Claude Managed Agents Gets Scheduled Deployments, Vault Env Vars, and session_thread_id

Anthropic's June 9, 2026 platform update adds two new primitives to Claude Managed Agents: scheduled deployments and environment-variable vault credentials. Together they address the two most common pieces of infrastructure operators were forced to manage themselves — a cron scheduler and a secrets-injection layer. Here is what changed and what it means for teams running production agent pipelines.

What happened

The Claude Platform release notes from June 9 include three additions to Managed Agents, now live in production.

Scheduled deployments. A new /v1/deployments resource allows you to attach a cron schedule directly to an agent definition. You provide a standard cron expression, a timezone, and the initial user.message that fires at each execution. Anthropic schedules and fires the session autonomously on that cadence.

{
  "name": "Weekly compliance scan",
  "agent": "<AGENT_ID>",
  "environment_id": "<ENV_ID>",
  "initial_events": [
    { "type": "user.message", "content": [{ "type": "text", "text": "Run the weekly compliance scan." }] }
  ],
  "schedule": {
    "type": "cron",
    "expression": "0 20 * * 5",
    "timezone": "America/New_York"
  }
}

The API responds with schedule.upcoming_runs_at — the next three fire times — so you can confirm the schedule before it runs. Granularity is at the minute level. Anthropic applies up to a few minutes of jitter to distribute load; this is not currently configurable.

Vault environment-variable credentials. Vaults in Managed Agents previously supported only MCP credentials (mcp_oauth, static_bearer). The June 9 update adds a third category: environment_variable. When you register this credential type, you provide a secret_name (the environment variable name) and a secret_value. At session runtime the credential is stored in the sandbox as an opaque placeholder; when the agent initiates an outbound request, the platform substitutes the real secret at egress. The agent itself never sees the secret value.

vault = client.beta.vaults.create(
    display_name="Alice",
    metadata={"external_user_id": "usr_abc123"},
)
client.beta.vaults.credentials.create(
    vault_id=vault.id,
    credential={
        "type": "environment_variable",
        "secret_name": "GITHUB_TOKEN",
        "secret_value": os.environ["ALICE_GITHUB_TOKEN"],
    }
)

Webhook session_thread_id. A smaller but operationally significant change: session.thread_* webhook events now include a session_thread_id field. For operators routing webhook events by thread — for example, when a multi-agent task fans out and multiple sub-sessions fire webhooks — this field lets you correlate events back to the originating multi-agent thread without parsing session metadata.

Why it matters for AI engineering teams

These additions remove two pieces of infrastructure that every team running recurring or secret-dependent Claude sessions previously had to build and maintain externally.

Scheduled deployments eliminate external cron infrastructure. Teams running periodic sessions on Managed Agents previously needed an external scheduler — a Lambda function on EventBridge, a Kubernetes CronJob, or a third-party cron service — to call /v1/sessions at the right time. That layer carried its own IAM grants, failure handling, and monitoring burden. Deployments fold that into the Managed Agents API itself.

What deployments do not replace: the deployment object is a new resource on top of existing Managed Agents primitives. Teams that need sub-minute granularity, dynamic payloads per run, or conditional firing logic still need external coordination.

Environment-variable vault credentials solve the per-user secret injection problem. Teams using CLI-based tools or SDKs inside Managed Agent sandboxes had no clean way to inject per-user secrets without either hardcoding them in the environment definition (too broad) or passing them through the initial message payload (exposes them in session logs). The new credential type creates a per-user, per-vault secret slot that survives across sessions for the same vault.

One current limitation to note: environment-variable credentials are not yet supported with self-hosted sandboxes. If your deployment uses the split-plane sandbox model — tool execution in your own infrastructure — you will need to continue injecting secrets through your own environment configuration at the sandbox level.

session_thread_id enables proper webhook routing for multi-agent workflows. If you are processing session.thread_started, session.thread_completed, or session.thread_error events, add session_thread_id as an indexed field in your event store. This is especially relevant for teams building multi-agent routing pipelines where fan-out and fan-in events need correlation.

The router/operator angle

Scheduled deployments change your session volume profile. Previously, session creation on Managed Agents was driven by user requests or external triggers, making volume roughly correlated with your product traffic. With scheduled deployments, you can now have steady-state background load that fires independently of user traffic. Review your rate limit tier against expected deployment cadences — especially if you are running multiple scheduled deployments in the same workspace.

Vault scoping is workspace-wide. The vault and credential API documentation makes an explicit warning: vaults and credentials are workspace-scoped, meaning any API key in the same workspace can reference a vault ID when creating a session. This is the same scoping model as other Managed Agents resources, but it is worth auditing if your workspace consolidates multiple products or customer segments. Per-product or per-customer workspace isolation is the recommended mitigation.

managed-agents-2026-04-01 beta header still required. All Managed Agents API requests still require this header. The SDK sets it automatically; direct curl callers need to include anthropic-beta: managed-agents-2026-04-01 in every request. This is a minor friction point but one that will continue until Managed Agents exits beta.

Decision framework: what to act on now

Already on Managed Agents:

• Audit external cron infrastructure. Any Lambda, CronJob, or EventBridge rule that calls Managed Agents on a schedule is now a migration candidate. Consolidating into deployments reduces moving parts and centralizes failure visibility in the Anthropic Console.
• Migrate tool secrets to vault env-var credentials. Tools that currently require environment variable injection — GitHub, Linear, internal APIs — can now be registered once per vault and referenced by vault ID at session creation. This eliminates the need to pass secrets through message payloads or hardcode them in environment definitions.
• Add session_thread_id indexing to your webhook pipeline if you process thread events from multi-agent sessions.

Evaluating Managed Agents:

• These additions address two previous objections: "we still need our own scheduler" and "we have no good way to inject per-user secrets." Both are now handled in-platform for Anthropic-hosted sandboxes. If self-hosted sandbox support for env-var credentials is important to your deployment, monitor the release notes — it is the most likely place that limitation will be lifted.