# Generated by API Evangelist (build-phrasing.py). Our phrasing, not observed demand.
overlay: 1.0.0
info:
  title: API Evangelist conversational phrasing for Anthropic Organizations API
  version: 1.0.0
extends: openapi/anthropic-organizations-api-openapi.yml
actions:
- target: $.info
  update:
    x-apievangelist-phrasing:
      method: generated
      generated: '2026-09-26'
      generator: build-phrasing.py
      label: Generated by API Evangelist
      operations: 68
- target: $.paths['/v1/organizations/api_keys/{api_key_id}?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: Look up an API key's details
      effect: read
      questions:
      - What can I see about one of my organization's API keys, like its name and status?
      - Is there a way to check whether a specific Claude API key is still active?
      instructions:
      - text: Show me the details of API key {api_key_id}.
        slots:
          api_key_id: path.api_key_id
      - text: Check the status of API key {api_key_id}.
        slots:
          api_key_id: path.api_key_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/api_keys/{api_key_id}?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Rename or deactivate an API key
      effect: write
      questions:
      - Can I rename an existing API key without rotating it?
      - How do I disable an API key that leaked but keep its record?
      instructions:
      - text: Rename API key {api_key_id} to {name}.
        slots:
          api_key_id: path.api_key_id
          name: requestBody.name
      - text: Set the status of API key {api_key_id} to {status}.
        slots:
          api_key_id: path.api_key_id
          status: requestBody.status
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/api_keys?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: List the organization's API keys
      effect: read
      questions:
      - Which API keys exist across my Anthropic organization?
      - Can I see only the API keys that belong to one workspace?
      - Who created each of our API keys?
      instructions:
      - text: List all API keys in my organization.
      - text: List the API keys in workspace {workspace_id}.
        slots:
          workspace_id: query.workspace_id
      - text: List API keys created by user {created_by_user_id} with status {status}.
        slots:
          created_by_user_id: query.created_by_user_id
          status: query.status
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/cost_report?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: Get the organization's cost report
      effect: read
      questions:
      - How much has my organization spent on the API since the start of the month?
      - Can I break down our spend by workspace or description in daily buckets?
      instructions:
      - text: Get our cost report starting {starting_at}.
        slots:
          starting_at: query.starting_at
      - text: Show spending from {starting_at} to {ending_at} grouped by {group_by}.
        slots:
          starting_at: query.starting_at
          ending_at: query.ending_at
          group_by: query.group_by[]
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/external_keys/{external_key_id}/validate?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Test an external KMS key config
      effect: write
      questions:
      - How can I confirm that Anthropic can actually encrypt and decrypt with my KMS key?
      - What happens if the KMS roundtrip check times out?
      instructions:
      - text: Validate external key config {external_key_id} against our KMS.
        slots:
          external_key_id: path.external_key_id
      - text: Run an encrypt/decrypt roundtrip test on external key {external_key_id}.
        slots:
          external_key_id: path.external_key_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/external_keys/{external_key_id}?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: Retrieve an external key config
      effect: read
      questions:
      - Where can I see the settings of a customer-managed encryption key config?
      - Which geo and KMS provider does one of my external key configs use?
      instructions:
      - text: Show external key config {external_key_id}.
        slots:
          external_key_id: path.external_key_id
      - text: Fetch the KMS provider details for external key {external_key_id}.
        slots:
          external_key_id: path.external_key_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/external_keys/{external_key_id}?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Edit an external key config
      effect: write
      questions:
      - Can I change the KMS provider config after a workspace already uses the key?
      - Is the display name of an external key config always editable?
      instructions:
      - text: Rename external key config {external_key_id} to {display_name}.
        slots:
          external_key_id: path.external_key_id
          display_name: requestBody.display_name
      - text: Replace the KMS provider config on external key {external_key_id} with {provider_config}.
        slots:
          external_key_id: path.external_key_id
          provider_config: requestBody.provider_config
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/external_keys/{external_key_id}?beta=true'].delete
  update:
    x-apievangelist-phrasing:
      intent: Delete an external key config
      effect: destructive
      questions:
      - Why would deleting an external key config be rejected?
      - Can I remove a customer-managed key config nobody references anymore?
      instructions:
      - text: Delete external key config {external_key_id}.
        slots:
          external_key_id: path.external_key_id
      - text: Remove the unused CMEK config {external_key_id} from our organization.
        slots:
          external_key_id: path.external_key_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/external_keys?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: List external key configs
      effect: read
      questions:
      - What customer-managed encryption key configs does my organization have?
