anthropic-sdk-python v1.17.0

The main addition in v1.17.0 is organization webhook endpoints, reachable as client.beta.organization.webhooks with create, retrieve, update, list, delete and a method to regenerate the endpoint's signing secret. The generated parameters show what these endpoints are currently for: the event types an endpoint may subscribe to are exactly two, user_profile.enforcement_action_opened and user_profile.enforcement_action_resolved, and the routes are in beta behind a webhooks-2026-10-07 header. A user profile is the record a platform uses to attribute API traffic to one of the entities it serves, such as an individual end-user of its product or a company it resells access to. The matching payload types carry the profile's id, the organization id, and an enforcement-action id prefixed enac_, so a platform receives a pointer to the case rather than its contents — enough to react in its own systems when an action against one of its profiles opens or is resolved.

The two bug fixes concern how identity headers survive a request. These SDKs let a header be set once on the client, for example through default_headers, and also per call, and an unset per-call argument such as workspace_id or user_profile_id arrives internally as an explicit "omit" marker. On the Bedrock and Mantle clients that marker could erase a workspace id set in default_headers, and on the Google Cloud client it could erase both a workspace id and a user profile id, so requests went out without the header the client was configured to send. The base client already had a helper that drops those markers for the workspace and user-profile headers; the release routes the three platform clients through it, replacing a Bedrock-only helper that covered just the user-profile header, and adds tests for each asserting that the client-level header is still present on the outgoing request. If you set workspace or profile identity in default_headers and call through Bedrock, Mantle or Google Cloud, this is the entry that matters.

The remaining entries are documentation-shaped. One adds RBAC group owner-access error codes to the Admin API surface, and one documents an unsupported_charset error code for plugin uploads, both of which describe error codes in the API surface rather than changing client behavior. The single chore moves a changelog check onto a standard CI runner.