What this read moved
501–519 of 519This capture is too large to show at once. Changes 501-519 of 519 are below, significant first; the rest are on the following screens.
api/skills Changed · +117 / -80 lines
### Headers ### Headers ### Headers ### Headers #### Headers #### Headers #### Headers #### Headers
from line 1
1---
2title: Skills
3url: https://platform.claude.com/docs/en/api/skills
4---
5
16# Skills
27
38## Create Skill
from line 11
611
712Create Skill
813
14### Headers
15
16- `"anthropic-workspace-id": optional string`
17
918### Body parameters (form-data)
1019
1120- `files: array of string`
from line 33
2433
2534- `Skill object`
2635
36 - `type: "skill"`
37
38 Object type.
39
40 For Skills, this is always `"skill"`.
41
42 default: skill
43
2744 - `id: string`
2845
2946 Unique identifier for the skill.
from line 93
7693
7794 - `"plugin"`
7895
79 - `type: "skill"`
80
81 Object type.
82
83 For Skills, this is always `"skill"`.
84
85 default: skill
86
8796 - `updated_at: string`
8897
8998 ISO 8601 timestamp of when the skill was last updated.
from line 156
147156 * `"custom"`: only return user-created skills
148157 * `"anthropic"`: only return Anthropic-created skills
149158
159### Headers
160
161- `"anthropic-workspace-id": optional string`
162
150163### Returns
151164
152165- `data: array of Skill`
from line 166
153166
154167 List of skills.
155168
169 - `type: "skill"`
170
171 Object type.
172
173 For Skills, this is always `"skill"`.
174
175 default: skill
176
156177 - `id: string`
157178
158179 Unique identifier for the skill.
from line 226
205226
206227 - `"plugin"`
207228
208 - `type: "skill"`
209
210 Object type.
211
212 For Skills, this is always `"skill"`.
213
214 default: skill
215
216229 - `updated_at: string`
217230
218231 ISO 8601 timestamp of when the skill was last updated.
from line 281
268281
269282 The format and length of IDs may change over time.
270283
284### Headers
285
286- `"anthropic-workspace-id": optional string`
287
271288### Returns
272289
273290- `Skill object`
274291
292 - `type: "skill"`
293
294 Object type.
295
296 For Skills, this is always `"skill"`.
297
298 default: skill
299
275300 - `id: string`
276301
277302 Unique identifier for the skill.
from line 349
324349
325350 - `"plugin"`
326351
327 - `type: "skill"`
328
329 Object type.
330
331 For Skills, this is always `"skill"`.
332
333 default: skill
334
335352 - `updated_at: string`
336353
337354 ISO 8601 timestamp of when the skill was last updated.
from line 393
376393
377394 The format and length of IDs may change over time.
378395
396### Headers
397
398- `"anthropic-workspace-id": optional string`
399
379400### Returns
380401
381402- `DeletedSkill object`
382403
383 - `id: string`
384
385 Unique identifier for the skill.
386
387 The format and length of IDs may change over time.
388
389404 - `type: "skill_deleted"`
390405
391406 Deleted object type.
from line 409
394409
395410 default: skill_deleted
396411
412 - `id: string`
413
414 Unique identifier for the skill.
415
416 The format and length of IDs may change over time.
417
397418### Example
398419
399420```bash
from line 439
418439
419440- `DeletedSkill object`
420441
421 - `id: string`
422
423 Unique identifier for the skill.
424
425 The format and length of IDs may change over time.
426
427442 - `type: "skill_deleted"`
428443
429444 Deleted object type.
from line 447
432447
433448 default: skill_deleted
434449
450 - `id: string`
451
452 Unique identifier for the skill.
453
454 The format and length of IDs may change over time.
455
435456### Skill
436457
437458- `Skill object`
438459
460 - `type: "skill"`
461
462 Object type.
463
464 For Skills, this is always `"skill"`.
465
466 default: skill
467
439468 - `id: string`
440469
441470 Unique identifier for the skill.
from line 517
488517
489518 - `"plugin"`
490519
491 - `type: "skill"`
492
493 Object type.
494
495 For Skills, this is always `"skill"`.
496
497 default: skill
498
499520 - `updated_at: string`
500521
501522 ISO 8601 timestamp of when the skill was last updated.
from line 562
541562
542563 The format and length of IDs may change over time.
543564
565#### Headers
566
567- `"anthropic-workspace-id": optional string`
568
544569#### Body parameters (form-data)
545570
546571- `files: array of string`
from line 578
553578
554579- `SkillVersion object`
555580
581 - `type: "skill_version"`
582
583 Object type.
584
585 For Skill Versions, this is always `"skill_version"`.
586
587 default: skill_version
588
556589 - `id: string`
557590
558591 Unique identifier for this Skill Version. The id addresses the version in
from line 616
583616
584617 The format and length of IDs may change over time.
585618
586 - `type: "skill_version"`
587
588 Object type.
589
590 For Skill Versions, this is always `"skill_version"`.
591
592 default: skill_version
593
594619#### Example
595620
596621```bash
from line 667
642667
643668 Optionally set to the `next_page` token from the previous response.
644669
670#### Headers
671
672- `"anthropic-workspace-id": optional string`
673
645674#### Returns
646675
647676- `data: array of SkillVersion`
from line 677
648677
649678 List of skills.
650679
680 - `type: "skill_version"`
681
682 Object type.
683
684 For Skill Versions, this is always `"skill_version"`.
685
686 default: skill_version
687
651688 - `id: string`
652689
653690 Unique identifier for this Skill Version. The id addresses the version in
from line 715
678715
679716 The format and length of IDs may change over time.
680717
681 - `type: "skill_version"`
682
683 Object type.
684
685 For Skill Versions, this is always `"skill_version"`.
686
687 default: skill_version
688
689718- `next_page: string or null`
690719
691720 Token for fetching the next page of results.
from line 767
738767
739768 Requests carrying the `skills-2025-10-02` beta header address versions by their Unix epoch timestamp instead (e.g., "1759178010641129").
740769
770#### Headers
771
772- `"anthropic-workspace-id": optional string`
773
741774#### Returns
742775
743776- `SkillVersion object`
744777
778 - `type: "skill_version"`
779
780 Object type.
781
782 For Skill Versions, this is always `"skill_version"`.
783
784 default: skill_version
785
745786 - `id: string`
746787
747788 Unique identifier for this Skill Version. The id addresses the version in
from line 813
772813
773814 The format and length of IDs may change over time.
774815
775 - `type: "skill_version"`
776
777 Object type.
778
779 For Skill Versions, this is always `"skill_version"`.
780
781 default: skill_version
782
783816#### Example
784817
785818```bash
from line 854
821854
822855 Requests carrying the `skills-2025-10-02` beta header address versions by their Unix epoch timestamp instead (e.g., "1759178010641129").
823856
857#### Headers
858
859- `"anthropic-workspace-id": optional string`
860
824861#### Returns
825862
826863- `DeletedSkillVersion object`
827864
828 - `id: string`
829
830 Unique identifier for this Skill Version. The id addresses the version in
831 paths and pins it in references.
832
833865 - `type: "skill_version_deleted"`
834866
835867 Deleted object type.
from line 869
837869 For Skill Versions, this is always `"skill_version_deleted"`.
838870
839871 default: skill_version_deleted
872
873 - `id: string`
874
875 Unique identifier for this Skill Version. The id addresses the version in
876 paths and pins it in references.
