When many customers share an API organization, the provider needs a reliable way to tell whose request it is handling. Build that attribution into the request path.
What launched on October 20
Anthropic’s release notes introduce user profiles for end-customer attribution. The documentation explains how a safety action can apply to one customer profile instead of the whole organization.
Create a profile once, store its returned identifier, and send it in the anthropic-user-profile-id header. Profiles are not billable and do not change API prices.
Choose the profile boundary deliberately
An application generally creates one profile for each signed-up user. A gateway reselling access to a company uses a company-level profile with access_type set to passthrough.
Profiles belong to the organization, not a workspace. Anthropic recommends separating internal usage from end-customer traffic across different organizations. Separate workspaces do not provide that separation.
The creation endpoint is not idempotent. Repeating a create request can produce another profile even when the reference identifier matches. Store the successful result before retrying the onboarding flow.
Test attribution through the complete gateway
I would register two harmless test customers, then trace their requests through the same path used by production traffic. Do not generate prohibited material to test enforcement.
- Verify that each request carries the intended stored profile ID.
- Check retries, batch paths, and fallback routes for missing attribution.
- Confirm that one customer cannot select another customer’s profile.
- Review how failed profile creation interrupts onboarding.
- Keep identifiers out of unnecessary public logs.
A valid profile header establishes attribution. It does not prove that your application has isolated customer data or enforced its own authorization rules.
Keep webhook access and provider support separate
Organization webhooks are a separate beta announced with the same release. Access requires contacting the Anthropic account team. Do not build a production dependency around an assumed entitlement.
The user-profile documentation also distinguishes backend-specific support. Verify the registration endpoint and inference path for your provider before copying a direct-API example.
The updated Inference Hooks guide covers pre-inference policy decisions. Our Compliance API article concerns a different audit interface.
Read the sources and choose your next check
- User-profile scope, creation, attribution and backend requirements
- October 20 launch and webhook beta status
Where could your request pipeline lose the customer’s profile ID?
Checked October 21, 2026. This article is based on source review and analysis. Suggested tests have not been performed by MustHave.ai.
