@anthropic-ai/sdk 0.120.0 → 0.121.0

package/src/resources/beta/organization/service-accounts/service-accounts.ts

@@ -0,0 +1,389 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import { APIResource } from '../../../../core/resource';
+import * as BetaAPI from '../../beta';
+import * as WorkspacesAPI from './workspaces';
+import {
+  WorkspaceAddParams,
+  WorkspaceListParams,
+  WorkspaceRemoveParams,
+  WorkspaceRemoveResponse,
+  Workspaces,
+} from './workspaces';
+import * as OrganizationWorkspacesAPI from '../workspaces/workspaces';
+import { APIPromise } from '../../../../core/api-promise';
+import { PageCursor, type PageCursorParams, PagePromise } from '../../../../core/pagination';
+import { buildHeaders } from '../../../../internal/headers';
+import { RequestOptions } from '../../../../internal/request-options';
+import { path } from '../../../../internal/utils/path';
+
+export class ServiceAccounts extends APIResource {
+  workspaces: WorkspacesAPI.Workspaces = new WorkspacesAPI.Workspaces(this._client);
+
+  /**
+   * **Requires an OAuth access token with the `org:admin` scope**, from
+   * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+   * API keys are not accepted. See
+   * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+   *
+   * Create a service account.
+   *
+   * A service account is a named workload identity that federation rules target.
+   * `organization_role` is `developer` (default) or `admin`; a rule may only be
+   * created or retargeted to grant `org:admin` scope when the target's
+   * `organization_role` is `admin`. Creating an `admin`-role service account
+   * requires an interactive credential (a user OAuth token or a Console session) — a
+   * workload may only create `developer`-role service accounts.
+   *
+   * @example
+   * ```ts
+   * const betaServiceAccount =
+   *   await client.beta.organization.serviceAccounts.create({
+   *     name: 'ci-deploy-bot',
+   *   });
+   * ```
+   */
+  create(params: ServiceAccountCreateParams, options?: RequestOptions): APIPromise<BetaServiceAccount> {
+    const { betas, ...body } = params;
+    return this._client.post('/v1/organizations/service_accounts?beta=true', {
+      body,
+      ...options,
+      headers: buildHeaders([
+        { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
+        options?.headers,
+      ]),
+    });
+  }
+
+  /**
+   * **Requires an OAuth access token with the `org:admin` scope**, from
+   * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+   * API keys are not accepted. See
+   * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+   *
+   * Retrieve a service account by its ID (`svac_...`).
+   *
+   * @example
+   * ```ts
+   * const betaServiceAccount =
+   *   await client.beta.organization.serviceAccounts.retrieve(
+   *     'service_account_id',
+   *   );
+   * ```
+   */
+  retrieve(
+    serviceAccountID: string,
+    params: ServiceAccountRetrieveParams | null | undefined = {},
+    options?: RequestOptions,
+  ): APIPromise<BetaServiceAccount> {
+    const { betas } = params ?? {};
+    return this._client.get(path`/v1/organizations/service_accounts/${serviceAccountID}?beta=true`, {
+      ...options,
+      headers: buildHeaders([
+        { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
+        options?.headers,
+      ]),
+    });
+  }
+
+  /**
+   * **Requires an OAuth access token with the `org:admin` scope**, from
+   * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+   * API keys are not accepted. See
+   * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+   *
+   * Update a service account.
+   *
+   * Only `description` and `organization_role` are mutable; `name` cannot be
+   * changed. Archived service accounts cannot be updated; this returns 400. Setting
+   * `organization_role` to `admin` (even when unchanged) requires an interactive
+   * credential (a user OAuth token or a Console session).