840877
841878#### Example
842879
api/skills/create Changed · +17 / -8 lines
## Headers
from line 1
1---
2title: Create Skill
3url: https://platform.claude.com/docs/en/api/skills/create
4---
5
16# Create Skill
27
38**POST** `/v1/skills`
from line 9
49
510Create Skill
611
12## Headers
13
14- `"anthropic-workspace-id": optional string`
15
716## Body parameters (form-data)
817
918- `files: array of string`
from line 31
2231
2332- `Skill object`
2433
34 - `type: "skill"`
35
36 Object type.
37
38 For Skills, this is always `"skill"`.
39
40 default: skill
41
2542 - `id: string`
2643
2744 Unique identifier for the skill.
from line 90
7390 - `"anthropic_example"`
7491
7592 - `"plugin"`
76
77 - `type: "skill"`
78
79 Object type.
80
81 For Skills, this is always `"skill"`.
82
83 default: skill
8493
8594 - `updated_at: string`
8695
api/skills/delete Changed · +15 / -6 lines
## Headers
from line 1
1---
2title: Delete Skill
3url: https://platform.claude.com/docs/en/api/skills/delete
4---
5
16# Delete Skill
27
38**DELETE** `/v1/skills/{skill_id}`
from line 17
1217
1318 The format and length of IDs may change over time.
1419
20## Headers
21
22- `"anthropic-workspace-id": optional string`
23
1524## Returns
1625
1726- `DeletedSkill object`
1827
19 - `id: string`
20
21 Unique identifier for the skill.
22
23 The format and length of IDs may change over time.
24
2528 - `type: "skill_deleted"`
2629
2730 Deleted object type.
from line 32
2932 For Skills, this is always `"skill_deleted"`.
3033
3134 default: skill_deleted
35
36 - `id: string`
37
38 Unique identifier for the skill.
39
40 The format and length of IDs may change over time.
3241
3342## Example
3443
api/skills/list Changed · +17 / -8 lines
## Headers
from line 1
1---
2title: List Skills
3url: https://platform.claude.com/docs/en/api/skills/list
4---
5
16# List Skills
27
38**GET** `/v1/skills`
from line 34
2934 * `"custom"`: only return user-created skills
3035 * `"anthropic"`: only return Anthropic-created skills
3136
37## Headers
38
39- `"anthropic-workspace-id": optional string`
40
3241## Returns
3342
3443- `data: array of Skill`
from line 44
3544
3645 List of skills.
3746
47 - `type: "skill"`
48
49 Object type.
50
51 For Skills, this is always `"skill"`.
52
53 default: skill
54
3855 - `id: string`
3956
4057 Unique identifier for the skill.
from line 103
86103 - `"anthropic_example"`
87104
88105 - `"plugin"`
89
90 - `type: "skill"`
91
92 Object type.
93
94 For Skills, this is always `"skill"`.
95
96 default: skill
97106
98107 - `updated_at: string`
99108
api/skills/retrieve Changed · +17 / -8 lines
## Headers
from line 1
1---
2title: Get Skill
3url: https://platform.claude.com/docs/en/api/skills/retrieve
4---
5
16# Get Skill
27
38**GET** `/v1/skills/{skill_id}`
from line 17
1217
1318 The format and length of IDs may change over time.
1419
20## Headers
21
22- `"anthropic-workspace-id": optional string`
23
1524## Returns
1625
1726- `Skill object`
1827
28 - `type: "skill"`
29
30 Object type.
31
32 For Skills, this is always `"skill"`.
33
34 default: skill
35
1936 - `id: string`
2037
2138 Unique identifier for the skill.
from line 84
6784 - `"anthropic_example"`
6885
6986 - `"plugin"`
70
71 - `type: "skill"`
72
73 Object type.
74
75 For Skills, this is always `"skill"`.
76
77 default: skill
7887
7988 - `updated_at: string`
8089
api/skills/versions Changed · +63 / -42 lines
### Headers ### Headers ### Headers ### Headers
from line 1
1---
2title: Versions
3url: https://platform.claude.com/docs/en/api/skills/versions
4---
5
16# Versions
27
38## Create Skill Version
from line 19
1419
1520 The format and length of IDs may change over time.
1621
22### Headers
23
24- `"anthropic-workspace-id": optional string`
25
1726### Body parameters (form-data)
1827
1928- `files: array of string`
from line 35
2635
2736- `SkillVersion object`
2837
38 - `type: "skill_version"`
39
40 Object type.
41
42 For Skill Versions, this is always `"skill_version"`.
43
44 default: skill_version
45
2946 - `id: string`
3047
3148 Unique identifier for this Skill Version. The id addresses the version in
from line 73
5673
5774 The format and length of IDs may change over time.
5875
59 - `type: "skill_version"`
60
61 Object type.
62
63 For Skill Versions, this is always `"skill_version"`.
64
65 default: skill_version
66
6776### Example
6877
6978```bash
from line 124
115124
116125 Optionally set to the `next_page` token from the previous response.
117126
127### Headers
128
129- `"anthropic-workspace-id": optional string`
130
118131### Returns
119132
120133- `data: array of SkillVersion`
from line 134
121134
122135 List of skills.
123136
137 - `type: "skill_version"`
138
139 Object type.
140
141 For Skill Versions, this is always `"skill_version"`.
142
143 default: skill_version
144
124145 - `id: string`
125146
126147 Unique identifier for this Skill Version. The id addresses the version in
from line 172
151172
152173 The format and length of IDs may change over time.
153174
154 - `type: "skill_version"`
155
156 Object type.
157
158 For Skill Versions, this is always `"skill_version"`.
159
160 default: skill_version
161
162175- `next_page: string or null`
163176
164177 Token for fetching the next page of results.
from line 224
211224
212225 Requests carrying the `skills-2025-10-02` beta header address versions by their Unix epoch timestamp instead (e.g., "1759178010641129").
213226
227### Headers
228
229- `"anthropic-workspace-id": optional string`
230
214231### Returns
215232
216233- `SkillVersion object`
217234
235 - `type: "skill_version"`
236
237 Object type.
238
239 For Skill Versions, this is always `"skill_version"`.
240
241 default: skill_version
242
218243 - `id: string`
219244
220245 Unique identifier for this Skill Version. The id addresses the version in
from line 270
245270
246271 The format and length of IDs may change over time.
247272
248 - `type: "skill_version"`
249
250 Object type.
251
252 For Skill Versions, this is always `"skill_version"`.
253
254 default: skill_version
255
256273### Example
257274
258275```bash
from line 311
294311
295312 Requests carrying the `skills-2025-10-02` beta header address versions by their Unix epoch timestamp instead (e.g., "1759178010641129").
296313
314### Headers
315
316- `"anthropic-workspace-id": optional string`
317
297318### Returns
298319
299320- `DeletedSkillVersion object`
300321
301 - `id: string`
302
303 Unique identifier for this Skill Version. The id addresses the version in
304 paths and pins it in references.
305
306322 - `type: "skill_version_deleted"`
307323
308324 Deleted object type.
from line 327
311327
312328 default: skill_version_deleted
313329
330 - `id: string`
331
332 Unique identifier for this Skill Version. The id addresses the version in
333 paths and pins it in references.