      - Are external key configs returned newest first?
      instructions:
      - text: List our external key configs.
      - text: Show the first {limit} CMEK configs in the organization.
        slots:
          limit: query.limit
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/external_keys?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Register a customer-managed KMS key
      effect: write
      questions:
      - How do I bring my own KMS key to encrypt Anthropic workspace data?
      - Which data residency geo can an external key config use?
      instructions:
      - text: Create an external key config with provider config {provider_config}.
        slots:
          provider_config: requestBody.provider_config
      - text: Register KMS key {provider_config} as external key {display_name} in geo {geo}.
        slots:
          provider_config: requestBody.provider_config
          display_name: requestBody.display_name
          geo: requestBody.geo
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/federation_issuers/{federation_issuer_id}/archive?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Archive a federation issuer
      effect: destructive
      questions:
      - How do I stop trusting an OIDC issuer for workload identity federation?
      - Why can't I archive an issuer that live federation rules still reference?
      instructions:
      - text: Archive federation issuer {federation_issuer_id}.
        slots:
          federation_issuer_id: path.federation_issuer_id
      - text: Stop trusting OIDC issuer {federation_issuer_id} for workload identity.
        slots:
          federation_issuer_id: path.federation_issuer_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/federation_issuers/{federation_issuer_id}?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: Retrieve a federation issuer
      effect: read
      questions:
      - What issuer URL and JWKS settings does one of my trusted OIDC issuers have?
      - Can I look up a single federation issuer by its fdis ID?
      instructions:
      - text: Show federation issuer {federation_issuer_id}.
        slots:
          federation_issuer_id: path.federation_issuer_id
      - text: Get the JWKS and issuer URL configured on {federation_issuer_id}.
        slots:
          federation_issuer_id: path.federation_issuer_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/federation_issuers/{federation_issuer_id}?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Edit a federation issuer
      effect: write
      questions:
      - How do I re-enable JWKS polling after it was paused for an issuer?
      - Can I shorten the maximum JWT lifetime accepted from an existing issuer?
      instructions:
      - text: Change the max JWT lifetime of issuer {federation_issuer_id} to {max_jwt_lifetime_seconds} seconds.
        slots:
          federation_issuer_id: path.federation_issuer_id
          max_jwt_lifetime_seconds: requestBody.max_jwt_lifetime_seconds
      - text: Update the issuer URL of {federation_issuer_id} to {issuer_url}.
        slots:
          federation_issuer_id: path.federation_issuer_id
          issuer_url: requestBody.issuer_url
      - text: Turn JTI replay protection {check_jti} on issuer {federation_issuer_id}.
        slots:
          check_jti: requestBody.check_jti
          federation_issuer_id: path.federation_issuer_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/federation_issuers?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: List federation issuers
      effect: read
      questions:
      - Which OIDC issuers does my organization trust for workload identity federation?
      - Can I include archived federation issuers when listing them?
      instructions:
      - text: List our federation issuers.
      - text: 'List federation issuers including archived ones: {include_archived}.'
        slots:
          include_archived: query.include_archived
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/federation_issuers?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Register an OIDC federation issuer
      effect: write
      questions:
      - How do I let my CI system's OIDC tokens authenticate to the Claude API without keys?
      - What is the default max JWT lifetime for a new trusted issuer?
      instructions:
      - text: Register OIDC issuer {issuer_url} as federation issuer {name}.
        slots:
          issuer_url: requestBody.issuer_url
          name: requestBody.name
      - text: Trust issuer {issuer_url} named {name} with JWKS config {jwks}.
        slots:
          issuer_url: requestBody.issuer_url
          name: requestBody.name
          jwks: requestBody.jwks
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/federation_rules/{federation_rule_id}/archive?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Archive a federation rule
      effect: destructive
      questions:
      - How do I immediately stop token exchange through a workload identity rule?
      - Is archiving a federation rule idempotent?
      instructions:
      - text: Archive federation rule {federation_rule_id}.
        slots:
          federation_rule_id: path.federation_rule_id
      - text: Shut off token exchange through rule {federation_rule_id}.
        slots:
          federation_rule_id: path.federation_rule_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/federation_rules/{federation_rule_id}/workspaces/{workspace_id}?beta=true'].delete
  update:
    x-apievangelist-phrasing:
      intent: Disable a federation rule for a workspace
      effect: destructive
      questions:
      - Can I turn off a federation rule for just one workspace?
