@anthropic-ai/sdk 0.120.0 → 0.122.0

package/resources/beta/organization/workspaces/service-accounts.d.ts

@@ -0,0 +1,210 @@
+import { APIResource } from "../../../../core/resource.js";
+import * as BetaAPI from "../../beta.js";
+import * as ServiceAccountsAPI from "../service-accounts/service-accounts.js";
+import { BetaServiceAccountWorkspaceMembersPageCursor } from "../service-accounts/service-accounts.js";
+import * as WorkspacesAPI from "./workspaces.js";
+import { APIPromise } from "../../../../core/api-promise.js";
+import { type PageCursorParams, PagePromise } from "../../../../core/pagination.js";
+import { RequestOptions } from "../../../../internal/request-options.js";
+export declare class ServiceAccounts extends APIResource {
+    /**
+     * **Requires an OAuth access token with the `org:admin` scope**, from
+     * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+     * API keys are not accepted. See
+     * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+     *
+     * Retrieve a service account's membership in a workspace.
+     *
+     * Returns the membership record, including the service account's `workspace_role`
+     * in this workspace. Archived workspaces return 400. For the default workspace,
+     * returns the implicit (`implicit: true`) membership when no explicit membership
+     * exists; an explicitly added membership is returned with its assigned role. An
+     * archived service account returns 404.
+     *
+     * @example
+     * ```ts
+     * const betaServiceAccountWorkspaceMember =
+     *   await client.beta.organization.workspaces.serviceAccounts.retrieve(
+     *     'service_account_id',
+     *     { workspace_id: 'workspace_id' },
+     *   );
+     * ```
+     */
+    retrieve(serviceAccountID: string, params: ServiceAccountRetrieveParams, options?: RequestOptions): APIPromise<ServiceAccountsAPI.BetaServiceAccountWorkspaceMember>;
+    /**
+     * **Requires an OAuth access token with the `org:admin` scope**, from
+     * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+     * API keys are not accepted. See
+     * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+     *
+     * Change a service account's role in a workspace.
+     *
+     * The new `workspace_role` replaces the current one. Only explicit memberships can
+     * be updated; to set a role on the implicit default-workspace membership, add the
+     * service account explicitly with
+     * `POST /workspaces/{workspace_id}/service_accounts`. Archived workspaces
+     * return 400. Archived service accounts cannot be updated and are rejected.
+     *
+     * @example
+     * ```ts
+     * const betaServiceAccountWorkspaceMember =
+     *   await client.beta.organization.workspaces.serviceAccounts.update(
+     *     'service_account_id',
+     *     {
+     *       workspace_id: 'workspace_id',
+     *       workspace_role: 'workspace_admin',
+     *     },
+     *   );
+     * ```
+     */
+    update(serviceAccountID: string, params: ServiceAccountUpdateParams, options?: RequestOptions): APIPromise<ServiceAccountsAPI.BetaServiceAccountWorkspaceMember>;
+    /**
+     * **Requires an OAuth access token with the `org:admin` scope**, from
+     * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+     * API keys are not accepted. See
+     * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+     *
+     * List the service accounts that are members of a workspace.
+     *
+     * Each entry includes the service account's `workspace_role`. Use `limit` and the
+     * `next_page` cursor to paginate. Archived workspaces return 400; use
+     * `GET /service_accounts/{id}/workspaces` to audit memberships of an archived
+     * workspace. The implicit default-workspace membership is not included in this
+     * list. Memberships of archived service accounts are omitted from the results.
+     *
+     * @example
+     * ```ts
+     * // Automatically fetches more pages as needed.
+     * for await (const betaServiceAccountWorkspaceMember of client.beta.organization.workspaces.serviceAccounts.list(
+     *   'workspace_id',
+     * )) {
+     *   // ...
+     * }
+     * ```
+     */
+    list(workspaceID: string, params?: ServiceAccountListParams | null | undefined, options?: RequestOptions): PagePromise<BetaServiceAccountWorkspaceMembersPageCursor, ServiceAccountsAPI.BetaServiceAccountWorkspaceMember>;
+    /**
+     * **Requires an OAuth access token with the `org:admin` scope**, from
+     * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+     * API keys are not accepted. See
+     * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+     *
+     * Add a service account to a workspace with the given `workspace_role`.
