---
title: "Create User Profile"
method: POST
path: "/v1/user_profiles"
---

# Create User Profile

`POST /v1/user_profiles`

## Request

- Base URL: `https://api.anthropic.com`
- URL: `https://api.anthropic.com/v1/user_profiles`
- Auth: none declared

## Headers

- `anthropic-version` string: The version of the Claude API you want to use. Read more about versioning and our version history [here](https://platform.claude.com/docs/en/api/versioning).
- `anthropic-workspace-id` string

## Request body

- CreateUserProfileRequest: The settings for a new user profile. Each request creates a new profile, even when another profile already has the same values.
  - `name` string, nullable: Optional for all profiles. Real-world name of the entity this profile represents (company or individual); for a company the platform resells Claude access to (`access_type` `passthrough`), that company's name where known. Maximum 255 characters.
  - `access_type` 'application' | 'passthrough': How the platform uses the API on behalf of the entity this profile represents. `application`: the platform sells a product that uses the API behind the scenes, and the profile represents an individual end-user of that product. `passthrough`: the platform resells raw inference, and the profile identifies the resold-to company.
  - `external_user_details` UserProfileExternalUserDetailsParams
    - `reference_id` string, nullable: The platform's own reference for the entity, for example the key of the end-user's row in the platform's database. Not interpreted by Anthropic and not enforced unique. 1 to 255 characters.
    - `onboarded_at` string, date-time: A timestamp in RFC 3339 format
    - `account_status` 'active' | 'suspended' | 'blocked': The status of the entity's account on the platform, as the platform states it: `active`; `suspended`, when the platform has restricted the account and may restore it; or `blocked`, when the platform has barred it. It records the platform's decision only. The statuses that Anthropic itself reports for the profile, such as its status in a program, are Anthropic's decisions and do not change with it.
    - `entity_type` 'individual' | 'business' | 'non_profit' | 'government': What kind of entity the profile represents, as the platform states it: `individual`, `business`, `non_profit` or `government`.
    - `country` string, nullable: The country of the entity (not of the platform), as the platform determines it: an ISO 3166-1 alpha-2 code in upper case, for example `US`. Only the form, two uppercase ASCII letters, is checked.
    - `name_hash` string, nullable: A hash of the entity's name, computed by the platform. Anthropic treats it as an opaque string and does not prescribe the hash function. 1 to 255 characters.
    - `email_hash` string, nullable: A hash of the entity's email address, computed by the platform. Anthropic treats it as an opaque string and does not prescribe the hash function. 1 to 255 characters.
  - `metadata` object: Free-form key-value data to attach to this user profile. Maximum 16 keys, with keys up to 64 characters and values up to 512 characters. Values must be non-empty strings.

## Response `200`

Successful response (OK)

