API Evangelist conversational phrasing for Anthropic Organizations API

# Generated by API Evangelist (build-phrasing.py). Our phrasing, not observed demand.
overlay: 1.0.0
info:
  title: API Evangelist conversational phrasing for Anthropic Organizations API
  version: 1.0.0
extends: openapi/anthropic-organizations-api-openapi.yml
actions:
- target: $.info
  update:
    x-apievangelist-phrasing:
      method: generated
      generated: '2026-09-26'
      generator: build-phrasing.py
      label: Generated by API Evangelist
      operations: 68
- target: $.paths['/v1/organizations/api_keys/{api_key_id}?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: Look up an API key's details
      effect: read
      questions:
      - What can I see about one of my organization's API keys, like its name and status?
      - Is there a way to check whether a specific Claude API key is still active?
      instructions:
      - text: Show me the details of API key {api_key_id}.
        slots:
          api_key_id: path.api_key_id
      - text: Check the status of API key {api_key_id}.
        slots:
          api_key_id: path.api_key_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/api_keys/{api_key_id}?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Rename or deactivate an API key
      effect: write
      questions:
      - Can I rename an existing API key without rotating it?
      - How do I disable an API key that leaked but keep its record?
      instructions:
      - text: Rename API key {api_key_id} to {name}.
        slots:
          api_key_id: path.api_key_id
          name: requestBody.name
      - text: Set the status of API key {api_key_id} to {status}.
        slots:
          api_key_id: path.api_key_id
          status: requestBody.status
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/api_keys?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: List the organization's API keys
      effect: read
      questions:
      - Which API keys exist across my Anthropic organization?
      - Can I see only the API keys that belong to one workspace?
      - Who created each of our API keys?
      instructions:
      - text: List all API keys in my organization.
      - text: List the API keys in workspace {workspace_id}.
        slots:
          workspace_id: query.workspace_id
      - text: List API keys created by user {created_by_user_id} with status {status}.
        slots:
          created_by_user_id: query.created_by_user_id
          status: query.status
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/cost_report?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: Get the organization's cost report
      effect: read
      questions:
      - How much has my organization spent on the API since the start of the month?
      - Can I break down our spend by workspace or description in daily buckets?
      instructions:
      - text: Get our cost report starting {starting_at}.
        slots:
          starting_at: query.starting_at
      - text: Show spending from {starting_at} to {ending_at} grouped by {group_by}.
        slots:
          starting_at: query.starting_at
          ending_at: query.ending_at
          group_by: query.group_by[]
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/external_keys/{external_key_id}/validate?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Test an external KMS key config
      effect: write
      questions:
      - How can I confirm that Anthropic can actually encrypt and decrypt with my KMS key?
      - What happens if the KMS roundtrip check times out?
      instructions:
      - text: Validate external key config {external_key_id} against our KMS.
        slots:
          external_key_id: path.external_key_id
      - text: Run an encrypt/decrypt roundtrip test on external key {external_key_id}.
        slots:
          external_key_id: path.external_key_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/external_keys/{external_key_id}?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: Retrieve an external key config
      effect: read
      questions:
      - Where can I see the settings of a customer-managed encryption key config?
      - Which geo and KMS provider does one of my external key configs use?
      instructions:
      - text: Show external key config {external_key_id}.
        slots:
          external_key_id: path.external_key_id
      - text: Fetch the KMS provider details for external key {external_key_id}.
        slots:
          external_key_id: path.external_key_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/external_keys/{external_key_id}?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Edit an external key config
      effect: write
      questions:
      - Can I change the KMS provider config after a workspace already uses the key?
      - Is the display name of an external key config always editable?
      instructions:
      - text: Rename external key config {external_key_id} to {display_name}.
        slots:
          external_key_id: path.external_key_id
          display_name: requestBody.display_name
      - text: Replace the KMS provider config on external key {external_key_id} with {provider_config}.
        slots:
          external_key_id: path.external_key_id
          provider_config: requestBody.provider_config
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/external_keys/{external_key_id}?beta=true'].delete
  update:
    x-apievangelist-phrasing:
      intent: Delete an external key config
      effect: destructive
      questions:
      - Why would deleting an external key config be rejected?
      - Can I remove a customer-managed key config nobody references anymore?
      instructions:
      - text: Delete external key config {external_key_id}.
        slots:
          external_key_id: path.external_key_id
      - text: Remove the unused CMEK config {external_key_id} from our organization.
        slots:
          external_key_id: path.external_key_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/external_keys?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: List external key configs
      effect: read
      questions:
      - What customer-managed encryption key configs does my organization have?