+     *
+     * The role determines what the service account can do in the workspace and which
+     * workspace-scoped permissions it can be granted when authenticating through
+     * federation. Every service account is already an implicit `workspace_user` member
+     * of the default workspace; adding it explicitly assigns a chosen role. If the
+     * service account is already an explicit member of the workspace, its
+     * `workspace_role` is replaced with the value supplied here. Archived workspaces
+     * return 400. Archived service accounts cannot be added and are rejected.
+     *
+     * @example
+     * ```ts
+     * const betaServiceAccountWorkspaceMember =
+     *   await client.beta.organization.workspaces.serviceAccounts.add(
+     *     'workspace_id',
+     *     {
+     *       service_account_id: 'service_account_id',
+     *       workspace_role: 'workspace_admin',
+     *     },
+     *   );
+     * ```
+     */
+    add(workspaceID: string, params: ServiceAccountAddParams, options?: RequestOptions): APIPromise<ServiceAccountsAPI.BetaServiceAccountWorkspaceMember>;
+    /**
+     * **Requires an OAuth access token with the `org:admin` scope**, from
+     * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+     * API keys are not accepted. See
+     * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+     *
+     * Remove a service account from a workspace.
+     *
+     * Removal is idempotent (returns 200 even if the membership was already removed).
+     * A DELETE against the implicit default-workspace membership returns 200 but is a
+     * no-op and the membership persists; deleting an explicit default-workspace row
+     * reverts to the implicit `workspace_user` membership. Archived workspaces
+     * return 400.
+     *
+     * @example
+     * ```ts
+     * const serviceAccount =
+     *   await client.beta.organization.workspaces.serviceAccounts.remove(
+     *     'service_account_id',
+     *     { workspace_id: 'workspace_id' },
+     *   );
+     * ```
+     */
+    remove(serviceAccountID: string, params: ServiceAccountRemoveParams, options?: RequestOptions): APIPromise<ServiceAccountRemoveResponse>;
+}
+export interface ServiceAccountRemoveResponse {
+    /**
+     * Tagged service account ID (`svac_...`) named in the delete request. Removal is
+     * idempotent; see the endpoint description for the implicit-membership no-op.
+     */
+    service_account_id: string;
+    type: 'service_account_workspace_member_deleted';
+    /**
+     * Tagged workspace ID (`wrkspc_...`) named in the delete request.
+     */
+    workspace_id: string;
+}
+export interface ServiceAccountRetrieveParams {
+    /**
+     * Path param: ID of the workspace.
+     */
+    workspace_id: string;
+    /**
+     * Header param: Optional header to specify the beta version(s) you want to use.
+     */
+    betas?: Array<BetaAPI.AnthropicBeta>;
+}
+export interface ServiceAccountUpdateParams {
+    /**
+     * Path param: ID of the workspace.
+     */
+    workspace_id: string;
+    /**
+     * Body param: New role for the service account in this workspace.
+     */
+    workspace_role: WorkspacesAPI.BetaNoBillingWorkspaceRole;
+    /**
+     * Header param: Optional header to specify the beta version(s) you want to use.
+     */
+    betas?: Array<BetaAPI.AnthropicBeta>;
+}
+export interface ServiceAccountListParams extends PageCursorParams {
+    /**
+     * Header param: Optional header to specify the beta version(s) you want to use.
+     */
+    betas?: Array<BetaAPI.AnthropicBeta>;
+}
+export interface ServiceAccountAddParams {
+    /**
+     * Body param: Tagged service account ID to add.
+     */
+    service_account_id: string;
+    /**
+     * Body param: Role to assign to the service account in this workspace.
+     */
+    workspace_role: WorkspacesAPI.BetaNoBillingWorkspaceRole;
+    /**
+     * Header param: Optional header to specify the beta version(s) you want to use.
+     */
+    betas?: Array<BetaAPI.AnthropicBeta>;
+}
+export interface ServiceAccountRemoveParams {
+    /**
+     * Path param: ID of the workspace.
