@anthropic-ai/sdk 0.119.0 → 0.121.0

package/resources/beta/organization/federation/rules/rules.mjs

@@ -0,0 +1,193 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+import { APIResource } from "../../../../../core/resource.mjs";
+import * as WorkspacesAPI from "./workspaces.mjs";
+import { Workspaces, } from "./workspaces.mjs";
+import { PageCursor } from "../../../../../core/pagination.mjs";
+import { buildHeaders } from "../../../../../internal/headers.mjs";
+import { path } from "../../../../../internal/utils/path.mjs";
+export class Rules extends APIResource {
+    constructor() {
+        super(...arguments);
+        this.workspaces = new WorkspacesAPI.Workspaces(this._client);
+    }
+    /**
+     * **Requires an OAuth access token with the `org:admin` scope**, from
+     * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+     * API keys are not accepted. See
+     * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+     *
+     * Create a federation rule owned by your organization.
+     *
+     * The referenced issuer and the target service account must already exist in the
+     * same organization; invalid references are rejected with a 400 error. The
+     * workspace reference is validated. Membership is not checked at rule creation:
+     * token exchange resolves a single enabled workspace per call and is rejected
+     * unless the target service account is a member of that workspace (it is
+     * implicitly a member of the default workspace). Rules on well-known shared
+     * issuers (GitHub Actions, GitLab, Buildkite, Terraform Cloud, Google) must
+     * constrain tenant identity via an identity-bearing claim, a tenant-pinning
+     * subject prefix (such as `repo:YOUR_ORG/...`), or a CEL condition referencing one
+     * of those identity claims (e.g. `claims.repository_owner`). OAuth callers may
+     * only manage rules whose `oauth_scope` is `workspace:developer` or
+     * `workspace:inference`; other scopes require a Console session.
+     *
+     * @example
+     * ```ts
+     * const betaFederationRule =
+     *   await client.beta.organization.federation.rules.create({
+     *     issuer_id: 'issuer_id',
+     *     match: {},
+     *     name: 'x',
+     *     oauth_scope: 'x',
+     *     target: {
+     *       service_account_id: 'svac_01SDCCSbTxrXDpWc1phhtcfK',
+     *       type: 'service_account',
+     *     },
+     *   });
+     * ```
+     */
+    create(params, options) {
+        const { betas, ...body } = params;
+        return this._client.post('/v1/organizations/federation_rules?beta=true', {
+            body,
+            ...options,
+            headers: buildHeaders([
+                { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
+                options?.headers,
+            ]),
+        });
+    }
+    /**
+     * **Requires an OAuth access token with the `org:admin` scope**, from
+     * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+     * API keys are not accepted. See
+     * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+     *
+     * Retrieve a federation rule by its ID (`fdrl_...`).
+     *
+     * @example
+     * ```ts
+     * const betaFederationRule =
+     *   await client.beta.organization.federation.rules.retrieve(
+     *     'federation_rule_id',
+     *   );
+     * ```
+     */
+    retrieve(federationRuleID, params = {}, options) {
+        const { betas } = params ?? {};
+        return this._client.get(path `/v1/organizations/federation_rules/${federationRuleID}?beta=true`, {
+            ...options,
+            headers: buildHeaders([
+                { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
+                options?.headers,
+            ]),
+        });
+    }
+    /**
+     * **Requires an OAuth access token with the `org:admin` scope**, from
+     * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+     * API keys are not accepted. See
+     * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+     *
+     * Partially update a federation rule.
+     *
+     * `issuer_id` is immutable. `match` and `target` are replaced as whole objects
+     * when set. Referenced service accounts and workspaces must exist in your
+     * organization; invalid references are rejected with a 400 error. Archived rules
+     * cannot be updated; this returns 400. Create a new rule instead. Rules on
+     * well-known shared issuers (GitHub Actions, GitLab, Buildkite, Terraform Cloud,
+     * Google) must constrain tenant identity via an identity-bearing claim, a
+     * tenant-pinning subject prefix (such as `repo:YOUR_ORG/...`), or a CEL condition
+     * referencing one of those identity claims (e.g. `claims.repository_owner`). On
+     * these issuers the requirement is re-checked on every update; if an existing
+     * rule's stored match does not yet constrain tenant identity, any update (even a
+     * rename or description change) must also supply a conforming `match` in the same
+     * request. OAuth callers may only manage rules whose `oauth_scope` is
+     * `workspace:developer` or `workspace:inference`; other scopes require a Console
+     * session.
