@anthropic-ai/sdk 0.120.0 → 0.122.0

package/src/resources/beta/organization/federation/rules/workspaces.ts

@@ -0,0 +1,196 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import { APIResource } from '../../../../../core/resource';
+import * as BetaAPI from '../../../beta';
+import * as RulesAPI from './rules';
+import { BetaFederationRuleWorkspacesPageCursor } from './rules';
+import { APIPromise } from '../../../../../core/api-promise';
+import { PageCursor, type PageCursorParams, PagePromise } from '../../../../../core/pagination';
+import { buildHeaders } from '../../../../../internal/headers';
+import { RequestOptions } from '../../../../../internal/request-options';
+import { path } from '../../../../../internal/utils/path';
+
+export class Workspaces extends APIResource {
+  /**
+   * **Requires an OAuth access token with the `org:admin` scope**, from
+   * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+   * API keys are not accepted. See
+   * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+   *
+   * List workspaces where this federation rule is enabled.
+   *
+   * Returns all workspace enablements in a single response; the `limit` and `page`
+   * parameters are accepted but have no effect, and `next_page` is always `null`.
+   * Returns explicit per-workspace enablements only; for rules with
+   * `applies_to_all_workspaces` or a legacy single `workspace_id`, check those
+   * fields on the rule itself.
+   *
+   * @example
+   * ```ts
+   * // Automatically fetches more pages as needed.
+   * for await (const betaFederationRuleWorkspace of client.beta.organization.federation.rules.workspaces.list(
+   *   'federation_rule_id',
+   * )) {
+   *   // ...
+   * }
+   * ```
+   */
+  list(
+    federationRuleID: string,
+    params: WorkspaceListParams | null | undefined = {},
+    options?: RequestOptions,
+  ): PagePromise<BetaFederationRuleWorkspacesPageCursor, RulesAPI.BetaFederationRuleWorkspace> {
+    const { betas, ...query } = params ?? {};
+    return this._client.getAPIList(
+      path`/v1/organizations/federation_rules/${federationRuleID}/workspaces?beta=true`,
+      PageCursor<RulesAPI.BetaFederationRuleWorkspace>,
+      {
+        query,
+        ...options,
+        headers: buildHeaders([
+          { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
+          options?.headers,
+        ]),
+      },
+    );
+  }
+
+  /**
+   * **Requires an OAuth access token with the `org:admin` scope**, from
+   * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+   * API keys are not accepted. See
+   * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+   *
+   * Enable a federation rule for a workspace.
+   *
+   * Idempotent; re-enabling returns the existing enablement. The rule and workspace
+   * must both belong to your organization. Membership of the rule's target service
+   * account in this workspace is not checked at enablement: token exchange into this
+   * workspace is rejected unless the target is a member (it is implicitly a member
+   * of the default workspace). Archived rules are rejected with 400. OAuth callers
+   * may only manage rules whose `oauth_scope` is `workspace:developer` or
+   * `workspace:inference`; other scopes require a Console session.
+   *
+   * @example
+   * ```ts
+   * const betaFederationRuleWorkspace =
+   *   await client.beta.organization.federation.rules.workspaces.add(