+     */
+    workspace_id: string;
+    /**
+     * Header param: Optional header to specify the beta version(s) you want to use.
+     */
+    betas?: Array<BetaAPI.AnthropicBeta>;
+}
+export declare namespace ServiceAccounts {
+    export { type ServiceAccountRemoveResponse as ServiceAccountRemoveResponse, type ServiceAccountRetrieveParams as ServiceAccountRetrieveParams, type ServiceAccountUpdateParams as ServiceAccountUpdateParams, type ServiceAccountListParams as ServiceAccountListParams, type ServiceAccountAddParams as ServiceAccountAddParams, type ServiceAccountRemoveParams as ServiceAccountRemoveParams, };
+}
+export { type BetaServiceAccountWorkspaceMembersPageCursor };
+//# sourceMappingURL=service-accounts.d.ts.map

package/resources/beta/organization/workspaces/service-accounts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-accounts.d.ts","sourceRoot":"","sources":["../../../../src/resources/beta/organization/workspaces/service-accounts.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,qCAAkC;AACxD,OAAO,KAAK,OAAO,sBAAmB;AACtC,OAAO,KAAK,kBAAkB,gDAA6C;AAC3E,OAAO,EAAE,4CAA4C,EAAE,gDAA6C;AACpG,OAAO,KAAK,aAAa,wBAAqB;AAC9C,OAAO,EAAE,UAAU,EAAE,wCAAqC;AAC1D,OAAO,EAAc,KAAK,gBAAgB,EAAE,WAAW,EAAE,uCAAoC;AAE7F,OAAO,EAAE,cAAc,EAAE,gDAA6C;AAGtE,qBAAa,eAAgB,SAAQ,WAAW;IAC9C;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,QAAQ,CACN,gBAAgB,EAAE,MAAM,EACxB,MAAM,EAAE,4BAA4B,EACpC,OAAO,CAAC,EAAE,cAAc,GACvB,UAAU,CAAC,kBAAkB,CAAC,iCAAiC,CAAC;IAcnE;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,MAAM,CACJ,gBAAgB,EAAE,MAAM,EACxB,MAAM,EAAE,0BAA0B,EAClC,OAAO,CAAC,EAAE,cAAc,GACvB,UAAU,CAAC,kBAAkB,CAAC,iCAAiC,CAAC;IAenE;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,IAAI,CACF,WAAW,EAAE,MAAM,EACnB,MAAM,GAAE,wBAAwB,GAAG,IAAI,GAAG,SAAc,EACxD,OAAO,CAAC,EAAE,cAAc,GACvB,WAAW,CACZ,4CAA4C,EAC5C,kBAAkB,CAAC,iCAAiC,CACrD;IAgBD;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,GAAG,CACD,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,uBAAuB,EAC/B,OAAO,CAAC,EAAE,cAAc,GACvB,UAAU,CAAC,kBAAkB,CAAC,iCAAiC,CAAC;IAYnE;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,MAAM,CACJ,gBAAgB,EAAE,MAAM,EACxB,MAAM,EAAE,0BAA0B,EAClC,OAAO,CAAC,EAAE,cAAc,GACvB,UAAU,CAAC,4BAA4B,CAAC;CAa5C;AAED,MAAM,WAAW,4BAA4B;IAC3C;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B,IAAI,EAAE,0CAA0C,CAAC;IAEjD;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,4BAA4B;IAC3C;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,KAAK,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,0BAA0B;IACzC;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,cAAc,EAAE,aAAa,CAAC,0BAA0B,CAAC;IAEzD;;OAEG;IACH,KAAK,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,wBAAyB,SAAQ,gBAAgB;IAChE;;OAEG;IACH,KAAK,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,uBAAuB;IACtC;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B;;OAEG;IACH,cAAc,EAAE,aAAa,CAAC,0BAA0B,CAAC;IAEzD;;OAEG;IACH,KAAK,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,0BAA0B;IACzC;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,KAAK,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;CACtC;AAED,MAAM,CAAC,OAAO,WAAW,eAAe,CAAC;IACvC,OAAO,EACL,KAAK,4BAA4B,IAAI,4BAA4B,EACjE,KAAK,4BAA4B,IAAI,4BAA4B,EACjE,KAAK,0BAA0B,IAAI,0BAA0B,EAC7D,KAAK,wBAAwB,IAAI,wBAAwB,EACzD,KAAK,uBAAuB,IAAI,uBAAuB,EACvD,KAAK,0BAA0B,IAAI,0BAA0B,GAC9D,CAAC;CACH;AAED,OAAO,EAAE,KAAK,4CAA4C,EAAE,CAAC"}

package/resources/beta/organization/workspaces/service-accounts.js

@@ -0,0 +1,189 @@
+"use strict";
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ServiceAccounts = void 0;
+const resource_1 = require("../../../../core/resource.js");
+const pagination_1 = require("../../../../core/pagination.js");
+const headers_1 = require("../../../../internal/headers.js");
+const path_1 = require("../../../../internal/utils/path.js");