+     *
+     * @example
+     * ```ts
+     * const betaFederationRule =
+     *   await client.beta.organization.federation.rules.update(
+     *     'federation_rule_id',
+     *   );
+     * ```
+     */
+    update(federationRuleID, params, options) {
+        const { betas, ...body } = params;
+        return this._client.post(path `/v1/organizations/federation_rules/${federationRuleID}?beta=true`, {
+            body,
+            ...options,
+            headers: buildHeaders([
+                { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
+                options?.headers,
+            ]),
+        });
+    }
+    /**
+     * **Requires an OAuth access token with the `org:admin` scope**, from
+     * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+     * API keys are not accepted. See
+     * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+     *
+     * List federation rules in your organization.
+     *
+     * Optionally filter by issuer with `issuer_id`. Archived rules are excluded unless
+     * `include_archived=true`.
+     *
+     * @example
+     * ```ts
+     * // Automatically fetches more pages as needed.
+     * for await (const betaFederationRule of client.beta.organization.federation.rules.list()) {
+     *   // ...
+     * }
+     * ```
+     */
+    list(params = {}, options) {
+        const { betas, ...query } = params ?? {};
+        return this._client.getAPIList('/v1/organizations/federation_rules?beta=true', (PageCursor), {
+            query,
+            ...options,
+            headers: buildHeaders([
+                { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
+                options?.headers,
+            ]),
+        });
+    }
+    /**
+     * **Requires an OAuth access token with the `org:admin` scope**, from
+     * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+     * API keys are not accepted. See
+     * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+     *
+     * Archive a federation rule.
+     *
+     * Token exchange through this rule stops immediately. Idempotent; re-archiving
+     * returns the rule with its original `archived_at`. Archiving clears the rule's
+     * workspace targeting (`workspace_id` and `workspace_ids` are emptied). Tokens
+     * already minted before archive remain valid until they expire. OAuth callers may
+     * only manage rules whose `oauth_scope` is `workspace:developer` or
+     * `workspace:inference`; other scopes require a Console session.
+     *
+     * @example
+     * ```ts
+     * const betaFederationRule =
+     *   await client.beta.organization.federation.rules.archive(
+     *     'federation_rule_id',
+     *   );
+     * ```
+     */
+    archive(federationRuleID, params = {}, options) {
+        const { betas } = params ?? {};
+        return this._client.post(path `/v1/organizations/federation_rules/${federationRuleID}/archive?beta=true`, {
+            ...options,
+            headers: buildHeaders([
+                { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
+                options?.headers,
+            ]),
+        });
+    }
+}
+Rules.Workspaces = Workspaces;
+//# sourceMappingURL=rules.mjs.map

package/resources/beta/organization/federation/rules/rules.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.mjs","sourceRoot":"","sources":["../../../../../src/resources/beta/organization/federation/rules/rules.