cmek-key-lifecycle changedmanage-claude/cmek-key-lifecycle

Nearest release: v2.1.312, published under an hour before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.

Recorded here 27 Oct 2026 18:58 UTC

Lines+8added

Lines−8removed

From line 14 where the diff opens

First seen 23 Oct 2026 this site's first read of the page

Recorded edits2to this page, all time

## If Anthropic can’t reach your key ## If Anthropic can't reach your key

The whole hunk

from line 14, old and new numbered

lines

from line 14

1414

1515| Action | What happens | Can you undo it? |

1616| ----------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |

17| Attach the key to a workspace (on Claude Enterprise, add it to the organization) | Your key protects data written [after it takes effect](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect). On Claude Platform, attaching also locks the workspace's [data retention setting](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#data-retention). | No. The key can't be removed or replaced. |

17| Attach the key to a workspace (on Claude Enterprise, add it to the organization) | Your key protects data written [after it takes effect](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect). On Claude Platform, attaching also locks the workspace’s [data retention setting](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#data-retention). | No. The key can’t be removed or replaced. |

1818| Rotate the key material within the same key | You rotate it in your KMS, on your own schedule. Rotation needs no action in Claude. | Nothing to undo. Keep earlier key versions enabled. |

19| Disable the key, or remove (revoke) Anthropic's access to it | The change can take up to 1 hour to apply, and requests in flight during that hour might still succeed. After that, Claude can't read or write the data the key protects, and requests fail. | Re-enable the key or restore Anthropic's access. [Two limits apply](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#restore-access). |

20| Delete the key in your KMS, schedule it for deletion, or destroy its key material | Anthropic can't recover the data the key protects. | Not by Anthropic. It keeps no copy of your key. |

21| Delete the key's record in Claude (**Delete encryption key** in the Claude Console) | You can do this only while no workspace, including an archived one, uses the key. | No. |

19| Disable the key, or remove (revoke) Anthropic’s access to it | The change can take up to 1 hour to apply, and requests in flight during that hour might still succeed. After that, Claude can’t read or write the data the key protects, and requests fail. | Re-enable the key or restore Anthropic’s access. [Two limits apply](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#restore-access). |

20| Delete the key in your KMS, schedule it for deletion, or destroy its key material | Anthropic can’t recover the data the key protects. | Not by Anthropic. It keeps no copy of your key. |

21| Delete the key’s record in Claude (**Delete encryption key** in the Claude Console) | You can do this only while no workspace, including an archived one, uses the key. | No. |

2222

2323## What disabling does, and what comes back

2424

2525While the key is disabled, Messages API requests in a workspace that uses it return [a 400 error with the code `cmek_key_disabled`](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#cmek-key-disabled).

2626

27Re-enabling the key, or restoring Anthropic's access to it, brings back access to the data the key protects. Two limits apply. Requests that failed while the key was disabled aren't retried. Disabling the key doesn't pause retention periods.

27Re-enabling the key, or restoring Anthropic’s access to it, brings back access to the data the key protects. Two limits apply. Requests that failed while the key was disabled aren’t retried. Disabling the key doesn’t pause retention periods.

2828

29## If Anthropic can't reach your key

29## If Anthropic can’t reach your key

3030

31Requests that store data under your key fail while Anthropic can't reach it, for example during an outage of your KMS. On Claude Enterprise, these requests include messages in chat and in voice mode.

31Requests that store data under your key fail while Anthropic can’t reach it, for example during an outage of your KMS. On Claude Enterprise, these requests include messages in chat and in voice mode.

3232

3333On the Messages API, these requests return a 503 error with the code `cmek_key_unreachable`, and you can retry them. The Message Batches API retries them for you until your key is available or the batch expires.

3434

3535## Change keys or stop using CMEK

3636

37A workspace or organization can't switch to a different key or go back to having none. On Claude Platform, you can create a new workspace with a different key, or with no key, and move your traffic to it. On Claude Enterprise, there's no way to change keys or stop using CMEK within the organization.

37A workspace or organization can’t switch to a different key or go back to having none. On Claude Platform, you can create a new workspace with a different key, or with no key, and move your traffic to it. On Claude Enterprise, there’s no way to change keys or stop using CMEK within the organization.

3838