+class ServiceAccounts extends resource_1.APIResource {
+    /**
+     * **Requires an OAuth access token with the `org:admin` scope**, from
+     * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+     * API keys are not accepted. See
+     * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+     *
+     * Retrieve a service account's membership in a workspace.
+     *
+     * Returns the membership record, including the service account's `workspace_role`
+     * in this workspace. Archived workspaces return 400. For the default workspace,
+     * returns the implicit (`implicit: true`) membership when no explicit membership
+     * exists; an explicitly added membership is returned with its assigned role. An
+     * archived service account returns 404.
+     *
+     * @example
+     * ```ts
+     * const betaServiceAccountWorkspaceMember =
+     *   await client.beta.organization.workspaces.serviceAccounts.retrieve(
+     *     'service_account_id',
+     *     { workspace_id: 'workspace_id' },
+     *   );
+     * ```
+     */
+    retrieve(serviceAccountID, params, options) {
+        const { workspace_id, betas } = params;
+        return this._client.get((0, path_1.path) `/v1/organizations/workspaces/${workspace_id}/service_accounts/${serviceAccountID}?beta=true`, {
+            ...options,
+            headers: (0, headers_1.buildHeaders)([
+                { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
+                options?.headers,
+            ]),
+        });
+    }
+    /**
+     * **Requires an OAuth access token with the `org:admin` scope**, from
+     * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+     * API keys are not accepted. See
+     * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+     *
+     * Change a service account's role in a workspace.
+     *
+     * The new `workspace_role` replaces the current one. Only explicit memberships can
+     * be updated; to set a role on the implicit default-workspace membership, add the
+     * service account explicitly with
+     * `POST /workspaces/{workspace_id}/service_accounts`. Archived workspaces
+     * return 400. Archived service accounts cannot be updated and are rejected.
+     *
+     * @example
+     * ```ts
+     * const betaServiceAccountWorkspaceMember =
+     *   await client.beta.organization.workspaces.serviceAccounts.update(
+     *     'service_account_id',
+     *     {
+     *       workspace_id: 'workspace_id',
+     *       workspace_role: 'workspace_admin',
+     *     },
+     *   );
+     * ```
+     */
+    update(serviceAccountID, params, options) {
+        const { workspace_id, betas, ...body } = params;
+        return this._client.post((0, path_1.path) `/v1/organizations/workspaces/${workspace_id}/service_accounts/${serviceAccountID}?beta=true`, {
+            body,
+            ...options,
+            headers: (0, headers_1.buildHeaders)([
+                { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
+                options?.headers,
+            ]),
+        });
+    }
+    /**
+     * **Requires an OAuth access token with the `org:admin` scope**, from
+     * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+     * API keys are not accepted. See
+     * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+     *
+     * List the service accounts that are members of a workspace.
+     *
+     * Each entry includes the service account's `workspace_role`. Use `limit` and the
+     * `next_page` cursor to paginate. Archived workspaces return 400; use
+     * `GET /service_accounts/{id}/workspaces` to audit memberships of an archived
+     * workspace. The implicit default-workspace membership is not included in this
+     * list. Memberships of archived service accounts are omitted from the results.
