for signature verification.
+            jwks:,
+            # If set, Anthropic's JWKS poller has paused polling for this issuer after
+            # repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via
+            # the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An
+            # OAuth caller cannot send this when the issuer backs a rule with any scope other
+            # than `workspace:developer` or `workspace:inference`; use a Console session.
+            jwks_polling_disabled_at:,
+            # Maximum allowed iat→exp spread for assertions from this issuer (1-176400
+            # seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing
+            # `iat` is rejected.
+            max_jwt_lifetime_seconds:,
+            # Admin-chosen slug identifier.
+            name:,
+            # Live state of Anthropic's JWKS polling for this issuer. Populated on both
+            # single-issuer retrieval and list responses, including archived issuers.
+            # Typically null for inline-key issuers (no polling), or when poll status is
+            # temporarily unavailable or polling has not started yet.
+            poll_status:,
+            # When this issuer was last updated.
+            updated_at:,
+            # Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.
+            updated_by_actor_id:,
+            type: :federation_issuer
+          )
+          end
+
+          sig do
+            override.returns(
+              {
+                id: String,
+                archived_at: T.nilable(Time),
+                archived_by_actor_id: T.nilable(String),
+                check_jti: T::Boolean,
+                created_at: Time,
+                created_by_actor_id: T.nilable(String),
+                issuer_url: String,
+                jwks:
+                  Anthropic::Organization::Federation::FederationIssuer::JWKS::Variants,
+                jwks_polling_disabled_at: T.nilable(Time),
+                max_jwt_lifetime_seconds: Integer,
+                name: String,
+                poll_status:
+                  T.nilable(
+                    Anthropic::Organization::Federation::FederationIssuerPollStatus
+                  ),
+                type: Symbol,
+                updated_at: Time,
+                updated_by_actor_id: T.nilable(String)
+              }
+            )
+          end
+          def to_hash
+          end
+
+          # How signing keys are obtained for signature verification.
+          module JWKS
+            extend Anthropic::Internal::Type::Union
+
+            Variants =
+              T.type_alias do
+                T.any(
+                  Anthropic::Organization::Federation::JWKSDiscovery,
+                  Anthropic::Organization::Federation::JWKSExplicitURL,
+                  Anthropic::Organization::Federation::JWKSInline
+                )
+              end
+
+            module Type
+              extend Anthropic::Internal::Type::Enum
+
+              TaggedSymbol =
+                T.type_alias do
+                  T.all(
+                    Symbol,
+                    Anthropic::Organization::Federation::FederationIssuer::JWKS::Type
+                  )
+                end
+              OrSymbol = T.type_alias { T.any(Symbol, String) }
+
+              DISCOVERY =
+                T.let(
+                  :discovery,
+                  Anthropic::Organization::Federation::FederationIssuer::JWKS::Type::TaggedSymbol
+                )
+              EXPLICIT_URL =
+                T.let(
+                  :explicit_url,
+                  Anthropic::Organization::Federation::FederationIssuer::JWKS::Type::TaggedSymbol
+                )
+              INLINE =
+                T.let(
+                  :inline,
+                  Anthropic::Organization::Federation::FederationIssuer::JWKS::Type::TaggedSymbol
+                )
+
+              sig do
+                override.returns(
+                  T::Array[
+                    Anthropic::Organization::Federation::FederationIssuer::JWKS::Type::TaggedSymbol
+                  ]
+                )
+              end
+              def self.values
+              end
+            end
+
+            sig do
+              override.returns(
+                T::Array[
+                  Anthropic::Organization::Federation::FederationIssuer::JWKS::Variants
+                ]
+              )
+            end
+            def self.variants
+            end
+
+            # Creates a new instance of the variant class whose `type` matches the given
+            # value, passing the remaining arguments to its constructor.
+            sig do
+              params(
+                type:
+                  Anthropic::Organization::Federation::FederationIssuer::JWKS::Type::OrSymbol,
+                ca_cert_pem: T.nilable(String),
+                discovery_base: T.nilable(String),
+                url: String,
+                keys: T::Array[T::Hash[Symbol, T.anything]]
+              ).returns(
+                Anthropic::Organization::Federation::FederationIssuer::JWKS::Variants
+              )
+            end
+            def self.new(
+              type:,
+              # Optional custom CA (PEM) for TLS verification of the JWKS fetch.
+              ca_cert_pem: nil,
+              # Set when the discovery URL differs from `issuer_url`.
