{"version":"2.1.321","anchor":"api-calls-from-user-delegated-sessions-are-route-restricted","canonical_anchor":"api-calls-from-user-delegated-sessions-are-route-restricted","heading":"User-delegated sessions are blocked from some API routes","tier":"notice","area":"Delegated Sessions","scope":"org","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.321\/e\/api-calls-from-user-delegated-sessions-are-route-restricted","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.321","markdown":"### User-delegated sessions are blocked from some API routes\n\nIn a user-delegated session, Claude Code now refuses API calls to routes that are not allowed and shows an error\n\n**Unclear.** It is not clear what makes a session user-delegated, so it is unclear who is affected.\n\n**What**\n\nBefore Claude Code calls its API, it now checks which route, or address, the call goes to. In a user-delegated session, a call to a route that is not allowed stops with the error \"API route not allowed in a user delegated session\". The earlier check still runs after this one.\n\n**Why**\n\nThis narrows what a user-delegated session can reach over the network.\n\n- Area: Delegated Sessions\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 4\/5\n- Scope: org\n- Heads-up: no"}