@anthropic-ai/sdk
Version:
The official TypeScript library for the Anthropic API
233 lines • 9.45 kB
text/typescript
import { APIResource } from "../../../core/resource.mjs";
import * as WorkspacesAPI from "./workspaces.mjs";
import { WorkspaceAddParams, WorkspaceListParams, WorkspaceRemoveParams, WorkspaceRemoveResponse, Workspaces } from "./workspaces.mjs";
import * as OrganizationWorkspacesAPI from "../workspaces/workspaces.mjs";
import { APIPromise } from "../../../core/api-promise.mjs";
import { PageCursor, type PageCursorParams, PagePromise } from "../../../core/pagination.mjs";
import { RequestOptions } from "../../../internal/request-options.mjs";
export declare class ServiceAccounts extends APIResource {
workspaces: WorkspacesAPI.Workspaces;
/**
* **Requires an OAuth access token with the `org:admin` scope**, from
* `ant auth login --scope org:admin` or a workload identity federation rule; Admin
* API keys are not accepted. See
* [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
*
* Create a service account.
*
* A service account is a named workload identity that federation rules target.
* `organization_role` is `developer` (default) or `admin`; a rule may only be
* created or retargeted to grant `org:admin` scope when the target's
* `organization_role` is `admin`. Creating an `admin`-role service account
* requires an interactive credential (a user OAuth token or a Console session) — a
* workload may only create `developer`-role service accounts.
*
* @example
* ```ts
* const serviceAccount =
* await client.organization.serviceAccounts.create({
* name: 'ci-deploy-bot',
* });
* ```
*/
create(body: ServiceAccountCreateParams, options?: RequestOptions): APIPromise<ServiceAccount>;
/**
* **Requires an OAuth access token with the `org:admin` scope**, from
* `ant auth login --scope org:admin` or a workload identity federation rule; Admin
* API keys are not accepted. See
* [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
*
* Retrieve a service account by its ID (`svac_...`).
*
* @example
* ```ts
* const serviceAccount =
* await client.organization.serviceAccounts.retrieve(
* 'service_account_id',
* );
* ```
*/
retrieve(serviceAccountID: string, options?: RequestOptions): APIPromise<ServiceAccount>;
/**
* **Requires an OAuth access token with the `org:admin` scope**, from
* `ant auth login --scope org:admin` or a workload identity federation rule; Admin
* API keys are not accepted. See
* [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
*
* Update a service account.
*
* Only `description` and `organization_role` are mutable; `name` cannot be
* changed. Archived service accounts cannot be updated; this returns 400. Setting
* `organization_role` to `admin` (even when unchanged) requires an interactive
* credential (a user OAuth token or a Console session).
*
* @example
* ```ts
* const serviceAccount =
* await client.organization.serviceAccounts.update(
* 'service_account_id',
* );
* ```
*/
update(serviceAccountID: string, body: ServiceAccountUpdateParams, options?: RequestOptions): APIPromise<ServiceAccount>;
/**
* **Requires an OAuth access token with the `org:admin` scope**, from
* `ant auth login --scope org:admin` or a workload identity federation rule; Admin
* API keys are not accepted. See
* [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
*
* List service accounts in the caller's organization.
*
* Results are ordered by creation time, newest first. Use `limit` and the
* `next_page` cursor to paginate; set `include_archived=true` to include archived
* service accounts.
*
* @example
* ```ts
* // Automatically fetches more pages as needed.
* for await (const serviceAccount of client.organization.serviceAccounts.list()) {
* // ...
* }
* ```
*/
list(query?: ServiceAccountListParams | null | undefined, options?: RequestOptions): PagePromise<ServiceAccountsPageCursor, ServiceAccount>;
/**
* **Requires an OAuth access token with the `org:admin` scope**, from
* `ant auth login --scope org:admin` or a workload identity federation rule; Admin
* API keys are not accepted. See
* [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
*
* Archive a service account.
*
* Idempotent; re-archiving returns the service account with its original
* `archived_at`. Rejected with 400 if any live (non-archived) federation rule
* still targets this service account, same as issuer archival; archive those rules
* first or change their target to another service account.
