@anthropic-ai/sdk 0.119.0 → 0.121.0

package/src/resources/beta/beta.ts

@@ -218,16 +218,24 @@ import {
   BetaManagedAgentsAlwaysAskPolicy,
   BetaManagedAgentsAnthropicSkill,
   BetaManagedAgentsAnthropicSkillParams,
+  BetaManagedAgentsBashToolConfig,
+  BetaManagedAgentsBashToolConfigParams,
   BetaManagedAgentsCustomSkill,
   BetaManagedAgentsCustomSkillParams,
   BetaManagedAgentsCustomTool,
   BetaManagedAgentsCustomToolInputSchema,
   BetaManagedAgentsCustomToolParams,
+  BetaManagedAgentsEditToolConfig,
+  BetaManagedAgentsEditToolConfigParams,
   BetaManagedAgentsEffortHigh,
   BetaManagedAgentsEffortLow,
   BetaManagedAgentsEffortMax,
   BetaManagedAgentsEffortMedium,
   BetaManagedAgentsEffortXhigh,
+  BetaManagedAgentsGlobToolConfig,
+  BetaManagedAgentsGlobToolConfigParams,
+  BetaManagedAgentsGrepToolConfig,
+  BetaManagedAgentsGrepToolConfigParams,
   BetaManagedAgentsMCPServerURLDefinition,
   BetaManagedAgentsMCPToolConfig,
   BetaManagedAgentsMCPToolConfigParams,
@@ -241,9 +249,18 @@ import {
   BetaManagedAgentsMultiagentCoordinator,
   BetaManagedAgentsMultiagentCoordinatorParams,
   BetaManagedAgentsMultiagentSelfParams,
+  BetaManagedAgentsReadToolConfig,
+  BetaManagedAgentsReadToolConfigParams,
   BetaManagedAgentsSessionThreadAgent,
   BetaManagedAgentsSkillParams,
   BetaManagedAgentsURLMCPServerParams,
+  BetaManagedAgentsUserLocation,
+  BetaManagedAgentsWebFetchToolConfig,
+  BetaManagedAgentsWebFetchToolConfigParams,
+  BetaManagedAgentsWebSearchToolConfig,
+  BetaManagedAgentsWebSearchToolConfigParams,
+  BetaManagedAgentsWriteToolConfig,
+  BetaManagedAgentsWriteToolConfigParams,
 } from './agents/agents';
 import * as EnvironmentsAPI from './environments/environments';
 import {
@@ -578,6 +595,8 @@ import {
   BetaMCPToolConfig,
   BetaMCPToolDefaultConfig,
 } from './messages/messages';
+import * as OrganizationAPI from './organization/organization';
+import { BetaOrganization, BetaOrganizationRole, Organization } from './organization/organization';
 import * as SessionsAPI from './sessions/sessions';
 import {
   BetaManagedAgentsAdvisorParams,
@@ -679,6 +698,7 @@ export class Beta extends APIResource {
   userProfiles: UserProfilesAPI.UserProfiles = new UserProfilesAPI.UserProfiles(this._client);
   dreams: DreamsAPI.Dreams = new DreamsAPI.Dreams(this._client);
   tunnels: TunnelsAPI.Tunnels = new TunnelsAPI.Tunnels(this._client);
+  organization: OrganizationAPI.Organization = new OrganizationAPI.Organization(this._client);
 }
 
 export type AnthropicBeta =
@@ -716,7 +736,14 @@ export type AnthropicBeta =
   | 'fallback-credit-2026-06-01'
   | 'fallback-credit-2026-07-01'
   | 'agent-memory-2026-07-22'
-  | 'mid-conversation-tool-changes-2026-07-01';
+  | 'mid-conversation-tool-changes-2026-07-01'
+  | 'compact-2026-01-12'
+  | 'computer-use-2025-11-24'
+  | 'mcp-tunnels-2026-06-22'
+  | 'structured-outputs-2025-11-13'
+  | 'task-budgets-2026-03-13'
+  | 'thinking-display-updates-2026-08-18'
+  | 'ce-user-management-2026-07-13';
 