+   *     'federation_rule_id',
+   *     { workspace_id: 'workspace_id' },
+   *   );
+   * ```
+   */
+  add(
+    federationRuleID: string,
+    params: WorkspaceAddParams,
+    options?: RequestOptions,
+  ): APIPromise<RulesAPI.BetaFederationRuleWorkspace> {
+    const { betas, ...body } = params;
+    return this._client.post(
+      path`/v1/organizations/federation_rules/${federationRuleID}/workspaces?beta=true`,
+      {
+        body,
+        ...options,
+        headers: buildHeaders([
+          { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
+          options?.headers,
+        ]),
+      },
+    );
+  }
+
+  /**
+   * **Requires an OAuth access token with the `org:admin` scope**, from
+   * `ant auth login --scope org:admin` or a workload identity federation rule; Admin
+   * API keys are not accepted. See
+   * [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
+   *
+   * Disable a federation rule for a workspace.
+   *
+   * Idempotent; succeeds even if the enablement was already removed. OAuth callers
+   * may only manage rules whose `oauth_scope` is `workspace:developer` or
+   * `workspace:inference`; other scopes require a Console session.
+   *
+   * @example
+   * ```ts
+   * const workspace =
+   *   await client.beta.organization.federation.rules.workspaces.remove(
+   *     'workspace_id',
+   *     { federation_rule_id: 'federation_rule_id' },
+   *   );
+   * ```
+   */
+  remove(
+    workspaceID: string,
+    params: WorkspaceRemoveParams,
+    options?: RequestOptions,
+  ): APIPromise<WorkspaceRemoveResponse> {
+    const { federation_rule_id, betas } = params;
+    return this._client.delete(
+      path`/v1/organizations/federation_rules/${federation_rule_id}/workspaces/${workspaceID}?beta=true`,
+      {
+        ...options,
+        headers: buildHeaders([
+          { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
+          options?.headers,
+        ]),
+      },
+    );
+  }
+}
+
+export interface WorkspaceRemoveResponse {
+  /**
+   * Tagged ID of the federation rule.
+   */
+  federation_rule_id: string;
+
+  type: 'federation_rule_workspace_deleted';
+
+  /**
+   * Tagged ID of the workspace named in the delete request. Removal is idempotent.
+   */
+  workspace_id: string;
+}
+
+export interface WorkspaceListParams extends PageCursorParams {
+  /**
+   * Header param: Optional header to specify the beta version(s) you want to use.
+   */
+  betas?: Array<BetaAPI.AnthropicBeta>;
+}
+
+export interface WorkspaceAddParams {
+  /**
+   * Body param: Tagged ID of the workspace to enable this rule for.
+   */
+  workspace_id: string;
+
+  /**
+   * Header param: Optional header to specify the beta version(s) you want to use.
+   */
+  betas?: Array<BetaAPI.AnthropicBeta>;
+}
+
+export interface WorkspaceRemoveParams {
+  /**
+   * Path param: ID of the federation rule.
+   */
+  federation_rule_id: string;
+
+  /**
+   * Header param: Optional header to specify the beta version(s) you want to use.
+   */
+  betas?: Array<BetaAPI.AnthropicBeta>;
+}
+
+export declare namespace Workspaces {
+  export {
+    type WorkspaceRemoveResponse as WorkspaceRemoveResponse,
+    type WorkspaceListParams as WorkspaceListParams,
+    type WorkspaceAddParams as WorkspaceAddParams,
+    type WorkspaceRemoveParams as WorkspaceRemoveParams,
+  };
+}
+
+export { type BetaFederationRuleWorkspacesPageCursor };

