Anthropic/admin

Manage the people in a Claude Enterprise organization through the Admin API user-management endpoints: read members, custom roles, and RBAC groups with their attached roles and members, add members to a group, and switch members between the User and Custom (managed) organization roles.

Authentication

Requires an Admin API key created by the primary owner in claude.ai → Organization settings → API, for all linked organizations, with the scopes read:members, write:members, read:rbac_groups, and write:rbac_groups. Store it in a swamp vault.

Usage

swamp extension pull @webframp/anthropic/admin
swamp vault create local_encryption anthropic   # once, if you have no vault yet
swamp vault put anthropic ADMIN_KEY             # prompts; never pass the value
swamp model create @webframp/anthropic/admin claude-admin \
  --global-arg 'adminKey=${{ vault.get("anthropic", "ADMIN_KEY") }}'

# Observe (read-only)
swamp model method run claude-admin sync_access

# Put every User and Custom member in a group (dry run by default)
swamp model method run claude-admin add_group_members \
  --input groupId=rbac_group_... --input expectRoleId=rbac_role_... \
  --input 'roles:json=["user","managed"]'

# Switch User members to Custom, only those already in the group
# (dry run by default; add --input dryRun=false to apply)
swamp model method run claude-admin set_member_roles \
  --input role=managed --input requireGroupId=rbac_group_... \
  --input expectRoleId=rbac_role_... --input 'fromRoles:json=["user"]'

Methods

• sync_members — read the member roster with organization roles
• sync_access — fan-out read: members, custom roles, and groups with their roles and members
• add_group_members — add members (by role or user ID) to a direct group; dry run by default
• set_member_roles — set user or managed (by current role or user ID); managed requires coverage (requireGroupId + expectRoleId, or requireRoleId for any group carrying the role); records previous roles for rollback; dry run by default

Only user and managed members are ever targeted: the API cannot modify owner, primary_owner, or membership_admin. Every write run adds a version to its audit record.

2026.10.21.1

Fixed: set_member_roles could change one more member after a cancel. When the cancel arrived while the run was re-reading the covering group and that read still completed, the next member was written before the run stopped. The run now checks for cancellation right after each re-read, so the record's changed list ends at the last write made before the cancel.

Changed: The README, the registry description, and the adminKey global argument description no longer print a token-shaped key prefix. The argument description now says to supply the key as ${{ vault.get("anthropic", "ADMIN_KEY") }}. The README and the registry Quick Start now create the vault if needed and store the key with the interactive swamp vault put anthropic ADMIN_KEY prompt before creating the model.

Upgrade note: No schema changes. The model version moves to 2026.10.21.1 with an identity upgrade.