 export interface BetaAPIError {
   message: string;
@@ -827,6 +854,7 @@ Beta.Webhooks = Webhooks;
 Beta.UserProfiles = UserProfiles;
 Beta.Dreams = Dreams;
 Beta.Tunnels = Tunnels;
+Beta.Organization = Organization;
 
 export declare namespace Beta {
   export {
@@ -1179,16 +1207,24 @@ export declare namespace Beta {
     type BetaManagedAgentsAlwaysAskPolicy as BetaManagedAgentsAlwaysAskPolicy,
     type BetaManagedAgentsAnthropicSkill as BetaManagedAgentsAnthropicSkill,
     type BetaManagedAgentsAnthropicSkillParams as BetaManagedAgentsAnthropicSkillParams,
+    type BetaManagedAgentsBashToolConfig as BetaManagedAgentsBashToolConfig,
+    type BetaManagedAgentsBashToolConfigParams as BetaManagedAgentsBashToolConfigParams,
     type BetaManagedAgentsCustomSkill as BetaManagedAgentsCustomSkill,
     type BetaManagedAgentsCustomSkillParams as BetaManagedAgentsCustomSkillParams,
     type BetaManagedAgentsCustomTool as BetaManagedAgentsCustomTool,
     type BetaManagedAgentsCustomToolInputSchema as BetaManagedAgentsCustomToolInputSchema,
     type BetaManagedAgentsCustomToolParams as BetaManagedAgentsCustomToolParams,
+    type BetaManagedAgentsEditToolConfig as BetaManagedAgentsEditToolConfig,
+    type BetaManagedAgentsEditToolConfigParams as BetaManagedAgentsEditToolConfigParams,
     type BetaManagedAgentsEffortHigh as BetaManagedAgentsEffortHigh,
     type BetaManagedAgentsEffortLow as BetaManagedAgentsEffortLow,
     type BetaManagedAgentsEffortMax as BetaManagedAgentsEffortMax,
     type BetaManagedAgentsEffortMedium as BetaManagedAgentsEffortMedium,
     type BetaManagedAgentsEffortXhigh as BetaManagedAgentsEffortXhigh,
+    type BetaManagedAgentsGlobToolConfig as BetaManagedAgentsGlobToolConfig,
+    type BetaManagedAgentsGlobToolConfigParams as BetaManagedAgentsGlobToolConfigParams,
+    type BetaManagedAgentsGrepToolConfig as BetaManagedAgentsGrepToolConfig,
+    type BetaManagedAgentsGrepToolConfigParams as BetaManagedAgentsGrepToolConfigParams,
     type BetaManagedAgentsMCPServerURLDefinition as BetaManagedAgentsMCPServerURLDefinition,
     type BetaManagedAgentsMCPToolConfig as BetaManagedAgentsMCPToolConfig,
     type BetaManagedAgentsMCPToolConfigParams as BetaManagedAgentsMCPToolConfigParams,
@@ -1202,9 +1238,18 @@ export declare namespace Beta {
     type BetaManagedAgentsMultiagentCoordinator as BetaManagedAgentsMultiagentCoordinator,
     type BetaManagedAgentsMultiagentCoordinatorParams as BetaManagedAgentsMultiagentCoordinatorParams,
     type BetaManagedAgentsMultiagentSelfParams as BetaManagedAgentsMultiagentSelfParams,
+    type BetaManagedAgentsReadToolConfig as BetaManagedAgentsReadToolConfig,
+    type BetaManagedAgentsReadToolConfigParams as BetaManagedAgentsReadToolConfigParams,
     type BetaManagedAgentsSessionThreadAgent as BetaManagedAgentsSessionThreadAgent,
     type BetaManagedAgentsSkillParams as BetaManagedAgentsSkillParams,
     type BetaManagedAgentsURLMCPServerParams as BetaManagedAgentsURLMCPServerParams,
+    type BetaManagedAgentsUserLocation as BetaManagedAgentsUserLocation,
+    type BetaManagedAgentsWebFetchToolConfig as BetaManagedAgentsWebFetchToolConfig,
+    type BetaManagedAgentsWebFetchToolConfigParams as BetaManagedAgentsWebFetchToolConfigParams,
+    type BetaManagedAgentsWebSearchToolConfig as BetaManagedAgentsWebSearchToolConfig,
+    type BetaManagedAgentsWebSearchToolConfigParams as BetaManagedAgentsWebSearchToolConfigParams,
+    type BetaManagedAgentsWriteToolConfig as BetaManagedAgentsWriteToolConfig,
+    type BetaManagedAgentsWriteToolConfigParams as BetaManagedAgentsWriteToolConfigParams,
     type BetaManagedAgentsAgentsPageCursor as BetaManagedAgentsAgentsPageCursor,
     type AgentCreateParams as AgentCreateParams,
     type AgentRetrieveParams as AgentRetrieveParams,
@@ -1506,4 +1551,10 @@ export declare namespace Beta {
     type TunnelRevealTokenParams as TunnelRevealTokenParams,
     type TunnelRotateTokenParams as TunnelRotateTokenParams,
   };
+
+  export {
+    Organization as Organization,
+    type BetaOrganization as BetaOrganization,
+    type BetaOrganizationRole as BetaOrganizationRole,
+  };
 }