      - Does disabling a rule in a workspace fail if it was already removed?
      instructions:
      - text: Disable federation rule {federation_rule_id} in workspace {workspace_id}.
        slots:
          federation_rule_id: path.federation_rule_id
          workspace_id: path.workspace_id
      - text: Remove workspace {workspace_id} from the enablements of rule {federation_rule_id}.
        slots:
          workspace_id: path.workspace_id
          federation_rule_id: path.federation_rule_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/federation_rules/{federation_rule_id}/workspaces?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: List workspaces a federation rule is enabled in
      effect: read
      questions:
      - In which workspaces is a given federation rule enabled?
      - Does the workspace enablement list for a rule come back in one response?
      instructions:
      - text: List the workspaces where federation rule {federation_rule_id} is enabled.
        slots:
          federation_rule_id: path.federation_rule_id
      - text: Show workspace enablements for rule {federation_rule_id}.
        slots:
          federation_rule_id: path.federation_rule_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/federation_rules/{federation_rule_id}/workspaces?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Enable a federation rule in a workspace
      effect: write
      questions:
      - How do I extend an existing federation rule to another workspace?
      - What happens if I enable a rule in a workspace where it's already on?
      instructions:
      - text: Enable federation rule {federation_rule_id} for workspace {workspace_id}.
        slots:
          federation_rule_id: path.federation_rule_id
          workspace_id: requestBody.workspace_id
      - text: Add workspace {workspace_id} to rule {federation_rule_id}.
        slots:
          workspace_id: requestBody.workspace_id
          federation_rule_id: path.federation_rule_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/federation_rules/{federation_rule_id}?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: Retrieve a federation rule
      effect: read
      questions:
      - What does a specific workload identity federation rule match and which service account does it target?
      - Can I fetch a rule by its fdrl ID to review its OAuth scopes?
      instructions:
      - text: Show federation rule {federation_rule_id}.
        slots:
          federation_rule_id: path.federation_rule_id
      - text: Get the match conditions and target of rule {federation_rule_id}.
        slots:
          federation_rule_id: path.federation_rule_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/federation_rules/{federation_rule_id}?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Edit a federation rule
      effect: write
      questions:
      - Can I change which OAuth scopes a federation rule grants on minted tokens?
      - Is a rule's issuer immutable once it's created?
      - How do I shorten the lifetime of tokens minted through a rule?
      instructions:
      - text: Set the token lifetime of rule {federation_rule_id} to {token_lifetime_seconds} seconds.
        slots:
          federation_rule_id: path.federation_rule_id
          token_lifetime_seconds: requestBody.token_lifetime_seconds
      - text: Change the OAuth scopes on rule {federation_rule_id} to {oauth_scope}.
        slots:
          federation_rule_id: path.federation_rule_id
          oauth_scope: requestBody.oauth_scope
      - text: Replace the match conditions of rule {federation_rule_id} with {match}.
        slots:
          federation_rule_id: path.federation_rule_id
          match: requestBody.match
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/federation_rules?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: List federation rules
      effect: read
      questions:
      - Which workload identity federation rules are set up in my organization?
      - Can I see only the rules that reference one issuer?
      instructions:
      - text: List our federation rules.
      - text: List federation rules that use issuer {issuer_id}.
        slots:
          issuer_id: query.issuer_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/federation_rules?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Create a workload identity federation rule
      effect: write
      questions:
      - How do I map tokens from a trusted issuer to a service account?
      - Can one federation rule apply to every workspace, including future ones?
      instructions:
      - text: Create federation rule {name} on issuer {issuer_id} matching {match}, targeting {target} with scopes {oauth_scope}.
        slots:
          name: requestBody.name
          issuer_id: requestBody.issuer_id
          match: requestBody.match
          target: requestBody.target
          oauth_scope: requestBody.oauth_scope
      - text: 'Add a rule {name} for issuer {issuer_id} that applies to all workspaces: {applies_to_all_workspaces}, match {match}, target {target}, scopes {oauth_scope}.'
        slots:
          name: requestBody.name
          issuer_id: requestBody.issuer_id
          applies_to_all_workspaces: requestBody.applies_to_all_workspaces
          match: requestBody.match
          target: requestBody.target
          oauth_scope: requestBody.oauth_scope
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/invites/{invite_id}?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: Look up an organization invite
      effect: read
      questions:
      - Has the person I invited to my organization accepted yet?