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAEtF,OAAO,EAAE,WAAW,EAAE,yCAAqC;AAE3D,OAAO,KAAK,aAAa,yBAAqB;AAC9C,OAAO,EAKL,UAAU,GACX,yBAAqB;AAEtB,OAAO,EAAE,UAAU,EAAsC,2CAAuC;AAChG,OAAO,EAAE,YAAY,EAAE,4CAAwC;AAE/D,OAAO,EAAE,IAAI,EAAE,+CAA2C;AAE1D,MAAM,OAAO,KAAM,SAAQ,WAAW;IAAtC;;QACE,eAAU,GAA6B,IAAI,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IA2MpF,CAAC;IAzMC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACH,MAAM,CAAC,MAAwB,EAAE,OAAwB;QACvD,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;QAClC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,8CAA8C,EAAE;YACvE,IAAI;YACJ,GAAG,OAAO;YACV,OAAO,EAAE,YAAY,CAAC;gBACpB,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE;gBACxF,OAAO,EAAE,OAAO;aACjB,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CACN,gBAAwB,EACxB,SAAgD,EAAE,EAClD,OAAwB;QAExB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAA,sCAAsC,gBAAgB,YAAY,EAAE;YAC9F,GAAG,OAAO;YACV,OAAO,EAAE,YAAY,CAAC;gBACpB,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE;gBACxF,OAAO,EAAE,OAAO;aACjB,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,MAAM,CACJ,gBAAwB,EACxB,MAAwB,EACxB,OAAwB;QAExB,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;QAClC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAA,sCAAsC,gBAAgB,YAAY,EAAE;YAC/F,IAAI;YACJ,GAAG,OAAO;YACV,OAAO,EAAE,YAAY,CAAC;gBACpB,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE;gBACxF,OAAO,EAAE,OAAO;aACjB,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,IAAI,CACF,SAA4C,EAAE,EAC9C,OAAwB;QAExB,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAC5B,8CAA8C,EAC9C,CAAA,UAA8B,CAAA,EAC9B;YACE,KAAK;YACL,GAAG,OAAO;YACV,OAAO,EAAE,YAAY,CAAC;gBACpB,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE;gBACxF,OAAO,EAAE,OAAO;aACjB,CAAC;SACH,CACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CACL,gBAAwB,EACxB,SAA+C,EAAE,EACjD,OAAwB;QAExB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAA,sCAAsC,gBAAgB,oBAAoB,EAAE;YACvG,GAAG,OAAO;YACV,OAAO,EAAE,YAAY,CAAC;gBACpB,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE;gBACxF,OAAO,EAAE,OAAO;aACjB,CAAC;SACH,CAAC,CAAC;IACL,CAAC;CACF;AA0XD,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC"}

package/resources/beta/organization/federation/rules/workspaces.d.mts

@@ -0,0 +1,124 @@
+import { APIResource } from "../../../../../core/resource.mjs";
+import * as BetaAPI from "../../../beta.mjs";
+import * as RulesAPI from "./rules.mjs";
+import { BetaFederationRuleWorkspacesPageCursor } from "./rules.mjs";
+import { APIPromise } from "../../../../../core/api-promise.mjs";
+import { type PageCursorParams, PagePromise } from "../../../../../core/pagination.mjs";
+import { RequestOptions } from "../../../../../internal/request-options.mjs";
+export declare class Workspaces extends APIResource {
+    /**
+     * **Requires an OAuth access token with the `org:admin` scope**, from
+     * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+     * API keys are not accepted. See
+     * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+     *
+     * List workspaces where this federation rule is enabled.
+     *
+     * Returns all workspace enablements in a single response; the `limit` and `page`
+     * parameters are accepted but have no effect, and `next_page` is always `null`.
+     * Returns explicit per-workspace enablements only; for rules with
+     * `applies_to_all_workspaces` or a legacy single `workspace_id`, check those
+     * fields on the rule itself.
+     *
+     * @example
+     * ```ts
+     * // Automatically fetches more pages as needed.
+     * for await (const betaFederationRuleWorkspace of client.beta.organization.federation.rules.workspaces.list(
+     *   'federation_rule_id',
+     * )) {
+     *   // ...
+     * }
+     * ```
+     */
+    list(federationRuleID: string, params?: WorkspaceListParams | null | undefined, options?: RequestOptions): PagePromise<BetaFederationRuleWorkspacesPageCursor, RulesAPI.BetaFederationRuleWorkspace>;
+    /**
+     * **Requires an OAuth access token with the `org:admin` scope**, from
+     * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+     * API keys are not accepted. See
+     * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+     *
+     * Enable a federation rule for a workspace.