package/src/resources/beta/organization/federation/rules.ts

@@ -0,0 +1,3 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+export * from './rules/index';

package/src/resources/beta/organization/federation.ts

@@ -0,0 +1,3 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+export * from './federation/index';

package/src/resources/beta/organization/index.ts

@@ -0,0 +1,83 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+export {
+  APIKeys,
+  type BetaAPIKey,
+  type BetaAPIKeyCreatedBy,
+  type BetaAPIKeyOrganizationScope,
+  type BetaAPIKeyServiceAccountActor,
+  type BetaAPIKeyUserActor,
+  type BetaAPIKeyWorkspaceScope,
+  type APIKeyUpdateParams,
+  type APIKeyListParams,
+  type BetaAPIKeysPage,
+} from './api-keys';
+export {
+  ExternalKeys,
+  type BetaAWSExternalKeyConfig,
+  type BetaAzureExternalKeyConfig,
+  type BetaAzureExternalKeyConfigParam,
+  type BetaExternalKey,
+  type BetaExternalKeyAttachedAttachment,
+  type BetaExternalKeyUnattachedAttachment,
+  type BetaGCPExternalKeyConfig,
+  type ExternalKeyDeleteResponse,
+  type ExternalKeyValidateResponse,
+  type ExternalKeyCreateParams,
+  type ExternalKeyUpdateParams,
+  type ExternalKeyListParams,
+  type BetaExternalKeysPageCursor,
+} from './external-keys';
+export { Federation } from './federation/index';
+export {
+  Invites,
+  type BetaOrganizationInvite,
+  type InviteDeleteResponse,
+  type InviteCreateParams,
+  type InviteListParams,
+  type BetaOrganizationInvitesPage,
+} from './invites';
+export { Organization, type BetaOrganization, type BetaOrganizationRole } from './organization';
+export {
+  RateLimits,
+  type BetaOrganizationRateLimit,
+  type BetaOrganizationRateLimitValue,
+  type RateLimitListParams,
+  type BetaOrganizationRateLimitsPageCursor,
+} from './rate-limits';
+export {
+  ServiceAccounts,
+  type BetaServiceAccount,
+  type BetaServiceAccountWorkspaceMember,
+  type ServiceAccountCreateParams,
+  type ServiceAccountRetrieveParams,
+  type ServiceAccountUpdateParams,
+  type ServiceAccountListParams,
+  type ServiceAccountArchiveParams,
+  type BetaServiceAccountWorkspaceMembersPageCursor,
+  type BetaServiceAccountsPageCursor,
+} from './service-accounts/index';
+export {
+  Users,
+  type BetaOrganizationUser,
+  type UserRemoveResponse,
+  type UserUpdateParams,
+  type UserListParams,
+  type BetaOrganizationUsersPage,
+} from './users';
+export {
+  Workspaces,
+  type BetaAllowedInferenceGeo,
+  type BetaDataResidency,
+  type BetaDataResidencyCreateConfig,
+  type BetaDataResidencyUpdateConfig,
+  type BetaNoBillingWorkspaceRole,
+  type BetaWorkspace,
+  type BetaWorkspaceMember,
+  type BetaWorkspaceRole,
+  type WorkspaceCreateParams,
+  type WorkspaceUpdateParams,
+  type WorkspaceListParams,
+  type BetaWorkspaceMembersPage,
+  type BetaWorkspacesPage,
+} from './workspaces/index';

