Requests refused by your organization's data-loss-prevention policy now show the exact reason instead of a generic failure.
What's wrong with this entry?
When a server refuses a request under an organization's data-loss-prevention policy, Claude Code now recognises the specific error code dlp_request_denied instead of showing a generic failure. It is treated as terminal for that request body, counted as a refusal when deciding whether a turn completed, and reported as the exact error detail rather than truncated free text. No client flag governs this; it activates whenever your organization's server returns that code.
- Added to the
api_errorunion in the SDK message schema, documented there as terminal for that request body, with a note that anything replaying history must not re-send it. - Carried through query results as an
isDlpDeniedflag. - Turn-completion telemetry now records a
verdictofdlp_denied, separate from the plainrefusalverdict. - None of this code exists in 2.1.238.
dlp_request_denied, dlp_request_denied: the request was refused by the organization's data-loss-prevention policy
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Related
Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.
-
v2.1.228
API rejections are classified from a structured marker instead of prose alone
Both mention error
-
v2.1.228
Oversized media in a request is now its own rejection class
Both mention error
-
v2.1.229
Render errors are now reported instead of silently blanking
Both mention error