+              discovery_base: nil,
+              # JWKS endpoint.
+              url: nil,
+              # Inline JWK objects.
+              keys: nil
+            )
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/rbi/anthropic/models/organization/federation/federation_issuer_poll_status.rbi

@@ -0,0 +1,67 @@
+# typed: strong
+
+module Anthropic
+  module Models
+    module Organization
+      FederationIssuerPollStatus = Federation::FederationIssuerPollStatus
+
+      module Federation
+        class FederationIssuerPollStatus < Anthropic::Internal::Type::BaseModel
+          OrHash =
+            T.type_alias do
+              T.any(
+                Anthropic::Organization::Federation::FederationIssuerPollStatus,
+                Anthropic::Internal::AnyHash
+              )
+            end
+
+          # Consecutive fetch failures since the last success.
+          sig { returns(Integer) }
+          attr_accessor :consecutive_failures
+
+          # When the last successful fetch completed.
+          sig { returns(T.nilable(Time)) }
+          attr_accessor :last_fetched_at
+
+          # When the next fetch is scheduled. Null if paused.
+          sig { returns(T.nilable(Time)) }
+          attr_accessor :next_poll_at
+
+          # Status of automatic JWKS polling for a federation issuer.
+          #
+          # Anthropic periodically fetches the issuer's signing keys in the background.
+          # These fields summarize the most recent fetches so the health of the JWKS
+          # endpoint can be monitored.
+          sig do
+            params(
+              consecutive_failures: Integer,
+              last_fetched_at: T.nilable(Time),
+              next_poll_at: T.nilable(Time)
+            ).returns(T.attached_class)
+          end
+          def self.new(
+            # Consecutive fetch failures since the last success.
+            consecutive_failures:,
+            # When the last successful fetch completed.
+            last_fetched_at:,
+            # When the next fetch is scheduled. Null if paused.
+            next_poll_at:
+          )
+          end
+
+          sig do
+            override.returns(
+              {
+                consecutive_failures: Integer,
+                last_fetched_at: T.nilable(Time),
+                next_poll_at: T.nilable(Time)
+              }
+            )
+          end
+          def to_hash
+          end
+        end
+      end
+    end
+  end
+end

data/rbi/anthropic/models/organization/federation/federation_rule.rbi

@@ -0,0 +1,224 @@
+# typed: strong
+
+module Anthropic
+  module Models
+    module Organization
+      FederationRule = Federation::FederationRule
+
+      module Federation
+        class FederationRule < Anthropic::Internal::Type::BaseModel
+          OrHash =
+            T.type_alias do
+              T.any(
+                Anthropic::Organization::Federation::FederationRule,
+                Anthropic::Internal::AnyHash
+              )
+            end
+
+          # Tagged ID of the federation rule.
+          sig { returns(String) }
+          attr_accessor :id
+
+          # When true, this rule is enabled for every workspace in the org (including ones
+          # created after the rule). `workspace_ids` is ignored at exchange time.
+          sig { returns(T::Boolean) }
+          attr_accessor :applies_to_all_workspaces
+
+          # If set, this rule is archived and rejects token exchange.
+          sig { returns(T.nilable(Time)) }
+          attr_accessor :archived_at
+
+          # Tagged ID (`user_`/`svac_`) of the actor that archived this rule.
+          sig { returns(T.nilable(String)) }
+          attr_accessor :archived_by_actor_id
+
+          # When this rule was created.
+          sig { returns(Time) }
+          attr_accessor :created_at
+
+          # Tagged ID (`user_`/`svac_`) of the actor that created this rule.
+          sig { returns(T.nilable(String)) }
+          attr_accessor :created_by_actor_id
+
+          # Optional free-text description.
+          sig { returns(T.nilable(String)) }
+          attr_accessor :description
+
+          # Tagged ID of the issuer whose tokens this rule accepts.
+          sig { returns(String) }
+          attr_accessor :issuer_id
+
+          # Issuer's display name at read time.
+          sig { returns(T.nilable(String)) }
+          attr_accessor :issuer_name
+
+          # Conditions the verified JWT must satisfy for this rule to apply. All populated
+          # matcher fields must pass.
+          sig do
+            returns(Anthropic::Organization::Federation::FederationRuleMatch)
+          end
+          attr_reader :match
+
+          sig do
+            params(
+              match:
+                Anthropic::Organization::Federation::FederationRuleMatch::OrHash
+            ).void
+          end
+          attr_writer :match
+
+          # Admin-chosen slug identifier.
