How to Set Up Anthropic Organization Webhooks While Events Are Not Live

You will learn: what can be registered now, why it will not deliver events yet, which two event types are documented, how to prepare a receiver, and why these are different from Claude Managed Agents webhooks. The screenshots show Anthropic's public documentation. We did not create an endpoint or receive a live event.

Check availability and the right account role

The October 20 release notes mark organization webhooks as an Admin API beta. The live guide checked 21 October displays an explicit notice that event delivery is not live and an endpoint receives nothing yet. It still documents registration so teams can prepare a handler. Anthropic says the Claude API organization needs the beta enabled and must not have HIPAA readiness enabled. The access path is to contact the Anthropic account team. The guide lists an Admin API key, an OAuth bearer token with org:admin, or a personal or service account key that is not scoped to a workspace as accepted credentials.

Any organization member can list or view endpoint records. Only an admin, owner or primary owner can create, change or delete one, or replace its signing secret. If an Admin API call returns 404, Anthropic lists missing beta header, feature access, HIPAA readiness, an unsupported credential, or a missing endpoint among the possible causes; 403 can mean insufficient role permission. Those codes alone do not identify the cause.

Subscribe to one or both documented events

The official event table contains two types, both about Anthropic enforcement against one of your organization's user profiles:

The documented event example includes an event ID, the user-profile ID, an enforcement-action ID and organization ID. It does not embed the full profile or action. When delivery becomes active, a receiver should verify the signature and retrieve the profile by data.id to see its current enforcement_status and open actions. Anthropic's described delivery design allows late or out-of-order events, so the retrieved state matters more than arrival order. A 404 on retrieval can mean the profile was deleted. These are specifications for a receiver, not observed live behavior today.

Register the endpoint using Anthropic's documented fields

The beta API reference lists POST /v1/organizations/webhooks to create an endpoint and GET /v1/organizations/webhooks to list endpoints. Anthropic's guide requires an HTTPS URL on port 443 with a public domain name, plus at least one type in enabled_events. The example below is in Anthropic's documentation, not a procedure we ran:

The same reference also lists get, update, delete and secret-regeneration operations under /v1/organizations/webhooks. A disabled endpoint still counts toward Anthropic's documented limit of 32 endpoints per organization. When an update supplies enabled_events, it replaces the full event list. If you need to stop delivery, set the endpoint state to disabled or delete it; Anthropic says an empty event list does not clear an existing list.

Prepare delivery checks for when events go live

Anthropic's documented delivery design uses Standard Webhooks headers: webhook-id, webhook-timestamp and webhook-signature. When delivery starts, verify the signature with the endpoint's signing secret before trusting a message. The planned receiver should return a 2xx response within five seconds and perform slower work afterward. Deduplicate on event ID, because the guide says a duplicate can carry the same one.

Once delivery is live, Anthropic's guide says failed deliveries get a few retries over the next few minutes, then may be dropped. A redirect, a URL resolving to a non-public IP address, or continuing failures can disable the endpoint. For recovery, the guide describes listing profiles by restricted and banned enforcement status and continuing through next_page until it is null. This is a future receiver design to test after launch, not evidence that notifications are being sent now.

Do not confuse this with Managed Agents webhooks

Anthropic's Managed Agents webhook guide describes notifications for agent session and resource changes. Those use a different product workflow and event family. An organization webhook's user_profile.enforcement_action_opened is not a session-completion event, and registering a Managed Agents webhook does not subscribe you to profile restrictions. That distinction matters when a search result mentions “Anthropic webhooks” without naming the product.

This release concerns access and safety events for platforms serving end customers. It does not measure how Claude describes a brand in an answer. Xtrusio records AI answers and cited sources for that separate visibility question. Xtrusio publishes this article; it does not claim to administer Anthropic organization webhooks.

Sources

• Anthropic, Claude Platform release notes, 20 October 2026. Beta launch and access requirement. Checked 21 October 2026.
• Anthropic, Organization webhooks guide. Current no-delivery notice, eligibility, roles, planned events and delivery behavior. Checked in a live browser 21 October 2026.
• Anthropic, Organization Webhooks API reference. Endpoint operations. Checked 21 October 2026.
• Anthropic, Managed Agents webhooks guide. Different agent-session event family. Checked 21 October 2026.