      - What role was a particular invite issued with?
      instructions:
      - text: Show invite {invite_id}.
        slots:
          invite_id: path.invite_id
      - text: Check the status of organization invite {invite_id}.
        slots:
          invite_id: path.invite_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/invites/{invite_id}?beta=true'].delete
  update:
    x-apievangelist-phrasing:
      intent: Cancel a pending invite
      effect: destructive
      questions:
      - Can I take back an invitation before someone accepts it?
      - What happens to a pending invite I delete?
      instructions:
      - text: Delete pending invite {invite_id}.
        slots:
          invite_id: path.invite_id
      - text: Revoke the organization invitation {invite_id}.
        slots:
          invite_id: path.invite_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/invites?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: List organization invites
      effect: read
      questions:
      - Which invitations to my organization are still pending?
      - Can I find the invite sent to a particular email address?
      - Is it possible to filter invites by role or expired status?
      instructions:
      - text: List all invites for my organization.
      - text: Find invites sent to {email}.
        slots:
          email: query.email
      - text: List invites with status {statuses}.
        slots:
          statuses: query.statuses[]
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/invites?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Invite someone to the organization
      effect: write
      questions:
      - How do I invite a colleague to our Anthropic Console organization?
      - What happens when there are no free seats left for a new invite?
      instructions:
      - text: Invite {email} to the organization as {role}.
        slots:
          email: requestBody.email
          role: requestBody.role
      - text: Send an invite to {email} with role {role} and RBAC groups {rbac_group_ids}.
        slots:
          email: requestBody.email
          role: requestBody.role
          rbac_group_ids: requestBody.rbac_group_ids
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/me?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: Show which organization this key belongs to
      effect: read
      questions:
      - Which organization is my admin API key tied to?
      - What's the name and ID of the org I'm authenticated against?
      instructions:
      - text: Show the organization for my current API key.
      - text: Tell me which org I'm authenticated as.
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/rate_limits?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: List the organization's rate limits
      effect: read
      questions:
      - What are my organization's rate limits for a given model?
      - Can I see the limits on API-surface groups like Message Batches or the Files API?
      instructions:
      - text: List our organization's Messages API rate limits.
      - text: Show the org rate limits that apply to model {model}.
        slots:
          model: query.model
      - text: List organization rate limits for group type {group_type}.
        slots:
          group_type: query.group_type
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/service_accounts/{service_account_id}/archive?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Archive a service account
      effect: destructive
      questions:
      - How do I retire a service account used for workload identity?
      - Why is archiving a service account rejected while rules still target it?
      instructions:
      - text: Archive service account {service_account_id}.
        slots:
          service_account_id: path.service_account_id
      - text: Retire workload identity service account {service_account_id}.
        slots:
          service_account_id: path.service_account_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/service_accounts/{service_account_id}/workspaces/{workspace_id}?beta=true'].delete
  update:
    x-apievangelist-phrasing:
      intent: Remove a service account from a workspace, by account
      effect: destructive
      questions:
      - Starting from a service account, how do I take away its access to one workspace?
      - Can I drop a workspace from a service account's memberships?
      instructions:
      - text: Take workspace {workspace_id} away from service account {service_account_id}.
        slots:
          workspace_id: path.workspace_id
          service_account_id: path.service_account_id
      - text: Drop service account {service_account_id}'s membership in {workspace_id}.
        slots:
          service_account_id: path.service_account_id
          workspace_id: path.workspace_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/service_accounts/{service_account_id}/workspaces?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: List a service account's workspaces
      effect: read
      questions:
      - Which workspaces is a given service account a member of?
      - What role does a service account hold in each of its workspaces?
      instructions:
      - text: List the workspaces service account {service_account_id} belongs to.
        slots:
          service_account_id: path.service_account_id
      - text: Show every workspace role held by service account {service_account_id}.
        slots:
          service_account_id: path.service_account_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/service_accounts/{service_account_id}/workspaces?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Grant a service account a workspace, by account
      effect: write
      questions:
      - Starting from a service account, can I give it access to another workspace?
      - Which role should I pass when attaching a workspace to a service account?
      instructions:
      - text: Give service account {service_account_id} access to workspace {workspace_id} as {workspace_role}.
        slots:
          service_account_id: path.service_account_id
          workspace_id: requestBody.workspace_id
          workspace_role: requestBody.workspace_role
      - text: Attach workspace {workspace_id} to service account {service_account_id} with role {workspace_role}.
        slots:
          workspace_id: requestBody.workspace_id
          service_account_id: path.service_account_id
          workspace_role: requestBody.workspace_role
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/service_accounts/{service_account_id}?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: Retrieve a service account
      effect: read
      questions:
      - What's the org role and description of a particular service account?