+     *
+     * @example
+     * ```ts
+     * // Automatically fetches more pages as needed.
+     * for await (const betaServiceAccountWorkspaceMember of client.beta.organization.workspaces.serviceAccounts.list(
+     *   'workspace_id',
+     * )) {
+     *   // ...
+     * }
+     * ```
+     */
+    list(workspaceID, params = {}, options) {
+        const { betas, ...query } = params ?? {};
+        return this._client.getAPIList((0, path_1.path) `/v1/organizations/workspaces/${workspaceID}/service_accounts?beta=true`, (pagination_1.PageCursor), {
+            query,
+            ...options,
+            headers: (0, headers_1.buildHeaders)([
+                { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
+                options?.headers,
+            ]),
+        });
+    }
+    /**
+     * **Requires an OAuth access token with the `org:admin` scope**, from
+     * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+     * API keys are not accepted. See
+     * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+     *
+     * Add a service account to a workspace with the given `workspace_role`.
+     *
+     * The role determines what the service account can do in the workspace and which
+     * workspace-scoped permissions it can be granted when authenticating through
+     * federation. Every service account is already an implicit `workspace_user` member
+     * of the default workspace; adding it explicitly assigns a chosen role. If the
+     * service account is already an explicit member of the workspace, its
+     * `workspace_role` is replaced with the value supplied here. Archived workspaces
+     * return 400. Archived service accounts cannot be added and are rejected.
+     *
+     * @example
+     * ```ts
+     * const betaServiceAccountWorkspaceMember =
+     *   await client.beta.organization.workspaces.serviceAccounts.add(
+     *     'workspace_id',
+     *     {
+     *       service_account_id: 'service_account_id',
+     *       workspace_role: 'workspace_admin',
+     *     },
+     *   );
+     * ```
+     */
+    add(workspaceID, params, options) {
+        const { betas, ...body } = params;
+        return this._client.post((0, path_1.path) `/v1/organizations/workspaces/${workspaceID}/service_accounts?beta=true`, {
+            body,
+            ...options,
+            headers: (0, headers_1.buildHeaders)([
+                { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
+                options?.headers,
+            ]),
+        });
+    }
+    /**
+     * **Requires an OAuth access token with the `org:admin` scope**, from
+     * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+     * API keys are not accepted. See
+     * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+     *
+     * Remove a service account from a workspace.
+     *
+     * Removal is idempotent (returns 200 even if the membership was already removed).
+     * A DELETE against the implicit default-workspace membership returns 200 but is a
+     * no-op and the membership persists; deleting an explicit default-workspace row
+     * reverts to the implicit `workspace_user` membership. Archived workspaces
+     * return 400.
+     *
+     * @example
+     * ```ts
+     * const serviceAccount =
+     *   await client.beta.organization.workspaces.serviceAccounts.remove(
+     *     'service_account_id',
+     *     { workspace_id: 'workspace_id' },
+     *   );
+     * ```
+     */
+    remove(serviceAccountID, params, options) {
+        const { workspace_id, betas } = params;
+        return this._client.delete((0, path_1.path) `/v1/organizations/workspaces/${workspace_id}/service_accounts/${serviceAccountID}?beta=true`, {
+            ...options,
+            headers: (0, headers_1.buildHeaders)([
+                { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
+                options?.headers,
+            ]),
+        });
+    }
+}
+exports.ServiceAccounts = ServiceAccounts;
+//# sourceMappingURL=service-accounts.js.map