+          sig { returns(String) }
+          attr_accessor :name
+
+          # Space-separated OAuth scopes granted on the minted token.
+          sig { returns(String) }
+          attr_accessor :oauth_scope
+
+          # Identity that tokens minted via this rule act as. Currently always a
+          # `service_account` target.
+          sig do
+            returns(Anthropic::Organization::Federation::ServiceAccountTarget)
+          end
+          attr_reader :target
+
+          sig do
+            params(
+              target:
+                Anthropic::Organization::Federation::ServiceAccountTarget::OrHash
+            ).void
+          end
+          attr_writer :target
+
+          # Lifetime in seconds of access tokens minted via this rule. Minted tokens are
+          # capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.
+          sig { returns(Integer) }
+          attr_accessor :token_lifetime_seconds
+
+          sig { returns(Symbol) }
+          attr_accessor :type
+
+          # When this rule was last updated.
+          sig { returns(Time) }
+          attr_accessor :updated_at
+
+          # Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.
+          sig { returns(T.nilable(String)) }
+          attr_accessor :updated_by_actor_id
+
+          # Tagged IDs of the workspaces this rule is enabled for. May be empty for older
+          # rules that only carry the legacy `workspace_id` binding. Ignored at exchange
+          # time when `applies_to_all_workspaces` is true (the list may still be non-empty).
+          sig { returns(T::Array[String]) }
+          attr_accessor :workspace_ids
+
+          # Authorization rule binding an external OIDC identity to Anthropic.
+          #
+          # Evaluates the match conditions and mints an OAuth access token for the resolved
+          # target, scoped to a single workspace where the rule is enabled (chosen by the
+          # caller at exchange time when the rule is enabled for more than one). For rules
+          # enabled via `workspace_ids` or `applies_to_all_workspaces`, the target service
+          # account must be a member of that workspace (it is implicitly a member of the
+          # default workspace); rules carrying only the legacy `workspace_id` binding do not
+          # enforce this.
+          sig do
+            params(
+              id: String,
+              applies_to_all_workspaces: T::Boolean,
+              archived_at: T.nilable(Time),
+              archived_by_actor_id: T.nilable(String),
+              created_at: Time,
+              created_by_actor_id: T.nilable(String),
+              description: T.nilable(String),
+              issuer_id: String,
+              issuer_name: T.nilable(String),
+              match:
+                Anthropic::Organization::Federation::FederationRuleMatch::OrHash,
+              name: String,
+              oauth_scope: String,
+              target:
+                Anthropic::Organization::Federation::ServiceAccountTarget::OrHash,
+              token_lifetime_seconds: Integer,
+              updated_at: Time,
+              updated_by_actor_id: T.nilable(String),
+              workspace_ids: T::Array[String],
+              type: Symbol
+            ).returns(T.attached_class)
+          end
+          def self.new(
+            # Tagged ID of the federation rule.
+            id:,
+            # When true, this rule is enabled for every workspace in the org (including ones
+            # created after the rule). `workspace_ids` is ignored at exchange time.
+            applies_to_all_workspaces:,
+            # If set, this rule is archived and rejects token exchange.
+            archived_at:,
+            # Tagged ID (`user_`/`svac_`) of the actor that archived this rule.
+            archived_by_actor_id:,
+            # When this rule was created.
+            created_at:,
+            # Tagged ID (`user_`/`svac_`) of the actor that created this rule.
+            created_by_actor_id:,
+            # Optional free-text description.
+            description:,
+            # Tagged ID of the issuer whose tokens this rule accepts.
+            issuer_id:,
+            # Issuer's display name at read time.
+            issuer_name:,
+            # Conditions the verified JWT must satisfy for this rule to apply. All populated
+            # matcher fields must pass.
+            match:,
+            # Admin-chosen slug identifier.
+            name:,
+            # Space-separated OAuth scopes granted on the minted token.
+            oauth_scope:,
+            # Identity that tokens minted via this rule act as. Currently always a
+            # `service_account` target.
+            target:,
+            # Lifetime in seconds of access tokens minted via this rule. Minted tokens are
+            # capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.
+            token_lifetime_seconds:,
+            # When this rule was last updated.
+            updated_at:,
+            # Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.
+            updated_by_actor_id:,
+            # Tagged IDs of the workspaces this rule is enabled for. May be empty for older
+            # rules that only carry the legacy `workspace_id` binding. Ignored at exchange
+            # time when `applies_to_all_workspaces` is true (the list may still be non-empty).
