cmek-admin-api changedmanage-claude/cmek-admin-api
Nearest release: v2.1.309, published 13 hours before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+740added
Lines−0removed
From line
—
no hunk to open at
First seen
23 Oct 2026
this site's first read of the page
Recorded edits1to this page, all time
## Before you start ## Create, validate, and attach the key
The whole hunk
740 lines, new page
/
lines
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Add and attach an encryption key with the Admin API
url: https://platform.claude.com/docs/en/manage-claude/cmek-admin-api
description: Create, validate, and attach a customer-managed encryption key with three Admin API calls.
---
These calls work on Claude Platform. On Claude Enterprise or Claude Platform on AWS, follow [your setup page](https://platform.claude.com/docs/en/manage-claude/cmek#set-it-up).
Creating an external key is what **Add key** does in the Claude Console, and validating it is what **Verify** does.
## Before you start
* Customer-managed encryption keys (CMEK) are [turned on for your organization](https://platform.claude.com/docs/en/manage-claude/cmek#availability).
* You have an [Admin API key](https://platform.claude.com/docs/en/manage-claude/admin-api-keys). The samples read it from `ANTHROPIC_API_KEY`.
* You've created your key in [AWS KMS](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#encryption-key-setup), [Google Cloud KMS](https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms#encryption-key-setup), or [Azure Key Vault](https://platform.claude.com/docs/en/manage-claude/cmek-azure-key-vault#encryption-key-setup), and kept the values the setup steps tell you to copy.
* You have a workspace that [retains data](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#data-retention), ideally a new one, because [existing data stays under Anthropic's key](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect).
## Create, validate, and attach the key
<Steps>
<Step title="Create the external key">
<Tabs>
<Tab title="AWS">
Replace `<friendly-name>` with a display name and `<key-arn-from-create-key-step>` with the key ARN.
<CodeGroup>
```bash cURL
curl -sS "https://api.anthropic.com/v1/organizations/external_keys" \
-H "x-api-key: $ANTHROPIC_API_KEY" \
-H "anthropic-version: 2023-06-01" \
-H "content-type: application/json" \
-d '{
"display_name": "<friendly-name>",
"geo": "us",
"provider_config": {
"type": "aws",
"kms_arn": "<key-arn-from-create-key-step>"
}
}'
```
```bash CLI
ant organization:external-keys create <<'YAML'
display_name: "<friendly-name>"
geo: us
provider_config:
type: aws
kms_arn: "<key-arn-from-create-key-step>"
YAML
```
```python Python
client = anthropic.Anthropic()
external_key = client.organization.external_keys.create(
display_name="<friendly-name>",
geo="us",
provider_config={"type": "aws", "kms_arn": "<key-arn-from-create-key-step>"},
)
print(f"id: {external_key.id}")
print(f"display_name: {external_key.display_name}")
```
```typescript TypeScript
const client = new Anthropic();
const externalKey = await client.organization.externalKeys.create({
display_name: "<friendly-name>",
geo: "us",
provider_config: {
type: "aws",
kms_arn: "<key-arn-from-create-key-step>"
}
});
console.log(`id: ${externalKey.id}`);
console.log(`display_name: ${externalKey.display_name}`);
```
```csharp C#
using Anthropic.Models.Organization.ExternalKeys;
AnthropicClient client = new();
var externalKey = await client.Organization.ExternalKeys.Create(new()
{
DisplayName = "<friendly-name>",
Geo = Geo.Us,
ProviderConfig = new AwsExternalKeyConfig
{
KmsArn = "<key-arn-from-create-key-step>"
}
});
Console.WriteLine($"id: {externalKey.ID}");
Console.WriteLine($"display_name: {externalKey.DisplayName}");
```
```go Go
client := anthropic.NewClient()
externalKey, err := client.Organization.ExternalKeys.New(context.Background(), anthropic.OrganizationExternalKeyNewParams{
DisplayName: anthropic.String("<friendly-name>"),
Geo: anthropic.OrganizationExternalKeyNewParamsGeoUs,
ProviderConfig: anthropic.OrganizationExternalKeyNewParamsProviderConfigUnion{
OfAWS: &anthropic.AWSExternalKeyConfigParam{
KMSARN: "<key-arn-from-create-key-step>",
},
},
})
if err != nil {
log.Fatal(err)
}
fmt.Printf("id: %s\n", externalKey.ID)
fmt.Printf("display_name: %s\n", externalKey.DisplayName)
```
```java Java
import com.anthropic.models.organization.externalkeys.AwsExternalKeyConfig;
import com.anthropic.models.organization.externalkeys.ExternalKeyCreateParams;
void main() {
AnthropicClient client = AnthropicOkHttpClient.fromEnv();
var params = ExternalKeyCreateParams.builder()
.displayName("<friendly-name>")
.geo(ExternalKeyCreateParams.Geo.US)
.providerConfig(AwsExternalKeyConfig.builder()
.kmsArn("<key-arn-from-create-key-step>")
.build())
.build();
var externalKey = client.organization().externalKeys().create(params);
IO.println("id: " + externalKey.id());
IO.println("display_name: " + externalKey.displayName().orElseThrow());
}
```
```php PHP
use Anthropic\Organization\ExternalKeys\ExternalKeyCreateParams\Geo;
// ...
