anthropic 1.37.0 → 1.38.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9eacf10bf13feb1eb221fe82ee801d2754524985991959c858db721b5cfd825e
-  data.tar.gz: 6e70a7c6d4ee0dd18a892272017f73e524ace1a943579b9694c23c94331ad421
+  metadata.gz: 5053fea394cb2c14a0692837413c50fdfa520703226d15b1788234b9dd865b53
+  data.tar.gz: ac9ffbef339cb6713fbf68b3c4248562f527ad145e621239d9375d43d8ba8d45
 SHA512:
-  metadata.gz: '002489936b1fa9dda322c5dd604bea0eb371ef4a25a8e091e8a7204db4acca6d3dfa7e4840666a1042b0052271215abc18499a99ab5d9a5589401ad1df9626c1'
-  data.tar.gz: 95b904d78f29eb0b36f694c628c52c686775349ca3ba9cb6746ce33758558dc48a624ca925bc72661bf54b033272cf14d57babea6d86ffed7b6d37531fada262
+  metadata.gz: 74d0c247922c3ae14f23915fbdf95d1e5e66d5b785cc9c3804d594da9d28b7c1bf2d68b56bae8f56e991f18f8f74010b0abe97e8b40611eae99931293b7fa89d
+  data.tar.gz: fe67842d5673483fefac88cfaaa496a56a94914eefed0d947815cbcdde48fb8a9120f0cfb1dd59de37f70e8c8eeb996505e1a024b056ce22845f14704377d7f5

data/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 1.38.0 (2026-05-05)
+
+Full Changelog: [v1.37.0...v1.38.0](https://github.com/anthropics/anthropic-sdk-ruby/compare/v1.37.0...v1.38.0)
+
+### Features
+
+* **client:** allow targeting a workspace for OIDC federation token exchange ([85f4668](https://github.com/anthropics/anthropic-sdk-ruby/commit/85f46687b798714bed259e6b78e07bc4df114046))
+
 ## 1.37.0 (2026-05-04)
 
 Full Changelog: [v1.36.0...v1.37.0](https://github.com/anthropics/anthropic-sdk-ruby/compare/v1.36.0...v1.37.0)

data/README.md

@@ -15,7 +15,7 @@ Add to your application's Gemfile:
 <!-- x-release-please-start-version -->
 
 ```ruby
-gem "anthropic", "~> 1.37.0"
+gem "anthropic", "~> 1.38.0"
 ```
 
 <!-- x-release-please-end -->

data/lib/anthropic/credentials/config_provider.rb

@@ -74,6 +74,9 @@ module Anthropic
         headers = {}
 
         auth_type = config[:authentication][:type]
+        # For federation profiles workspace_id is sent in the jwt-bearer
+        # exchange body, not as a request header (the minted token is already
+        # workspace-scoped, so the header would be ignored).
         if auth_type != AUTH_TYPE_OIDC_FEDERATION
           workspace_id = config[:workspace_id]
           headers["anthropic-workspace-id"] = workspace_id.to_s if workspace_id
@@ -193,6 +196,7 @@ module Anthropic
           federation_rule_id: federation_rule_id,
           organization_id: organization_id,
           service_account_id: auth[:service_account_id],
+          workspace_id: @config[:workspace_id],
           scope: auth[:scope]
         )
 
@@ -394,6 +398,7 @@ module Anthropic
       def fill_missing_from_env(config, auth)
         fill(config, :base_url, ENV_BASE_URL)
         fill(config, :organization_id, ENV_ORGANIZATION_ID)
+        fill(config, :workspace_id, ENV_WORKSPACE_ID)
 
         auth_type = auth[:type]
         if auth_type == AUTH_TYPE_OIDC_FEDERATION

data/lib/anthropic/credentials/constants.rb

@@ -62,6 +62,9 @@ module Anthropic
     # Environment variable for service account ID.
     ENV_SERVICE_ACCOUNT_ID = "ANTHROPIC_SERVICE_ACCOUNT_ID"
 
+    # Environment variable for workspace ID.
+    ENV_WORKSPACE_ID = "ANTHROPIC_WORKSPACE_ID"
+
     # Environment variable for OAuth scope.
     ENV_SCOPE = "ANTHROPIC_SCOPE"
 

data/lib/anthropic/credentials/in_memory_config.rb

@@ -103,6 +103,7 @@ module Anthropic
           federation_rule_id: federation_rule_id,
           organization_id: organization_id,
           service_account_id: auth[:service_account_id],
+          workspace_id: config[:workspace_id],
           scope: auth[:scope]
         )
 

data/lib/anthropic/credentials/workload_identity.rb

@@ -53,6 +53,16 @@ module Anthropic
       # @param organization_id [String] the organization's raw UUID string
       # @param service_account_id [String, nil] optional service account ID to
       #   impersonate
+      # @param workspace_id [String, nil] Optional +wrkspc_*+ tagged ID, or the
+      #   literal +"default"+ to scope the token to the organization's default
+      #   workspace. When omitted the server picks the rule's sole enabled
+      #   workspace, else the org default if the rule covers it. Required when
+      #   the rule enables more than one non-default workspace, or to target a
+      #   specific workspace other than the one the server would pick. The
+      #   minted token is workspace-scoped: per-request workspace selection
+      #   (the +anthropic-workspace-id+ header) is not supported for federation
+      #   tokens — switching workspaces requires a new token exchange with a
+      #   different +workspace_id+.
       # @param scope [String, nil] optional OAuth scope (informational only for
       #   federation; the server derives the effective scope from the federation rule)
       def initialize(
@@ -60,12 +70,14 @@ module Anthropic
         federation_rule_id:,
         organization_id:,
         service_account_id: nil,
+        workspace_id: nil,
         scope: nil # rubocop:disable Lint/UnusedMethodArgument
       )
         @identity_token_provider = identity_token_provider
         @federation_rule_id = federation_rule_id
         @organization_id = organization_id
         @service_account_id = service_account_id
+        @workspace_id = workspace_id
         @bound_base_url = nil
       end
 