      - Can I look up a service account by its svac ID?
      instructions:
      - text: Show service account {service_account_id}.
        slots:
          service_account_id: path.service_account_id
      - text: Get details for workload identity {service_account_id}.
        slots:
          service_account_id: path.service_account_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/service_accounts/{service_account_id}?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Change a service account's role or description
      effect: write
      questions:
      - Can I rename a service account, or only change its description and role?
      - How do I promote a service account to a different organization role?
      instructions:
      - text: Change the org role of service account {service_account_id} to {organization_role}.
        slots:
          service_account_id: path.service_account_id
          organization_role: requestBody.organization_role
      - text: Update the description of service account {service_account_id} to {description}.
        slots:
          service_account_id: path.service_account_id
          description: requestBody.description
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/service_accounts?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: List service accounts
      effect: read
      questions:
      - What service accounts exist in my organization?
      - Are archived service accounts hidden by default?
      instructions:
      - text: List our service accounts.
      - text: 'List service accounts, including archived ones: {include_archived}.'
        slots:
          include_archived: query.include_archived
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/service_accounts?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Create a service account
      effect: write
      questions:
      - How do I create a named workload identity for federation rules to target?
      - What organization role does a new service account get by default?
      instructions:
      - text: Create service account {name}.
        slots:
          name: requestBody.name
      - text: Create service account {name} with org role {organization_role} and description {description}.
        slots:
          name: requestBody.name
          organization_role: requestBody.organization_role
          description: requestBody.description
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/tunnels/{tunnel_id}/archive?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Archive a tunnel via the admin endpoint
      effect: destructive
      questions:
      - Can I still archive an MCP tunnel through the deprecated admin tunnels endpoint?
      - Is the organization-level tunnel archive call being retired?
      instructions:
      - text: Archive tunnel {tunnel_id} using the admin endpoint.
        slots:
          tunnel_id: path.tunnel_id
      - text: Shut down org tunnel {tunnel_id}.
        slots:
          tunnel_id: path.tunnel_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/tunnels/{tunnel_id}/certificates/{certificate_id}/archive?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Archive a tunnel CA certificate (admin)
      effect: destructive
      questions:
      - How do I stop trusting one CA certificate on a tunnel from the admin API?
      - Can I retire an old tunnel certificate without archiving the tunnel?
      instructions:
      - text: Archive certificate {certificate_id} on tunnel {tunnel_id}.
        slots:
          certificate_id: path.certificate_id
          tunnel_id: path.tunnel_id
      - text: Retire CA cert {certificate_id} from org tunnel {tunnel_id}.
        slots:
          certificate_id: path.certificate_id
          tunnel_id: path.tunnel_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/tunnels/{tunnel_id}/certificates/{certificate_id}?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: Retrieve a tunnel certificate (admin)
      effect: read
      questions:
      - Where can I see one CA certificate registered on a tunnel?
      - Is a particular tunnel certificate archived or still trusted?
      instructions:
      - text: Show certificate {certificate_id} on tunnel {tunnel_id}.
        slots:
          certificate_id: path.certificate_id
          tunnel_id: path.tunnel_id
      - text: Fetch tunnel {tunnel_id}'s CA certificate {certificate_id}.
        slots:
          tunnel_id: path.tunnel_id
          certificate_id: path.certificate_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/tunnels/{tunnel_id}/certificates?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: List a tunnel's certificates (admin)
      effect: read
      questions:
      - Which CA certificates are registered on one of my tunnels?
      - Can I include archived certificates when listing a tunnel's certs?
      instructions:
      - text: List the certificates on tunnel {tunnel_id}.
        slots:
          tunnel_id: path.tunnel_id
      - text: 'List all certificates on tunnel {tunnel_id}, archived included: {include_archived}.'
        slots:
          tunnel_id: path.tunnel_id
          include_archived: query.include_archived
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/tunnels/{tunnel_id}/certificates?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Register a CA certificate on a tunnel (admin)
      effect: write
      questions:
      - How do I upload a CA certificate so Anthropic trusts my tunnel gateway?