334
314335### Example
315336
316337```bash
from line 356
335356
336357- `DeletedSkillVersion object`
337358
338 - `id: string`
339
340 Unique identifier for this Skill Version. The id addresses the version in
341 paths and pins it in references.
342
343359 - `type: "skill_version_deleted"`
344360
345361 Deleted object type.
from line 364
348364
349365 default: skill_version_deleted
350366
367 - `id: string`
368
369 Unique identifier for this Skill Version. The id addresses the version in
370 paths and pins it in references.
371
351372### Skill Version
352373
353374- `SkillVersion object`
354375
376 - `type: "skill_version"`
377
378 Object type.
379
380 For Skill Versions, this is always `"skill_version"`.
381
382 default: skill_version
383
355384 - `id: string`
356385
357386 Unique identifier for this Skill Version. The id addresses the version in
from line 410
381410 Unique identifier for the skill.
382411
383412 The format and length of IDs may change over time.
384
385 - `type: "skill_version"`
386
387 Object type.
388
389 For Skill Versions, this is always `"skill_version"`.
390
391 default: skill_version
392413
api/skills/versions/create Changed · +17 / -8 lines
## Headers
from line 1
1---
2title: Create Skill Version
3url: https://platform.claude.com/docs/en/api/skills/versions/create
4---
5
16# Create Skill Version
27
38**POST** `/v1/skills/{skill_id}/versions`
from line 17
1217
1318 The format and length of IDs may change over time.
1419
20## Headers
21
22- `"anthropic-workspace-id": optional string`
23
1524## Body parameters (form-data)
1625
1726- `files: array of string`
from line 33
2433
2534- `SkillVersion object`
2635
36 - `type: "skill_version"`
37
38 Object type.
39
40 For Skill Versions, this is always `"skill_version"`.
41
42 default: skill_version
43
2744 - `id: string`
2845
2946 Unique identifier for this Skill Version. The id addresses the version in
from line 70
5370 Unique identifier for the skill.
5471
5572 The format and length of IDs may change over time.
56
57 - `type: "skill_version"`
58
59 Object type.
60
61 For Skill Versions, this is always `"skill_version"`.
62
63 default: skill_version
6473
6574## Example
6675
api/skills/versions/delete Changed · +14 / -5 lines
## Headers
from line 1
1---
2title: Delete Skill Version
3url: https://platform.claude.com/docs/en/api/skills/versions/delete
4---
5
16# Delete Skill Version
27
38**DELETE** `/v1/skills/{skill_id}/versions/{version}`
from line 23
1823
1924 Requests carrying the `skills-2025-10-02` beta header address versions by their Unix epoch timestamp instead (e.g., "1759178010641129").
2025
26## Headers
27
28- `"anthropic-workspace-id": optional string`
29
2130## Returns
2231
2332- `DeletedSkillVersion object`
2433
25 - `id: string`
26
27 Unique identifier for this Skill Version. The id addresses the version in
28 paths and pins it in references.
29
3034 - `type: "skill_version_deleted"`
3135
3236 Deleted object type.
from line 38
3438 For Skill Versions, this is always `"skill_version_deleted"`.
3539
3640 default: skill_version_deleted
41
42 - `id: string`
43
44 Unique identifier for this Skill Version. The id addresses the version in
45 paths and pins it in references.
3746
3847## Example
3948
api/skills/versions/list Changed · +17 / -8 lines
## Headers
from line 1
1---
2title: List Skill Versions
3url: https://platform.claude.com/docs/en/api/skills/versions/list
4---
5
16# List Skill Versions
27
38**GET** `/v1/skills/{skill_id}/versions`
from line 31
2631
2732 Optionally set to the `next_page` token from the previous response.
2833
34## Headers
35
36- `"anthropic-workspace-id": optional string`
37
2938## Returns
3039
3140- `data: array of SkillVersion`
from line 41
3241
3342 List of skills.
3443
44 - `type: "skill_version"`
45
46 Object type.
47
48 For Skill Versions, this is always `"skill_version"`.
49
50 default: skill_version
51
3552 - `id: string`
3653
3754 Unique identifier for this Skill Version. The id addresses the version in
from line 78
6178 Unique identifier for the skill.
6279
6380 The format and length of IDs may change over time.
64
65 - `type: "skill_version"`
66
67 Object type.
68
69 For Skill Versions, this is always `"skill_version"`.
70
71 default: skill_version
7281
7382- `next_page: string or null`
7483
api/skills/versions/retrieve Changed · +17 / -8 lines
## Headers
from line 1
1---
2title: Get Skill Version
3url: https://platform.claude.com/docs/en/api/skills/versions/retrieve
4---
5
16# Get Skill Version
27
38**GET** `/v1/skills/{skill_id}/versions/{version}`
from line 23
1823
1924 Requests carrying the `skills-2025-10-02` beta header address versions by their Unix epoch timestamp instead (e.g., "1759178010641129").
2025
26## Headers
27
28- `"anthropic-workspace-id": optional string`
29
2130## Returns
2231
2332- `SkillVersion object`
2433
34 - `type: "skill_version"`
35
36 Object type.
37
38 For Skill Versions, this is always `"skill_version"`.
39
40 default: skill_version
41
2542 - `id: string`
2643
2744 Unique identifier for this Skill Version. The id addresses the version in
from line 68
5168 Unique identifier for the skill.
5269
5370 The format and length of IDs may change over time.
54
55 - `type: "skill_version"`
56
57 Object type.
58
59 For Skill Versions, this is always `"skill_version"`.
60
61 default: skill_version
6271
6372## Example
6473
managed-agents/events-and-streaming Changed · +22 / -2 lines
from line 2162
21622162
21632163### Tool confirmation
21642164
2165When a [permission policy](https://platform.claude.com/docs/en/managed-agents/permission-policies) requires confirmation before a tool executes:
2165A tool call waits for your confirmation under an `always_ask` [permission policy](https://platform.claude.com/docs/en/managed-agents/permission-policies), or under `auto` when the server reaches no determination. When that happens:
21662166
216721671. The session emits an `agent.tool_use` or `agent.mcp_tool_use` event.
21682. The session pauses with a `session.status_idle` event containing `stop_reason: requires_action`. The blocking event IDs are in the `stop_reason.event_ids` array.
21682. The session pauses with a `session.status_idle` event whose `stop_reason.type` is `requires_action`. The blocking event IDs are in the `stop_reason.event_ids` array.
216921693. Send a `user.tool_confirmation` event for each, passing the event ID in the `tool_use_id` parameter. Set `result` to `"allow"` or `"deny"`. Use `deny_message` to explain a denial.
217021704. Once all blocking events are resolved, the session transitions back to `running`.
21712171
2172Each `agent.tool_use` and `agent.mcp_tool_use` event carries `evaluated_permission` (`allow`, `ask`, or `deny`), and only events whose `evaluated_permission` is `"ask"` wait for a confirmation. Most events also carry an `evaluation` object that records which policy produced that outcome, described under [See how each call was evaluated](https://platform.claude.com/docs/en/managed-agents/permission-policies#see-how-each-call-was-evaluated). For example, a `bash` call paused under an `always_ask` policy appears on the stream as follows:
2173
2174```json
2175{
2176 "type": "agent.tool_use",
2177 "id": "sevt_01def...",
2178 "name": "bash",
2179 "input": {
2180 "command": "pip install -r requirements.txt"
2181 },
2182 "evaluated_permission": "ask",
2183 "evaluation": {
2184 "type": "always_ask"
2185 },
2186 "processed_at": "2026-03-25T14:01:45Z"
2187}
2188```
2189
21722190<CodeGroup>
21732191 ```bash cURL
21742192 exec {stream_fd}< <(curl --fail-with-body -sS -N \
from line 2802
27842802 * **Threads** lists every thread with its status, context size, and cost. Select a thread to view its details, such as the agent, model, context usage, and cost.