@@ -128,6 +140,7 @@ module Anthropic
           "organization_id" => @organization_id
         }
         body["service_account_id"] = @service_account_id if @service_account_id
+        body["workspace_id"] = @workspace_id if @workspace_id
 
         request = Net::HTTP::Post.new(uri.path)
         request["Content-Type"] = "application/json"
@@ -173,8 +186,23 @@ module Anthropic
           response.body&.slice(0, 256)
         end
 
+        message = "Token exchange failed (HTTP #{response.code}): #{body}"
+        # An ambiguous 401 is usually a federation-rule misconfiguration.
+        # Surface the fix in the error rather than making the user dig through docs.
+        if response.code.to_i == 401
+          hint_parts = ["Ensure your federation rule matches your identity token"]
+          if @workspace_id.nil?
+            hint_parts << "If your federation rule is scoped to multiple workspaces, set the " \
+                          "ANTHROPIC_WORKSPACE_ID environment variable, the 'workspace_id' " \
+                          "config key, or the workspace_id: keyword argument"
+          end
+          hint_parts << "View your authentication events in the Workload identity page of " \
+                        "Claude Console for more details"
+          message += " #{hint_parts.join('. ')}."
+        end
+
         raise WorkloadIdentityError.new(
-          "Token exchange failed (HTTP #{response.code}): #{body}",
+          message,
           status_code: response.code.to_i,
           body: body,
           request_id: request_id

data/lib/anthropic/credentials.rb

@@ -146,6 +146,10 @@ module Anthropic
           federation_rule_id: federation_rule_id,
           organization_id: organization_id,
           service_account_id: ENV[ENV_SERVICE_ACCOUNT_ID],
+          # Coerce empty string to nil so a defaulted-but-empty CI variable doesn't
+          # put "workspace_id" => "" on the wire — matches the blank-skip in
+          # ConfigProvider#fill.
+          workspace_id: ENV[ENV_WORKSPACE_ID].then { _1 unless _1.to_s.empty? },
           scope: ENV[ENV_SCOPE]
         )
         provider.bind_base_url(base_url)

data/lib/anthropic/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Anthropic
-  VERSION = "1.37.0"
+  VERSION = "1.38.0"
 end

data/rbi/anthropic/credentials.rbi

@@ -23,6 +23,7 @@ module Anthropic
     ENV_FEDERATION_RULE_ID = T.let("ANTHROPIC_FEDERATION_RULE_ID", String)
     ENV_ORGANIZATION_ID = T.let("ANTHROPIC_ORGANIZATION_ID", String)
     ENV_SERVICE_ACCOUNT_ID = T.let("ANTHROPIC_SERVICE_ACCOUNT_ID", String)
+    ENV_WORKSPACE_ID = T.let("ANTHROPIC_WORKSPACE_ID", String)
     ENV_SCOPE = T.let("ANTHROPIC_SCOPE", String)
     AUTH_TYPE_OIDC_FEDERATION = T.let("oidc_federation", String)
     AUTH_TYPE_USER_OAUTH = T.let("user_oauth", String)
@@ -166,6 +167,7 @@ module Anthropic
           federation_rule_id: String,
           organization_id: String,
           service_account_id: T.nilable(String),
+          workspace_id: T.nilable(String),
           scope: T.nilable(String)
         ).void
       end
@@ -174,6 +176,7 @@ module Anthropic
         federation_rule_id:,
         organization_id:,
         service_account_id: nil,
+        workspace_id: nil,
         scope: nil
       )
       end

data/sig/anthropic/credentials.rbs

@@ -20,6 +20,7 @@ module Anthropic
     ENV_FEDERATION_RULE_ID: String
     ENV_ORGANIZATION_ID: String
     ENV_SERVICE_ACCOUNT_ID: String
+    ENV_WORKSPACE_ID: String
     ENV_SCOPE: String
     AUTH_TYPE_OIDC_FEDERATION: String
     AUTH_TYPE_USER_OAUTH: String
@@ -113,6 +114,7 @@ module Anthropic
       @federation_rule_id: String
       @organization_id: String
       @service_account_id: String?
+      @workspace_id: String?
       @scope: String?
       @bound_base_url: String?
 
@@ -121,6 +123,7 @@ module Anthropic
         federation_rule_id: String,
         organization_id: String,
         ?service_account_id: String?,
+        ?workspace_id: String?,
         ?scope: String?
       ) -> void
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: anthropic
 version: !ruby/object:Gem::Version
-  version: 1.37.0
+  version: 1.38.0
 platform: ruby
 authors:
 - Anthropic
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-05-04 00:00:00.000000000 Z
+date: 2026-05-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: cgi