TL;DR: What changed in the Claude API this week?
Three things that matter if you build on Claude. On 20 October, Anthropic launched user profiles: if you tag each API request with the end customer it's for, a safety restriction or ban can hit that one customer instead of your whole organization. Profiles are free, but you have to build them in. On 21 October, Anthropic released API version 2026-10-21 and new major SDK versions that use it by default. Any request that sends temperature, top_p or top_k now fails with a 400 error, and the SDKs moved from the MIT to the Apache 2.0 licence. On 22 October, the Claude API became available through Google Cloud Marketplace, run by Anthropic. If you serve European customers, note that none of Anthropic's own routes offers EU-only inference yet.
If your product runs on Claude and you have paying users, you have probably had this thought at 2 a.m.: what if one of my users does something nasty and Anthropic switches off my whole account? Until this week, that was a real risk with no clean fix. Every request you sent for your customers arrived as your own traffic.
Anthropic has now built a fix, and shipped an SDK upgrade that can break your app if you install it without reading the notes. Both landed in the same week, between 20 and 23 October 2026, in the API release notes rather than a blog post. So far, they've had little press coverage. Here's what changed and what to do.
What happened
Anthropic's API release notes list three days of changes:
- 20 October: user profiles launched, "so you can tell Anthropic which of your end customers each API request is for. If you operate a platform or gateway, or resell API access, a safety enforcement action can then apply to one end customer instead of your whole organization." Organization webhooks for restriction and ban events arrived in beta, and admins got a switch to turn off web fetch or limit it to chosen domains.
- 21 October: API version 2026-10-21 shipped with new SDKs that send it by default: Python 2.0.0, TypeScript 1.0.0, C# 13.0.0, Go 2.0.0, Java 3.0.0, PHP 1.0.0, Ruby 2.0.0 and the ant CLI 2.0.0. Anthropic says they "also have breaking changes that don't depend on the API version, and they are licensed under Apache 2.0 instead of the MIT License." User profiles also gained enforcement_status and enforcement_actions fields, so you can see when Anthropic has restricted or banned one of your customers.
- 22 October: Anthropic launched Claude Models on Google Cloud (Anthropic managed), "the Claude API operated by Anthropic and reached through your Google Cloud project", billed through Google Cloud Marketplace.
Package registries show how fast this moved. The Python SDK 2.0.0 went up on PyPI at 15:51 UTC on 21 October and TypeScript 1.0.0 on npm nine minutes later. By 23 October, Python was already on 2.3.0, with fixes that included sending user profile requests to the right endpoint on Google Cloud.
Why user profiles matter if you resell Claude
The user profiles documentation is blunt about the old risk: "Anthropic runs automated safety classifiers over API traffic. Without a profile on the request, one end customer can trigger an enforcement action that applies to your whole organization." With a profile on the request, the action can apply to that customer alone. "When it does, the rest of your traffic is unaffected."
For a bootstrapped SaaS with a few hundred users, that's the difference between one angry support ticket and a full outage. If you're building an AI writing tool, a support bot, an agent product or a wrapper of any kind on Claude, this feature is for you. Anthropic's IPO filing shows why this matters: it estimates that 5% to 7% of its revenue in the first nine months of 2026 came from customers breaking its usage policy, as we explain in the Anthropic S-1 risk factors.
How it works, in short:
- You register each end customer once with POST /v1/user_profiles and store the uprof_ ID that comes back.
- You send that ID in the anthropic-user-profile-id header on every request you make for that customer (user_profile_id in the SDKs).
- "Profiles aren't billable and don't affect pricing." You need a normal API key, not an Admin key.
- Every field is optional. You can send a name, a country, a reference ID and hashes of a name or email address instead of the real ones. A profile "doesn't contain conversation content", and Anthropic doesn't verify the details.
- Use one profile per signed-up user (access type application, the default) or one per company if you resell API access (passthrough).
