Claude API 2026-10-21 rejects temperature. Decide before the SDK bump.

On October 21, 2026, Anthropic released Claude API version 2026-10-21. The migration guide is the path off 2023-06-01, the version earlier SDKs sent with every request. Python SDK 2.0.0, TypeScript SDK 1.0.0, C# SDK 13.0.0, Go SDK 2.0.0, Java SDK 3.0.0, PHP SDK 1.0.0, Ruby SDK 2.0.0, and ant CLI 2.0.0 send 2026-10-21 by default. A major bump on one of those packages changes the API version your coding agents call. Anthropic says to ship that bump with the code fixes, and to test against 2026-10-21 before you release.

What now returns a 400

On 2026-10-21, a request that sends temperature, top_p, or top_k returns a 400 error, even at the parameter’s default. The rule covers POST /v1/messages, token counting, and each request in a Message Batch created on this version. Remove the three parameters. The new SDKs and the CLI no longer include them.

A request that omits them samples at the defaults, including a temperature of 1.0, the same as a 2023-06-01 request that also omits them. Models that already accept only those defaults, such as Claude 4.7 and later, sample as before. On a model that still accepts other values, such as Claude Sonnet 4.6, a request that lowered temperature for more consistent output loses that effect. The guide’s line is: “No other setting replaces it.” If a request relies on a non-default value, stop sending the parameter or keep that request on 2023-06-01.

Two other shapes return a 400. A document block placed directly in an assistant message is rejected. Send documents in user messages. A document nested inside another block, such as a web fetch tool result, is still accepted. A user-message text block with a non-empty citations array is rejected. Citations on assistant text still pass, and so does the citations setting on documents and search results.

The new SDKs split the old message type into one type per role. In Python, a dict literal that names its role needs no change. Code that constructs the old type, or that edits a message before it knows the role, does. The guide has the before-and-after for each language. On this version the Admin API and the Claude Enterprise Analytics API also drop old field names. An API key’s workspace_id is gone. Read scope.

The key moves to Authorization

These releases send the API key as Authorization: Bearer <key>. Earlier releases sent it in X-Api-Key. The Claude API accepts either header. A proxy, gateway, middleware, log filter, or test stub that reads only X-Api-Key does not see the key.

The ant CLI cannot add a header of its own. If --base-url or ANTHROPIC_BASE_URL points it at a gateway that still reads X-Api-Key, the gateway has to read Authorization.

Foundry clients in Python, TypeScript, C#, Go, Java, and PHP still send x-api-key. The guide’s note for each language names the clients that still use that header and the ones that were already sending a bearer token. Read it before you rewrite a header. On the Ruby SDK, a redirect to another origin drops Authorization, including http to https on the same host, so the key drops with it.

If you install ant with Go, the module path is now github.com/anthropics/anthropic-cli/v2. The old path still installs the latest v1 release, with no error or warning. On Amazon Bedrock, 2026-10-21 is available only for Claude 4.7 and later. Anthropic says to leave older Bedrock models on the SDK you use today. Moving those calls onto this version means switching them to a Claude 4.7 or later model first.

These SDK and CLI versions are Apache 2.0. Earlier versions remain MIT. Anthropic says the license change needs no code edit.

Move, pin, or hold

Sort each Messages client before you change the lockfile.

Move it when the call already omits temperature, top_p, and top_k, and the gateway can read Authorization. If the model accepted a lower temperature, dropping the parameter drops that effect.

Pin it to an SDK that still sends 2023-06-01 when the call needs a non-default sampling value, or when it is Bedrock on a model older than Claude 4.7.

Hold the release until the parameter removals, the header change, and any message-type edits ship with the SDK bump. Test the moved calls against 2026-10-21 first.

A shared client that sets temperature sends it for every agent on that client. Give pinned calls their own client.

What to check in the repo

1. Search code and agent config for temperature, top_p, and top_k. Write down the model on each hit.
2. Search for X-Api-Key and x-api-key in proxies, gateways, log filters, middleware, and tests.
3. Read the lockfile range. A range that allows the new major switches the API version and the header on the next update.
4. If ant was installed with go install on the old module path, it stays on v1 until the path includes /v2.
5. List Bedrock model IDs. Anything older than Claude 4.7 stays off this version.
6. If you read Admin API or Enterprise Analytics fields, note each renamed field you parse, including workspace_id on API keys.

What to do this week

• Put every Messages client in the move bucket or the pin bucket.
• Strip temperature, top_p, and top_k from the clients you are moving.
• Point any call that still needs a non-default sampling value at an SDK that sends 2023-06-01.
• Change the gateway and the log filter so they read Authorization, or set X-Api-Key the way the guide shows for your language.
• Run the moved calls against 2026-10-21 before you release.
• Keep the list of pinned requests and the model each one calls.

Consult is sold in 5-hour blocks as time with a coach on the decisions that stall when the CTO is busy: what the coding-agent policy says, who approves AI-written changes, how on-call works when there are three engineers, and which systems agents may operate.