+            workspace_ids:,
+            type: :federation_rule
+          )
+          end
+
+          sig do
+            override.returns(
+              {
+                id: String,
+                applies_to_all_workspaces: T::Boolean,
+                archived_at: T.nilable(Time),
+                archived_by_actor_id: T.nilable(String),
+                created_at: Time,
+                created_by_actor_id: T.nilable(String),
+                description: T.nilable(String),
+                issuer_id: String,
+                issuer_name: T.nilable(String),
+                match: Anthropic::Organization::Federation::FederationRuleMatch,
+                name: String,
+                oauth_scope: String,
+                target:
+                  Anthropic::Organization::Federation::ServiceAccountTarget,
+                token_lifetime_seconds: Integer,
+                type: Symbol,
+                updated_at: Time,
+                updated_by_actor_id: T.nilable(String),
+                workspace_ids: T::Array[String]
+              }
+            )
+          end
+          def to_hash
+          end
+        end
+      end
+    end
+  end
+end

data/rbi/anthropic/models/organization/federation/federation_rule_match.rbi

@@ -0,0 +1,89 @@
+# typed: strong
+
+module Anthropic
+  module Models
+    module Organization
+      FederationRuleMatch = Federation::FederationRuleMatch
+
+      module Federation
+        class FederationRuleMatch < Anthropic::Internal::Type::BaseModel
+          OrHash =
+            T.type_alias do
+              T.any(
+                Anthropic::Organization::Federation::FederationRuleMatch,
+                Anthropic::Internal::AnyHash
+              )
+            end
+
+          # Exact match against the `aud` claim (any element if array). When omitted, the
+          # JWT's `aud` must still equal Anthropic's expected audience for the issuer;
+          # setting this field overrides that default.
+          sig { returns(T.nilable(String)) }
+          attr_accessor :audience
+
+          # Exact-match `{claim: value}` pairs against top-level claims. Only string-valued
+          # claims can be matched; use `condition` for non-string claims.
+          sig { returns(T.nilable(T::Hash[Symbol, String])) }
+          attr_accessor :claims
+
+          # CEL expression over claims for logic the structural fields can't express. Must
+          # evaluate to a boolean and may reference only the `claims` variable; a
+          # constant-true expression (such as `true`) is rejected with 400.
+          sig { returns(T.nilable(String)) }
+          attr_accessor :condition
+
+          # Match the verified JWT `sub` claim. Exact match unless the value ends with `*`,
+          # in which case it is a prefix match. Example:
+          # `repo:my-org/my-repo:ref:refs/heads/main`.
+          sig { returns(T.nilable(String)) }
+          attr_accessor :subject_prefix
+
+          # Does the incoming JWT qualify?
+          #
+          # All populated fields must pass; omitted fields are skipped. At least one of
+          # `subject_prefix` (other than a wildcard-only value like `*`), `claims`, or
+          # `condition` is required; `audience` alone is not sufficient.
+          sig do
+            params(
+              audience: T.nilable(String),
+              claims: T.nilable(T::Hash[Symbol, String]),
+              condition: T.nilable(String),
+              subject_prefix: T.nilable(String)
+            ).returns(T.attached_class)
+          end
+          def self.new(
+            # Exact match against the `aud` claim (any element if array). When omitted, the
+            # JWT's `aud` must still equal Anthropic's expected audience for the issuer;
+            # setting this field overrides that default.
+            audience: nil,
+            # Exact-match `{claim: value}` pairs against top-level claims. Only string-valued
+            # claims can be matched; use `condition` for non-string claims.
+            claims: nil,
+            # CEL expression over claims for logic the structural fields can't express. Must
+            # evaluate to a boolean and may reference only the `claims` variable; a
+            # constant-true expression (such as `true`) is rejected with 400.
+            condition: nil,
+            # Match the verified JWT `sub` claim. Exact match unless the value ends with `*`,
+            # in which case it is a prefix match. Example:
+            # `repo:my-org/my-repo:ref:refs/heads/main`.
+            subject_prefix: nil
+          )
+          end
+
+          sig do
+            override.returns(
+              {
+                audience: T.nilable(String),
+                claims: T.nilable(T::Hash[Symbol, String]),
+                condition: T.nilable(String),
+                subject_prefix: T.nilable(String)
+              }
+            )
+          end
+          def to_hash
+          end
+        end
+      end
+    end
+  end
+end