package/resources/beta/organization/workspaces/service-accounts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-accounts.js","sourceRoot":"","sources":["../../../../src/resources/beta/organization/workspaces/service-accounts.ts"],"names":[],"mappings":";AAAA,sFAAsF;;;AAEtF,2DAAwD;AAMxD,+DAA6F;AAC7F,6DAA4D;AAE5D,6DAAuD;AAEvD,MAAa,eAAgB,SAAQ,sBAAW;IAC9C;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,QAAQ,CACN,gBAAwB,EACxB,MAAoC,EACpC,OAAwB;QAExB,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;QACvC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CACrB,IAAA,WAAI,EAAA,gCAAgC,YAAY,qBAAqB,gBAAgB,YAAY,EACjG;YACE,GAAG,OAAO;YACV,OAAO,EAAE,IAAA,sBAAY,EAAC;gBACpB,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE;gBACxF,OAAO,EAAE,OAAO;aACjB,CAAC;SACH,CACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,MAAM,CACJ,gBAAwB,EACxB,MAAkC,EAClC,OAAwB;QAExB,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;QAChD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB,IAAA,WAAI,EAAA,gCAAgC,YAAY,qBAAqB,gBAAgB,YAAY,EACjG;YACE,IAAI;YACJ,GAAG,OAAO;YACV,OAAO,EAAE,IAAA,sBAAY,EAAC;gBACpB,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE;gBACxF,OAAO,EAAE,OAAO;aACjB,CAAC;SACH,CACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,IAAI,CACF,WAAmB,EACnB,SAAsD,EAAE,EACxD,OAAwB;QAKxB,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAC5B,IAAA,WAAI,EAAA,gCAAgC,WAAW,6BAA6B,EAC5E,CAAA,uBAAgE,CAAA,EAChE;YACE,KAAK;YACL,GAAG,OAAO;YACV,OAAO,EAAE,IAAA,sBAAY,EAAC;gBACpB,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE;gBACxF,OAAO,EAAE,OAAO;aACjB,CAAC;SACH,CACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,GAAG,CACD,WAAmB,EACnB,MAA+B,EAC/B,OAAwB;QAExB,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;QAClC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAA,WAAI,EAAA,gCAAgC,WAAW,6BAA6B,EAAE;YACrG,IAAI;YACJ,GAAG,OAAO;YACV,OAAO,EAAE,IAAA,sBAAY,EAAC;gBACpB,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE;gBACxF,OAAO,EAAE,OAAO;aACjB,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,MAAM,CACJ,gBAAwB,EACxB,MAAkC,EAClC,OAAwB;QAExB,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;QACvC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CACxB,IAAA,WAAI,EAAA,gCAAgC,YAAY,qBAAqB,gBAAgB,YAAY,EACjG;YACE,GAAG,OAAO;YACV,OAAO,EAAE,IAAA,sBAAY,EAAC;gBACpB,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE;gBACxF,OAAO,EAAE,OAAO;aACjB,CAAC;SACH,CACF,CAAC;IACJ,CAAC;CACF;AA1ND,0CA0NC"}

package/resources/beta/organization/workspaces/service-accounts.mjs

@@ -0,0 +1,185 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+import { APIResource } from "../../../../core/resource.mjs";
+import { PageCursor } from "../../../../core/pagination.mjs";
+import { buildHeaders } from "../../../../internal/headers.mjs";
+import { path } from "../../../../internal/utils/path.mjs";
+export class ServiceAccounts extends APIResource {
+    /**
+     * **Requires an OAuth access token with the `org:admin` scope**, from
+     * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+     * API keys are not accepted. See
+     * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+     *
+     * Retrieve a service account's membership in a workspace.
+     *
+     * Returns the membership record, including the service account's `workspace_role`
+     * in this workspace. Archived workspaces return 400. For the default workspace,
+     * returns the implicit (`implicit: true`) membership when no explicit membership
+     * exists; an explicitly added membership is returned with its assigned role. An
+     * archived service account returns 404.
+     *
+     * @example
+     * ```ts
+     * const betaServiceAccountWorkspaceMember =
+     *   await client.beta.organization.workspaces.serviceAccounts.retrieve(
+     *     'service_account_id',
+     *     { workspace_id: 'workspace_id' },
+     *   );
+     * ```
+     */
+    retrieve(serviceAccountID, params, options) {
+        const { workspace_id, betas } = params;
+        return this._client.get(path `/v1/organizations/workspaces/${workspace_id}/service_accounts/${serviceAccountID}?beta=true`, {
+            ...options,
+            headers: buildHeaders([
+                { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
+                options?.headers,
+            ]),
+        });
+    }
+    /**
+     * **Requires an OAuth access token with the `org:admin` scope**, from
+     * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+     * API keys are not accepted. See
+     * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+     *
+     * Change a service account's role in a workspace.
