Service eligibility and regional restrictions
PuppyIP serves only compliant overseas businesses and their authorized personnel. Proxy services are not available in mainland China. The service may only be used for lawful business activities outside mainland China. Use of this service within mainland China is prohibited.
Hosting a proxy IP or server overseas does not change these restrictions. The service must not be provided to end users in mainland China through relaying, forwarding, sharing or resale. Before use, read the Terms of Service.
Key Takeaways
- On August 19, 2026, Anthropic announced GA for member, invitation, group, and custom-role user-management endpoints in Claude Enterprise organizations.
- Group and custom-role requests no longer require the ce-user-management beta header. Requests that retain the old header are still accepted with the same behavior.
- Claude Enterprise and Claude Console share some Admin API paths but offer different resources. Groups and custom roles are Enterprise-only.
- Admin API keys need members or rbac_groups scopes appropriate to their read/write tasks. Custom roles are read-only; changes still happen in claude.ai organization settings.
- SCIM groups and identity-provider-managed members cannot be freely overwritten through the API. Invitations also consume limited seats, so design idempotency and rollback before migrating.
Who is actually affected by this GA release
This update targets IT administrators, identity-platform teams, and automation developers in Claude Enterprise (claude.ai) organizations. Typical tasks include synchronizing members, sending or revoking invitations, maintaining group membership, reading custom roles, and integrating employee onboarding and offboarding with enterprise systems. It is not a Claude model-capability update and does not give ordinary Claude API projects new inference features.
The most common failures are not missing endpoints, but mixing Claude Console and Claude Enterprise organizations, granting an Admin API key excessive permissions, attempting to overwrite SCIM-managed objects, or overlooking invitations' effect on the seat pool. Before launch, map responsibilities across “identity source—organization—member—group—role—seat.”
How to handle the beta header after GA
The August 19 release notes explicitly state that member, invitation, group, and custom-role endpoints are GA. Group and custom-role requests no longer require `anthropic-beta: ce-user-management-2026-07-13`. For compatibility with existing integrations, requests that still send this header remain accepted with identical behavior. Member and invitation requests did not require this header even during beta.
Do not remove the header, rotate keys, change pagination, and rewrite permission logic all at once. Record current responses in a test organization first, then remove only the beta header for comparison. Deploy after confirming identical status codes, fields, pagination, and write results. Continued support for the old header means there is no emergency shutdown, but set a cleanup date to avoid a lasting dependency on an outdated marker.
Distinguish Enterprise and Console organizations first
The Admin API organization path is `https://api.anthropic.com/v1/organizations/`, but the two organization types use different keys and receive different resource subsets. Members and invitations are available to both. Groups, custom roles, and spend limits serve Claude Enterprise, while administrative resources such as workspaces, API keys, usage and costs, and rate limits belong to Claude Console organizations.
A shared base path does not make every endpoint universal. Include organization type, Admin API key origin, target resource, and the official availability matrix in configuration checks. For 403 or 404 responses, check the organization and resource scope first; do not try to bypass permissions by changing networks or regions or repeating requests.
Separate least-privilege scopes by resource
Reading members and invitations uses `read:members`; writing and deleting them uses `write:members`. Reading groups uses `read:rbac_groups`; writing groups and memberships uses `write:rbac_groups`. Custom roles have no separate scope and are read with `read:members`. A read-only audit key with `read:org_audit` can also call these GET endpoints, but that does not make it appropriate for write workflows.
Give each automation task its own key with only the required scopes, and record its creator, expiry, and rotation owner. Member and invitation requests also require `anthropic-version: 2023-06-01`; group and custom-role requests do not require that version header. Do not blindly assume a generic client can use identical headers for every resource.
Boundaries for roles, SCIM, and custom roles
The API can set ordinary member roles to `user` or `managed`, but `owner`, `membership_admin`, and the unique `primary_owner` are still managed in claude.ai organization settings and cannot be assigned, changed, or removed through this endpoint. Custom roles and their attachment to groups are also maintained only in organization settings; the API reads roles and permissions.
Groups whose `source_type` is `direct` can be created, renamed, deleted, and have their membership adjusted through the API. `scim` groups belong to the identity provider and are read-only; writes return 400. If advanced SSO or SCIM already manages members or roles, related API changes may also return 400. Keep a single authoritative identity source rather than creating a second writer that overwrites the IdP.
Do not overlook invitations, seats, rate limits, or pagination
Creating an invitation sends an email. It is pending before acceptance and may later become accepted or expired; only pending invitations can be revoked. In a limited seat pool, pending invitations consume a seat and automatically use the lowest available tier. If no seat is free, the request returns 400 and does not buy one automatically. A seat returns to the pool only after revocation, expiry, or member removal. Check seats before bulk onboarding, and handle duplicate emails and existing members idempotently.
The Admin API generally shares a limit of 100 requests per minute across an organization, with an additional invitation-creation limit of 1,200 per hour. Members and invitations use ID-based pagination; groups and custom roles use opaque cursors. A synchronization process must continue until `has_more` is false or `next_page` is null and handle 429 responses. Do not fetch only the first page and mistake missing members for users to delete.
Production migration and rollback checklist
Before launch, confirm organization type; list the resources actually called; separate scopes for read and write tasks; save response samples before and after removing the beta header; route SCIM and direct objects separately; check seats in advance; implement pagination, 429 backoff, and idempotent repeated invitations; prohibit administrative-role changes through the API; preview impacts and require approval before deleting members or groups; and retain an object-ID-based rollback or manual repair path.
If a call fails, check organization type, scope, identity source, seats, status, and rate limits first. Use the layered network troubleshooting checklist only when there is evidence of DNS, connection, TLS, or proxy-authentication problems. For basic API fields, see the AI API configuration guide. For stable access to official documentation, you can visit the PuppyIP website, but a network exit cannot change an Enterprise plan, scopes, or SCIM ownership.
Sources
Frequently Asked Questions
Must I remove the beta header immediately after Claude Enterprise user management reaches GA?
No urgent removal is required. Official guidance says the old ce-user-management header is still accepted with the same behavior. Use a single-variable comparison test, then clean it up on schedule.
Can Claude Console organizations also use group and custom-role endpoints?
Do not assume equal capabilities. The official matrix shows group and custom-role endpoints as Claude Enterprise-only; Console organizations have a different set of administrative resources.
Can the Admin API grant owner or primary_owner?
No. The API can set members only to user or managed. Administrative roles must be handled in claude.ai organization settings.
Why does changing a SCIM group return 400?
A group whose source_type is scim belongs to the identity provider and is read-only through the API. Change it in the IdP and avoid two systems overwriting each other.
Does creating an invitation automatically purchase a new Claude seat?
No. If a limited seat pool has no free seat, the request returns 400. A pending invitation itself consumes an existing seat.
If I get 403 after removing the beta header, should I change proxies first?
No. Check organization type, Admin API key, scope, and resource availability first. Investigate the proxy connection only when there is a clear network-layer error.