+   *
+   * @example
+   * ```ts
+   * const betaServiceAccount =
+   *   await client.beta.organization.serviceAccounts.update(
+   *     'service_account_id',
+   *   );
+   * ```
+   */
+  update(
+    serviceAccountID: string,
+    params: ServiceAccountUpdateParams,
+    options?: RequestOptions,
+  ): APIPromise<BetaServiceAccount> {
+    const { betas, ...body } = params;
+    return this._client.post(path`/v1/organizations/service_accounts/${serviceAccountID}?beta=true`, {
+      body,
+      ...options,
+      headers: buildHeaders([
+        { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
+        options?.headers,
+      ]),
+    });
+  }
+
+  /**
+   * **Requires an OAuth access token with the `org:admin` scope**, from
+   * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+   * API keys are not accepted. See
+   * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+   *
+   * List service accounts in the caller's organization.
+   *
+   * Results are ordered by creation time, newest first. Use `limit` and the
+   * `next_page` cursor to paginate; set `include_archived=true` to include archived
+   * service accounts.
+   *
+   * @example
+   * ```ts
+   * // Automatically fetches more pages as needed.
+   * for await (const betaServiceAccount of client.beta.organization.serviceAccounts.list()) {
+   *   // ...
+   * }
+   * ```
+   */
+  list(
+    params: ServiceAccountListParams | null | undefined = {},
+    options?: RequestOptions,
+  ): PagePromise<BetaServiceAccountsPageCursor, BetaServiceAccount> {
+    const { betas, ...query } = params ?? {};
+    return this._client.getAPIList(
+      '/v1/organizations/service_accounts?beta=true',
+      PageCursor<BetaServiceAccount>,
+      {
+        query,
+        ...options,
+        headers: buildHeaders([
+          { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
+          options?.headers,
+        ]),
+      },
+    );
+  }
+
+  /**
+   * **Requires an OAuth access token with the `org:admin` scope**, from
+   * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+   * API keys are not accepted. See
+   * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+   *
+   * Archive a service account.
+   *
+   * Idempotent; re-archiving returns the service account with its original
+   * `archived_at`. Rejected with 400 if any live (non-archived) federation rule
+   * still targets this service account, same as issuer archival; archive those rules
+   * first or change their target to another service account.
+   *
+   * @example
+   * ```ts
+   * const betaServiceAccount =
+   *   await client.beta.organization.serviceAccounts.archive(
+   *     'service_account_id',
+   *   );
+   * ```
+   */
+  archive(
+    serviceAccountID: string,
+    params: ServiceAccountArchiveParams | null | undefined = {},
+    options?: RequestOptions,
+  ): APIPromise<BetaServiceAccount> {
+    const { betas } = params ?? {};
+    return this._client.post(path`/v1/organizations/service_accounts/${serviceAccountID}/archive?beta=true`, {
+      ...options,
+      headers: buildHeaders([
+        { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
+        options?.headers,
+      ]),
+    });
+  }
+}
+
+export type BetaServiceAccountsPageCursor = PageCursor<BetaServiceAccount>;
+
+export type BetaServiceAccountWorkspaceMembersPageCursor = PageCursor<BetaServiceAccountWorkspaceMember>;
+
+/**
+ * Named non-human identity within the caller's organization.
+ *
+ * A service account is a pure identity: name + org. Authorization lives on
+ * whatever references it (federation rules).
+ */
+export interface BetaServiceAccount {
+  /**
+   * Tagged ID of the service account.
+   */
+  id: string;
+
+  /**
+   * If set, this service account is archived.
+   */
+  archived_at: string | null;
+
+  /**
+   * Tagged ID (`user_`/`svac_`) of the actor that archived this service account.
+   */
+  archived_by_actor_id: string | null;
+
+  /**
+   * When this service account was created.
+   */
+  created_at: string;
+
+  /**
+   * Tagged ID (`user_`/`svac_`) of the actor that created this service account.
+   */
+  created_by_actor_id: string | null;
+
+  /**
+   * Optional free-text description.
+   */
+  description: string | null;
+
+  /**
+   * Admin-chosen slug identifier.
+   */
+  name: string;
+
+  /**
+   * Org-level role. A federation rule may only be created or retargeted to grant
+   * `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target
+   * is later demoted to `developer` is rejected at token exchange. Rules granting
+   * `org:admin` are managed in the Console.