+     *
+     * Idempotent; re-enabling returns the existing enablement. The rule and workspace
+     * must both belong to your organization. Membership of the rule's target service
+     * account in this workspace is not checked at enablement: token exchange into this
+     * workspace is rejected unless the target is a member (it is implicitly a member
+     * of the default workspace). Archived rules are rejected with 400. OAuth callers
+     * may only manage rules whose `oauth_scope` is `workspace:developer` or
+     * `workspace:inference`; other scopes require a Console session.
+     *
+     * @example
+     * ```ts
+     * const betaFederationRuleWorkspace =
+     *   await client.beta.organization.federation.rules.workspaces.add(
+     *     'federation_rule_id',
+     *     { workspace_id: 'workspace_id' },
+     *   );
+     * ```
+     */
+    add(federationRuleID: string, params: WorkspaceAddParams, options?: RequestOptions): APIPromise<RulesAPI.BetaFederationRuleWorkspace>;
+    /**
+     * **Requires an OAuth access token with the `org:admin` scope**, from
+     * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+     * API keys are not accepted. See
+     * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+     *
+     * Disable a federation rule for a workspace.
+     *
+     * Idempotent; succeeds even if the enablement was already removed. OAuth callers
+     * may only manage rules whose `oauth_scope` is `workspace:developer` or
+     * `workspace:inference`; other scopes require a Console session.
+     *
+     * @example
+     * ```ts
+     * const workspace =
+     *   await client.beta.organization.federation.rules.workspaces.remove(
+     *     'workspace_id',
+     *     { federation_rule_id: 'federation_rule_id' },
+     *   );
+     * ```
+     */
+    remove(workspaceID: string, params: WorkspaceRemoveParams, options?: RequestOptions): APIPromise<WorkspaceRemoveResponse>;
+}
+export interface WorkspaceRemoveResponse {
+    /**
+     * Tagged ID of the federation rule.
+     */
+    federation_rule_id: string;
+    type: 'federation_rule_workspace_deleted';
+    /**
+     * Tagged ID of the workspace named in the delete request. Removal is idempotent.
+     */
+    workspace_id: string;
+}
+export interface WorkspaceListParams extends PageCursorParams {
+    /**
+     * Header param: Optional header to specify the beta version(s) you want to use.
+     */
+    betas?: Array<BetaAPI.AnthropicBeta>;
+}
+export interface WorkspaceAddParams {
+    /**
+     * Body param: Tagged ID of the workspace to enable this rule for.
+     */
+    workspace_id: string;
+    /**
+     * Header param: Optional header to specify the beta version(s) you want to use.
+     */
+    betas?: Array<BetaAPI.AnthropicBeta>;
+}
+export interface WorkspaceRemoveParams {
+    /**
+     * Path param: ID of the federation rule.
+     */
+    federation_rule_id: string;
+    /**
+     * Header param: Optional header to specify the beta version(s) you want to use.
