cmek-admin-api changedmanage-claude/cmek-admin-api

Nearest release: v2.1.312, published under an hour before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.

Recorded here 27 Oct 2026 18:58 UTC

Lines+5added

Lines−5removed

From line 12 where the diff opens

First seen 23 Oct 2026 this site's first read of the page

Recorded edits2to this page, all time

The whole hunk

from line 12, old and new numbered

lines

from line 12

1212

1313* Customer-managed encryption keys (CMEK) are [turned on for your organization](https://platform.claude.com/docs/en/manage-claude/cmek#availability).

1414* You have an [Admin API key](https://platform.claude.com/docs/en/manage-claude/admin-api-keys). The samples read it from `ANTHROPIC_API_KEY`.

15* You've created your key in [AWS KMS](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#encryption-key-setup), [Google Cloud KMS](https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms#encryption-key-setup), or [Azure Key Vault](https://platform.claude.com/docs/en/manage-claude/cmek-azure-key-vault#encryption-key-setup), and kept the values the setup steps tell you to copy.

16* You have a workspace that [retains data](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#data-retention), ideally a new one, because [existing data stays under Anthropic's key](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect).

15* You’ve created your key in [AWS KMS](https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms#encryption-key-setup), [Google Cloud KMS](https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms#encryption-key-setup), or [Azure Key Vault](https://platform.claude.com/docs/en/manage-claude/cmek-azure-key-vault#encryption-key-setup), and kept the values the setup steps tell you to copy.

16* You have a workspace that [retains data](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#data-retention), ideally a new one, because [existing data stays under Anthropic’s key](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect).

1717

1818## Create, validate, and attach the key

1919

from line 337

337337 * `<friendly-name>`: a display name

338338 * `https://<your-vault-name>.vault.azure.net/`: the vault URI

339339 * `<your-key-name>`: the key name

340 * `<your-tenant-id>`: the vault's tenant ID

340 * `<your-tenant-id>`: the vault’s tenant ID

341341

342342 <CodeGroup>

343343 ```bash cURL

from line 619

619619

620620 <Step title="Attach the key to a workspace">

621621 <Warning>

622 Attaching a key [can't be undone](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#what-each-action-does). If the key is deleted, Anthropic can't recover the data it protects.

622 Attaching a key [can’t be undone](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#what-each-action-does). If the key is deleted, Anthropic can’t recover the data it protects.

623623 </Warning>

624624

625625 Replace `<workspace-id>` with the workspace ID, which starts with `wrkspc_`, and `ekey_<id>` with the external key ID.

from line 735

735735 ```

736736 </CodeGroup>

737737

738 The response shows the attached key's ID in `external_key_id`. If the request is refused, [look up the error](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#refused).

738 The response shows the attached key’s ID in `external_key_id`. If the request is refused, [look up the error](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#refused).

739739 </Step>

740740</Steps>

741741