+   */
+  organization_role: 'admin' | 'developer';
+
+  type: 'service_account';
+
+  /**
+   * When this service account was last updated.
+   */
+  updated_at: string;
+
+  /**
+   * Tagged ID (`user_`/`svac_`) of the actor that last updated this service account.
+   */
+  updated_by_actor_id: string | null;
+}
+
+export interface BetaServiceAccountWorkspaceMember {
+  /**
+   * Tagged ID (`user_...`/`svac_...`) of the actor who created this membership.
+   */
+  created_by_actor_id: string | null;
+
+  /**
+   * True when this is the implicit default-workspace membership every service
+   * account has when no explicit membership exists. Implicit memberships have role
+   * `workspace_user` and cannot be removed.
+   */
+  implicit: boolean | null;
+
+  /**
+   * Tagged service account ID (`svac_...`).
+   */
+  service_account_id: string;
+
+  type: 'service_account_workspace_member';
+
+  /**
+   * Tagged workspace ID (`wrkspc_...`).
+   */
+  workspace_id: string;
+
+  /**
+   * Role of the service account in this workspace. Service accounts cannot hold the
+   * `workspace_billing` role.
+   */
+  workspace_role: OrganizationWorkspacesAPI.BetaWorkspaceRole;
+}
+
+export interface ServiceAccountCreateParams {
+  /**
+   * Body param: Slug identifier (lowercase, digits, hyphens). Unique within the
+   * organization; a duplicate name returns 409.
+   */
+  name: string;
+
+  /**
+   * Body param: Optional free-text description.
+   */
+  description?: string | null;
+
+  /**
+   * Body param: Org-level role. Defaults to `developer`.
+   */
+  organization_role?: 'admin' | 'developer';
+
+  /**
+   * Header param: Optional header to specify the beta version(s) you want to use.
+   */
+  betas?: Array<BetaAPI.AnthropicBeta>;
+}
+
+export interface ServiceAccountRetrieveParams {
+  /**
+   * Optional header to specify the beta version(s) you want to use.
+   */
+  betas?: Array<BetaAPI.AnthropicBeta>;
+}
+
+export interface ServiceAccountUpdateParams {
+  /**
+   * Body param: Replaces the description. Omit to leave unchanged; send `null` to
+   * clear (the field is stored as an empty string).
+   */
+  description?: string | null;
+
+  /**
+   * Body param: Replaces the org-level role. Omit or send `null` to leave unchanged.
+   */
+  organization_role?: 'admin' | 'developer' | null;
+
+  /**
+   * Header param: Optional header to specify the beta version(s) you want to use.
+   */
+  betas?: Array<BetaAPI.AnthropicBeta>;
+}
+
+export interface ServiceAccountListParams extends PageCursorParams {
+  /**
+   * Query param: Include archived resources. Defaults to false.
+   */
+  include_archived?: boolean;
+
+  /**
+   * Header param: Optional header to specify the beta version(s) you want to use.
+   */
+  betas?: Array<BetaAPI.AnthropicBeta>;
+}
+
+export interface ServiceAccountArchiveParams {
+  /**
+   * Optional header to specify the beta version(s) you want to use.