package/src/resources/beta/environments/environments.ts

@@ -231,6 +231,9 @@ export interface BetaCloudConfigParams {
    * When versioning, use the version semantics relevant for the package manager,
    * e.g. for `pip` use `package==1.0.0`. You are responsible for validating the
    * package and version exist. Unversioned installs the latest.
+   *
+   * Under `limited` networking, requires `networking.allow_package_managers` to be
+   * `true`.
    */
   packages?: BetaPackagesParams | null;
 }
@@ -352,7 +355,8 @@ export interface BetaLimitedNetworkParams {
 
   /**
    * Permits outbound access to public package registries (PyPI, npm, etc.) beyond
-   * those listed in the `allowed_hosts` array. Defaults to `false`.
+   * those listed in the `allowed_hosts` array. Defaults to `false` on creation. Must
+   * be `true` when `packages` are specified.
    */
   allow_package_managers?: boolean | null;
 
@@ -408,6 +412,9 @@ export interface BetaPackages {
  * When versioning, use the version semantics relevant for the package manager,
  * e.g. for `pip` use `package==1.0.0`. You are responsible for validating the
  * package and version exist. Unversioned installs the latest.
+ *
+ * Under `limited` networking, requires `networking.allow_package_managers` to be
+ * `true`.
  */
 export interface BetaPackagesParams {
   /**

package/src/resources/beta/environments/work.ts

@@ -302,6 +302,13 @@ export class Work extends APIResource {
    * await client.beta.environments.work.worker({ workdir: '/workspace' }).handleItem();
    * ```
    */
+  worker(opts: Omit<RunnerEnvironmentWorkerOptions, 'client' | 'unrestrictedPaths'>): EnvironmentWorker;
+  /** @deprecated `unrestrictedPaths` is no longer accepted — see {@link RunnerEnvironmentWorkerOptions.unrestrictedPaths}. */
+  worker(
+    opts: Omit<RunnerEnvironmentWorkerOptions, 'client' | 'unrestrictedPaths'> & {
+      unrestrictedPaths: boolean;
+    },
+  ): EnvironmentWorker; // help language servers see deprecation
   worker(opts: Omit<RunnerEnvironmentWorkerOptions, 'client'>): EnvironmentWorker {
     return new EnvironmentWorker({ ...opts, client: this._client as Anthropic });
   }