      - Are external key configs returned newest first?
      instructions:
      - text: List our external key configs.
      - text: Show the first {limit} CMEK configs in the organization.
        slots:
          limit: query.limit
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/external_keys?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Register a customer-managed KMS key
      effect: write
      questions:
      - How do I bring my own KMS key to encrypt Anthropic workspace data?
      - Which data residency geo can an external key config use?
      instructions:
      - text: Create an external key config with provider config {provider_config}.
        slots:
          provider_config: requestBody.provider_config
      - text: Register KMS key {provider_config} as external key {display_name} in geo {geo}.
        slots:
          provider_config: requestBody.provider_config
          display_name: requestBody.display_name
          geo: requestBody.geo
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/federation_issuers/{federation_issuer_id}/archive?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Archive a federation issuer
      effect: destructive
      questions:
      - How do I stop trusting an OIDC issuer for workload identity federation?
      - Why can't I archive an issuer that live federation rules still reference?
      instructions:
      - text: Archive federation issuer {federation_issuer_id}.
        slots:
          federation_issuer_id: path.federation_issuer_id
      - text: Stop trusting OIDC issuer {federation_issuer_id} for workload identity.
        slots:
          federation_issuer_id: path.federation_issuer_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/federation_issuers/{federation_issuer_id}?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: Retrieve a federation issuer
      effect: read
      questions:
      - What issuer URL and JWKS settings does one of my trusted OIDC issuers have?
      - Can I look up a single federation issuer by its fdis ID?
      instructions:
      - text: Show federation issuer {federation_issuer_id}.
        slots:
          federation_issuer_id: path.federation_issuer_id
      - text: Get the JWKS and issuer URL configured on {federation_issuer_id}.
        slots:
          federation_issuer_id: path.federation_issuer_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/federation_issuers/{federation_issuer_id}?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Edit a federation issuer
      effect: write
      questions:
      - How do I re-enable JWKS polling after it was paused for an issuer?
      - Can I shorten the maximum JWT lifetime accepted from an existing issuer?
      instructions:
      - text: Change the max JWT lifetime of issuer {federation_issuer_id} to {max_jwt_lifetime_seconds} seconds.
        slots:
          federation_issuer_id: path.federation_issuer_id
          max_jwt_lifetime_seconds: requestBody.max_jwt_lifetime_seconds
      - text: Update the issuer URL of {federation_issuer_id} to {issuer_url}.
        slots:
          federation_issuer_id: path.federation_issuer_id
          issuer_url: requestBody.issuer_url
      - text: Turn JTI replay protection {check_jti} on issuer {federation_issuer_id}.
        slots:
          check_jti: requestBody.check_jti
          federation_issuer_id: path.federation_issuer_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/federation_issuers?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: List federation issuers
      effect: read
      questions:
      - Which OIDC issuers does my organization trust for workload identity federation?
      - Can I include archived federation issuers when listing them?
      instructions:
      - text: List our federation issuers.
      - text: 'List federation issuers including archived ones: {include_archived}.'
        slots:
          include_archived: query.include_archived
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/federation_issuers?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Register an OIDC federation issuer
      effect: write
      questions:
      - How do I let my CI system's OIDC tokens authenticate to the Claude API without keys?
      - What is the default max JWT lifetime for a new trusted issuer?
      instructions:
      - text: Register OIDC issuer {issuer_url} as federation issuer {name}.
        slots:
          issuer_url: requestBody.issuer_url
          name: requestBody.name
      - text: Trust issuer {issuer_url} named {name} with JWKS config {jwks}.
        slots:
          issuer_url: requestBody.issuer_url
          name: requestBody.name
          jwks: requestBody.jwks
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/federation_rules/{federation_rule_id}/archive?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Archive a federation rule
      effect: destructive
      questions:
      - How do I immediately stop token exchange through a workload identity rule?
      - Is archiving a federation rule idempotent?
      instructions:
      - text: Archive federation rule {federation_rule_id}.
        slots:
          federation_rule_id: path.federation_rule_id
      - text: Shut off token exchange through rule {federation_rule_id}.
        slots:
          federation_rule_id: path.federation_rule_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/federation_rules/{federation_rule_id}/workspaces/{workspace_id}?beta=true'].delete
  update:
    x-apievangelist-phrasing:
      intent: Disable a federation rule for a workspace
      effect: destructive
      questions:
      - Can I turn off a federation rule for just one workspace?
