Claude API 2026-10-21: pin the SDK until sampling parameters are gone

Verdict, October 22, 2026. Mid as a same-day upgrade. OP to stay on a pinned SDK, which still sends anthropic-version: 2023-06-01, when a request needs a non-default temperature, top_p, or top_k on a model that still accepts one, or when Amazon Bedrock is still on Opus 4.6 or earlier. OP to take the new SDK majors on a planned release once those requests are fixed, the gateway reads Authorization, and the license entry says Apache 2.0. On Claude 4.7 and later, sampling was already stuck at the defaults. The version history page lists 2023-06-01 and states no retirement date. No letter moves on the Frontier Models board. S stays locked. This is the platform API and the ant CLI, not the Claude Code client in yesterday's note. OP or Mid has not sent a request on 2026-10-21.

Anthropic's release notes, migration guide, version history, model-deprecations page, and user-profiles page, read October 22, 2026. Behavior described there is a vendor claim.

What returns 400

NERF API version 2026-10-21 shipped October 21, 2026. Python SDK 2.0.0, TypeScript SDK 1.0.0, C# SDK 13.0.0, Go SDK 2.0.0, Java SDK 3.0.0, PHP SDK 1.0.0, Ruby SDK 2.0.0, and ant CLI 2.0.0 send it by default, including on Amazon Bedrock and Google Cloud. Without an SDK, set anthropic-version. The version history page lists it for the Claude API, Claude Platform on AWS, Microsoft Foundry, and Google Cloud, and on Bedrock only for Claude 4.7 and later. The Messages rules also cover token counting and each request in a Message Batch created with this version. Sources: October 21 release notes (opens in a new tab), migration guide (opens in a new tab), version history (opens in a new tab).

REMOVED Sending temperature, top_p, or top_k returns a 400, even at the default. The new SDK and CLI drop all three. Omit them and the request samples at the defaults, including a temperature of 1.0, the same as a 2023-06-01 request that left them out. Claude 4.7 and later already accept only those defaults. On a model that still accepts other values, the guide's example is Claude Sonnet 4.6, and a lowered temperature stops doing anything. The guide says no other setting replaces it. The parameter table says to omit them and use prompting. Keep the request on 2023-06-01 if you need the non-default value. That does not help Claude 4.7 and later or Claude Mythos Preview: earlier API versions already 400 a non-default value there. Sonnet 4.6 is still Active. Sources: migration guide (opens in a new tab), API parameter deprecations (opens in a new tab).

NERF A document block placed directly in an assistant message returns a 400. Put documents on user messages. A document nested in another block, such as a web fetch tool result, is still accepted. A non-empty citations array on a text block in a user message, including inside a search_result, also returns a 400. Citations on assistant text stay accepted, and so does {"citations": {"enabled": true}} on documents and search results. Source: migration guide (opens in a new tab).

NERF Admin API and Claude Enterprise Analytics responses drop old names: roles becomes role_ids, group_id becomes rbac_group_id, name becomes display_name, group_type becomes group.type, API-key workspace_id becomes scope, actor.email becomes actor.email_address, and summaries becomes data. The group_type query and the workspace_id list filter stay. A null workspace_id used to mean Default or an all-workspaces key. scope.workspace_id is now the real ID, including Default. An all-workspaces key is scope type organization and has no workspace_id. Code that treated null as Default should compare against the workspace named "Default" from List Workspaces with include_default=true. Source: migration guide (opens in a new tab).

What the SDK major breaks on its own

NERF The new majors also break things that do not depend on the API version. Earlier versions sent 2023-06-01 on every request, and the removed parameters and old field names leave the types, flags, and output. The key goes out as Authorization: Bearer instead of X-Api-Key. The Claude API accepts either header, so a direct caller needs no change for that swap. A gateway that reads X-Api-Key does, and ant cannot add a header, so it cannot send X-Api-Key. Foundry clients in the guide still send x-api-key. A key and a token now share one header: passing both is an error. To send both, keep the token, set X-Api-Key yourself, and have the gateway strip Authorization before it forwards. Source: migration guide (opens in a new tab).

# Before
X-Api-Key: <key>

# After
Authorization: Bearer <key>

REMOVED ant 2.0.0 drops --api-key and --auth-token. Both have warned since v1.27.0. A command that still passes one stops with flag provided but not defined. Use ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN, the stdin flags, or ant auth login. MessageParam is now one type per role. A Python dict needs no change. Calling MessageParam(...) raises TypeError. A TypeScript literal that names its role still type-checks.