package/src/resources/beta/index.ts

@@ -21,16 +21,24 @@ export {
   type BetaManagedAgentsAlwaysAskPolicy,
   type BetaManagedAgentsAnthropicSkill,
   type BetaManagedAgentsAnthropicSkillParams,
+  type BetaManagedAgentsBashToolConfig,
+  type BetaManagedAgentsBashToolConfigParams,
   type BetaManagedAgentsCustomSkill,
   type BetaManagedAgentsCustomSkillParams,
   type BetaManagedAgentsCustomTool,
   type BetaManagedAgentsCustomToolInputSchema,
   type BetaManagedAgentsCustomToolParams,
+  type BetaManagedAgentsEditToolConfig,
+  type BetaManagedAgentsEditToolConfigParams,
   type BetaManagedAgentsEffortHigh,
   type BetaManagedAgentsEffortLow,
   type BetaManagedAgentsEffortMax,
   type BetaManagedAgentsEffortMedium,
   type BetaManagedAgentsEffortXhigh,
+  type BetaManagedAgentsGlobToolConfig,
+  type BetaManagedAgentsGlobToolConfigParams,
+  type BetaManagedAgentsGrepToolConfig,
+  type BetaManagedAgentsGrepToolConfigParams,
   type BetaManagedAgentsMCPServerURLDefinition,
   type BetaManagedAgentsMCPToolConfig,
   type BetaManagedAgentsMCPToolConfigParams,
@@ -44,9 +52,18 @@ export {
   type BetaManagedAgentsMultiagentCoordinator,
   type BetaManagedAgentsMultiagentCoordinatorParams,
   type BetaManagedAgentsMultiagentSelfParams,
+  type BetaManagedAgentsReadToolConfig,
+  type BetaManagedAgentsReadToolConfigParams,
   type BetaManagedAgentsSessionThreadAgent,
   type BetaManagedAgentsSkillParams,
   type BetaManagedAgentsURLMCPServerParams,
+  type BetaManagedAgentsUserLocation,
+  type BetaManagedAgentsWebFetchToolConfig,
+  type BetaManagedAgentsWebFetchToolConfigParams,
+  type BetaManagedAgentsWebSearchToolConfig,
+  type BetaManagedAgentsWebSearchToolConfigParams,
+  type BetaManagedAgentsWriteToolConfig,
+  type BetaManagedAgentsWriteToolConfigParams,
   type AgentCreateParams,
   type AgentRetrieveParams,
   type AgentUpdateParams,
@@ -531,6 +548,7 @@ export {
   type ModelListParams,
   type BetaModelInfosPage,
 } from './models';
+export { Organization, type BetaOrganization, type BetaOrganizationRole } from './organization/index';
 export {
   Sessions,
   type BetaManagedAgentsAdvisorParams,

package/src/resources/beta/memory-stores/memories.ts

@@ -187,10 +187,11 @@ export interface BetaManagedAgentsContentSha256Precondition {
 
 /**
  * Tombstone returned by
- * [Delete a memory](/en/api/beta/memory_stores/memories/delete). The memory's
- * version history persists and remains listable via
- * [List memory versions](/en/api/beta/memory_stores/memory_versions/list) until
- * the store itself is deleted.
+ * [Delete a memory](/en/api/beta/memory_stores/memories/delete). Deleting a memory
+ * does not erase its version history: its versions remain listable via
+ * [List memory versions](/en/api/beta/memory_stores/memory_versions/list) while
+ * they are retained (each version is kept for at least the version retention
+ * period after it was written, unless the store itself is deleted).
  */
 export interface BetaManagedAgentsDeletedMemory {
   /**
@@ -258,7 +259,7 @@ export interface BetaManagedAgentsMemory {
    * ID of the `memory_version` representing this memory's current content (a
    * `memver_...` value). This is the authoritative head pointer; `memory_version`
    * objects do not carry an `is_latest` flag, so compare against this field instead.
-   * Enumerate the full history via
+   * Enumerate the history via
    * [List memory versions](/en/api/beta/memory_stores/memory_versions/list).
    */
   memory_version_id: string;

package/src/resources/beta/memory-stores/memory-versions.ts

@@ -137,10 +137,12 @@ export interface BetaManagedAgentsAPIActor {
 /**
  * A `memory_version` object: one immutable, attributed row in a memory's
  * append-only history. Every non-no-op mutation to a memory produces a new
- * version. Versions belong to the store (not the individual memory) and persist
- * after the memory is deleted. Retrieving a redacted version returns 200 with
- * `content`, `path`, `content_size_bytes`, and `content_sha256` set to `null`;
- * branch on `redacted_at`, not HTTP status.
+ * version. Versions belong to the store (not the individual memory) and are not
+ * deleted with the memory; each version is retained for at least the version
+ * retention period after it was written, unless the store itself is deleted.
+ * Retrieving a redacted version returns 200 with `content`, `path`,
+ * `content_size_bytes`, and `content_sha256` set to `null`; branch on
+ * `redacted_at`, not HTTP status.
  */
 export interface BetaManagedAgentsMemoryVersion {
   /**
@@ -157,7 +159,8 @@ export interface BetaManagedAgentsMemoryVersion {
    * ID of the memory this version snapshots (a `mem_...` value). Remains valid after
    * the memory is deleted; pass it as `memory_id` to
    * [List memory versions](/en/api/beta/memory_stores/memory_versions/list) to
-   * retrieve the full lineage including the `deleted` row.
+   * retrieve the memory's retained versions, including the `deleted` row while the
+   * lineage is retained.
    */
   memory_id: string;
 