+     */
+    betas?: Array<BetaAPI.AnthropicBeta>;
+}
+export declare namespace Workspaces {
+    export { type WorkspaceRemoveResponse as WorkspaceRemoveResponse, type WorkspaceListParams as WorkspaceListParams, type WorkspaceAddParams as WorkspaceAddParams, type WorkspaceRemoveParams as WorkspaceRemoveParams, };
+}
+export { type BetaFederationRuleWorkspacesPageCursor };
+//# sourceMappingURL=workspaces.d.mts.map

package/resources/beta/organization/federation/rules/workspaces.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspaces.d.mts","sourceRoot":"","sources":["../../../../../src/resources/beta/organization/federation/rules/workspaces.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,yCAAqC;AAC3D,OAAO,KAAK,OAAO,0BAAsB;AACzC,OAAO,KAAK,QAAQ,oBAAgB;AACpC,OAAO,EAAE,sCAAsC,EAAE,oBAAgB;AACjE,OAAO,EAAE,UAAU,EAAE,4CAAwC;AAC7D,OAAO,EAAc,KAAK,gBAAgB,EAAE,WAAW,EAAE,2CAAuC;AAEhG,OAAO,EAAE,cAAc,EAAE,oDAAgD;AAGzE,qBAAa,UAAW,SAAQ,WAAW;IACzC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,IAAI,CACF,gBAAgB,EAAE,MAAM,EACxB,MAAM,GAAE,mBAAmB,GAAG,IAAI,GAAG,SAAc,EACnD,OAAO,CAAC,EAAE,cAAc,GACvB,WAAW,CAAC,sCAAsC,EAAE,QAAQ,CAAC,2BAA2B,CAAC;IAgB5F;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,GAAG,CACD,gBAAgB,EAAE,MAAM,EACxB,MAAM,EAAE,kBAAkB,EAC1B,OAAO,CAAC,EAAE,cAAc,GACvB,UAAU,CAAC,QAAQ,CAAC,2BAA2B,CAAC;IAenD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,MAAM,CACJ,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,qBAAqB,EAC7B,OAAO,CAAC,EAAE,cAAc,GACvB,UAAU,CAAC,uBAAuB,CAAC;CAavC;AAED,MAAM,WAAW,uBAAuB;IACtC;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B,IAAI,EAAE,mCAAmC,CAAC;IAE1C;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,mBAAoB,SAAQ,gBAAgB;IAC3D;;OAEG;IACH,KAAK,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,KAAK,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;OAEG;IACH,KAAK,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;CACtC;AAED,MAAM,CAAC,OAAO,WAAW,UAAU,CAAC;IAClC,OAAO,EACL,KAAK,uBAAuB,IAAI,uBAAuB,EACvD,KAAK,mBAAmB,IAAI,mBAAmB,EAC/C,KAAK,kBAAkB,IAAI,kBAAkB,EAC7C,KAAK,qBAAqB,IAAI,qBAAqB,GACpD,CAAC;CACH;AAED,OAAO,EAAE,KAAK,sCAAsC,EAAE,CAAC"}

package/resources/beta/organization/federation/rules/workspaces.d.ts

@@ -0,0 +1,124 @@
+import { APIResource } from "../../../../../core/resource.js";
+import * as BetaAPI from "../../../beta.js";
+import * as RulesAPI from "./rules.js";
+import { BetaFederationRuleWorkspacesPageCursor } from "./rules.js";
+import { APIPromise } from "../../../../../core/api-promise.js";
+import { type PageCursorParams, PagePromise } from "../../../../../core/pagination.js";
+import { RequestOptions } from "../../../../../internal/request-options.js";
+export declare class Workspaces extends APIResource {
+    /**
+     * **Requires an OAuth access token with the `org:admin` scope**, from
+     * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+     * API keys are not accepted. See
+     * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+     *
+     * List workspaces where this federation rule is enabled.
+     *
+     * Returns all workspace enablements in a single response; the `limit` and `page`
+     * parameters are accepted but have no effect, and `next_page` is always `null`.
+     * Returns explicit per-workspace enablements only; for rules with
+     * `applies_to_all_workspaces` or a legacy single `workspace_id`, check those
+     * fields on the rule itself.
+     *
+     * @example
+     * ```ts
+     * // Automatically fetches more pages as needed.
+     * for await (const betaFederationRuleWorkspace of client.beta.organization.federation.rules.workspaces.list(
+     *   'federation_rule_id',
+     * )) {
+     *   // ...
+     * }
+     * ```
+     */
+    list(federationRuleID: string, params?: WorkspaceListParams | null | undefined, options?: RequestOptions): PagePromise<BetaFederationRuleWorkspacesPageCursor, RulesAPI.BetaFederationRuleWorkspace>;
+    /**
+     * **Requires an OAuth access token with the `org:admin` scope**, from
+     * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+     * API keys are not accepted. See
+     * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+     *
+     * Enable a federation rule for a workspace.
+     *
+     * Idempotent; re-enabling returns the existing enablement. The rule and workspace
+     * must both belong to your organization. Membership of the rule's target service
+     * account in this workspace is not checked at enablement: token exchange into this
+     * workspace is rejected unless the target is a member (it is implicitly a member
+     * of the default workspace). Archived rules are rejected with 400. OAuth callers
+     * may only manage rules whose `oauth_scope` is `workspace:developer` or
+     * `workspace:inference`; other scopes require a Console session.