      - Can the PEM I register contain a private key?
      instructions:
      - text: Register CA certificate {ca_certificate_pem} on tunnel {tunnel_id}.
        slots:
          ca_certificate_pem: requestBody.ca_certificate_pem
          tunnel_id: path.tunnel_id
      - text: 'Add this PEM CA cert to org tunnel {tunnel_id}: {ca_certificate_pem}.'
        slots:
          tunnel_id: path.tunnel_id
          ca_certificate_pem: requestBody.ca_certificate_pem
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/tunnels/{tunnel_id}/reveal_token?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Reveal a tunnel's connector token (admin)
      effect: read
      questions:
      - How do I get the connector token for an existing tunnel?
      - Does revealing a tunnel token change it?
      instructions:
      - text: Reveal the connector token for tunnel {tunnel_id}.
        slots:
          tunnel_id: path.tunnel_id
      - text: Show me tunnel {tunnel_id}'s current token.
        slots:
          tunnel_id: path.tunnel_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/tunnels/{tunnel_id}/rotate_token?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Rotate a tunnel's connector token (admin)
      effect: destructive
      questions:
      - What should I do if a tunnel connector token was exposed?
      - Does rotating a tunnel token break new connections using the old one?
      instructions:
      - text: Rotate the connector token on tunnel {tunnel_id}.
        slots:
          tunnel_id: path.tunnel_id
      - text: Issue a fresh token for org tunnel {tunnel_id} and invalidate the old one.
        slots:
          tunnel_id: path.tunnel_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/tunnels/{tunnel_id}?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: Retrieve a tunnel (admin)
      effect: read
      questions:
      - What hostname and status does one of my MCP tunnels have?
      - Can I look up a single tunnel through the organization admin API?
      instructions:
      - text: Show tunnel {tunnel_id}.
        slots:
          tunnel_id: path.tunnel_id
      - text: Get details of org tunnel {tunnel_id}.
        slots:
          tunnel_id: path.tunnel_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/tunnels?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: List tunnels (admin)
      effect: read
      questions:
      - Which MCP tunnels exist across my organization?
      - Can I list only the tunnels in one workspace?
      instructions:
      - text: List all tunnels in the organization.
      - text: List tunnels in workspace {workspace_id}.
        slots:
          workspace_id: query.workspace_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/usage_report/claude_code?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: Get daily Claude Code usage metrics
      effect: read
      questions:
      - How much are our developers using Claude Code each day?
      - Can I pull per-user Claude Code metrics to build a productivity dashboard?
      instructions:
      - text: Get the Claude Code usage report for {starting_at}.
        slots:
          starting_at: query.starting_at
      - text: Show Claude Code activity by user on {starting_at}.
        slots:
          starting_at: query.starting_at
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/usage_report/messages?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: Get Messages API token usage
      effect: read
      questions:
      - How many tokens did we use on the Messages API last week?
      - Can I break usage down by model, API key or workspace?
      - Is it possible to see usage for only one service tier or inference geo?
      instructions:
      - text: Get Messages usage from {starting_at} to {ending_at}.
        slots:
          starting_at: query.starting_at
          ending_at: query.ending_at
      - text: Show token usage since {starting_at} for models {models}, grouped by {group_by}.
        slots:
          starting_at: query.starting_at
          models: query.models[]
          group_by: query.group_by[]
      - text: Report usage since {starting_at} for workspace {workspace_ids} in {bucket_width} buckets.
        slots:
          starting_at: query.starting_at
          workspace_ids: query.workspace_ids[]
          bucket_width: query.bucket_width
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/users/{user_id}?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: Look up an organization member
      effect: read
      questions:
      - What role does a specific person have in my organization?
      - Can I look up an org member's email by user ID?
      instructions:
      - text: Show organization member {user_id}.
        slots:
          user_id: path.user_id
      - text: Get the org role of user {user_id}.
        slots:
          user_id: path.user_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/users/{user_id}?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Change a member's organization role
      effect: write
      questions:
      - How do I make someone an admin of our organization?
      - Can I downgrade a member's organization role?
      instructions:
      - text: Change user {user_id}'s organization role to {role}.
        slots:
          user_id: path.user_id
          role: requestBody.role
      - text: Make member {user_id} a {role} in the org.
        slots:
          user_id: path.user_id
          role: requestBody.role
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/users/{user_id}?beta=true'].delete
  update:
    x-apievangelist-phrasing:
      intent: Remove a member from the organization
      effect: destructive
      questions:
      - How do I remove someone who left the company from our organization?