package/src/resources/beta/messages/messages.ts

@@ -3256,11 +3256,25 @@ export interface BetaInputTokensTrigger {
  * Per-iteration token usage breakdown.
  *
  * Each entry represents one sampling iteration, with its own input/output token
- * counts and cache statistics. This allows you to:
+ * counts and cache statistics, discriminated by `type`. For `message` entries
+ * (model sampling iterations, such as the turns of a server-side tool use loop),
+ * this allows you to:
  *
  * - Determine which iterations exceeded long context thresholds (>=200k tokens)
- * - Calculate the true context window size from the last iteration
+ * - Calculate the context window size from the last `message` entry
  * - Understand token accumulation across server-side tool use loops
+ *
+ * A `compaction` entry reports the token usage of the compaction operation itself
+ * — the server-side request that summarizes the context being closed — NOT the
+ * size of the context that was compacted away, and its token counts can be much
+ * smaller than that closed context (for example, a compaction that closes a
+ * ~200k-token context can report only a few thousand tokens). Do not derive the
+ * context window size from a `compaction` entry, even when it is the last entry. A
+ * `compaction` entry's tokens are not included in the top-level `usage` fields.
+ * When an input-token trigger is in effect (the default — 150,000 tokens unless
+ * configured otherwise), each `compaction` entry closes a context that had reached
+ * at least that threshold, though the context can exceed it by the final
+ * iteration's output and tool results.
  */
 export type BetaIterationsUsage = Array<
   | BetaMessageIterationUsage
@@ -3685,11 +3699,25 @@ export interface BetaMessageDeltaUsage {
    * Per-iteration token usage breakdown.
    *
    * Each entry represents one sampling iteration, with its own input/output token
-   * counts and cache statistics. This allows you to:
+   * counts and cache statistics, discriminated by `type`. For `message` entries
+   * (model sampling iterations, such as the turns of a server-side tool use loop),
+   * this allows you to:
    *
    * - Determine which iterations exceeded long context thresholds (>=200k tokens)
-   * - Calculate the true context window size from the last iteration
+   * - Calculate the context window size from the last `message` entry
    * - Understand token accumulation across server-side tool use loops
+   *
+   * A `compaction` entry reports the token usage of the compaction operation itself
+   * — the server-side request that summarizes the context being closed — NOT the
+   * size of the context that was compacted away, and its token counts can be much
+   * smaller than that closed context (for example, a compaction that closes a
+   * ~200k-token context can report only a few thousand tokens). Do not derive the
+   * context window size from a `compaction` entry, even when it is the last entry. A
+   * `compaction` entry's tokens are not included in the top-level `usage` fields.
+   * When an input-token trigger is in effect (the default — 150,000 tokens unless
+   * configured otherwise), each `compaction` entry closes a context that had reached
+   * at least that threshold, though the context can exceed it by the final
+   * iteration's output and tool results.
    */
   iterations: BetaIterationsUsage | null;
 
@@ -4280,7 +4308,7 @@ export interface BetaSkill {
   type: 'anthropic' | 'custom';
 
   /**
-   * Skill version or 'latest' for most recent version
+   * The resolved version: a skill version ID for custom skills.
    */
   version: string;
 }
@@ -4536,7 +4564,7 @@ export interface BetaThinkingConfigAdaptive {
    * redacted but a signature is returned for multi-turn continuity. Defaults to
    * `summarized`.
    */
-  display?: 'summarized' | 'omitted' | null;
+  display?: 'summarized' | 'omitted' | 'updates' | null;
 }
 
 export interface BetaThinkingConfigDisabled {
@@ -4565,7 +4593,7 @@ export interface BetaThinkingConfigEnabled {
    * redacted but a signature is returned for multi-turn continuity. Defaults to
    * `summarized`.
    */
-  display?: 'summarized' | 'omitted' | null;
+  display?: 'summarized' | 'omitted' | 'updates' | null;
 }
 