      - Does disabling a rule in a workspace fail if it was already removed?
      instructions:
      - text: Disable federation rule {federation_rule_id} in workspace {workspace_id}.
        slots:
          federation_rule_id: path.federation_rule_id
          workspace_id: path.workspace_id
      - text: Remove workspace {workspace_id} from the enablements of rule {federation_rule_id}.
        slots:
          workspace_id: path.workspace_id
          federation_rule_id: path.federation_rule_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/federation_rules/{federation_rule_id}/workspaces?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: List workspaces a federation rule is enabled in
      effect: read
      questions:
      - In which workspaces is a given federation rule enabled?
      - Does the workspace enablement list for a rule come back in one response?
      instructions:
      - text: List the workspaces where federation rule {federation_rule_id} is enabled.
        slots:
          federation_rule_id: path.federation_rule_id
      - text: Show workspace enablements for rule {federation_rule_id}.
        slots:
          federation_rule_id: path.federation_rule_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/federation_rules/{federation_rule_id}/workspaces?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Enable a federation rule in a workspace
      effect: write
      questions:
      - How do I extend an existing federation rule to another workspace?
      - What happens if I enable a rule in a workspace where it's already on?
      instructions:
      - text: Enable federation rule {federation_rule_id} for workspace {workspace_id}.
        slots:
          federation_rule_id: path.federation_rule_id
          workspace_id: requestBody.workspace_id
      - text: Add workspace {workspace_id} to rule {federation_rule_id}.
        slots:
          workspace_id: requestBody.workspace_id
          federation_rule_id: path.federation_rule_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/federation_rules/{federation_rule_id}?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: Retrieve a federation rule
      effect: read
      questions:
      - What does a specific workload identity federation rule match and which service account does it target?
      - Can I fetch a rule by its fdrl ID to review its OAuth scopes?
      instructions:
      - text: Show federation rule {federation_rule_id}.
        slots:
          federation_rule_id: path.federation_rule_id
      - text: Get the match conditions and target of rule {federation_rule_id}.
        slots:
          federation_rule_id: path.federation_rule_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/federation_rules/{federation_rule_id}?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Edit a federation rule
      effect: write
      questions:
      - Can I change which OAuth scopes a federation rule grants on minted tokens?
      - Is a rule's issuer immutable once it's created?
      - How do I shorten the lifetime of tokens minted through a rule?
      instructions:
      - text: Set the token lifetime of rule {federation_rule_id} to {token_lifetime_seconds} seconds.
        slots:
          federation_rule_id: path.federation_rule_id
          token_lifetime_seconds: requestBody.token_lifetime_seconds
      - text: Change the OAuth scopes on rule {federation_rule_id} to {oauth_scope}.
        slots:
          federation_rule_id: path.federation_rule_id
          oauth_scope: requestBody.oauth_scope
      - text: Replace the match conditions of rule {federation_rule_id} with {match}.
        slots:
          federation_rule_id: path.federation_rule_id
          match: requestBody.match
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/federation_rules?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: List federation rules
      effect: read
      questions:
      - Which workload identity federation rules are set up in my organization?
      - Can I see only the rules that reference one issuer?
      instructions:
      - text: List our federation rules.
      - text: List federation rules that use issuer {issuer_id}.
        slots:
          issuer_id: query.issuer_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/federation_rules?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Create a workload identity federation rule
      effect: write
      questions:
      - How do I map tokens from a trusted issuer to a service account?
      - Can one federation rule apply to every workspace, including future ones?
      instructions:
      - text: Create federation rule {name} on issuer {issuer_id} matching {match}, targeting {target} with scopes {oauth_scope}.
        slots:
          name: requestBody.name
          issuer_id: requestBody.issuer_id
          match: requestBody.match
          target: requestBody.target
          oauth_scope: requestBody.oauth_scope
      - text: 'Add a rule {name} for issuer {issuer_id} that applies to all workspaces: {applies_to_all_workspaces}, match {match}, target {target}, scopes {oauth_scope}.'
        slots:
          name: requestBody.name
          issuer_id: requestBody.issuer_id
          applies_to_all_workspaces: requestBody.applies_to_all_workspaces
          match: requestBody.match
          target: requestBody.target
          oauth_scope: requestBody.oauth_scope
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/invites/{invite_id}?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: Look up an organization invite
      effect: read
      questions:
      - Has the person I invited to my organization accepted yet?
      - What role was a particular invite issued with?
      instructions:
      - text: Show invite {invite_id}.
        slots:
          invite_id: path.invite_id
      - text: Check the status of organization invite {invite_id}.
        slots:
          invite_id: path.invite_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/invites/{invite_id}?beta=true'].delete
  update:
    x-apievangelist-phrasing:
      intent: Cancel a pending invite
      effect: destructive
      questions:
      - Can I take back an invitation before someone accepts it?