package/src/resources/beta/organization/invites.ts

@@ -0,0 +1,207 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import { APIResource } from '../../../core/resource';
+import * as OrganizationAPI from './organization';
+import { APIPromise } from '../../../core/api-promise';
+import { Page, type PageParams, PagePromise } from '../../../core/pagination';
+import { RequestOptions } from '../../../internal/request-options';
+import { path } from '../../../internal/utils/path';
+
+export class Invites extends APIResource {
+  /**
+   * Invite a user to join the organization by email.
+   *
+   * On plans that draw members from a finite pool of purchased seats, the invite
+   * automatically consumes a seat from the lowest tier with availability; there is
+   * no seat-tier parameter. When no seat is free the request fails with a 400 error
+   * rather than purchasing a seat.
+   *
+   * @example
+   * ```ts
+   * const betaOrganizationInvite =
+   *   await client.beta.organization.invites.create({
+   *     email: 'user@emaildomain.com',
+   *     role: 'user',
+   *   });
+   * ```
+   */
+  create(body: InviteCreateParams, options?: RequestOptions): APIPromise<BetaOrganizationInvite> {
+    return this._client.post('/v1/organizations/invites?beta=true', { body, ...options });
+  }
+
+  /**
+   * Retrieve an invite by ID.
+   *
+   * @example
+   * ```ts
+   * const betaOrganizationInvite =
+   *   await client.beta.organization.invites.retrieve(
+   *     'invite_id',
+   *   );
+   * ```
+   */
+  retrieve(inviteID: string, options?: RequestOptions): APIPromise<BetaOrganizationInvite> {
+    return this._client.get(path`/v1/organizations/invites/${inviteID}?beta=true`, options);
+  }
+
+  /**
+   * List the organization's invites.
+   *
+   * @example
+   * ```ts
+   * // Automatically fetches more pages as needed.
+   * for await (const betaOrganizationInvite of client.beta.organization.invites.list()) {
+   *   // ...
+   * }
+   * ```
+   */
+  list(
+    query: InviteListParams | null | undefined = {},
+    options?: RequestOptions,
+  ): PagePromise<BetaOrganizationInvitesPage, BetaOrganizationInvite> {
+    return this._client.getAPIList('/v1/organizations/invites?beta=true', Page<BetaOrganizationInvite>, {
+      query,
+      ...options,
+    });
+  }
+
+  /**
+   * Delete a pending invite.
+   *
+   * @example
+   * ```ts
+   * const invite =
+   *   await client.beta.organization.invites.delete(
+   *     'invite_id',
+   *   );
+   * ```
+   */
+  delete(inviteID: string, options?: RequestOptions): APIPromise<InviteDeleteResponse> {
+    return this._client.delete(path`/v1/organizations/invites/${inviteID}?beta=true`, options);
+  }
+}
+
+export type BetaOrganizationInvitesPage = Page<BetaOrganizationInvite>;
+
+export interface BetaOrganizationInvite {
+  /**
+   * ID of the Invite.
+   */
+  id: string;
+
+  /**
+   * RFC 3339 datetime string indicating when the Invite was accepted, or null.
+   */
+  accepted_at: string | null;
+
+  /**
+   * Email of the User being invited.
+   */
+  email: string;
+
+  /**
+   * RFC 3339 datetime string indicating when the Invite expires.
+   */
+  expires_at: string;
+
+  /**
+   * RFC 3339 datetime string indicating when the Invite was created.
+   */
+  invited_at: string;
+
+  /**
+   * RBAC group IDs recorded on the Invite (Claude Enterprise organizations), to be
+   * assigned to the User when the Invite is accepted. `[]` when none.
+   */
+  rbac_group_ids: Array<string>;
+
+  /**
+   * Organization role of the User.
+   */
+  role: OrganizationAPI.BetaOrganizationRole;
+
+  /**
+   * Status of the Invite.
+   */
+  status: 'accepted' | 'deleted' | 'expired' | 'pending';
+
+  /**
+   * Object type.
+   *
+   * For Invites, this is always `"invite"`.
+   */
+  type: 'invite';
+}
+
+export interface InviteDeleteResponse {
+  /**
+   * ID of the Invite.
+   */
+  id: string;
+
+  /**
+   * Deleted object type.
+   *
+   * For Invites, this is always `"invite_deleted"`.
+   */
+  type: 'invite_deleted';
+}
+
+export interface InviteCreateParams {
+  /**
+   * Email of the User.
+   */
+  email: string;
+
+  /**
+   * Role for the invited User.
+   *
+   * The accepted values depend on the organization type. Console and API
+   * organizations accept `user`, `developer`, `billing`, and `claude_code_user`;
+   * `admin` cannot be assigned through the API. Claude Enterprise organizations
+   * accept `user` and `managed`.
+   */
+  role: 'billing' | 'claude_code_user' | 'developer' | 'managed' | 'user';
+
+  /**
+   * RBAC group IDs to assign to the User when the Invite is accepted. A non-empty
+   * array is accepted only for a Claude Enterprise organization with RBAC groups,
+   * and requires the key to carry the `write:rbac_groups` scope.
+   */
+  rbac_group_ids?: Array<string>;
+}
+
+export interface InviteListParams extends PageParams {
+  /**
+   * Filter by the email address the Invite was sent to. Matches the same way as the
+   * Users list's `email` filter (normalized, case-insensitive).
+   */
+  email?: string;
+
+  /**
+   * Filter to items whose `role` equals one of the supplied values. Repeatable;
+   * values are OR'ed together.
+   *
+   * Accepted values depend on the organization type: Console and API organizations
+   * accept `user`, `developer`, `billing`, `admin`, and `claude_code_user`; Claude
+   * Enterprise organizations accept `user`, `owner`, `primary_owner`,
+   * `membership_admin`, and `managed`.
+   */
+  roles?: Array<string>;
+
+  /**
+   * Filter by Invite status. Repeatable; values are OR'ed together. Omit to return
+   * `pending`, `accepted`, and `expired` Invites alike.
+   */
+  statuses?: Array<'accepted' | 'expired' | 'pending'>;
+}
+
+export declare namespace Invites {
+  export {
+    type BetaOrganizationInvite as BetaOrganizationInvite,
+    type InviteDeleteResponse as InviteDeleteResponse,
+    type BetaOrganizationInvitesPage as BetaOrganizationInvitesPage,
+    type InviteCreateParams as InviteCreateParams,
+    type InviteListParams as InviteListParams,
+  };
+}