 /**
@@ -5460,11 +5488,25 @@ export interface BetaUsage {
    * Per-iteration token usage breakdown.
    *
    * Each entry represents one sampling iteration, with its own input/output token
-   * counts and cache statistics. This allows you to:
+   * counts and cache statistics, discriminated by `type`. For `message` entries
+   * (model sampling iterations, such as the turns of a server-side tool use loop),
+   * this allows you to:
    *
    * - Determine which iterations exceeded long context thresholds (>=200k tokens)
-   * - Calculate the true context window size from the last iteration
+   * - Calculate the context window size from the last `message` entry
    * - Understand token accumulation across server-side tool use loops
+   *
+   * A `compaction` entry reports the token usage of the compaction operation itself
+   * — the server-side request that summarizes the context being closed — NOT the
+   * size of the context that was compacted away, and its token counts can be much
+   * smaller than that closed context (for example, a compaction that closes a
+   * ~200k-token context can report only a few thousand tokens). Do not derive the
+   * context window size from a `compaction` entry, even when it is the last entry. A
+   * `compaction` entry's tokens are not included in the top-level `usage` fields.
+   * When an input-token trigger is in effect (the default — 150,000 tokens unless
+   * configured otherwise), each `compaction` entry closes a context that had reached
+   * at least that threshold, though the context can exceed it by the final
+   * iteration's output and tool results.
    */
   iterations: BetaIterationsUsage | null;
 