      - What happens to a pending invite I delete?
      instructions:
      - text: Delete pending invite {invite_id}.
        slots:
          invite_id: path.invite_id
      - text: Revoke the organization invitation {invite_id}.
        slots:
          invite_id: path.invite_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/invites?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: List organization invites
      effect: read
      questions:
      - Which invitations to my organization are still pending?
      - Can I find the invite sent to a particular email address?
      - Is it possible to filter invites by role or expired status?
      instructions:
      - text: List all invites for my organization.
      - text: Find invites sent to {email}.
        slots:
          email: query.email
      - text: List invites with status {statuses}.
        slots:
          statuses: query.statuses[]
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/invites?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Invite someone to the organization
      effect: write
      questions:
      - How do I invite a colleague to our Anthropic Console organization?
      - What happens when there are no free seats left for a new invite?
      instructions:
      - text: Invite {email} to the organization as {role}.
        slots:
          email: requestBody.email
          role: requestBody.role
      - text: Send an invite to {email} with role {role} and RBAC groups {rbac_group_ids}.
        slots:
          email: requestBody.email
          role: requestBody.role
          rbac_group_ids: requestBody.rbac_group_ids
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/me?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: Show which organization this key belongs to
      effect: read
      questions:
      - Which organization is my admin API key tied to?
      - What's the name and ID of the org I'm authenticated against?
      instructions:
      - text: Show the organization for my current API key.
      - text: Tell me which org I'm authenticated as.
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/rate_limits?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: List the organization's rate limits
      effect: read
      questions:
      - What are my organization's rate limits for a given model?
      - Can I see the limits on API-surface groups like Message Batches or the Files API?
      instructions:
      - text: List our organization's Messages API rate limits.
      - text: Show the org rate limits that apply to model {model}.
        slots:
          model: query.model
      - text: List organization rate limits for group type {group_type}.
        slots:
          group_type: query.group_type
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/service_accounts/{service_account_id}/archive?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Archive a service account
      effect: destructive
      questions:
      - How do I retire a service account used for workload identity?
      - Why is archiving a service account rejected while rules still target it?
      instructions:
      - text: Archive service account {service_account_id}.
        slots:
          service_account_id: path.service_account_id
      - text: Retire workload identity service account {service_account_id}.
        slots:
          service_account_id: path.service_account_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/service_accounts/{service_account_id}/workspaces/{workspace_id}?beta=true'].delete
  update:
    x-apievangelist-phrasing:
      intent: Remove a service account from a workspace, by account
      effect: destructive
      questions:
      - Starting from a service account, how do I take away its access to one workspace?
      - Can I drop a workspace from a service account's memberships?
      instructions:
      - text: Take workspace {workspace_id} away from service account {service_account_id}.
        slots:
          workspace_id: path.workspace_id
          service_account_id: path.service_account_id
      - text: Drop service account {service_account_id}'s membership in {workspace_id}.
        slots:
          service_account_id: path.service_account_id
          workspace_id: path.workspace_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/service_accounts/{service_account_id}/workspaces?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: List a service account's workspaces
      effect: read
      questions:
      - Which workspaces is a given service account a member of?
      - What role does a service account hold in each of its workspaces?
      instructions:
      - text: List the workspaces service account {service_account_id} belongs to.
        slots:
          service_account_id: path.service_account_id
      - text: Show every workspace role held by service account {service_account_id}.
        slots:
          service_account_id: path.service_account_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/service_accounts/{service_account_id}/workspaces?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Grant a service account a workspace, by account
      effect: write
      questions:
      - Starting from a service account, can I give it access to another workspace?
      - Which role should I pass when attaching a workspace to a service account?
      instructions:
      - text: Give service account {service_account_id} access to workspace {workspace_id} as {workspace_role}.
        slots:
          service_account_id: path.service_account_id
          workspace_id: requestBody.workspace_id
          workspace_role: requestBody.workspace_role
      - text: Attach workspace {workspace_id} to service account {service_account_id} with role {workspace_role}.
        slots:
          workspace_id: requestBody.workspace_id
          service_account_id: path.service_account_id
          workspace_role: requestBody.workspace_role
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/service_accounts/{service_account_id}?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: Retrieve a service account
      effect: read
      questions:
      - What's the org role and description of a particular service account?
      - Can I look up a service account by its svac ID?
      instructions:
      - text: Show service account {service_account_id}.
        slots:
          service_account_id: path.service_account_id
      - text: Get details for workload identity {service_account_id}.
        slots:
          service_account_id: path.service_account_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/service_accounts/{service_account_id}?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Change a service account's role or description
      effect: write
      questions:
      - Can I rename a service account, or only change its description and role?