+     *
+     * The new `workspace_role` replaces the current one. Only explicit memberships can
+     * be updated; to set a role on the implicit default-workspace membership, add the
+     * service account explicitly with
+     * `POST /workspaces/{workspace_id}/service_accounts`. Archived workspaces
+     * return 400. Archived service accounts cannot be updated and are rejected.
+     *
+     * @example
+     * ```ts
+     * const betaServiceAccountWorkspaceMember =
+     *   await client.beta.organization.workspaces.serviceAccounts.update(
+     *     'service_account_id',
+     *     {
+     *       workspace_id: 'workspace_id',
+     *       workspace_role: 'workspace_admin',
+     *     },
+     *   );
+     * ```
+     */
+    update(serviceAccountID, params, options) {
+        const { workspace_id, betas, ...body } = params;
+        return this._client.post(path `/v1/organizations/workspaces/${workspace_id}/service_accounts/${serviceAccountID}?beta=true`, {
+            body,
+            ...options,
+            headers: buildHeaders([
+                { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
+                options?.headers,
+            ]),
+        });
+    }
+    /**
+     * **Requires an OAuth access token with the `org:admin` scope**, from
+     * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+     * API keys are not accepted. See
+     * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+     *
+     * List the service accounts that are members of a workspace.
+     *
+     * Each entry includes the service account's `workspace_role`. Use `limit` and the
+     * `next_page` cursor to paginate. Archived workspaces return 400; use
+     * `GET /service_accounts/{id}/workspaces` to audit memberships of an archived
+     * workspace. The implicit default-workspace membership is not included in this
+     * list. Memberships of archived service accounts are omitted from the results.
+     *
+     * @example
+     * ```ts
+     * // Automatically fetches more pages as needed.
+     * for await (const betaServiceAccountWorkspaceMember of client.beta.organization.workspaces.serviceAccounts.list(
+     *   'workspace_id',
+     * )) {
+     *   // ...
+     * }
+     * ```
+     */
+    list(workspaceID, params = {}, options) {
+        const { betas, ...query } = params ?? {};
+        return this._client.getAPIList(path `/v1/organizations/workspaces/${workspaceID}/service_accounts?beta=true`, (PageCursor), {
+            query,
+            ...options,
+            headers: buildHeaders([
+                { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
+                options?.headers,
+            ]),
+        });
+    }
+    /**
+     * **Requires an OAuth access token with the `org:admin` scope**, from
+     * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+     * API keys are not accepted. See
+     * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+     *
+     * Add a service account to a workspace with the given `workspace_role`.
+     *
+     * The role determines what the service account can do in the workspace and which
+     * workspace-scoped permissions it can be granted when authenticating through
+     * federation. Every service account is already an implicit `workspace_user` member
+     * of the default workspace; adding it explicitly assigns a chosen role. If the
+     * service account is already an explicit member of the workspace, its
+     * `workspace_role` is replaced with the value supplied here. Archived workspaces
+     * return 400. Archived service accounts cannot be added and are rejected.
+     *
+     * @example
+     * ```ts
+     * const betaServiceAccountWorkspaceMember =
+     *   await client.beta.organization.workspaces.serviceAccounts.add(
+     *     'workspace_id',
+     *     {
+     *       service_account_id: 'service_account_id',
+     *       workspace_role: 'workspace_admin',
+     *     },
+     *   );
+     * ```
+     */
+    add(workspaceID, params, options) {
+        const { betas, ...body } = params;
+        return this._client.post(path `/v1/organizations/workspaces/${workspaceID}/service_accounts?beta=true`, {
+            body,
+            ...options,
+            headers: buildHeaders([
+                { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
+                options?.headers,
+            ]),
+        });
+    }
+    /**
+     * **Requires an OAuth access token with the `org:admin` scope**, from
+     * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+     * API keys are not accepted. See
+     * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+     *
+     * Remove a service account from a workspace.