- UserProfile: A record of an entity that the platform serves through the API, such as an end-user of the platform's product or a company that the platform resells Claude access to. A Messages, Message Batches or token counting request can send a profile's `id` in the `anthropic-user-profile-id` header to attribute the request to that entity.
  - `id` string, required: Unique identifier for this user profile, prefixed `uprof_`.
  - `type` 'user_profile', required: Object type. Always `user_profile`.
  - `name` string, nullable, required: Real-world name of the entity this profile represents (company or individual). For a company the platform resells Claude access to (`access_type` `passthrough`) this is that company's name. `null` until the platform supplies one.
  - `access_type` 'application' | 'passthrough', required: How the platform uses the API on behalf of the entity this profile represents. `application`: the platform sells a product that uses the API behind the scenes, and the profile represents an individual end-user of that product. `passthrough`: the platform resells raw inference, and the profile identifies the resold-to company.
  - `external_user_details` UserProfileExternalUserDetails, required: Details about the entity this profile represents, as the platform states them. Anthropic does not verify them. Every field is present, `null` until the platform supplies a value.
    - `reference_id` string, nullable, required: The platform's own reference for the entity. `null` until the platform supplies one.
    - `onboarded_at` string, date-time, required: A timestamp in RFC 3339 format
    - `account_status` 'active' | 'suspended' | 'blocked', required: The status of the entity's account on the platform, as the platform states it: `active`; `suspended`, when the platform has restricted the account and may restore it; or `blocked`, when the platform has barred it. It records the platform's decision only. The statuses that Anthropic itself reports for the profile, such as its status in a program, are Anthropic's decisions and do not change with it.
    - `entity_type` 'individual' | 'business' | 'non_profit' | 'government', required: What kind of entity the profile represents, as the platform states it: `individual`, `business`, `non_profit` or `government`.
    - `country` string, nullable, required: The country the platform associates with the entity, as an ISO 3166-1 alpha-2 code. `null` until the platform supplies one.
    - `name_hash` string, nullable, required: The platform-computed hash of the entity's name. `null` until the platform supplies one.
    - `email_hash` string, nullable, required: The platform-computed hash of the entity's email address. `null` until the platform supplies one.
  - `enforcement_status` 'unrestricted' | 'pending' | 'restricted' | 'banned', required: Anthropic's enforcement status of this profile: `unrestricted`, `pending`, `restricted` or `banned`. More values may be added; read a value you do not recognize as `restricted`.
  - `enforcement_actions` UserProfileEnforcementAction[], required: The enforcement actions open on this profile; empty when none is open. Absent under the `user-profiles-2026-09-04` and earlier beta headers.
    - union: A limit Anthropic has placed on the entity this profile represents and not yet resolved, discriminated by `type`: `restriction` or `ban`. More types may be added; read a `type` you do not recognize as `restriction`.
      - UserProfileEnforcementActionRestriction: Anthropic has limited how it serves the end user until the action is resolved. The end user may still be served in part.
        - `type` 'restriction', required
        - `id` string, required: The action's ID (`enac_...`), stable while the action is open.
        - `reason` 'unsupported_region' | 'fraud_or_abuse' | 'high_harm' | 'usage_policy_violation' | 'account_compromise' | 'unspecified', required: Why Anthropic placed this enforcement action: `unsupported_region`, `fraud_or_abuse`, `high_harm`, `usage_policy_violation`, `account_compromise` or `unspecified`. More values may be added; read a value you do not recognize as `unspecified`.
        - `action` 'verify', required: The next step on this enforcement action: `verify` means the end user can clear the action by passing an identity check. More values may be added; read a value you do not recognize as `null`.
        - `opened_at` string, date-time, required: A timestamp in RFC 3339 format
        - `expires_at` string, date-time, required: A timestamp in RFC 3339 format
      - UserProfileEnforcementActionBan: Anthropic has stopped serving the end user where the ban applies and does not plan to serve them there again.
        - `type` 'ban', required
        - `id` string, required: The action's ID (`enac_...`), stable while the action is open.
        - `reason` 'unsupported_region' | 'fraud_or_abuse' | 'high_harm' | 'usage_policy_violation' | 'account_compromise' | 'unspecified', required: Why Anthropic placed this enforcement action: `unsupported_region`, `fraud_or_abuse`, `high_harm`, `usage_policy_violation`, `account_compromise` or `unspecified`. More values may be added; read a value you do not recognize as `unspecified`.
        - `action` 'verify', required: The next step on this enforcement action: `verify` means the end user can clear the action by passing an identity check. More values may be added; read a value you do not recognize as `null`.
        - `opened_at` string, date-time, required: A timestamp in RFC 3339 format
        - `expires_at` string, date-time, required: A timestamp in RFC 3339 format
  - `programs` UserProfilePrograms, required: A user profile's standing in each program. A program is a set of capabilities or exemptions that Anthropic approves for the entity the profile represents. A program reads `null` when the profile has no status in it, when the caller's organization is not entitled to read programs, or when the response does not report that program. Retrieving the profile reports every program. Anthropic may add programs; ignore a key you do not recognize.
    - `cyber` UserProfileCyberProgram, required: A user profile's standing in the Cyber Verification Program, which relaxes cyber safeguards for requests that name the profile.
      - `status` 'active' | 'pending' | 'rejected', required: A user profile's status in a program. Each program's `status` field says what the values mean there.
      - `tiers` object, required: The program's tiers, keyed by tier: `a` (Specialized Access), `b` (Red Team Access) and `c` (Defense Access). A response reports either every tier or none. When it reports them, as retrieving the profile normally does, every tier has a key, whether or not it applies to the profile. When it does not, as in the list of user profiles, `tiers` is `{}`, which does not mean that the tiers are inactive. No tier implies another, so read the tier you need. Anthropic may add tiers; ignore a key you do not recognize.
      - `requirements` UserProfileCyberRequirements, required: What a request that names the profile must allow to get the relaxed safeguards of the profile's `active` tiers. A field reads `true` when at least one of those tiers has the requirement and Anthropic has not waived it on that tier for the profile. A request that does not meet a requirement is still served, without the relaxed safeguards of the tiers that have it. The values differ between profiles and can change, so read them rather than assuming them.
        - `data_retention` boolean, required: Whether Anthropic must be able to retain the request's inference data.
        - `human_review` boolean, required: Whether Anthropic personnel must be allowed to review the data retained from the request.
    - `efs` UserProfileEfsProgram, required: A user profile's standing in Enterprise Frontier Safeguards, a program under which Anthropic approves the entity the profile represents and may approve any of the program's features.
      - `status` 'active' | 'pending' | 'rejected', required: A user profile's status in a program. Each program's `status` field says what the values mean there.
      - `features` object, required: The program's features, keyed by feature: `data_retention_exemption` (use of models that normally require data retention, without the data being retained), `cmek` (customer-managed encryption keys) and `storage` (customer-owned storage). Every feature that the caller's organization may read has a key, whether or not it is approved; a missing key does not mean that the feature is inactive. Anthropic may add features; ignore a key you do not recognize.
  - `created_at` string, date-time, required: A timestamp in RFC 3339 format
  - `metadata` object, required: Arbitrary key-value metadata. Maximum 16 pairs, keys up to 64 chars, values up to 512 chars.
  - `updated_at` string, date-time, required: A timestamp in RFC 3339 format