$client = new Client();
$externalKey = $client->organization->externalKeys->create(
displayName: '<friendly-name>',
geo: Geo::US,
providerConfig: [
'type' => 'aws',
'kmsARN' => '<key-arn-from-create-key-step>',
],
);
echo "id: {$externalKey->id}\n";
echo "display_name: {$externalKey->displayName}\n";
```
```ruby Ruby
client = Anthropic::Client.new
external_key = client.organization.external_keys.create(
display_name: "<friendly-name>",
geo: :us,
provider_config: {
type: :aws,
kms_arn: "<key-arn-from-create-key-step>"
}
)
puts "id: #{external_key.id}"
puts "display_name: #{external_key.display_name}"
```
</CodeGroup>
</Tab>
<Tab title="Google Cloud">
Replace `<friendly-name>` with a display name. Replace the value that starts with `projects/` with the full key resource name.
<CodeGroup>
```bash cURL
curl -sS "https://api.anthropic.com/v1/organizations/external_keys" \
-H "x-api-key: $ANTHROPIC_API_KEY" \
-H "anthropic-version: 2023-06-01" \
-H "content-type: application/json" \
-d '{
"display_name": "<friendly-name>",
"geo": "us",
"provider_config": {
"type": "gcp",
"key_name": "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>"
}
}'
```
```bash CLI
ant organization:external-keys create <<'YAML'
display_name: "<friendly-name>"
geo: us
provider_config:
type: gcp
key_name: "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>"
YAML
```
```python Python
client = anthropic.Anthropic()
external_key = client.organization.external_keys.create(
display_name="<friendly-name>",
geo="us",
provider_config={
"type": "gcp",
"key_name": "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>",
},
)
print(f"id: {external_key.id}")
print(f"display_name: {external_key.display_name}")
```
```typescript TypeScript
const client = new Anthropic();
const externalKey = await client.organization.externalKeys.create({
display_name: "<friendly-name>",
geo: "us",
provider_config: {
type: "gcp",
key_name:
"projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>"
}
});
console.log(`id: ${externalKey.id}`);
console.log(`display_name: ${externalKey.display_name}`);
```
```csharp C#
using Anthropic.Models.Organization.ExternalKeys;
AnthropicClient client = new();
var externalKey = await client.Organization.ExternalKeys.Create(new()
{
DisplayName = "<friendly-name>",
Geo = Geo.Us,
ProviderConfig = new GcpExternalKeyConfig
{
KeyName = "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>"
}
});
Console.WriteLine($"id: {externalKey.ID}");
Console.WriteLine($"display_name: {externalKey.DisplayName}");
```
```go Go
client := anthropic.NewClient()
externalKey, err := client.Organization.ExternalKeys.New(context.Background(), anthropic.OrganizationExternalKeyNewParams{
DisplayName: anthropic.String("<friendly-name>"),
Geo: anthropic.OrganizationExternalKeyNewParamsGeoUs,
ProviderConfig: anthropic.OrganizationExternalKeyNewParamsProviderConfigUnion{
OfGCP: &anthropic.GCPExternalKeyConfigParam{
KeyName: "projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>",
},
},
})
if err != nil {
log.Fatal(err)
}
fmt.Printf("id: %s\n", externalKey.ID)
fmt.Printf("display_name: %s\n", externalKey.DisplayName)
```
```java Java
import com.anthropic.models.organization.externalkeys.ExternalKeyCreateParams;
void main() {
AnthropicClient client = AnthropicOkHttpClient.fromEnv();
var params = ExternalKeyCreateParams.builder()
.displayName("<friendly-name>")
.geo(ExternalKeyCreateParams.Geo.US)
.gcpProviderConfig("projects/<your-project-id>/locations/<region>/keyRings/<your-keyring-name>/cryptoKeys/<your-key-name>")
.build();
var externalKey = client.organization().externalKeys().create(params);
IO.println("id: " + externalKey.id());
IO.println("display_name: " + externalKey.displayName().orElseThrow());
}
```
```php PHP
use Anthropic\Organization\ExternalKeys\ExternalKeyCreateParams\Geo;
// ...
Cut at 300 lines. The page has the rest.
No line in this hunk matches that.