When Anthropic acts, a profile's enforcement_status changes from unrestricted to restricted or banned. Each action has a type (restriction or ban), a reason, a start date and an end date or none. The reasons Anthropic lists are unsupported_region, fraud_or_abuse, high_harm, usage_policy_violation, account_compromise and unspecified. While an action is open, Anthropic "refuses some or all inference requests" that carry that profile's ID.
Two catches. First, the webhooks that should tell you when a customer is restricted are not working yet. The webhook docs say: "Event delivery isn't live: Anthropic doesn't send the two events, so an endpoint you register receives nothing." Access to the beta also goes through an Anthropic account team, which most solo founders don't have. Until that changes, poll the list endpoint with the enforcement_status filter.
Second, Anthropic says requests with no profile ID count as your own usage, and it recommends keeping customer traffic in a separate organization from your team's own work. A separate workspace isn't enough. If you use the same API key for your internal agents and your customers, now is the time to split them. After the Railway and LiteLLM breaches and the OpenCode key leak this month, separate keys are a good idea anyway.
The SDK upgrade that can break your app
The bigger short-term risk is the upgrade. The migration guide says that in API version 2026-10-21, "a request that sends temperature, top_p, or top_k returns a 400 error, even at the parameter's default value." The new SDKs send that version by default, so if you run an unpinned pip install --upgrade or npm update and your code sets temperature, your calls start failing.
For Claude 4.7 and later models, nothing changes in practice, because they already accept only the defaults. On older models such as Claude Sonnet 4.6, Anthropic warns that "a request that lowered temperature for more consistent output loses that effect. No other setting replaces it." If you rely on a low temperature, the guide's advice is to stop sending it or keep that request on the old version, 2023-06-01. Neither the migration guide nor the versioning page gives an end date for 2023-06-01.
Source: Anthropic, Migrating to API version 2026-10-21, read 25 Oct 2026.
The licence change is unlikely to hurt a normal SaaS that only calls the SDK. Apache 2.0 is a common, permissive licence, and the guide says earlier versions remain under MIT. If you redistribute a modified copy of the SDK, though, Apache 2.0 has its own notice rules, so it's worth a quick look.
Claude on Google Cloud, and what's still missing for Europe
The third change is about how you pay. With Claude Models on Google Cloud (Anthropic managed), you get the real Claude API, with the same request format, run by Anthropic but reached through a Google Cloud project. Billing goes through Google Cloud Marketplace in "Claude Consumption Units" of $0.01 each, and "Anthropic doesn't send a separate invoice." If you have a Google Cloud spend commitment, usage counts toward it like other Marketplace purchases. There are no API keys: access runs only through Google Cloud credentials.
The day before, Google announced OpenAI models in its Model Garden: GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna, "rolling out now in private preview to select enterprise customers". Google says it is "the only hyperscale cloud provider offering access to all three leading closed source LLMs". For a small team, the OpenAI part is not usable yet. The Claude part is, and it means one cloud bill for Gemini and Claude. Neither page says whether Google for Startups credits can be spent on these models, so check before you count on it.
For European founders, the catch is data location. Anthropic's data residency page lists only two inference options on its own routes, "global" and "us", and US-only inference costs 1.1 times the standard rate. On the new Google Cloud route, every workspace stores data in the US, and Anthropic notes that some services, "such as Anthropic's trust and safety systems, process data outside Google Cloud." The older Google-managed route on Vertex AI does offer an EU multi-region and regional endpoints such as europe-west1, at 10% more, but regional endpoints only serve Claude Sonnet 4.6 and earlier.
Sources: Anthropic docs on user profiles, data residency and Claude on Google Cloud, read 25 Oct 2026.
If your customers ask where their prompts go, this table is your answer for now. Put it in your data processing agreement and your privacy page, and don't promise EU-only processing on a route that doesn't offer it.