      - What happens when I kick a user out of the org?
      instructions:
      - text: Remove user {user_id} from the organization.
        slots:
          user_id: path.user_id
      - text: Offboard member {user_id} from our org.
        slots:
          user_id: path.user_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/users?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: List organization members
      effect: read
      questions:
      - Who are all the members of my organization?
      - Can I find a member by email or filter members by role?
      instructions:
      - text: List everyone in my organization.
      - text: Find the org member with email {email}.
        slots:
          email: query.email
      - text: List organization members with roles {roles}.
        slots:
          roles: query.roles[]
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/workspaces/{workspace_id}/archive?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Archive a workspace
      effect: destructive
      questions:
      - How do I archive a workspace we no longer use?
      - What does archiving a workspace do to its API keys?
      instructions:
      - text: Archive workspace {workspace_id}.
        slots:
          workspace_id: path.workspace_id
      - text: Retire the workspace {workspace_id}.
        slots:
          workspace_id: path.workspace_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/workspaces/{workspace_id}/members/{user_id}?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: Look up a user's workspace membership
      effect: read
      questions:
      - What role does a particular user have in one workspace?
      - Is a given person a member of a specific workspace?
      instructions:
      - text: Show user {user_id}'s membership in workspace {workspace_id}.
        slots:
          user_id: path.user_id
          workspace_id: path.workspace_id
      - text: Get the workspace role of {user_id} in {workspace_id}.
        slots:
          user_id: path.user_id
          workspace_id: path.workspace_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/workspaces/{workspace_id}/members/{user_id}?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Change a user's workspace role
      effect: write
      questions:
      - How do I give a user developer rights in a single workspace?
      - Can I change someone's workspace role without touching their org role?
      instructions:
      - text: Set user {user_id}'s role in workspace {workspace_id} to {workspace_role}.
        slots:
          user_id: path.user_id
          workspace_id: path.workspace_id
          workspace_role: requestBody.workspace_role
      - text: Promote {user_id} to {workspace_role} in workspace {workspace_id}.
        slots:
          user_id: path.user_id
          workspace_role: requestBody.workspace_role
          workspace_id: path.workspace_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/workspaces/{workspace_id}/members/{user_id}?beta=true'].delete
  update:
    x-apievangelist-phrasing:
      intent: Remove a user from a workspace
      effect: destructive
      questions:
      - How do I take a user out of one workspace but leave them in the org?
      - Can I revoke a person's access to a single workspace?
      instructions:
      - text: Remove user {user_id} from workspace {workspace_id}.
        slots:
          user_id: path.user_id
          workspace_id: path.workspace_id
      - text: Revoke {user_id}'s access to workspace {workspace_id}.
        slots:
          user_id: path.user_id
          workspace_id: path.workspace_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/workspaces/{workspace_id}/members?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: List a workspace's user members
      effect: read
      questions:
      - Which users have access to a given workspace?
      - Can I page through the people in a large workspace?
      instructions:
      - text: List the users in workspace {workspace_id}.
        slots:
          workspace_id: path.workspace_id
      - text: Show the first {limit} members of workspace {workspace_id}.
        slots:
          limit: query.limit
          workspace_id: path.workspace_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/workspaces/{workspace_id}/members?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Add a user to a workspace
      effect: write
      questions:
      - How do I add an existing org member to a workspace?
      - Which workspace role should a new member start with?
      instructions:
      - text: Add user {user_id} to workspace {workspace_id} as {workspace_role}.
        slots:
          user_id: requestBody.user_id
          workspace_id: path.workspace_id
          workspace_role: requestBody.workspace_role
      - text: Grant {user_id} a seat in workspace {workspace_id} with the {workspace_role} role.
        slots:
          user_id: requestBody.user_id
          workspace_role: requestBody.workspace_role
          workspace_id: path.workspace_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/workspaces/{workspace_id}/rate_limits?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: List a workspace's rate-limit overrides
      effect: read
      questions:
      - Does a particular workspace have custom rate limits that differ from the org?
      - Why don't all rate-limit groups show up for my workspace?
      instructions:
      - text: List the rate-limit overrides on workspace {workspace_id}.
        slots:
          workspace_id: path.workspace_id
      - text: Show workspace {workspace_id}'s overrides for group type {group_type}.
        slots:
          workspace_id: path.workspace_id
          group_type: query.group_type
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: Look up a service account's workspace membership
      effect: read
      questions:
      - From a workspace, what role does a specific service account have there?