+   */
+  betas?: Array<BetaAPI.AnthropicBeta>;
+}
+
+ServiceAccounts.Workspaces = Workspaces;
+
+export declare namespace ServiceAccounts {
+  export {
+    type BetaServiceAccount as BetaServiceAccount,
+    type BetaServiceAccountWorkspaceMember as BetaServiceAccountWorkspaceMember,
+    type BetaServiceAccountsPageCursor as BetaServiceAccountsPageCursor,
+    type ServiceAccountCreateParams as ServiceAccountCreateParams,
+    type ServiceAccountRetrieveParams as ServiceAccountRetrieveParams,
+    type ServiceAccountUpdateParams as ServiceAccountUpdateParams,
+    type ServiceAccountListParams as ServiceAccountListParams,
+    type ServiceAccountArchiveParams as ServiceAccountArchiveParams,
+  };
+
+  export {
+    Workspaces as Workspaces,
+    type WorkspaceRemoveResponse as WorkspaceRemoveResponse,
+    type WorkspaceListParams as WorkspaceListParams,
+    type WorkspaceAddParams as WorkspaceAddParams,
+    type WorkspaceRemoveParams as WorkspaceRemoveParams,
+  };
+}

package/src/resources/beta/organization/service-accounts/workspaces.ts

@@ -0,0 +1,217 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import { APIResource } from '../../../../core/resource';
+import * as BetaAPI from '../../beta';
+import * as ServiceAccountsAPI from './service-accounts';
+import { BetaServiceAccountWorkspaceMembersPageCursor } from './service-accounts';
+import * as OrganizationWorkspacesAPI from '../workspaces/workspaces';
+import { APIPromise } from '../../../../core/api-promise';
+import { PageCursor, type PageCursorParams, PagePromise } from '../../../../core/pagination';
+import { buildHeaders } from '../../../../internal/headers';
+import { RequestOptions } from '../../../../internal/request-options';
+import { path } from '../../../../internal/utils/path';
+
+export class Workspaces extends APIResource {
+  /**
+   * **Requires an OAuth access token with the `org:admin` scope**, from
+   * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+   * API keys are not accepted. See
+   * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+   *
+   * List the workspaces a service account is a member of.
+   *
+   * Each entry includes the service account's `workspace_role` in that workspace.
+   * Use `limit` and the `next_page` cursor to paginate. When the service account has
+   * no explicit default-workspace membership, the implicit (`implicit: true`)
+   * membership is returned as the first entry on the first page; with `limit=1` the
+   * first page may return up to 2 entries (the implicit entry plus one explicit
+   * membership) so a pagination cursor can be derived. Memberships are returned only
+   * while the service account is active. Without a `page` cursor, an archived
+   * service account returns an empty list. A `page` cursor that does not match an
+   * active membership returns a 400 invalid-request error. A cursor stops matching
+   * when the membership is removed, the workspace is deleted, or the service account
+   * is archived. Restart pagination from the first page to recover.
+   *
+   * @example
+   * ```ts
+   * // Automatically fetches more pages as needed.
+   * for await (const betaServiceAccountWorkspaceMember of client.beta.organization.serviceAccounts.workspaces.list(
+   *   'service_account_id',
+   * )) {
+   *   // ...
+   * }
+   * ```
+   */
+  list(
+    serviceAccountID: string,
+    params: WorkspaceListParams | null | undefined = {},
+    options?: RequestOptions,
+  ): PagePromise<
+    BetaServiceAccountWorkspaceMembersPageCursor,
+    ServiceAccountsAPI.BetaServiceAccountWorkspaceMember
+  > {
+    const { betas, ...query } = params ?? {};
+    return this._client.getAPIList(
+      path`/v1/organizations/service_accounts/${serviceAccountID}/workspaces?beta=true`,
+      PageCursor<ServiceAccountsAPI.BetaServiceAccountWorkspaceMember>,
+      {
+        query,
+        ...options,
+        headers: buildHeaders([
+          { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
+          options?.headers,
+        ]),
+      },
+    );
+  }
+
+  /**
+   * **Requires an OAuth access token with the `org:admin` scope**, from
+   * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+   * API keys are not accepted. See
+   * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+   *
+   * Add a service account to a workspace with the given `workspace_role`.
+   *
+   * Mirror of `POST /workspaces/{workspace_id}/service_accounts`, addressed from the
+   * service-account side; both create the same membership. If the service account is
+   * already an explicit member of the workspace, its `workspace_role` is replaced
+   * with the value supplied here. Archived workspaces return 400. Archived service
+   * accounts cannot be added and are rejected.