+     *
+     * @example
+     * ```ts
+     * const betaFederationRuleWorkspace =
+     *   await client.beta.organization.federation.rules.workspaces.add(
+     *     'federation_rule_id',
+     *     { workspace_id: 'workspace_id' },
+     *   );
+     * ```
+     */
+    add(federationRuleID: string, params: WorkspaceAddParams, options?: RequestOptions): APIPromise<RulesAPI.BetaFederationRuleWorkspace>;
+    /**
+     * **Requires an OAuth access token with the `org:admin` scope**, from
+     * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+     * API keys are not accepted. See
+     * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+     *
+     * Disable a federation rule for a workspace.
+     *
+     * Idempotent; succeeds even if the enablement was already removed. OAuth callers
+     * may only manage rules whose `oauth_scope` is `workspace:developer` or
+     * `workspace:inference`; other scopes require a Console session.
+     *
+     * @example
+     * ```ts
+     * const workspace =
+     *   await client.beta.organization.federation.rules.workspaces.remove(
+     *     'workspace_id',
+     *     { federation_rule_id: 'federation_rule_id' },
+     *   );
+     * ```
+     */
+    remove(workspaceID: string, params: WorkspaceRemoveParams, options?: RequestOptions): APIPromise<WorkspaceRemoveResponse>;
+}
+export interface WorkspaceRemoveResponse {
+    /**
+     * Tagged ID of the federation rule.
+     */
+    federation_rule_id: string;
+    type: 'federation_rule_workspace_deleted';
+    /**
+     * Tagged ID of the workspace named in the delete request. Removal is idempotent.
+     */
+    workspace_id: string;
+}
+export interface WorkspaceListParams extends PageCursorParams {
+    /**
+     * Header param: Optional header to specify the beta version(s) you want to use.
+     */
+    betas?: Array<BetaAPI.AnthropicBeta>;
+}
+export interface WorkspaceAddParams {
+    /**
+     * Body param: Tagged ID of the workspace to enable this rule for.
+     */
+    workspace_id: string;
+    /**
+     * Header param: Optional header to specify the beta version(s) you want to use.
+     */
+    betas?: Array<BetaAPI.AnthropicBeta>;
+}
+export interface WorkspaceRemoveParams {
+    /**
+     * Path param: ID of the federation rule.
+     */
+    federation_rule_id: string;
+    /**
+     * Header param: Optional header to specify the beta version(s) you want to use.
+     */
+    betas?: Array<BetaAPI.AnthropicBeta>;
+}
+export declare namespace Workspaces {
+    export { type WorkspaceRemoveResponse as WorkspaceRemoveResponse, type WorkspaceListParams as WorkspaceListParams, type WorkspaceAddParams as WorkspaceAddParams, type WorkspaceRemoveParams as WorkspaceRemoveParams, };
+}
+export { type BetaFederationRuleWorkspacesPageCursor };
+//# sourceMappingURL=workspaces.d.ts.map

package/resources/beta/organization/federation/rules/workspaces.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspaces.d.ts","sourceRoot":"","sources":["../../../../../src/resources/beta/organization/federation/rules/workspaces.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,wCAAqC;AAC3D,OAAO,KAAK,OAAO,yBAAsB;AACzC,OAAO,KAAK,QAAQ,mBAAgB;AACpC,OAAO,EAAE,sCAAsC,EAAE,mBAAgB;AACjE,OAAO,EAAE,UAAU,EAAE,2CAAwC;AAC7D,OAAO,EAAc,KAAK,gBAAgB,EAAE,WAAW,EAAE,0CAAuC;AAEhG,OAAO,EAAE,cAAc,EAAE,mDAAgD;AAGzE,qBAAa,UAAW,SAAQ,WAAW;IACzC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,IAAI,CACF,gBAAgB,EAAE,MAAM,EACxB,MAAM,GAAE,mBAAmB,GAAG,IAAI,GAAG,SAAc,EACnD,OAAO,CAAC,EAAE,cAAc,GACvB,WAAW,CAAC,sCAAsC,EAAE,QAAQ,CAAC,2BAA2B,CAAC;IAgB5F;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,GAAG,CACD,gBAAgB,EAAE,MAAM,EACxB,MAAM,EAAE,kBAAkB,EAC1B,OAAO,CAAC,EAAE,cAAc,GACvB