      - Is a service account an explicit member of this workspace?
      instructions:
      - text: Show service account {service_account_id}'s membership record in workspace {workspace_id}.
        slots:
          service_account_id: path.service_account_id
          workspace_id: path.workspace_id
      - text: Get the role workspace {workspace_id} grants service account {service_account_id}.
        slots:
          workspace_id: path.workspace_id
          service_account_id: path.service_account_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Change a service account's workspace role
      effect: write
      questions:
      - How do I change the role a service account has inside a workspace?
      - Can I update an implicit service account membership?
      instructions:
      - text: Change service account {service_account_id}'s role in workspace {workspace_id} to {workspace_role}.
        slots:
          service_account_id: path.service_account_id
          workspace_id: path.workspace_id
          workspace_role: requestBody.workspace_role
      - text: In workspace {workspace_id}, set service account {service_account_id} to {workspace_role}.
        slots:
          workspace_id: path.workspace_id
          service_account_id: path.service_account_id
          workspace_role: requestBody.workspace_role
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}?beta=true'].delete
  update:
    x-apievangelist-phrasing:
      intent: Remove a service account from a workspace
      effect: destructive
      questions:
      - From the workspace side, how do I remove a service account member?
      - Does removing a service account from a workspace succeed if it's already gone?
      instructions:
      - text: Remove service account {service_account_id} from workspace {workspace_id}'s members.
        slots:
          service_account_id: path.service_account_id
          workspace_id: path.workspace_id
      - text: Kick service account {service_account_id} out of workspace {workspace_id}.
        slots:
          service_account_id: path.service_account_id
          workspace_id: path.workspace_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/workspaces/{workspace_id}/service_accounts?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: List a workspace's service account members
      effect: read
      questions:
      - Which service accounts are members of a given workspace?
      - What roles do the machine identities in this workspace hold?
      instructions:
      - text: List the service accounts in workspace {workspace_id}.
        slots:
          workspace_id: path.workspace_id
      - text: Show machine identities with access to workspace {workspace_id}.
        slots:
          workspace_id: path.workspace_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/workspaces/{workspace_id}/service_accounts?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Add a service account to a workspace
      effect: write
      questions:
      - From a workspace, how do I add a service account as a member?
      - Which role decides what a service account can do inside a workspace?
      instructions:
      - text: Add service account {service_account_id} to workspace {workspace_id} with role {workspace_role}.
        slots:
          service_account_id: requestBody.service_account_id
          workspace_id: path.workspace_id
          workspace_role: requestBody.workspace_role
      - text: Make {service_account_id} a {workspace_role} member of workspace {workspace_id}.
        slots:
          service_account_id: requestBody.service_account_id
          workspace_role: requestBody.workspace_role
          workspace_id: path.workspace_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/workspaces/{workspace_id}?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: Retrieve a workspace
      effect: read
      questions:
      - What are the settings of one of my workspaces, like its data residency?
      - Is a particular workspace archived?
      instructions:
      - text: Show workspace {workspace_id}.
        slots:
          workspace_id: path.workspace_id
      - text: Get the settings of workspace {workspace_id}.
        slots:
          workspace_id: path.workspace_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/workspaces/{workspace_id}?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Update a workspace's settings
      effect: write
      questions:
      - Can I rename a workspace or change its Console color?
      - How do I switch a workspace to a customer-managed encryption key?
      instructions:
      - text: Rename workspace {workspace_id} to {name}.
        slots:
          workspace_id: path.workspace_id
          name: requestBody.name
      - text: Encrypt workspace {workspace_id} with external key {external_key_id}.
        slots:
          workspace_id: path.workspace_id
          external_key_id: requestBody.external_key_id
      - text: Set tags {tags} on workspace {workspace_id}.
        slots:
          tags: requestBody.tags
          workspace_id: path.workspace_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/workspaces?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: List workspaces
      effect: read
      questions:
      - Which workspaces does my organization have?
      - Can I include archived workspaces in the list?
      instructions:
      - text: List our workspaces.
      - text: 'List workspaces, including archived: {include_archived}.'
        slots:
          include_archived: query.include_archived
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/workspaces?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Create a workspace
      effect: write
      questions:
      - How do I create a new workspace to separate a team's API usage?
      - What data residency does a new workspace get if I don't specify one?
      instructions:
      - text: Create a workspace called {name}.
        slots:
          name: requestBody.name
      - text: Create workspace {name} with data residency {data_residency}.
        slots:
          name: requestBody.name
          data_residency: requestBody.data_residency
      method: generated
      generated: '2026-09-26'