Claude on Vertex AI is served through three endpoint types, and they trade availability against control differently. The global endpoint routes dynamically: Google can process your request from any region the model supports, which is explicitly positioned as the maximum-availability option — fewer errors, possibly at some latency cost. Multi-region endpoints (currently us and eu) route dynamically within a geography, for teams that need data residency plus high availability. Regional endpoints guarantee routing through one specific region. Failover design starts by recognizing that the global endpoint is a failover mechanism — one Google operates for you.
Strategy 1: let the global endpoint do the work
If your data-residency rules allow requests to be processed anywhere the model is supported, the simplest resilient architecture is AnthropicVertex(project_id=..., region="global") and nothing else. You also pay less: regional and multi-region endpoints carry a 10% pricing premium over global for Sonnet 4.5 and later models. Prompt caching works on the global endpoint, and it supports the current Claude lineup (Fable 5, Opus 4.8 and earlier Opus versions, Sonnet 5 and earlier, Haiku 4.5). Two caveats: the global endpoint is pay-as-you-go only — provisioned throughput requires regional endpoints — and Google-native batch prediction doesn't support it. Note also that some organizations can't choose this path: admins can block global routing with the org policy constraint constraints/gcp.restrictEndpointUsage.
Strategy 2: client-side fallback between endpoints
Anthropic's server-side fallbacks parameter is not supported on Vertex — fallback is your client's job. The pattern is a small ladder: try the primary endpoint; on retryable failure (throttling, service errors), retry with backoff; if the primary stays unhealthy, construct a client against a second endpoint and repeat. For residency-bound workloads the ladder might be us-east1 → us multi-region; for unconstrained ones, global with a regional backstop is reasonable.
import anthropic
from anthropic import AnthropicVertex
ENDPOINTS = ["global", "us-east5"] # ordered preference
def call_with_fallback(messages):
last = None
for region in ENDPOINTS:
client = AnthropicVertex(project_id="my-project", region=region)
try:
return client.messages.create(model="claude-opus-4-8",
max_tokens=1024, messages=messages)
except anthropic.APIStatusError as e:
last = e
if e.status_code not in (429, 500, 502, 503, 504):
raise
raise lastThree platform facts make or break this pattern. First, quota buckets are independent: global-endpoint quota and each multi-region-endpoint quota are separate, so a 429 on one endpoint does not imply the other is exhausted — that independence is exactly what makes an endpoint ladder useful, but it also means the fallback path needs its own quota provisioned in advance. Second, pricing differs: failing over from global to a regional or multi-region endpoint costs 10% more per token; fine for an incident, worth knowing for finance. Third, model support differs by endpoint type — multi-region endpoints support Claude models version 4.7 and later, so verify your chosen model exists on every rung of your ladder.
Strategy 3: provisioned throughput as the anchor
If you run provisioned throughput — the fixed-fee subscription that reserves capacity and prioritizes your requests over pay-as-you-go traffic — remember it is regional-only. A common architecture anchors baseline traffic on a provisioned regional endpoint and spills overflow or failover traffic to the global endpoint at pay-as-you-go rates. Details in the provisioned throughput article.
Test the failover before the outage does
A fallback path that has never carried traffic is a hypothesis, not a strategy. Verify, per environment: the model is enabled and quota is provisioned for every fallback endpoint; IAM works identically (the same roles/aiplatform.user grant covers all endpoints in a project); and your retry classification actually triggers the ladder — fault-inject by pointing the primary at an endpoint with deliberately tiny quota, or by forcing the exception in a staging build. Watch two numbers during the drill: end-to-end latency (dynamic routing may be slower) and 429 rates on the fallback (its independent quota is now taking unfamiliar load). Then rehearse the return path — failback is the half of failover everyone forgets to script.
Where to go next
The endpoint decision itself is covered in global vs regional endpoints; the throttling mechanics in handling 429s; the retry scaffolding in production error handling.