Anthropic Wires Its Admin API Into Every Official SDK and CLI

Anthropic just wired its Admin API into the official SDKs and the ant command-line tool. Instead of hand-rolling curl requests against api.anthropic.com/v1/organizations, you can call the same organization management endpoints from the same client library you already use for Messages.

The Python, TypeScript, C#, Go, Java, PHP, and Ruby SDKs expose the Admin API under client.beta.organization, and the CLI under ant beta:organization. That covers the full surface area for programmatic org management: members, invites, workspaces, workspace members, and API keys, plus service accounts and federation primitives for workload identity.

What you can actually script

The endpoints map to the everyday admin chores that usually live in a browser tab: onboarding and offboarding, workspace access, key audits. From any SDK you can now:

• List, update the role of, or remove organization members
• Create, list, and delete pending invites
• Add or remove workspace members and change their workspace role
• List, rename, or deactivate API keys (you still cannot mint new ones through the API)
• Read your org's configured rate limits, usage, and cost reports

A minimal Python example looks like any other Anthropic SDK call:

import anthropic
client = anthropic.Anthropic()
users = client.beta.organization.users.list(limit=10)
for user in users:
    print(f"{user.id}: {user.email} ({user.role})")

SDK list methods in Python, TypeScript, C#, Go, and Java return an iterator that fetches more pages on demand, so limit sets the page size, not the total. PHP, Ruby, and curl still hand you one page at a time.

Two credentials, two capability sets

Which credential you pick determines what you can do. An Admin API key (starting with sk-ant-admin...) goes in the x-api-key header, and only organization members with the admin role can provision one. The alternative is an OAuth bearer token with the org:admin scope, which you mint through the CLI:

ant auth login --profile admin --scope "org:admin"
export ANTHROPIC_AUTH_TOKEN=$(ant auth print-credentials --profile admin --access-token)

A handful of endpoints accept only the OAuth token: service accounts, federation issuers, and federation rules. Those are the pieces you need if you are wiring up Workload Identity Federation so CI jobs can authenticate without a long-lived key.

Roles, limits, and the gotchas

Anthropic exposes five org-level roles (user, claude_code_user, developer, billing, and admin), with owners and primary owners layered on top. A few things you cannot do through the API are worth flagging up front:

• New API keys can only be created through the Claude Console, for security reasons. The Admin API can only manage existing keys.
• Members with the admin role cannot be removed via the API.
• Organization invites expire after 21 days.
• Each organization is capped at 100 workspaces. Archived workspaces do not count toward the limit.

AWS users face an extra constraint. Only the workspace endpoints (create, get, list, update, and archive on /v1/organizations/workspaces) are available on Claude Platform on AWS. Member management, invites, and reports do not cross that boundary.

Why bother

The Admin API itself is not new, but using it from a typed SDK previously meant raw HTTP or an unofficial wrapper. Folding it into client.beta.organization means the same retry logic, pagination, and error types you rely on for inference now cover org plumbing. If you already run scripts to reconcile Okta groups with SaaS tools, adding Anthropic to that pipeline takes a few lines rather than a bespoke HTTP client.

There is no separate pricing for the Admin API; it uses your existing organization credentials, and the endpoints are live across every listed SDK and the ant CLI. If you have ever clicked through the Console to deactivate a departing engineer's key, this is the update that lets you delete that runbook.