PermissionRequest
A Claude Code hook event, read out of the shipped bundle. No mined inventory carries it: everything below comes from what this site has written about it.
When a tool call needs a permission decision
Anthropic's own wording. Read off Hooks reference, captured 2026-10-22.
In the changelogs
40Releases whose published page names PermissionRequest.
-
v2.1.307
PermissionRequest hooks can now approve a request another hook raised
When a hook asks for approval, a PermissionRequest hook can now answer allow, where before it could only deny
named in this entry, found in this entry's text
-
v2.1.307
Hook decisions on tool use now go through a central permission check
Allow, ask and deny decisions from PreToolUse and PermissionRequest hooks now pass through a central permission check that handlers can answer
named in this entry, found in this entry's text
-
v2.1.304
Permission request hooks can refuse a tool before you are asked
When a tool would ask for your permission, PermissionRequest hooks can now run first and turn that question into a refusal
found in this entry's text, named in this entry
-
v2.1.304
SDK sessions can mark MCP tools that run code, so auto mode checks them
SDK sessions can now name MCP tools that run model-written code, so auto mode reviews calls to them and hooks cannot change the permission mode
found in this entry's text
-
v2.1.300
Hook-changed tool input is checked and can be refused if it is malformed
When a hook changes a tool call's input, Claude Code checks it against what the tool accepts and can refuse the call if it does not fit
found in this entry's text, named in this entry
-
v2.1.300
Startup warning now says when invalid managed settings drop security hooks
If invalid managed settings include PreToolUse or PermissionRequest hooks, the startup message now says those hooks are not loaded
found in this entry's text
-
v2.1.300
Hooks can no longer change the permission mode in Cowork cloud sessions
In Cowork cloud sessions, or where an MCP tool runs code, a
PermissionRequesthook's allow answer can no longer switch the permission modefound in this entry's text, named in this entry
-
v2.1.300
Clearer warning when a managed hook cannot be loaded
Settings checks now explain that an unloadable managed hook, and every other hook in that file, does not run
found in this entry's text
-
v2.1.299
Denied permission answers passed on from a subagent no longer run PermissionRequest hooks
When a subagent's permission answer is a denial, Claude Code now skips
PermissionRequesthooks instead of always running themfound in this entry's text, named in this entry
-
v2.1.299
Hooks can no longer approve some tools while auto mode is on
In auto mode, an allow answer from a
PermissionRequesthook is now ignored for certain toolsfound in this entry's text, named in this entry
-
v2.1.296
Stalled remote tool calls and approvals have new recovery steps
Claude Code now tracks remote tool calls that go silent and can reapply an approval answer given before a restart, running PermissionRequest hooks first
found in this entry's text
-
v2.1.296
A permission hook's allow no longer goes through if stricter rules were lost
When a
PermissionRequesthook allows with permission updates, Claude Code withholds the allow if any stricter rule was lostfound in this entry's text
-
v2.1.295
A new setting limits what your own skills, agents and hooks can do
Setting CLAUDE_CODE_RESTRICT_PERSONAL_CONFIG stops your own skills, agents and hooks from widening permissions, and makes key hooks required
found in this entry's text
-
v2.1.295
New option to block a session when your personal settings file is broken
With
CLAUDE_CODE_RESTRICT_PERSONAL_CONFIGset, errors in your user settings file block every prompt and tool call until they are fixedfound in this entry's text
-
v2.1.295
Hook permission answers are read differently
Claude Code now reads every
PermissionRequesthook answer as allow, and aPreToolUseanswer only when it is set and is not denyfound in this entry's text
-
v2.1.295
Plugin hooks on another machine can no longer change a tool call's input
If a plugin hook on another machine changes a tool call's input, Claude Code now refuses the call instead of running it
found in this entry's text
-
v2.1.293
Cloud sessions deny permission requests when a PermissionRequest hook can't run
In cloud sessions, a
PermissionRequesthook that is a command, script, HTTP or MCP tool hook now causes the request to be deniedfound in this entry's text, named in this entry
-
v2.1.290
Hooks can no longer approve desktop tools in hosted sessions
PermissionRequesthooks are now blocked from approving a hosted session's desktop tools, and a broken hook command gets a clearer errorfound in this entry's text
-
v2.1.290
WebFetch refuses hook approvals that attach arguments it can't check
If a PermissionRequest hook approves a web fetch but attaches arguments WebFetch can't check, Claude Code now denies the fetch
found in this entry's text
-
v2.1.288
Tool calls are blocked when Claude Code can't prepare or match their hooks
If Claude Code can't work out which hooks apply to a tool call, or can't package the hook input, it now blocks the call with an error
found in this entry's text
-
v2.1.284