27852803
27862804Append `?event={event_id}` to a session URL to open the session at a specific event.
2805
2806With `ant beta:sessions connect`, you can open the same viewer from the `ant` CLI or follow the session in your terminal. See [Connect to a Managed Agents session from your terminal](https://platform.claude.com/docs/en/cli-sdks-libraries/cli/sessions-connect).
27872807
27882808## Debugging tips
27892809
managed-agents/migration Changed · +7 / -7 lines
from line 625
625625| `cwd`, `add_dirs` point at local paths | Upload or mount [files](https://platform.claude.com/docs/en/managed-agents/files) as session resources. |
626626| `system_prompt` and the `CLAUDE.md` hierarchy | A single `system` string on the Agent. Each update that changes the agent produces a new server-side version; pin sessions to a specific version to promote or roll back without a deploy. See [Agent setup](https://platform.claude.com/docs/en/managed-agents/agent-setup). |
627627| `mcp_servers` configured and authenticated in one place | Declare servers on the Agent; provide credentials through a [Vault](https://platform.claude.com/docs/en/managed-agents/vaults) on the Session. |
628| `permission_mode`, `can_use_tool` | Per-tool [`permission_policy`](https://platform.claude.com/docs/en/managed-agents/permission-policies); send `user.tool_confirmation` events for `always_ask` tools. |
628| `permission_mode`, `can_use_tool` | Per-tool [`permission_policy`](https://platform.claude.com/docs/en/managed-agents/permission-policies) (`always_allow`, `always_ask`, or `auto`); send `user.tool_confirmation` events for calls that pause for your approval. |
629629
630630### Code comparison
631631
from line 1306
13061306
13071307The tradeoff for Anthropic running the agent loop is that a few things the SDK handled automatically become your client's responsibility.
13081308
1309| SDK feature | Managed Agents approach |
1310| ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- |
1311| Plan mode | Run a planning-only session first, then a second session to run the plan. |
1312| Output styles, slash commands | Apply in your client before sending `user.message` or after receiving `agent.message`. |
1313| `PreToolUse` / `PostToolUse` hooks | Your client already sees every `agent.custom_tool_use` event before responding; put the logic there. For built-in tools, use `permission_policy: always_ask`. |
1314| `max_turns` | Count turns client-side. |
1309| SDK feature | Managed Agents approach |
1310| ---------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
1311| Plan mode | Run a planning-only session first, then a second session to run the plan. |
1312| Output styles, slash commands | Apply in your client before sending `user.message` or after receiving `agent.message`. |
1313| `PreToolUse` / `PostToolUse` hooks | Your client already sees every `agent.custom_tool_use` event before responding; put the logic there. For built-in tools, use `permission_policy: always_ask` to review every call. [`auto`](https://platform.claude.com/docs/en/managed-agents/permission-policies#let-the-server-evaluate-each-call-with-auto) lets the server evaluate each call instead, but if the server evaluates a call as safe, it runs without reaching your client. |
1314| `max_turns` | Count turns client-side. |
13151315
13161316## Migration checklist
13171317
managed-agents/permission-policies Changed · +406 / -6 lines
## Let the server evaluate each call with `auto` ## See how each call was evaluated
The two sides of this change are more than 400 edits apart, too far apart to line up, so this is the differ's own diff of it and the words inside a line are not marked.
from line 4
44description: Control when agent and MCP tools execute.
55---
66
7Permission policies control whether server-executed tools (the pre-built agent toolset and MCP toolset) run automatically or wait for your approval. Custom tools are executed by your application and controlled by you, so they are not governed by permission policies.
7Permission policies control whether server-executed tools (the pre-built agent toolset and MCP toolset) run automatically, wait for your approval, or have each call evaluated by the server. Custom tools are executed by your application and controlled by you, so they are not governed by permission policies.
88
99<Note>
1010 Managed Agents API requests require the `managed-agents-2026-04-01` beta header, except memory store endpoints, which use `agent-memory-2026-07-22` instead. The SDK sets the correct beta header automatically. See [Beta headers](https://platform.claude.com/docs/en/api/beta-headers#endpoint-specific-headers).
from line 12
1212
1313## Permission policy types
1414
15| Policy | Behavior |
16| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
17| `always_allow` | The tool executes automatically with no confirmation. |
18| `always_ask` | The session pauses and waits for your approval before executing. See [Respond to confirmation requests](https://platform.claude.com/docs/en/managed-agents/permission-policies#respond-to-confirmation-requests) for the event flow. |
15| Policy | Behavior |
16| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
17| `always_allow` | The tool executes automatically with no confirmation. |
18| `always_ask` | The session pauses and waits for your approval before executing. See [Respond to confirmation requests](https://platform.claude.com/docs/en/managed-agents/permission-policies#respond-to-confirmation-requests) for the event flow. |
19| `auto` | The server evaluates each call and runs it, denies it, or pauses for your approval. See [Let the server evaluate each call with `auto`](https://platform.claude.com/docs/en/managed-agents/permission-policies#let-the-server-evaluate-each-call-with-auto). |
1920
2021Each toolset kind has its own default: the agent toolset defaults to `always_allow`, and MCP toolsets default to `always_ask`.
2122
from line 665
664665
665666Pass this `tools` configuration in the agent create request (the CLI tab shows the complete command). MCP toolsets support the same per-tool overrides, with `name` set to the tool name reported by the MCP server. See [Configure which MCP tools are available](https://platform.claude.com/docs/en/managed-agents/mcp-connector#configure-which-mcp-tools-are-available).
666667
668## Let the server evaluate each call with `auto`
669
670With the `auto` permission policy, the server evaluates each call before it runs. Because the evaluation considers the tool, the call's input, and the session's content up to that point, the server can treat two calls to the same tool differently. Each call has one of three outcomes:
671
672* **The call runs.** When the server determines that the call is safe, the tool runs as it would under `always_allow`.
673* **The call is denied.** When the server evaluates the call as high-risk, the tool does not run. The agent receives an error tool result with the content `Permission to use {tool_name} has been denied.` and `is_error: true`. The session keeps running, and your client cannot override the denial.
674* **The call pauses for your approval.** When the server reaches no determination, the session pauses as it does under `always_ask`. See [Respond to confirmation requests](https://platform.claude.com/docs/en/managed-agents/permission-policies#respond-to-confirmation-requests).
675
676To turn on `auto`, set `permission_policy` to `{"type": "auto"}`. It goes in the same two places as the other policies: a toolset's [`default_config`](https://platform.claude.com/docs/en/managed-agents/permission-policies#set-a-policy-for-a-toolset) for the whole toolset, or a [`configs` entry](https://platform.claude.com/docs/en/managed-agents/permission-policies#override-an-individual-tool-policy) for one tool. The agent toolset and MCP toolsets both accept it. No toolset uses `auto` by default.