The policy date to remember: 12 November
User profiles also make Anthropic's rules more personal to your customers. Anthropic's 2026 Usage Policy update, published on 8 October, "takes effect on November 12". Among other changes, it adds "a prohibition on sustained and needless abusive or cruel behavior toward our models." With profiles in place, a breach by one of your users is more likely to land on that user rather than on you, but you should still tell users what isn't allowed. Put a short acceptable-use section in your terms that points to Anthropic's policy.
This comes as Anthropic is preparing to go public, as we covered in Anthropic's leaked IPO filing, and as it pushes deeper into small business with products like Claude Duet. Our read: per-customer enforcement is what a company needs if it wants many more platforms reselling its models without one bad user taking a whole platform down.
What this means for you
- Pin your SDK version today. Lock anthropic to 1.x in Python or 0.x in TypeScript until you have tested the new major. An accidental upgrade is the fastest way to break production this week.
- Search your code for temperature, top_p and top_k. Remove them where you don't need them. Where you do, test the output without them or keep those calls on 2023-06-01.
- Add user profiles if you serve customers. One profile per user at sign-up, the header on every call, and a daily job that lists restricted or banned profiles. It costs nothing and removes your biggest platform risk.
- Split your organizations. Your own agents and tests in one Anthropic organization, customer traffic in another, with separate keys.
- Turn off web fetch if you don't use it. Admins can now switch it off or limit it to approved domains on the Console's Capabilities page. Fewer open doors means fewer surprises.
- Be honest about data location. If you sell to European companies, say where inference runs. If EU-only is a hard requirement, the Vertex AI EU route is the option today, with older models on regional endpoints and a 10% premium.
For prices across Claude, GPT and Gemini, see our AI price war overview. For every other Anthropic update this month, see our Anthropic Claude news for October 2026 and Claude Code news for October 2026.
Are you getting customers from AI search yet?
More and more traffic is coming from Perplexity, ChatGPT, Grok and other AI tools.
👉 Rank on ChatGPT
FAQ: Claude API user profiles and API version 2026-10-21
What are Claude API user profiles?
A way to tell Anthropic which of your end customers each API request is for. You create a profile per customer with POST /v1/user_profiles and send its ID in the anthropic-user-profile-id header. If one customer triggers a safety action, it can then apply to that customer instead of your whole organization.
Do user profiles cost anything?
No. Anthropic's documentation says "Profiles aren't billable and don't affect pricing." Every field is optional, and you can send hashes instead of names or email addresses.
Can Anthropic still ban my whole account?
Requests without a profile ID still count as your own usage, so one customer's behaviour can still affect your organization. Anthropic recommends keeping customer traffic in a separate organization from your own use and sending a profile ID on every customer request.
Why does my Claude API call return a 400 error after upgrading the SDK?
The new major SDKs (Python 2.0.0, TypeScript 1.0.0 and others, released 21 October 2026) send API version 2026-10-21 by default. In that version, any request that sends temperature, top_p or top_k returns a 400 error, even at the default value. Remove those parameters or keep the request on 2023-06-01.
Is API version 2023-06-01 being shut down?
Anthropic's migration guide and versioning page don't give an end date for it. Older SDK versions keep sending 2023-06-01, and you can keep sending that header yourself.
Can I keep Claude API data in the EU?
Not on Anthropic's own routes: its data residency page lists only global and US inference. The Google-managed route on Vertex AI offers an EU multi-region and EU regional endpoints at 10% more, with regional endpoints limited to Claude Sonnet 4.6 and earlier.
About the Author
Violetta Bonenkamp, also known as MeanCEO, is an experienced startup founder with an impressive educational background including an MBA and four other higher education degrees. She has over 20 years of work experience across multiple countries, including 5 years as a solopreneur and serial entrepreneur. Throughout her startup experience she has applied for multiple startup grants at the EU level, in the Netherlands and Malta, and her startups received quite a few of those. She’s been living, studying and working in many countries around the globe and her extensive multicultural experience has influenced her immensely.
