# Claude Web Fetch Controls: Domain Restrictions and the New 400 Error

Anthropic added organization-wide web fetch controls, which changes how teams configure and troubleshoot agents that read the web.

By Paras Madan | 2026-10-22


Anthropic added organization-wide web fetch controls on October 20, 2026. Admins can disable the tool or restrict its domains in Claude Console. For developers, the important change is that a valid-looking agent configuration can now be rejected by policy set above the application.

The [Claude Platform release notes](https://platform.claude.com/docs/en/release-notes/overview) also clarify that Managed Agents enforce these organization restrictions alongside each agent's own lists, including when a fetched page redirects somewhere else.

This is useful for teams deploying several agents against the same organization. They can set a common boundary without relying entirely on every application developer to remember the same configuration.

## What changed in Claude Console

An organization administrator can manage web fetch on the Console's Capabilities page. With the tool enabled, the administrator can specify allowed or blocked domains. With it disabled, applications cannot simply enable it again by including the tool in a request.

These changes concern the Claude Platform's web tools, not a new browsing feature in the consumer Claude app. They also should not be confused with the web search settings described in the same release notes. Managed Agents have followed the organization-level web search toggle since October 6 and search domain restrictions since October 14.

## Why the Messages API returns a 400 error

According to the [web fetch documentation](https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-fetch-tool), a Messages API request that includes web fetch while the organization has disabled it fails with a 400 `invalid_request_error`. The error says web fetch is not enabled.

Managed Agents behave differently. A disabled `web_fetch` call returns an error result to the agent while its session continues. **A running session does not mean its web fetch succeeded.**

That difference should shape monitoring. An HTTP-error dashboard may catch the first failure, while the second needs inspection of tool results. Otherwise, an application could record the session as healthy even though the research step did not retrieve the page it needed.

For a new failure, check the organization's Capabilities setting before changing prompts or upgrading SDKs. A retry with the same permissions is not a repair for a policy rejection.

## How domain restrictions combine

The [Managed Agents domain guide](https://platform.claude.com/docs/en/managed-agents/tools-web-restrictions) says a fetched URL must pass both the organization policy and the agent's per-tool lists. Redirect destinations must pass them too. A blocked fetch produces an error result; disallowed search results are omitted.

For example, imagine an organization allows `docs.example.com`, while one agent allows `example.com`. The broader agent entry does not expand the organization's permission. Now imagine an approved documentation URL redirects to a different hosting domain. The destination must also be permitted.

These are illustrative configurations, not tests I ran. They show why inspecting only the first URL or only the agent definition can miss the reason a fetch failed.

For Managed Agents web fetch, use plain hostnames without a scheme, wildcard or path.

## Check the network boundary separately

Limited-network cloud environments also enforce `allowed_hosts`. A tool allowlist outside this boundary can cause a 400 error on session creation or update.

The matching rules differ. A tool entry for `example.com` includes subdomains. An environment entry matches an exact host unless it begins with `*.`.

This is a good reason to review organizational policy, tool configuration and environment networking together. Treating any one of them as the whole permission model makes troubleshooting harder.

The [server-tool documentation](https://platform.claude.com/docs/en/agents-and-tools/tool-use/server-tools) also distinguishes Messages API domain handling from Managed Agents. In Messages API web fetch, a domain entry containing a path never matches a fetch URL. A configuration copied from a search tool therefore deserves review before reuse.

## What this control does not solve

Web fetch still carries standard token costs, even though Anthropic does not add a separate fetch charge. Its documentation also warns about data-exfiltration risk when untrusted input and sensitive information are combined.

An approved domain does not make every document on it trustworthy. These controls limit destinations; applications still need to handle the content they retrieve and make failures visible to users.

For production agents, the useful shift is that access policy can live above individual prompts and tool definitions. The corresponding engineering responsibility is to make that policy observable when it prevents the agent from completing its work.

I'm Paras. I work at the intersection of AI, engineering and distribution.

I help technical founders explain APIs, agent behavior and product changes in content that developers can use and share.

[Book a 30-minute call](https://cal.com/paras-madan/30min).