677
678The following example sets `auto` as the default for the agent toolset and for the `github` MCP toolset, and overrides `bash` to `always_ask`:
679
680<CodeGroup defaultLanguage="CLI">
681 ```bash cURL
682 agent=$(curl -fsSL https://api.anthropic.com/v1/agents \
683 -H "x-api-key: $ANTHROPIC_API_KEY" \
684 -H "anthropic-version: 2023-06-01" \
685 -H "anthropic-beta: managed-agents-2026-04-01" \
686 -H "content-type: application/json" \
687 -d '{
688 "name": "Ops Agent",
689 "model": "claude-opus-5",
690 "mcp_servers": [
691 {"type": "url", "name": "github", "url": "https://mcp.example.com/github"}
692 ],
693 "tools": [
694 {
695 "type": "agent_toolset_20260401",
696 "default_config": {
697 "permission_policy": {"type": "auto"}
698 },
699 "configs": [
700 {"name": "bash", "permission_policy": {"type": "always_ask"}}
701 ]
702 },
703 {
704 "type": "mcp_toolset",
705 "mcp_server_name": "github",
706 "default_config": {
707 "permission_policy": {"type": "auto"}
708 }
709 }
710 ]
711 }')
712 ```
713
714 <MultiFileExample language="cli" label="CLI">
715 ```bash CLI
716 ant apply agent.md
717 ```
718
719 <File filename="agent.md">
720 ```markdown
721 ---
722 name: Ops Agent
723 model: claude-opus-5
724 mcp_servers:
725 - type: url
726 name: github
727 url: https://mcp.example.com/github
728 tools:
729 - type: agent_toolset_20260401
730 default_config:
731 permission_policy:
732 type: auto
733 configs:
734 - name: bash
735 permission_policy:
736 type: always_ask
737 - type: mcp_toolset
738 mcp_server_name: github
739 default_config:
740 permission_policy:
741 type: auto
742 ---
743 ```
744 </File>
745 </MultiFileExample>
746
747 ```python Python
748 agent = client.beta.agents.create(
749 name="Ops Agent",
750 model="claude-opus-5",
751 mcp_servers=[
752 {"type": "url", "name": "github", "url": "https://mcp.example.com/github"},
753 ],
754 tools=[
755 {
756 "type": "agent_toolset_20260401",
757 "default_config": {
758 "permission_policy": {"type": "auto"},
759 },
760 "configs": [
761 {"name": "bash", "permission_policy": {"type": "always_ask"}},
762 ],
763 },
764 {
765 "type": "mcp_toolset",
766 "mcp_server_name": "github",
767 "default_config": {
768 "permission_policy": {"type": "auto"},
769 },
770 },
771 ],
772 )
773 ```
774
775 ```typescript TypeScript
776 const agent = await client.beta.agents.create({
777 name: "Ops Agent",
778 model: "claude-opus-5",
779 mcp_servers: [{ type: "url", name: "github", url: "https://mcp.example.com/github" }],
780 tools: [
781 {
782 type: "agent_toolset_20260401",
783 default_config: {
784 permission_policy: { type: "auto" }
785 },
786 configs: [{ name: "bash", permission_policy: { type: "always_ask" } }]
787 },
788 {
789 type: "mcp_toolset",
790 mcp_server_name: "github",
791 default_config: {
792 permission_policy: { type: "auto" }
793 }
794 }
795 ]
796 });
797 ```
798
799 ```csharp C#
800 using Anthropic.Models.Beta.Agents;
801
802 var agent = await client.Beta.Agents.Create(new()
803 {
804 Name = "Ops Agent",
805 Model = BetaManagedAgentsModel.ClaudeOpus5,
806 McpServers =
807 [
808 new()
809 {
810 Type = BetaManagedAgentsUrlMcpServerParamsType.Url,
811 Name = "github",
812 Url = "https://mcp.example.com/github",
813 },
814 ],
815 Tools =
816 [
817 new BetaManagedAgentsAgentToolset20260401Params
818 {
819 Type = BetaManagedAgentsAgentToolset20260401ParamsType.AgentToolset20260401,
820 DefaultConfig = new()
821 {
822 PermissionPolicy = new BetaManagedAgentsAutoPolicy(),
823 },
824 Configs =
825 [
826 new BetaManagedAgentsBashToolConfigParams
827 {
828 PermissionPolicy = new BetaManagedAgentsAlwaysAskPolicy { Type = "always_ask" },
829 },
830 ],
831 },
832 new BetaManagedAgentsMcpToolsetParams
833 {
834 Type = BetaManagedAgentsMcpToolsetParamsType.McpToolset,
835 McpServerName = "github",
836 DefaultConfig = new()
837 {
838 PermissionPolicy = new BetaManagedAgentsAutoPolicy(),
839 },
840 },
841 ],
842 });
843 ```
844
845 ```go Go
846 agent, err := client.Beta.Agents.New(ctx, anthropic.BetaAgentNewParams{
847 Name: "Ops Agent",
848 Model: anthropic.BetaManagedAgentsModelConfigParams{
849 ID: "claude-opus-5",
850 },
851 MCPServers: []anthropic.BetaManagedAgentsURLMCPServerParams{{
852 Type: anthropic.BetaManagedAgentsURLMCPServerParamsTypeURL,
853 Name: "github",
854 URL: "https://mcp.example.com/github",
855 }},
856 Tools: []anthropic.BetaAgentNewParamsToolUnion{
857 {
858 OfAgentToolset20260401: &anthropic.BetaManagedAgentsAgentToolset20260401Params{
859 Type: anthropic.BetaManagedAgentsAgentToolset20260401ParamsTypeAgentToolset20260401,
860 DefaultConfig: anthropic.BetaManagedAgentsAgentToolsetDefaultConfigParams{
861 PermissionPolicy: anthropic.BetaManagedAgentsAgentToolsetDefaultConfigParamsPermissionPolicyUnion{
862 OfAuto: &anthropic.BetaManagedAgentsAutoPolicyParam{},
863 },
864 },
865 Configs: []anthropic.BetaManagedAgentsAgentToolConfigParamsUnion{{
866 OfBash: &anthropic.BetaManagedAgentsBashToolConfigParams{
867 PermissionPolicy: anthropic.BetaManagedAgentsBashToolConfigParamsPermissionPolicyUnion{
868 OfAlwaysAsk: &anthropic.BetaManagedAgentsAlwaysAskPolicyParam{
869 Type: anthropic.BetaManagedAgentsAlwaysAskPolicyTypeAlwaysAsk,
870 },
871 },
872 },
873 }},
874 },
875 },
876 {
877 OfMCPToolset: &anthropic.BetaManagedAgentsMCPToolsetParams{
878 Type: anthropic.BetaManagedAgentsMCPToolsetParamsTypeMCPToolset,
879 MCPServerName: "github",
880 DefaultConfig: anthropic.BetaManagedAgentsMCPToolsetDefaultConfigParams{
881 PermissionPolicy: anthropic.BetaManagedAgentsMCPToolsetDefaultConfigParamsPermissionPolicyUnion{
882 OfAuto: &anthropic.BetaManagedAgentsAutoPolicyParam{},
883 },
884 },
885 },
886 },
887 },
888 })
889 if err != nil {
890 panic(err)
891 }
892 _ = agent
893 ```
894
895 ```java Java
896 import com.anthropic.models.beta.agents.*;
897
898 var agent = client.beta().agents().create(
899 AgentCreateParams.builder()
900 .name("Ops Agent")
901 .model(BetaManagedAgentsModel.CLAUDE_OPUS_5)
902 .addMcpServer(
903 BetaManagedAgentsUrlMcpServerParams.builder()
904 .type(BetaManagedAgentsUrlMcpServerParams.Type.URL)
905 .name("github")
906 .url("https://mcp.example.com/github")
907 .build()
908 )
909 .addTool(
910 BetaManagedAgentsAgentToolset20260401Params.builder()
911 .type(BetaManagedAgentsAgentToolset20260401Params.Type.AGENT_TOOLSET_20260401)
912 .defaultConfig(
913 BetaManagedAgentsAgentToolsetDefaultConfigParams.builder()