*
* @example
* ```ts
* const serviceAccount =
* await client.organization.serviceAccounts.archive(
* 'service_account_id',
* );
* ```
*/
archive(serviceAccountID: string, options?: RequestOptions): APIPromise<ServiceAccount>;
}
export type ServiceAccountsPageCursor = PageCursor<ServiceAccount>;
export type ServiceAccountWorkspaceMembersPageCursor = PageCursor<ServiceAccountWorkspaceMember>;
/**
* Named non-human identity within the caller's organization.
*
* A service account is a pure identity: name + org. Authorization lives on
* whatever references it (federation rules).
*/
export interface ServiceAccount {
/**
* Tagged ID of the service account.
*/
id: string;
/**
* If set, this service account is archived.
*/
archived_at: string | null;
/**
* Tagged ID (`user_`/`svac_`) of the actor that archived this service account.
*/
archived_by_actor_id: string | null;
/**
* When this service account was created.
*/
created_at: string;
/**
* Tagged ID (`user_`/`svac_`) of the actor that created this service account.
*/
created_by_actor_id: string | null;
/**
* Optional free-text description.
*/
description: string | null;
/**
* Admin-chosen slug identifier.
*/
name: string;
/**
* Org-level role. A federation rule may only be created or retargeted to grant
* `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target
* is later demoted to `developer` is rejected at token exchange. Rules granting
* `org:admin` are managed in the Console.
*/
organization_role: 'admin' | 'developer';
type: 'service_account';
/**
* When this service account was last updated.
*/
updated_at: string;
/**
* Tagged ID (`user_`/`svac_`) of the actor that last updated this service account.
*/
updated_by_actor_id: string | null;
}
export interface ServiceAccountWorkspaceMember {
/**
* Tagged ID (`user_...`/`svac_...`) of the actor who created this membership.
*/
created_by_actor_id: string | null;
/**
* True when this is the implicit default-workspace membership every service
* account has when no explicit membership exists. Implicit memberships have role
* `workspace_user` and cannot be removed.
*/
implicit: boolean | null;
/**
* Tagged service account ID (`svac_...`).
*/
service_account_id: string;
type: 'service_account_workspace_member';
/**
* Tagged workspace ID (`wrkspc_...`).
*/
workspace_id: string;
/**
* Role of the service account in this workspace. Service accounts cannot hold the
* `workspace_billing` role.
*/
workspace_role: OrganizationWorkspacesAPI.WorkspaceRole;
}
export interface ServiceAccountCreateParams {
/**
* Slug identifier (lowercase, digits, hyphens). Unique within the organization; a
* duplicate name returns 409.
*/
name: string;
/**
* Optional free-text description.
*/
description?: string | null;
/**
* Org-level role. Defaults to `developer`.
*/
organization_role?: 'admin' | 'developer';
}
export interface ServiceAccountUpdateParams {
/**
* Replaces the description. Omit to leave unchanged; send `null` to clear (the
* field is stored as an empty string).
*/
description?: string | null;
/**
* Replaces the org-level role. Omit or send `null` to leave unchanged.
*/
organization_role?: 'admin' | 'developer' | null;
}
export interface ServiceAccountListParams extends PageCursorParams {
/**
* Include archived resources. Defaults to false.
*/
include_archived?: boolean;
}
export declare namespace ServiceAccounts {
export { type ServiceAccount as ServiceAccount, type ServiceAccountWorkspaceMember as ServiceAccountWorkspaceMember, type ServiceAccountsPageCursor as ServiceAccountsPageCursor, type ServiceAccountCreateParams as ServiceAccountCreateParams, type ServiceAccountUpdateParams as ServiceAccountUpdateParams, type ServiceAccountListParams as ServiceAccountListParams, };
export { Workspaces as Workspaces, type WorkspaceRemoveResponse as WorkspaceRemoveResponse, type WorkspaceListParams as WorkspaceListParams, type WorkspaceAddParams as WorkspaceAddParams, type WorkspaceRemoveParams as WorkspaceRemoveParams, };
}
//# sourceMappingURL=service-accounts.d.mts.map