Skip to content

Claude API user profiles scope safety bans to one customer, not your org

Anthropic lets platforms and resellers tag each API request with an end customer, so a trust and safety action lands on that customer alone instead of the whole account.

Source: Claude Platform release notes

Anthropic launched user profiles for the Claude API on 20 October. If you run a platform, gateway or resell API access, you can now tell Anthropic which of your end customers each request belongs to, using new /v1/user_profiles endpoints supported by the SDK and the ant CLI.

The point is containment. Until now, a safety enforcement action, a restriction or ban triggered by one customer’s misuse, applied to your whole organisation’s API access. With user profiles in place, that action can instead apply to the single end customer who caused it. Anthropic also added organisation webhooks to the Admin API, in beta behind the webhooks-2026-10-07 header, firing when a user profile is restricted or banned and when that restriction ends. Access needs a request to your Anthropic account team.

POST /v1/user_profiles

Why it matters: anyone building multi-tenant software on top of Claude, a SaaS product, an AI gateway, a reseller, has been exposed to one bad customer taking down the whole integration. Tagging requests by end customer turns that into a per-customer risk instead of an existential one, and the webhooks mean you can find out and react automatically rather than discovering it when all your traffic starts failing.

The caveat: the webhook piece is still beta and gated behind contacting your account team, so it is not yet a self-serve switch.

Share

Related reading

ML for Web Devs

Tokens, context windows, and why your bill is what it is

The unit of billing for language models is not the request or the word. Once you understand tokens and how a context window fills up, the invoice stops being a surprise.

ML for Web Devs

RAG is just search with extra steps

Retrieval-augmented generation gets written up like an architecture. It is a search query, a string concatenation and one API call, and the search query is the part that decides whether it works.

ML for Web Devs

A prompt is a spec, so write it like one

Prompt engineering has very little to do with magic words. It is the same skill as writing a clear ticket for a capable contractor who will not ask you any questions.

More from The Wire

All briefs