Anthropic adds API user profiles so gateways and resellers can tag each request with an end customer, letting safety enforcement hit one customer instead of the whole organization

Why it matters

【Key points】

Anthropic's Claude Platform release notes (Oct 20 entry) add user profiles: gateways and resellers can tag each API request with an end customer, so safety enforcement hits that customer, not the whole organization.

1. Register each customer via POST /v1/user_profiles, then send the uprof_ ID in the anthropic-user-profile-id header. Types: application (a product user, default) or passthrough (a company buying raw inference). Free.

2. Optional fields: name, country, own customer ID, name/email hashes. No chat content; Anthropic does not verify them.

3. A read-only programs field (incl. Cyber Verification) lets trusted-access programs apply per customer.

4. Admin API org webhooks (beta) signal restrictions and bans, but event delivery is not live yet.

5. Claude API, Claude Platform on AWS, Anthropic-hosted Foundry; Bedrock and Google Cloud check only the ID format.

【Verifiable】

Guide: https://platform.claude.com/docs/en/manage-claude/user-profiles

API reference: https://platform.claude.com/docs/en/api/user_profiles

Org webhooks: https://platform.claude.com/docs/en/manage-claude/organization-webhooks

Release notes: https://platform.claude.com/docs/en/release-notes/overview

【Our read】

1. One bad downstream user could previously get a whole reseller's org stopped. After the OpenCode "distillation attack" breach and CERT-In's agent warning, labs are tightening while trying to spare aggregators like OpenRouter.

2. OpenAI has safety_identifier, a hashed per-user ID. Anthropic goes further: pre-registered profiles, an app-user vs reseller split, and programs attached per customer, pushing KYC down to the end customer.

3. Gateways get insurance against collateral bans but must report customers' country and identity hashes; requests without an ID still count as their own, so reporting becomes the default.