# Before
message = MessageParam(role="user", content="Hello")

# After
message: MessageParam = {"role": "user", "content": "Hello"}

Text Completions leaves the TypeScript, Go, Java, and Ruby SDKs and the CLI. Use ant messages create and read content.0.text instead of completion. Non-beta Models methods no longer take betas. In Ruby, passing betas: to client.models does not raise and no longer sets the header. Go SDK 2.0.0 requires Go 1.25 or later. C# IChatClient adapters ignore Temperature, TopK, and TopP. These versions are Apache 2.0. Earlier versions stay MIT. No code change for the license. Update the entry if you track one. @anthropic-ai/bedrock-sdk, @anthropic-ai/vertex-sdk, @anthropic-ai/foundry-sdk, @anthropic-ai/aws-sdk, and @anthropic-ai/google-cloud-sdk, plus C# Anthropic.Bedrock, Anthropic.Vertex, Anthropic.Foundry, Anthropic.Aws, Anthropic.GoogleCloud, and Anthropic.Mcp, change license in their own 1.0.0 releases. Java covers every com.anthropic artifact. Source: migration guide (opens in a new tab).

Who can keep the pin

UPDATE The version history page lists 2026-10-21, 2023-06-01, and 2023-01-01, recommends the latest version, and states no retirement date for 2023-06-01. The guide's alternative for a non-default sampling value is to keep that request on 2023-06-01. The user-profiles create example still sends that header. That is the documentation. We did not call the API. Sources: version history (opens in a new tab), migration guide (opens in a new tab), user profiles (opens in a new tab).

The guide does not say a caret range installs these majors. npm's caret stops at the left-most non-zero component: ^1.2.3 is >=1.2.3 <2.0.0-0, and ^0.2.3 is >=0.2.3 <0.3.0-0. The last TypeScript SDK version the release notes name before October 21 is 0.130.0, on September 30, 2026, so a caret on 0.130.0 does not include 1.0.0. PHP: composer update stays inside the current constraint. The upgrade command is composer require "anthropic-ai/sdk". Go's old path keeps installing the latest v1, with no error or warning.

# Before
go install 'github.com/anthropics/anthropic-cli/cmd/ant@latest'

# After
go install 'github.com/anthropics/anthropic-cli/v2/cmd/ant@latest'

The Go SDK import becomes github.com/anthropics/anthropic-sdk-go/v2. On Bedrock, stay on today's SDK for Opus 4.6 and earlier, then switch those calls to Claude 4.7 or later before this API version. v1 of the TypeScript platform packages needs v1 of @anthropic-ai/sdk. Upgrade them together, or the package manager installs a second, older copy. A lockfile, an exact pin, an npm caret on the current 0.x or 1.x line, composer update, and the old Go path do not take this major by themselves. An explicit upgrade, @latest on the v2 Go path, or composer require does. Sources: node-semver caret ranges (opens in a new tab), September 30 release notes (opens in a new tab), migration guide (opens in a new tab).

Enforcement fields are separate

NEW The same October 21 notes add enforcement_status and enforcement_actions on user profiles, which shipped October 20. The user-profiles page does not say they require 2026-10-21. user-profiles-2026-09-04 and earlier omit them. Status is unrestricted, restricted, or banned. An open action means Anthropic refuses some or all inference that carries that profile ID. Writing either field returns a 400. List with enforcement_status[]=restricted and enforcement_status[]=banned. A change does not reliably move updated_at. On Claude Platform on AWS the status stays unrestricted, the list stays empty, and an open action does not refuse requests there. Sources: October 21 release notes (opens in a new tab), user profiles (opens in a new tab).

The board stays put

No letter moves. The Claude 5.5 family stays in A on the Frontier Models board. S stays locked. AI Coding Agents stays put. The Claude row is unchanged.

What to do today

Release the upgrade with the fixes, and test against 2026-10-21 before that release. Source: migration guide (opens in a new tab).

Pin if the range has no ceiling. A caret on the current line does not pull these majors.
Delete the three sampling parameters, direct assistant document blocks, and user-message citations before the header flips. Keep 2023-06-01 where Sonnet 4.6, or another model that still accepts it, needs a non-default value.
Leave Bedrock's Opus 4.6 and earlier on today's SDK. Point gateways at Authorization, pass one credential, and drop ant --api-key and --auth-token.
On the bump, move TypeScript platform packages to v1 with @anthropic-ai/sdk, switch the Go import on Go 1.25 or later, and record Apache 2.0 if you track licenses.
Platforms: drop user-profiles-2026-09-04 or earlier to read enforcement. Do not read a ban from Claude Platform on AWS.

The weekly patch is on beehiiv: subscribe free (opens in a new tab).

The OP or Mid Team

Sources

Checked October 22, 2026.