+     *
+     * Removal is idempotent (returns 200 even if the membership was already removed).
+     * A DELETE against the implicit default-workspace membership returns 200 but is a
+     * no-op and the membership persists; deleting an explicit default-workspace row
+     * reverts to the implicit `workspace_user` membership. Archived workspaces
+     * return 400.
+     *
+     * @example
+     * ```ts
+     * const serviceAccount =
+     *   await client.beta.organization.workspaces.serviceAccounts.remove(
+     *     'service_account_id',
+     *     { workspace_id: 'workspace_id' },
+     *   );
+     * ```
+     */
+    remove(serviceAccountID, params, options) {
+        const { workspace_id, betas } = params;
+        return this._client.delete(path `/v1/organizations/workspaces/${workspace_id}/service_accounts/${serviceAccountID}?beta=true`, {
+            ...options,
+            headers: buildHeaders([
+                { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
+                options?.headers,
+            ]),
+        });
+    }
+}
+//# sourceMappingURL=service-accounts.mjs.map

package/resources/beta/organization/workspaces/service-accounts.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-accounts.mjs","sourceRoot":"","sources":["../../../../src/resources/beta/organization/workspaces/service-accounts.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAEtF,OAAO,EAAE,WAAW,EAAE,sCAAkC;AAMxD,OAAO,EAAE,UAAU,EAAsC,wCAAoC;AAC7F,OAAO,EAAE,YAAY,EAAE,yCAAqC;AAE5D,OAAO,EAAE,IAAI,EAAE,4CAAwC;AAEvD,MAAM,OAAO,eAAgB,SAAQ,WAAW;IAC9C;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,QAAQ,CACN,gBAAwB,EACxB,MAAoC,EACpC,OAAwB;QAExB,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;QACvC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CACrB,IAAI,CAAA,gCAAgC,YAAY,qBAAqB,gBAAgB,YAAY,EACjG;YACE,GAAG,OAAO;YACV,OAAO,EAAE,YAAY,CAAC;gBACpB,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE;gBACxF,OAAO,EAAE,OAAO;aACjB,CAAC;SACH,CACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,MAAM,CACJ,gBAAwB,EACxB,MAAkC,EAClC,OAAwB;QAExB,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;QAChD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB,IAAI,CAAA,gCAAgC,YAAY,qBAAqB,gBAAgB,YAAY,EACjG;YACE,IAAI;YACJ,GAAG,OAAO;YACV,OAAO,EAAE,YAAY,CAAC;gBACpB,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE;gBACxF,OAAO,EAAE,OAAO;aACjB,CAAC;SACH,CACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,IAAI,CACF,WAAmB,EACnB,SAAsD,EAAE,EACxD,OAAwB;QAKxB,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAC5B,IAAI,CAAA,gCAAgC,WAAW,6BAA6B,EAC5E,CAAA,UAAgE,CAAA,EAChE;YACE,KAAK;YACL,GAAG,OAAO;YACV,OAAO,EAAE,YAAY,CAAC;gBACpB,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE;gBACxF,OAAO,EAAE,OAAO;aACjB,CAAC;SACH,CACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,GAAG,CACD,WAAmB,EACnB,MAA+B,EAC/B,OAAwB;QAExB,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;QAClC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAA,gCAAgC,WAAW,6BAA6B,EAAE;YACrG,IAAI;YACJ,GAAG,OAAO;YACV,OAAO,EAAE,YAAY,CAAC;gBACpB,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE;gBACxF,OAAO,EAAE,OAAO;aACjB,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,MAAM,CACJ,gBAAwB,EACxB,MAAkC,EAClC,OAAwB;QAExB,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;QACvC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CACxB,IAAI,CAAA,gCAAgC,YAAY,qBAAqB,gBAAgB,YAAY,EACjG;YACE,GAAG,OAAO;YACV,OAAO,EAAE,YAAY,CAAC;gBACpB,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE;gBACxF,OAAO,EAAE,OAAO;aACjB,CAAC;SACH,CACF,CAAC;IACJ,CAAC;CACF"}