apicheats.dev Cheat sheet Raw .md
POST

Try POST /v1/organizations/federation_rules — Claude API

Claude playground

Create Federation Rule

Credentials

Kept in this tab only. Requests go through apicheats.dev's same-origin proxy straight to api.anthropic.com; the proxy stores and logs nothing about them.

Headers

Body application/json

10 body fields
  • applies_to_all_workspaces · optional · boolean — When true, enable this rule for every workspace in the org (including workspaces created later).
  • attributes · optional · object — CEL expressions `{name: expr}` extracting named values from claims. Not yet supported; any non-empty value is rejected with 400.
  • description · optional · string — Optional free-text description.
  • issuer_id · required · string — Tagged ID of the federation issuer.
  • match · required · object — Does the incoming JWT qualify? All populated fields must pass; omitted fields are skipped. At least one of `subject_prefix` (other than a wildcard-only value like `*`), `claims`, or `condition` is required; `audience` alone is not sufficient.
  • name · required · string — Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.
  • oauth_scope · required · string — Space-separated OAuth scopes. OAuth callers may only set `workspace:developer` or `workspace:inference`; other scopes (such as `org:admin`) require a Console session.
  • target · required · object — Bind to a fixed service account by ID.
  • token_lifetime_seconds · optional · integer — Lifetime in seconds for access tokens minted via this rule (60-86400). Defaults to 3600 (1h). Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.
  • workspace_id · optional · string — Tagged ID of the workspace to enable this rule for. Required unless `applies_to_all_workspaces` is true. Additional workspaces can be added via the `/federation_rules/{federation_rule_id}/workspaces` sub-resource.