+   *
+   * @example
+   * ```ts
+   * const betaServiceAccountWorkspaceMember =
+   *   await client.beta.organization.serviceAccounts.workspaces.add(
+   *     'service_account_id',
+   *     {
+   *       workspace_id: 'workspace_id',
+   *       workspace_role: 'workspace_admin',
+   *     },
+   *   );
+   * ```
+   */
+  add(
+    serviceAccountID: string,
+    params: WorkspaceAddParams,
+    options?: RequestOptions,
+  ): APIPromise<ServiceAccountsAPI.BetaServiceAccountWorkspaceMember> {
+    const { betas, ...body } = params;
+    return this._client.post(
+      path`/v1/organizations/service_accounts/${serviceAccountID}/workspaces?beta=true`,
+      {
+        body,
+        ...options,
+        headers: buildHeaders([
+          { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
+          options?.headers,
+        ]),
+      },
+    );
+  }
+
+  /**
+   * **Requires an OAuth access token with the `org:admin` scope**, from
+   * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+   * API keys are not accepted. See
+   * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+   *
+   * Remove a service account from a workspace.
+   *
+   * Mirror of
+   * `DELETE /workspaces/{workspace_id}/service_accounts/{service_account_id}`,
+   * addressed from the service-account side. Removal is idempotent (returns 200 even
+   * if the membership was already removed). A DELETE against the implicit
+   * default-workspace membership returns 200 but is a no-op and the membership
+   * persists; deleting an explicit default-workspace row reverts to the implicit
+   * `workspace_user` membership. Archived workspaces return 400.
+   *
+   * @example
+   * ```ts
+   * const workspace =
+   *   await client.beta.organization.serviceAccounts.workspaces.remove(
+   *     'workspace_id',
+   *     { service_account_id: 'service_account_id' },
+   *   );
+   * ```
+   */
+  remove(
+    workspaceID: string,
+    params: WorkspaceRemoveParams,
+    options?: RequestOptions,
+  ): APIPromise<WorkspaceRemoveResponse> {
+    const { service_account_id, betas } = params;
+    return this._client.delete(
+      path`/v1/organizations/service_accounts/${service_account_id}/workspaces/${workspaceID}?beta=true`,
+      {
+        ...options,
+        headers: buildHeaders([
+          { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
+          options?.headers,
+        ]),
+      },
+    );
+  }
+}
+
+export interface WorkspaceRemoveResponse {
+  /**
+   * Tagged service account ID (`svac_...`) named in the delete request. Removal is
+   * idempotent; see the endpoint description for the implicit-membership no-op.
+   */
+  service_account_id: string;
+
+  type: 'service_account_workspace_member_deleted';
+
+  /**
+   * Tagged workspace ID (`wrkspc_...`) named in the delete request.
+   */
+  workspace_id: string;
+}
+
+export interface WorkspaceListParams extends PageCursorParams {
+  /**
+   * Header param: Optional header to specify the beta version(s) you want to use.
+   */
+  betas?: Array<BetaAPI.AnthropicBeta>;
+}
+
+export interface WorkspaceAddParams {
+  /**
+   * Body param: Tagged workspace ID to add the service account to.
+   */
+  workspace_id: string;
+
+  /**
+   * Body param: Role to assign to the service account in this workspace.
+   */
+  workspace_role: OrganizationWorkspacesAPI.BetaNoBillingWorkspaceRole;
+
+  /**
+   * Header param: Optional header to specify the beta version(s) you want to use.
+   */
+  betas?: Array<BetaAPI.AnthropicBeta>;
+}
+
+export interface WorkspaceRemoveParams {
+  /**
+   * Path param: ID of the service account.
+   */
+  service_account_id: string;
+
+  /**
+   * Header param: Optional header to specify the beta version(s) you want to use.
+   */
+  betas?: Array<BetaAPI.AnthropicBeta>;
+}
+
+export declare namespace Workspaces {
+  export {
+    type WorkspaceRemoveResponse as WorkspaceRemoveResponse,
+    type WorkspaceListParams as WorkspaceListParams,
+    type WorkspaceAddParams as WorkspaceAddParams,
+    type WorkspaceRemoveParams as WorkspaceRemoveParams,
+  };
+}
+
+export { type BetaServiceAccountWorkspaceMembersPageCursor };

package/src/resources/beta/organization/service-accounts.ts

@@ -0,0 +1,3 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+export * from './service-accounts/index';