## Other responses

- `400`: Invalid argument - The client specified an invalid argument
- `401`: Unauthenticated - The request does not have valid authentication credentials
- `403`: Permission denied - The caller does not have permission to execute the specified operation
- `404`: Not found - Some requested entity was not found
- `408`: Deadline exceeded - The deadline expired before the operation could complete
- `409`: Aborted - The operation was aborted due to concurrency issue
- `412`: Failed precondition - Operation was rejected because the system is not in required state
- `413`: Out of range - Operation was attempted past the valid range
- `429`: Resource exhausted - Some resource has been exhausted (rate limiting)
- `431`: Request header fields too large - Request metadata was too large
- `499`: Cancelled - The operation was cancelled by the client
- `500`: Internal - Internal server error
- `501`: Unimplemented - The operation is not implemented or supported
- `503`: Unavailable - The service is currently unavailable
- `504`: Deadline exceeded - Upstream service did not respond in time

## Changes

- **2026-11-02** `9578ce4001dd`: 1 breaking
  - added the pattern `^[A-Z]{2}$` to the request property `external_user_details/allOf[#/components/schemas/UserProfileExternalUserDetailsParams]/country/anyOf[subschema #1]/`
- **2026-10-21** `54a5d04eb67f`: 2 info
  - added the required property `enforcement_actions` to the response with the `200` status
  - added the required property `enforcement_status` to the response with the `200` status
- **2026-10-19** `b8225d432262`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/anthropics/apis/anthropic-api/changes/v1/user_profiles/post.md)

---

[API](https://skmtc.dev/anthropics/apis/anthropic-api.md) - [All operations](https://skmtc.dev/anthropics/apis/anthropic-api/llms.txt) - [OpenAPI document](https://skmtc.dev/anthropics/apis/anthropic-api/revisions/328591af84ad?raw)