914 .permissionPolicy(BetaManagedAgentsAutoPolicy.builder().build())
915 .build()
916 )
917 .addConfig(
918 BetaManagedAgentsBashToolConfigParams.builder()
919 .permissionPolicy(
920 BetaManagedAgentsAlwaysAskPolicy.builder()
921 .type(BetaManagedAgentsAlwaysAskPolicy.Type.ALWAYS_ASK)
922 .build()
923 )
924 .build()
925 )
926 .build()
927 )
928 .addTool(
929 BetaManagedAgentsMcpToolsetParams.builder()
930 .type(BetaManagedAgentsMcpToolsetParams.Type.MCP_TOOLSET)
931 .mcpServerName("github")
932 .defaultConfig(
933 BetaManagedAgentsMcpToolsetDefaultConfigParams.builder()
934 .permissionPolicy(BetaManagedAgentsAutoPolicy.builder().build())
935 .build()
936 )
937 .build()
938 )
939 .build()
940 );
941 ```
942
943 ```php PHP
944 use Anthropic\Beta\Agents\BetaManagedAgentsAgentToolset20260401Params;
945 use Anthropic\Beta\Agents\BetaManagedAgentsAgentToolsetDefaultConfigParams;
946 use Anthropic\Beta\Agents\BetaManagedAgentsAlwaysAskPolicy;
947 use Anthropic\Beta\Agents\BetaManagedAgentsAutoPolicy;
948 use Anthropic\Beta\Agents\BetaManagedAgentsBashToolConfigParams;
949 use Anthropic\Beta\Agents\BetaManagedAgentsMCPToolsetDefaultConfigParams;
950 use Anthropic\Beta\Agents\BetaManagedAgentsMCPToolsetParams;
951 use Anthropic\Beta\Agents\BetaManagedAgentsURLMCPServerParams;
952
953 $agent = $client->beta->agents->create(
954 name: 'Ops Agent',
955 model: 'claude-opus-5',
956 mcpServers: [
957 BetaManagedAgentsURLMCPServerParams::with(
958 type: 'url',
959 name: 'github',
960 url: 'https://mcp.example.com/github',
961 ),
962 ],
963 tools: [
964 BetaManagedAgentsAgentToolset20260401Params::with(
965 type: 'agent_toolset_20260401',
966 defaultConfig: BetaManagedAgentsAgentToolsetDefaultConfigParams::with(
967 permissionPolicy: BetaManagedAgentsAutoPolicy::with(),
968 ),
969 configs: [
970 BetaManagedAgentsBashToolConfigParams::with(
971 permissionPolicy: BetaManagedAgentsAlwaysAskPolicy::with(type: 'always_ask'),
972 ),
973 ],
974 ),
975 BetaManagedAgentsMCPToolsetParams::with(
976 type: 'mcp_toolset',
977 mcpServerName: 'github',
978 defaultConfig: BetaManagedAgentsMCPToolsetDefaultConfigParams::with(
979 permissionPolicy: BetaManagedAgentsAutoPolicy::with(),
980 ),
981 ),
982 ],
983 );
984 ```
985
986 ```ruby Ruby
987 agent = client.beta.agents.create(
988 name: "Ops Agent",
989 model: "claude-opus-5",
990 mcp_servers: [
991 {type: "url", name: "github", url: "https://mcp.example.com/github"}
992 ],
993 tools: [
994 {
995 type: "agent_toolset_20260401",
996 default_config: {
997 permission_policy: {type: "auto"}
998 },
999 configs: [
1000 {name: "bash", permission_policy: {type: "always_ask"}}
1001 ]
1002 },
1003 {
1004 type: "mcp_toolset",
1005 mcp_server_name: "github",
1006 default_config: {
1007 permission_policy: {type: "auto"}
1008 }
1009 }
1010 ]
1011 )
1012 ```
1013</CodeGroup>
1014
1015What you post in `user.message` events counts as your intent, and it can lead the server to allow a call it would otherwise deny. The server does not read intent from a tool result, a fetched webpage, an MCP server's response, or a message between [session threads](https://platform.claude.com/docs/en/managed-agents/multiagent-orchestration#tool-permissions-and-custom-tools). It assesses that content but does not take instructions from it. The server evaluates some calls as high-risk no matter who asks. If you relay untrusted end-user input in `user.message` events, the server reads that input as your intent too, and it can get a call allowed. Configure `always_ask` on the tools you would not let that end user run without review.
1016
1017<Warning>
1018 `auto` is not a human checkpoint. If the server determines that a call is safe, the call runs before anyone sees it, and its effects might not be reversible. If a person must review a tool's calls before they run, configure `always_ask` on that tool.
1019</Warning>
1020
1021## See how each call was evaluated
1022
1023Under any permission policy, each `agent.tool_use` and `agent.mcp_tool_use` event carries `evaluated_permission`, the outcome of the call's permission check: `"allow"`, `"ask"`, or `"deny"`. Most events also carry an `evaluation` object whose `type` names the policy that produced that outcome. Under `auto`, the object also records the server's determination, plus a `reason_code` when the outcome is `ask` or `deny`.
1024
1025For example, when `bash` is under `auto` and the server evaluates a call as high-risk, the denied call appears on the event stream as follows:
1026
1027```json
1028{
1029 "type": "agent.tool_use",
1030 "id": "sevt_01pqr...",
1031 "name": "bash",
1032 "input": {
1033 "command": "rm -rf /workspace/reports"
1034 },
1035 "evaluated_permission": "deny",
1036 "evaluation": {
1037 "type": "auto",
1038 "evaluated_permission": {
1039 "type": "deny",
1040 "reason_code": "high_risk"
1041 }
1042 },
1043 "processed_at": "2026-03-25T14:05:12Z"
1044}
1045```
1046
1047The `evaluation` object takes one of the forms in the following table.
1048
1049| `evaluation` | Top-level `evaluated_permission` | Meaning |
1050| ------------------------------------------------------------------------------------------- | -------------------------------- | ---------------------------------------------------------------------------------------- |
1051| `{"type": "always_allow"}` | `"allow"` | The resolved policy is `always_allow`, so the call ran. |
1052| `{"type": "always_ask"}` | `"ask"` | The resolved policy is `always_ask`, so the call paused for your approval. |
1053| `{"type": "auto", "evaluated_permission": {"type": "allow"}}` | `"allow"` | Under `auto`, the server determined that the call was safe, and it ran. |
1054| `{"type": "auto", "evaluated_permission": {"type": "ask", "reason_code": "indeterminate"}}` | `"ask"` | Under `auto`, the server reached no determination, so the call paused for your approval. |
1055| `{"type": "auto", "evaluated_permission": {"type": "deny", "reason_code": "high_risk"}}` | `"deny"` | Under `auto`, the server evaluated the call as high-risk and denied it. |
1056
1057When `evaluation.type` is `"auto"`, its nested `evaluated_permission.type` repeats the event's top-level `evaluated_permission`, so you can read the outcome from either field. A `reason_code` is a value for your client to branch on and keep in audit records, not text to display to end users.