      - How do I promote a service account to a different organization role?
      instructions:
      - text: Change the org role of service account {service_account_id} to {organization_role}.
        slots:
          service_account_id: path.service_account_id
          organization_role: requestBody.organization_role
      - text: Update the description of service account {service_account_id} to {description}.
        slots:
          service_account_id: path.service_account_id
          description: requestBody.description
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/service_accounts?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: List service accounts
      effect: read
      questions:
      - What service accounts exist in my organization?
      - Are archived service accounts hidden by default?
      instructions:
      - text: List our service accounts.
      - text: 'List service accounts, including archived ones: {include_archived}.'
        slots:
          include_archived: query.include_archived
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/service_accounts?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Create a service account
      effect: write
      questions:
      - How do I create a named workload identity for federation rules to target?
      - What organization role does a new service account get by default?
      instructions:
      - text: Create service account {name}.
        slots:
          name: requestBody.name
      - text: Create service account {name} with org role {organization_role} and description {description}.
        slots:
          name: requestBody.name
          organization_role: requestBody.organization_role
          description: requestBody.description
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/tunnels/{tunnel_id}/archive?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Archive a tunnel via the admin endpoint
      effect: destructive
      questions:
      - Can I still archive an MCP tunnel through the deprecated admin tunnels endpoint?
      - Is the organization-level tunnel archive call being retired?
      instructions:
      - text: Archive tunnel {tunnel_id} using the admin endpoint.
        slots:
          tunnel_id: path.tunnel_id
      - text: Shut down org tunnel {tunnel_id}.
        slots:
          tunnel_id: path.tunnel_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/tunnels/{tunnel_id}/certificates/{certificate_id}/archive?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Archive a tunnel CA certificate (admin)
      effect: destructive
      questions:
      - How do I stop trusting one CA certificate on a tunnel from the admin API?
      - Can I retire an old tunnel certificate without archiving the tunnel?
      instructions:
      - text: Archive certificate {certificate_id} on tunnel {tunnel_id}.
        slots:
          certificate_id: path.certificate_id
          tunnel_id: path.tunnel_id
      - text: Retire CA cert {certificate_id} from org tunnel {tunnel_id}.
        slots:
          certificate_id: path.certificate_id
          tunnel_id: path.tunnel_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/tunnels/{tunnel_id}/certificates/{certificate_id}?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: Retrieve a tunnel certificate (admin)
      effect: read
      questions:
      - Where can I see one CA certificate registered on a tunnel?
      - Is a particular tunnel certificate archived or still trusted?
      instructions:
      - text: Show certificate {certificate_id} on tunnel {tunnel_id}.
        slots:
          certificate_id: path.certificate_id
          tunnel_id: path.tunnel_id
      - text: Fetch tunnel {tunnel_id}'s CA certificate {certificate_id}.
        slots:
          tunnel_id: path.tunnel_id
          certificate_id: path.certificate_id
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/tunnels/{tunnel_id}/certificates?beta=true'].get
  update:
    x-apievangelist-phrasing:
      intent: List a tunnel's certificates (admin)
      effect: read
      questions:
      - Which CA certificates are registered on one of my tunnels?
      - Can I include archived certificates when listing a tunnel's certs?
      instructions:
      - text: List the certificates on tunnel {tunnel_id}.
        slots:
          tunnel_id: path.tunnel_id
      - text: 'List all certificates on tunnel {tunnel_id}, archived included: {include_archived}.'
        slots:
          tunnel_id: path.tunnel_id
          include_archived: query.include_archived
      method: generated
      generated: '2026-09-26'
- target: $.paths['/v1/organizations/tunnels/{tunnel_id}/certificates?beta=true'].post
  update:
    x-apievangelist-phrasing:
      intent: Register a CA certificate on a tunnel (admin)
      effect: write
      questions:
      - How do I upload a CA certificate so Anthropic trusts my tunnel gateway?
      - Can the PEM I register contain a private key?
      instructions:
      - text: Register CA certificate {ca_certificate_pem} on tunnel {tunnel_id}.
        slots:
          ca_certificate_pem: requestBody.ca_certificate_pem
          tunnel_id: path.tunnel_id
      - text: 'Add this PEM CA cert to org tunnel {tunnel_id}: {ca_certificate_pem}.'
        slots:
          tunnel_id: path.tunnel_id
          ca_certificate_pem: requestBody.ca_certificate_pem
      method: generated
      generated: '2026-09-26'


# --- truncated at 32 KB (50 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/anthropic/refs/heads/main/overlays/anthropic-organizations-api-phrasing-overlay.yaml