,UAAU,CAAC,QAAQ,CAAC,2BAA2B,CAAC;IAenD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,MAAM,CACJ,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,qBAAqB,EAC7B,OAAO,CAAC,EAAE,cAAc,GACvB,UAAU,CAAC,uBAAuB,CAAC;CAavC;AAED,MAAM,WAAW,uBAAuB;IACtC;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B,IAAI,EAAE,mCAAmC,CAAC;IAE1C;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,mBAAoB,SAAQ,gBAAgB;IAC3D;;OAEG;IACH,KAAK,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,KAAK,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;OAEG;IACH,KAAK,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;CACtC;AAED,MAAM,CAAC,OAAO,WAAW,UAAU,CAAC;IAClC,OAAO,EACL,KAAK,uBAAuB,IAAI,uBAAuB,EACvD,KAAK,mBAAmB,IAAI,mBAAmB,EAC/C,KAAK,kBAAkB,IAAI,kBAAkB,EAC7C,KAAK,qBAAqB,IAAI,qBAAqB,GACpD,CAAC;CACH;AAED,OAAO,EAAE,KAAK,sCAAsC,EAAE,CAAC"}

package/resources/beta/organization/federation/rules/workspaces.js

@@ -0,0 +1,114 @@
+"use strict";
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Workspaces = void 0;
+const resource_1 = require("../../../../../core/resource.js");
+const pagination_1 = require("../../../../../core/pagination.js");
+const headers_1 = require("../../../../../internal/headers.js");
+const path_1 = require("../../../../../internal/utils/path.js");
+class Workspaces extends resource_1.APIResource {
+    /**
+     * **Requires an OAuth access token with the `org:admin` scope**, from
+     * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+     * API keys are not accepted. See
+     * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+     *
+     * List workspaces where this federation rule is enabled.
+     *
+     * Returns all workspace enablements in a single response; the `limit` and `page`
+     * parameters are accepted but have no effect, and `next_page` is always `null`.
+     * Returns explicit per-workspace enablements only; for rules with
+     * `applies_to_all_workspaces` or a legacy single `workspace_id`, check those
+     * fields on the rule itself.
+     *
+     * @example
+     * ```ts
+     * // Automatically fetches more pages as needed.
+     * for await (const betaFederationRuleWorkspace of client.beta.organization.federation.rules.workspaces.list(
+     *   'federation_rule_id',
+     * )) {
+     *   // ...
+     * }
+     * ```
+     */
+    list(federationRuleID, params = {}, options) {
+        const { betas, ...query } = params ?? {};
+        return this._client.getAPIList((0, path_1.path) `/v1/organizations/federation_rules/${federationRuleID}/workspaces?beta=true`, (pagination_1.PageCursor), {
+            query,
+            ...options,
+            headers: (0, headers_1.buildHeaders)([
+                { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
+                options?.headers,
+            ]),
+        });
+    }
+    /**
+     * **Requires an OAuth access token with the `org:admin` scope**, from
+     * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+     * API keys are not accepted. See
+     * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+     *
+     * Enable a federation rule for a workspace.
+     *
+     * Idempotent; re-enabling returns the existing enablement. The rule and workspace
+     * must both belong to your organization. Membership of the rule's target service
+     * account in this workspace is not checked at enablement: token exchange into this
+     * workspace is rejected unless the target is a member (it is implicitly a member
+     * of the default workspace). Archived rules are rejected with 400. OAuth callers
+     * may only manage rules whose `oauth_scope` is `workspace:developer` or
+     * `workspace:inference`; other scopes require a Console session.