package/src/resources/beta/organization/api-keys.ts

@@ -0,0 +1,231 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import { APIResource } from '../../../core/resource';
+import { APIPromise } from '../../../core/api-promise';
+import { Page, type PageParams, PagePromise } from '../../../core/pagination';
+import { RequestOptions } from '../../../internal/request-options';
+import { path } from '../../../internal/utils/path';
+
+export class APIKeys extends APIResource {
+  /**
+   * Get API Key
+   *
+   * @example
+   * ```ts
+   * const betaAPIKey =
+   *   await client.beta.organization.apiKeys.retrieve(
+   *     'api_key_id',
+   *   );
+   * ```
+   */
+  retrieve(apiKeyID: string, options?: RequestOptions): APIPromise<BetaAPIKey> {
+    return this._client.get(path`/v1/organizations/api_keys/${apiKeyID}?beta=true`, options);
+  }
+
+  /**
+   * Update API Key
+   *
+   * @example
+   * ```ts
+   * const betaAPIKey =
+   *   await client.beta.organization.apiKeys.update(
+   *     'api_key_id',
+   *   );
+   * ```
+   */
+  update(apiKeyID: string, body: APIKeyUpdateParams, options?: RequestOptions): APIPromise<BetaAPIKey> {
+    return this._client.post(path`/v1/organizations/api_keys/${apiKeyID}?beta=true`, { body, ...options });
+  }
+
+  /**
+   * List API Keys
+   *
+   * @example
+   * ```ts
+   * // Automatically fetches more pages as needed.
+   * for await (const betaAPIKey of client.beta.organization.apiKeys.list()) {
+   *   // ...
+   * }
+   * ```
+   */
+  list(
+    query: APIKeyListParams | null | undefined = {},
+    options?: RequestOptions,
+  ): PagePromise<BetaAPIKeysPage, BetaAPIKey> {
+    return this._client.getAPIList('/v1/organizations/api_keys?beta=true', Page<BetaAPIKey>, {
+      query,
+      ...options,
+    });
+  }
+}
+
+export type BetaAPIKeysPage = Page<BetaAPIKey>;
+
+export interface BetaAPIKey {
+  /**
+   * ID of the API key.
+   */
+  id: string;
+
+  /**
+   * RFC 3339 datetime string indicating when the API Key was created.
+   */
+  created_at: string;
+
+  /**
+   * The ID and type of the actor that created the API key, or `null` when the
+   * creator is not recorded (legacy, workload-identity-federated, or system-created
+   * keys).
+   */
+  created_by: BetaAPIKeyCreatedBy | null;
+
+  /**
+   * RFC 3339 datetime string indicating when the API Key expires, or `null` if it
+   * never expires.
+   */
+  expires_at: string | null;
+
+  /**
+   * Name of the API key.
+   */
+  name: string;
+
+  /**
+   * Partially redacted hint for the API key.
+   */
+  partial_key_hint: string | null;
+
+  /**
+   * The principal the API key acts as (a User or a Service Account), or `null` if
+   * the API key is not bound to a principal.
+   */
+  principal: BetaAPIKeyUserActor | BetaAPIKeyServiceAccountActor | null;
+
+  /**
+   * Where the API key belongs: its Workspace
+   * (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's
+   * real ID even when it is the organization's default Workspace), or the
+   * organization (`{"type": "organization"}`) for a principal-bound API key that has
+   * no Workspace.
+   */
+  scope: BetaAPIKeyOrganizationScope | BetaAPIKeyWorkspaceScope;
+
+  /**
+   * Status of the API key.
+   */
+  status: 'active' | 'archived' | 'expired' | 'inactive';
+
+  /**
+   * Object type.
+   *
+   * For API Keys, this is always `"api_key"`.
+   */
+  type: 'api_key';
+
+  /**
+   * @deprecated Use `scope` instead. `workspace_id` is `null` both for an API key in
+   * the default Workspace and for a principal-bound API key that has no Workspace.
+   */
+  workspace_id: string | null;
+}
+
+export interface BetaAPIKeyCreatedBy {
+  /**
+   * ID of the actor that created the object.
+   */
+  id: string;
+
+  /**
+   * Type of the actor that created the object.
+   */
+  type: 'service_account' | 'user';
+}
+
+export interface BetaAPIKeyOrganizationScope {
+  /**
+   * Scope type. Always `"organization"`: the API key has no Workspace. Only a
+   * principal-bound API key can have this scope.
+   */
+  type: 'organization';
+}
+
+export interface BetaAPIKeyServiceAccountActor {
+  /**
+   * ID of the Service Account the API key acts as.
+   */
+  service_account_id: string;
+
+  /**
+   * Principal type. Always `"service_account_actor"` for a Service Account.
+   */
+  type: 'service_account_actor';
+}
+
+export interface BetaAPIKeyUserActor {
+  /**
+   * Principal type. Always `"user_actor"` for a User.
+   */
+  type: 'user_actor';
+
+  /**
+   * ID of the User the API key acts as.
+   */
+  user_id: string;
+}
+
+export interface BetaAPIKeyWorkspaceScope {
+  /**
+   * Scope type. Always `"workspace"`: the API key belongs to one Workspace.
+   */
+  type: 'workspace';
+
+  /**
+   * ID of the Workspace the API key belongs to. Unlike the deprecated top-level
+   * `workspace_id`, this is the Workspace's real ID even for the organization's
+   * default Workspace.
+   */
+  workspace_id: string;
+}
+
+export interface APIKeyUpdateParams {
+  /**
+   * Name of the API key.
+   */
+  name?: string | null;
+
+  /**
+   * Status of the API key.
+   */
+  status?: 'active' | 'archived' | 'inactive' | null;
+}
+
+export interface APIKeyListParams extends PageParams {
+  /**
+   * Filter by the ID of the User who created the object.
+   */
+  created_by_user_id?: string | null;
+
+  /**
+   * Filter by API key status.
+   */
+  status?: 'active' | 'archived' | 'expired' | 'inactive' | null;
+
+  /**
+   * Filter by Workspace ID.
+   */
+  workspace_id?: string | null;
+}
+
+export declare namespace APIKeys {
+  export {
+    type BetaAPIKey as BetaAPIKey,
+    type BetaAPIKeyCreatedBy as BetaAPIKeyCreatedBy,
+    type BetaAPIKeyOrganizationScope as BetaAPIKeyOrganizationScope,
+    type BetaAPIKeyServiceAccountActor as BetaAPIKeyServiceAccountActor,
+    type BetaAPIKeyUserActor as BetaAPIKeyUserActor,
+    type BetaAPIKeyWorkspaceScope as BetaAPIKeyWorkspaceScope,
+    type BetaAPIKeysPage as BetaAPIKeysPage,
+    type APIKeyUpdateParams as APIKeyUpdateParams,
+    type APIKeyListParams as APIKeyListParams,
+  };
+}