When many customers share an API organization, the provider needs a reliable way to tell whose request it is handling. Build that attribution into the request path.
October 21 update: read a profile’s enforcement status
Anthropic’s October 21 release notes add enforcement_status and enforcement_actions to user profiles. The profile-list endpoint also supports the enforcement_status[] filter.
These fields let a platform inspect whether Anthropic has restricted or banned an end customer. Keep the stored profile ID connected to the customer record when displaying that status.
I would test the status-display path with authorized fixtures and harmless requests. Check stale responses, missing profiles, and the customer shown to an administrator. Do not create prohibited traffic to trigger enforcement.
The status fields are separate from the access-controlled webhook beta. See the current user-profile guide for the schema and backend scope. The API migration guide covers the accompanying SDK changes.
What launched on October 20
Anthropic’s release notes introduce user profiles for end-customer attribution. The documentation explains how a safety action can apply to one customer profile instead of the whole organization.
Create a profile once, store its returned identifier, and send it in the anthropic-user-profile-id header. Profiles are not billable and do not change API prices.
Choose the profile boundary deliberately
An application generally creates one profile for each signed-up user. A gateway reselling access to a company uses a company-level profile with access_type set to passthrough.
Profiles belong to the organization, not a workspace. Anthropic recommends separating internal usage from end-customer traffic across different organizations. Separate workspaces do not provide that separation.
The creation endpoint is not idempotent. Repeating a create request can produce another profile even when the reference identifier matches. Store the successful result before retrying the onboarding flow.
Test attribution through the complete gateway
I would register two harmless test customers, then trace their requests through the same path used by production traffic. Do not generate prohibited material to test enforcement.
- Verify that each request carries the intended stored profile ID.
- Check retries, batch paths, and fallback routes for missing attribution.
- Confirm that one customer cannot select another customer’s profile.
- Review how failed profile creation interrupts onboarding.
- Keep identifiers out of unnecessary public logs.
A valid profile header establishes attribution. It does not prove that your application has isolated customer data or enforced its own authorization rules.
Keep webhook access and provider support separate
Organization webhooks are a separate beta announced with the same release. Access requires contacting the Anthropic account team. Do not build a production dependency around an assumed entitlement.
The user-profile documentation also distinguishes backend-specific support. Verify the registration endpoint and inference path for your provider before copying a direct-API example.
The updated Inference Hooks guide covers pre-inference policy decisions. Our Compliance API article concerns a different audit interface.
Read the sources and choose your next check
- User-profile scope, creation, attribution and backend requirements
- October 20 launch and webhook beta status
Where could your request pipeline lose the customer’s profile ID?
Checked October 22, 2026. This article is based on source review and analysis. Suggested tests have not been performed by MustHave.ai.