Headless runs now also wait for MCP servers named in allow rules and hooks
Before a -p run's first turn, Claude Code now also counts MCP servers named in allow rules and mcp_tool hooks as ones to wait for
found in this entry's text
-
v2.1.284
Always allow for web fetches and searches lasts only for the session in some cases
In certain sessions, choosing to always allow WebFetch or WebSearch now lasts only for that session and is not saved to your settings
found in this entry's text
-
v2.1.284
Hooks cannot grant web fetching or searching in Projects sessions
In Projects sessions, a
PermissionRequesthook can no longer approve WebFetch or WebSearch or loosen their rulesfound in this entry's text
-
v2.1.283
Hooks can no longer change calls to the account memory server
Hooks may still allow or block calls to the account memory server, but a call they try to rewrite is denied and a rewritten result is dropped
found in this entry's text
-
v2.1.282
Skills and plugin commands can no longer grant themselves tools under managed-only permission rules
When policy restricts permission rules to managed settings, tool grants written into skills and plugin commands are ignored
found in this entry's text
-
v2.1.274
New guard against permission hooks silently approving foreign-artifact reads
New messaging explains exactly why a foreign-org artifact read was blocked, including when a PermissionRequest hook auto-answered instead of the user
found in this entry's text
-
v2.1.271
Hook-exec keepalive for remote/CCR sessions
Remote and CCR sessions now hold a keepalive open while certain hooks are running
found in this entry's text
-
v2.1.271
Hook-dispatch keepalive hold, gated off by default
A new keepalive mechanism can keep remote hook connections open during slow hooks, off by default
found in this entry's text
-
v2.1.271
Strict-kind permission-request hook path added for headless/agent tools
Claude Code now rejects a permission hook's modified input if it doesn't match what was actually requested, for 'strict' tool calls
found in this entry's text
-
v2.1.257
Hooks declared outside the "hooks" key (or PreToolUse/PermissionRequest nested arrays) now fail to load with a clear error
A plugin or agent declaring PreToolUse or PermissionRequest hooks in the wrong place is now rejected with a clear error.
found in this entry's text, named in this entry
-
v2.1.257
Hook-triggered abort now unwraps sub-agent turn controllers
A hook interrupting a sub-agent or forked turn now aborts the real turn controller instead of doing nothing.
found in this entry's text
-
v2.1.257
Skills reject top-level PreToolUse/PermissionRequest hooks in frontmatter
A skill declaring permission hooks outside the hooks object no longer loads them or its allowed-tools.
found in this entry's text
-
v2.1.257
Same top-level-hooks guard extended to plugin hooks.json files
A plugin hooks.json with permission hooks outside the hooks key now throws instead of loading malformed config.
found in this entry's text
-
v2.1.257
Stricter hook-config validation for PreToolUse/PermissionRequest guard entries
Malformed permission-hook entries are now flagged with a warning that the neighbouring permission guard may not apply.
found in this entry's text
-
v2.1.257
Hooks module scanning now flags PreToolUse/PermissionRequest declared outside the hooks object
Permission hooks declared at the top level of hooks.json now give a message pointing at the misconfiguration.
found in this entry's text
-
v2.1.248
Hook schema failures now print the exact field, a template, and which tool failed
A bad hook response now shows the exact failing field, the output and a template.
found in this entry's text
-
v2.1.248
New hook events and compiled-in plugin admission defaults
Three new hook event names appear, and unverified plugins are still allowed to load.
found in this entry's text
-
v2.1.236
Some hook events take a separate dispatch path
Six hook events now wait on a readiness step before running; the rest are unchanged.
found in this entry's text
-
v2.1.227
PermissionRequest hooks can interrupt the whole turn
A PermissionRequest hook can now set
interruptto stop the whole turn, not just one tool call.named in this entry, found in this entry's text
-
v2.1.21
Enhanced PermissionRequest Hook Error Messages
found in this entry's text
First cited
9The earliest release whose published evidence quoted PermissionRequest was v2.1.21, 28 Jan 2026. That is the oldest release this project wrote about it, so it is a floor on the name's age and not the release that introduced it. It is not a presence reading: which builds carried the name is the table below.
3 further spans in the ledger name it. The list above is the earliest first and stops at 6.
Presence across releases
0The miner has never read a build containing this name. It is here because a changelog entry of ours names it, which is evidence that it existed and not evidence of which releases carried it. The inventory starts at v2.1.138 and everything older than that was never mined.
Read out of the published npm bundle release by release, and out of Anthropic's own documentation as this site captured it. Nothing on this page is a description anybody here wrote about what the hook event does. All hook events.