+     *
+     * @example
+     * ```ts
+     * const betaFederationRuleWorkspace =
+     *   await client.beta.organization.federation.rules.workspaces.add(
+     *     'federation_rule_id',
+     *     { workspace_id: 'workspace_id' },
+     *   );
+     * ```
+     */
+    add(federationRuleID, params, options) {
+        const { betas, ...body } = params;
+        return this._client.post((0, path_1.path) `/v1/organizations/federation_rules/${federationRuleID}/workspaces?beta=true`, {
+            body,
+            ...options,
+            headers: (0, headers_1.buildHeaders)([
+                { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
+                options?.headers,
+            ]),
+        });
+    }
+    /**
+     * **Requires an OAuth access token with the `org:admin` scope**, from
+     * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+     * API keys are not accepted. See
+     * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+     *
+     * Disable a federation rule for a workspace.
+     *
+     * Idempotent; succeeds even if the enablement was already removed. OAuth callers
+     * may only manage rules whose `oauth_scope` is `workspace:developer` or
+     * `workspace:inference`; other scopes require a Console session.
+     *
+     * @example
+     * ```ts
+     * const workspace =
+     *   await client.beta.organization.federation.rules.workspaces.remove(
+     *     'workspace_id',
+     *     { federation_rule_id: 'federation_rule_id' },
+     *   );
+     * ```
+     */
+    remove(workspaceID, params, options) {
+        const { federation_rule_id, betas } = params;
+        return this._client.delete((0, path_1.path) `/v1/organizations/federation_rules/${federation_rule_id}/workspaces/${workspaceID}?beta=true`, {
+            ...options,
+            headers: (0, headers_1.buildHeaders)([
+                { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
+                options?.headers,
+            ]),
+        });
+    }
+}
+exports.Workspaces = Workspaces;
+//# sourceMappingURL=workspaces.js.map

package/resources/beta/organization/federation/rules/workspaces.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspaces.js","sourceRoot":"","sources":["../../../../../src/resources/beta/organization/federation/rules/workspaces.ts"],"names":[],"mappings":";AAAA,sFAAsF;;;AAEtF,8DAA2D;AAK3D,kEAAgG;AAChG,gEAA+D;AAE/D,gEAA0D;AAE1D,MAAa,UAAW,SAAQ,sBAAW;IACzC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,IAAI,CACF,gBAAwB,EACxB,SAAiD,EAAE,EACnD,OAAwB;QAExB,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAC5B,IAAA,WAAI,EAAA,sCAAsC,gBAAgB,uBAAuB,EACjF,CAAA,uBAAgD,CAAA,EAChD;YACE,KAAK;YACL,GAAG,OAAO;YACV,OAAO,EAAE,IAAA,sBAAY,EAAC;gBACpB,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE;gBACxF,OAAO,EAAE,OAAO;aACjB,CAAC;SACH,CACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,GAAG,CACD,gBAAwB,EACxB,MAA0B,EAC1B,OAAwB;QAExB,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;QAClC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB,IAAA,WAAI,EAAA,sCAAsC,gBAAgB,uBAAuB,EACjF;YACE,IAAI;YACJ,GAAG,OAAO;YACV,OAAO,EAAE,IAAA,sBAAY,EAAC;gBACpB,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE;gBACxF,OAAO,EAAE,OAAO;aACjB,CAAC;SACH,CACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,MAAM,CACJ,WAAmB,EACnB,MAA6B,EAC7B,OAAwB;QAExB,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;QAC7C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CACxB,IAAA,WAAI,EAAA,sCAAsC,kBAAkB,eAAe,WAAW,YAAY,EAClG;YACE,GAAG,OAAO;YACV,OAAO,EAAE,IAAA,sBAAY,EAAC;gBACpB,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE;gBACxF,OAAO,EAAE,OAAO;aACjB,CAAC;SACH,CACF,CAAC;IACJ,CAAC;CACF;AA/HD,gCA+HC"}