You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
3Signal: worth watching, 1 to 5
ErrorsArea: what it touches
New FeaturesKind: in v2.1.239,
New FeaturesSection of the release
What
When a server refuses a request under an organization's data-loss-prevention policy, Claude Code now recognises the specific error code dlp_request_denied instead of showing a generic failure. It is treated as terminal for that request body, counted as a refusal when deciding whether a turn completed, and reported as the exact error detail rather than truncated free text. No client flag governs this; it activates whenever your organization's server returns that code.
Details
Added to the api_error union in the SDK message schema, documented there as terminal for that request body, with a note that anything replaying history must not re-send it.
Carried through query results as an isDlpDenied flag.
Turn-completion telemetry now records a verdict of dlp_denied, separate from the plain refusal verdict.
None of this code exists in 2.1.238.
Evidence
dlp_request_denied, dlp_request_denied: the request was refused by the organization's data-loss-prevention policy
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