1058
1059`evaluation` is absent in two cases. When the agent names a tool that is not enabled in the session, the server denies the call without evaluating a policy: the event carries `evaluated_permission: "deny"` and no `evaluation`. Events recorded before `evaluation` was introduced also omit it: read those as `always_allow` when `evaluated_permission` is `"allow"` and as `always_ask` when it is `"ask"`.
1060
1061Write your client to tolerate an `evaluation.type` or `reason_code` it does not recognize. `agent.custom_tool_use` events carry neither field, because permission policies do not govern [custom tools](https://platform.claude.com/docs/en/managed-agents/permission-policies#custom-tools).
1062
6671063## Respond to confirmation requests
6681064
669When the agent invokes a tool with an `always_ask` policy:
1065A tool call evaluates to `ask` under an `always_ask` policy, or under `auto` when the server reaches no determination. When that happens:
6701066
67110671. The session emits an `agent.tool_use` or `agent.mcp_tool_use` event.
67210682. The session pauses with a `session.status_idle` event whose `stop_reason.type` is `requires_action`. The blocking event IDs are in the `stop_reason.event_ids` array. The session waits indefinitely for a response.
67310693. Send a `user.tool_confirmation` event for each blocking event, passing the event ID in the `tool_use_id` parameter. Set `result` to `"allow"` or `"deny"`. Use `deny_message` to explain a denial. You can send several confirmations in a single `events` request.
67410704. Once all blocking events are resolved, the session transitions back to `running`. Allowed tools execute. Denied tools do not run, and the agent receives a tool result saying the call was rejected, including your `deny_message`.
1071
1072If you send a `user.tool_confirmation` for an event whose `evaluated_permission` is not `ask`, the API rejects it with a 400 error. That includes calls the server denied under `auto`: your client cannot override them.
1073
1074To answer interactively instead, use `ant beta:sessions connect`, which shows the waiting call and sends this event when you allow or deny it. See [Connect to a Managed Agents session from your terminal](https://platform.claude.com/docs/en/cli-sdks-libraries/cli/sessions-connect#follow-and-steer-the-session).
6751075
6761076In the following examples, the tool-use event IDs come from the `stop_reason.event_ids` array of the `session.status_idle` event. Learn more about receiving events in the [Session event stream](https://platform.claude.com/docs/en/managed-agents/events-and-streaming#integrating-events) guide, or [subscribe to webhooks](https://platform.claude.com/docs/en/managed-agents/webhooks) to be notified when a session pauses for input.
6771077
6781078
managed-agents/reference Changed · +12 / -12 lines
from line 27
2727 </Tab>
2828
2929 <Tab title="Agent events">
30 | Type | Description |
31 | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
32 | `agent.message` | Agent response content blocks. |
33 | `agent.thinking` | Signals the agent is making forward progress through extended thinking. This is a progress signal only and does not carry the thinking content. |
34 | `agent.tool_use` | Agent invokes a pre-built agent tool (bash, file operations, and so on). |
35 | `agent.tool_result` | Result of a pre-built agent tool execution. |
36 | `agent.mcp_tool_use` | Agent invokes an MCP server tool. |
37 | `agent.mcp_tool_result` | Result of an MCP tool execution. |
38 | `agent.custom_tool_use` | Agent invokes one of your custom tools. Respond with a `user.custom_tool_result` event. |
39 | `agent.thread_context_compacted` | Conversation history was compacted to fit the context window. |
40 | `agent.thread_message_received` | In a [multiagent](https://platform.claude.com/docs/en/managed-agents/multiagent-orchestration) session, a message from another thread arrived on the thread whose stream carries this event; on the primary thread, an agent sent a report or question to the coordinator. |
41 | `agent.thread_message_sent` | In a [multiagent](https://platform.claude.com/docs/en/managed-agents/multiagent-orchestration) session, the thread whose stream carries this event sent a message to another thread; on the primary thread, the coordinator sent a task or follow-up message to another agent. |
30 | Type | Description |
31 | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
32 | `agent.message` | Agent response content blocks. |
33 | `agent.thinking` | Signals the agent is making forward progress through extended thinking. This is a progress signal only and does not carry the thinking content. |
34 | `agent.tool_use` | Agent invokes a pre-built agent tool (bash, file operations, and so on). Carries `evaluated_permission` and, usually, `evaluation` (see [how each call was evaluated](https://platform.claude.com/docs/en/managed-agents/permission-policies#see-how-each-call-was-evaluated)). |
35 | `agent.tool_result` | Result of a pre-built agent tool execution. |
36 | `agent.mcp_tool_use` | Agent invokes an MCP server tool. Carries `evaluated_permission` and, usually, `evaluation` (see [how each call was evaluated](https://platform.claude.com/docs/en/managed-agents/permission-policies#see-how-each-call-was-evaluated)). |
37 | `agent.mcp_tool_result` | Result of an MCP tool execution. |
38 | `agent.custom_tool_use` | Agent invokes one of your custom tools. Respond with a `user.custom_tool_result` event. |
39 | `agent.thread_context_compacted` | Conversation history was compacted to fit the context window. |
40 | `agent.thread_message_received` | In a [multiagent](https://platform.claude.com/docs/en/managed-agents/multiagent-orchestration) session, a message from another thread arrived on the thread whose stream carries this event; on the primary thread, an agent sent a report or question to the coordinator. |
41 | `agent.thread_message_sent` | In a [multiagent](https://platform.claude.com/docs/en/managed-agents/multiagent-orchestration) session, the thread whose stream carries this event sent a message to another thread; on the primary thread, the coordinator sent a task or follow-up message to another agent. |
4242
4343 Message content in these events can include a `redacted` content block, `{"type": "redacted"}`: a placeholder for content withheld by Anthropic model policy. The block carries no other fields. Redacted blocks appear only in content the platform emits; a user event that includes one is rejected with a 400 error.
4444 </Tab>
release-notes/overview Changed · +5 / -0 lines
### September 10, 2026
from line 12
1212 For updates to Claude Code, see the [complete CHANGELOG.md](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md) in the `claude-code` repository.
1313</Tip>
1414
15### September 10, 2026
16
17* Claude Managed Agents permission policies now include `auto`: the server evaluates each agent or MCP tool call and runs it, denies it, or pauses for your approval. `agent.tool_use` and `agent.mcp_tool_use` events report how each call was evaluated in an `evaluation` field alongside `evaluated_permission`. See [Let the server evaluate each call with `auto`](https://platform.claude.com/docs/en/managed-agents/permission-policies#let-the-server-evaluate-each-call-with-auto).
18* The `ant` CLI adds `ant beta:sessions connect`, which attaches your terminal to a Claude Managed Agents session. You can follow the session live, send messages, and allow or deny tool calls that are waiting for approval. Pass `--web` to serve the Claude Console's session viewer locally and open the session there instead. See [Connect to a Managed Agents session from your terminal](https://platform.claude.com/docs/en/cli-sdks-libraries/cli/sessions-connect).
19
1520### September 3, 2026
1621
1722* Version 1.30.0 of the `ant` CLI adds `ant apply`, which creates and updates agents, environments, skills, memory stores, and deployments from files in your repository. Describe each resource in a file, run `ant apply`, and approve the plan it prints. Commit the `claude-lock.json` lockfile it writes so that later runs, on your machine or in CI, update the same resources instead of creating new ones. See [Manage resources as code with ant apply](https://platform.claude.com/docs/en/cli-sdks-libraries/cli/apply).
manage-claude/inference-hooks Changed · +2 / -2 lines
from line 5
55---
66
77<Note>
8 Inference hooks are in beta and available to Claude Enterprise organizations. Configuring them requires the `organization:manage` permission in claude.ai, which the built-in Admin, Owner, and Primary owner roles hold; see [Configure Inference hooks](https://platform.claude.com/docs/en/manage-claude/inference-hooks-configuration).
8 Inference hooks are in beta and available to Claude Enterprise organizations. Configuring them requires the `organization:manage` permission in claude.ai, which only the Owner and Primary owner roles hold; see [Configure Inference hooks](https://platform.claude.com/docs/en/manage-claude/inference-hooks-configuration).
99</Note>
1010
1111Inference hooks let a Claude Enterprise organization route every governed prompt through an AI security server, an HTTPS service that the organization or its security vendor operates, before inference runs. When a user submits a prompt, Anthropic sends the conversation transcript to your AI security server and waits for an allow or deny verdict; a denied request never reaches the model. Security and compliance teams use Inference hooks to enforce data policies inline, and developers build the AI security server that evaluates each request.
from line 58
5858
5959## Availability
6060
61Inference hooks are available to Claude Enterprise organizations. Configuring them requires the `organization:manage` permission, which the built-in Admin, Owner, and Primary owner roles hold, as does any custom role granted it.
61Inference hooks are available to Claude Enterprise organizations. Configuring them requires the `organization:manage` permission, which only the Owner and Primary owner roles hold.
6262
6363One hook governs conversations across claude.ai, Cowork, and Claude Code sessions in your Claude Enterprise organization, whether they run on the web, in the desktop or mobile apps, or in the CLI. Inference hooks are not available on Amazon Bedrock or Google Cloud.
6464
manage-claude/inference-hooks-configuration Changed · +2 / -2 lines
from line 5
55---
66
77<Note>
8 Inference hooks are in beta and available to Claude Enterprise organizations. Configuring them requires the `organization:manage` permission, which the built-in Admin, Owner, and Primary owner roles hold, as does any custom role granted it.
8 Inference hooks are in beta and available to Claude Enterprise organizations. Configuring them requires the `organization:manage` permission, which only the Owner and Primary owner roles hold.
99</Note>
1010
1111Inference hooks send prompts from your organization to an AI security server you choose, and hold each request for an allow or deny verdict before Claude processes it. This page walks through turning the feature on, connecting your server, and controlling enforcement. To learn what Inference hooks are and when to use them, see the [Inference hooks overview](https://platform.claude.com/docs/en/manage-claude/inference-hooks). To build the AI security server itself, see [Develop an Inference hooks integration](https://platform.claude.com/docs/en/manage-claude/inference-hooks-endpoint).
from line 14
1414
1515You need:
1616
17* The `organization:manage` permission in claude.ai. The built-in **Admin**, **Owner**, and **Primary owner** roles hold it, as does any custom role it has been granted.
17* The `organization:manage` permission in claude.ai, which only the **Owner** and **Primary owner** roles hold. The **Admin** role doesn't have it.
1818* An AI security server HTTPS endpoint that accepts verdict requests: an `https://` URL on port 443, on a publicly routable host, reachable without redirects. Reverse-tunnel hosts (ngrok and similar tunnel services) are not supported: Anthropic's network policy blocks them. Don't test through a tunnel; host your server on a domain you control. For the full [hosting requirements](https://platform.claude.com/docs/en/manage-claude/inference-hooks-endpoint#receive-a-request), and to build the server and verify signed requests, see [Develop an Inference hooks integration](https://platform.claude.com/docs/en/manage-claude/inference-hooks-endpoint).
1919
2020## Set up Inference hooks
managed-agents/multiagent-orchestration Changed · +3 / -1 lines
from line 1415
14151415
14161416### Tool permissions and custom tools
14171417
1418If a subagent needs something from your client, such as [permission](https://platform.claude.com/docs/en/managed-agents/events-and-streaming#tool-confirmation) to run an `always_ask` tool, or the [result of a custom tool](https://platform.claude.com/docs/en/managed-agents/events-and-streaming#handling-custom-tool-calls), the event is cross-posted to the **primary thread** with `session_thread_id` identifying the originating session thread.
1418If a subagent needs something from your client, such as [permission](https://platform.claude.com/docs/en/managed-agents/events-and-streaming#tool-confirmation) to run a tool call or the [result of a custom tool](https://platform.claude.com/docs/en/managed-agents/events-and-streaming#handling-custom-tool-calls), the event is cross-posted to the **primary thread** with `session_thread_id` identifying the originating session thread. A tool call needs your permission under `always_ask`, or under [`auto`](https://platform.claude.com/docs/en/managed-agents/permission-policies#let-the-server-evaluate-each-call-with-auto) when the server reaches no determination.
14191419
14201420```json
14211421{
from line 1431
14311431```
14321432
14331433Post `user.tool_confirmation` (with `tool_use_id`) or `user.custom_tool_result` (with `custom_tool_use_id`); the server routes the response to the correct thread automatically.
1434
1435Under `auto`, your `user.message` events can lead the server to allow a call it would otherwise deny. Nothing in a subagent's thread counts as your intent: your client posts no messages there, and the coordinator's messages to the subagent do not count. When the server denies a call under `auto`, nothing is cross-posted: the event and the error tool result appear only on the subagent's own [thread stream](https://platform.claude.com/docs/en/managed-agents/multiagent-orchestration#session-thread-events), and the subagent keeps running.
14341436
14351437The following example extends the [tool confirmation handler](https://platform.claude.com/docs/en/managed-agents/events-and-streaming#tool-confirmation) to route replies. The same pattern applies to `user.custom_tool_result`.
14361438
managed-agents/tools Changed · +1 / -1 lines
from line 31
3131
3232## Configuring the toolset
3333
34Enable the full toolset with `agent_toolset_20260401` when creating an agent. Use the `configs` array to disable specific tools or override their settings. Each config entry can also set a `permission_policy` that controls whether the tool's calls are auto-approved or require confirmation. See [Permission policies](https://platform.claude.com/docs/en/managed-agents/permission-policies) for the available policy types.
34Enable the full toolset with `agent_toolset_20260401` when creating an agent. Use the `configs` array to disable specific tools or override their settings. Each config entry can also set a `permission_policy` that controls whether the tool's calls run without confirmation, require confirmation, or are evaluated individually by the server. See [Permission policies](https://platform.claude.com/docs/en/managed-agents/permission-policies) for the available policy types.
3535
3636Config entries for `web_search` and `web_fetch` also accept domain filters and other web settings; see [Restrict web search and web fetch domains](https://platform.claude.com/docs/en/managed-agents/tools#restrict-web-search-and-web-fetch-domains).
3737