External Keys changedapi/beta/organization/external_keys
Nearest release: v2.1.315, published under an hour before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+60added
Lines−31removed
From line
31
where the diff opens
First seen
26 Aug 2026
this site's first read of the page
Recorded edits9to this page, all time
The whole hunk
from line 31, old and new numbered
/
from line 31
3131
3232 - `kms_arn: string`
3333
34 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
34 Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
3535
3636 maxLength: 2048
3737
from line 43
4343
4444 **Deprecated**
4545
46 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
46 IAM role ARN. Deprecated; this field is ignored.
4747
4848 - `BetaGCPExternalKeyConfig object`
4949
from line 85
8585
8686 Data residency geo. Only `us` is supported.
8787
88- `user_profile_id: optional string or null`
89
90 ID of a user profile to bind the key to. Omit this field for a key that isn't bound to a user profile. Such a key can be attached to a Workspace whatever its user profile. The binding cannot be changed later. A key bound to a user profile can only be attached to a Workspace that has the same user profile.
91
8892### Returns
8993
9094- `BetaExternalKey object`
from line 105
101105
102106 - `id: string`
103107
104 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
108 Identifier of the external key config: a tagged ID prefixed `ekey_`, or, on Claude Platform on AWS, an AWS KMS key's ARN.
105109
106110 - `attachment: BetaExternalKeyAttachedAttachment or BetaExternalKeyUnattachedAttachment`
107111
from line 133
129133
130134 - `geo: string`
131135
132 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
136 Data residency geo. Selects the region that handles this key's encrypt/decrypt roundtrips.
133137
134138 - `provider_config: BetaAWSExternalKeyConfig or BetaGCPExternalKeyConfig or BetaAzureExternalKeyConfig`
135139
from line 145
141145
142146 - `kms_arn: string`
143147
144 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
148 Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
145149
146150 maxLength: 2048
147151
from line 157
153157
154158 **Deprecated**
155159
156 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
160 IAM role ARN. Deprecated; this field is ignored.
157161
158162 - `BetaGCPExternalKeyConfig object`
159163
from line 191
187191
188192 format: date-time
189193
194 - `user_profile_id: string or null`
195
196 ID of the user profile the key is bound to, or null if the key is not bound to one. A key bound to a user profile can only be attached to a Workspace that has the same user profile. A key that isn't bound can be attached to a Workspace whatever its user profile.
197
190198### Example
191199
192200```bash
from line 206
198206 "provider_config": {
199207 "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
200208 "type": "aws"
201 }
209 },
210 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
202211 }'
203212```
204213
from line 229
220229 "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
221230 },
222231 "type": "external_key",
223 "updated_at": "2024-10-30T23:58:27.427722Z"
232 "updated_at": "2024-10-30T23:58:27.427722Z",
233 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
224234}
225235```
226236
from line 273
263273
264274 - `id: string`
265275
266 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
276 Identifier of the external key config: a tagged ID prefixed `ekey_`, or, on Claude Platform on AWS, an AWS KMS key's ARN.
267277
268278 - `attachment: BetaExternalKeyAttachedAttachment or BetaExternalKeyUnattachedAttachment`
269279
from line 301
291301
292302 - `geo: string`
293303
294 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
304 Data residency geo. Selects the region that handles this key's encrypt/decrypt roundtrips.
295305
296306 - `provider_config: BetaAWSExternalKeyConfig or BetaGCPExternalKeyConfig or BetaAzureExternalKeyConfig`
297307
from line 313
303313
304314 - `kms_arn: string`
305315
306 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
316 Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
307317
308318 maxLength: 2048
309319
from line 325
315325
316326 **Deprecated**
317327
318 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
328 IAM role ARN. Deprecated; this field is ignored.
319329
320330 - `BetaGCPExternalKeyConfig object`
321331
from line 359
349359
350360 format: date-time
351361
362 - `user_profile_id: string or null`
363
364 ID of the user profile the key is bound to, or null if the key is not bound to one. A key bound to a user profile can only be attached to a Workspace that has the same user profile. A key that isn't bound can be attached to a Workspace whatever its user profile.
365
352366- `next_page: string or null`
353367
354368 Opaque cursor for the next page, or null if no more results. Pass as `?page=` to fetch the next page.
from line 395
381395 "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
382396 },
383397 "type": "external_key",
384 "updated_at": "2024-10-30T23:58:27.427722Z"
398 "updated_at": "2024-10-30T23:58:27.427722Z",
399 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
385400 }
386401 ],
387402 "next_page": "next_page"
from line 441
426441
427442 - `id: string`
428443
429 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
444 Identifier of the external key config: a tagged ID prefixed `ekey_`, or, on Claude Platform on AWS, an AWS KMS key's ARN.
430445
431446 - `attachment: BetaExternalKeyAttachedAttachment or BetaExternalKeyUnattachedAttachment`
432447
from line 469
454469
455470 - `geo: string`
456471
457 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
472 Data residency geo. Selects the region that handles this key's encrypt/decrypt roundtrips.
458473
459474 - `provider_config: BetaAWSExternalKeyConfig or BetaGCPExternalKeyConfig or BetaAzureExternalKeyConfig`
460475
from line 481
466481
467482 - `kms_arn: string`
468483
469 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
484 Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
470485
471486 maxLength: 2048
472487
from line 493
478493
479494 **Deprecated**
480495
481 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
496 IAM role ARN. Deprecated; this field is ignored.
482497
483498 - `BetaGCPExternalKeyConfig object`
484499
from line 527
512527
513528 format: date-time
514529
530 - `user_profile_id: string or null`
531
532 ID of the user profile the key is bound to, or null if the key is not bound to one. A key bound to a user profile can only be attached to a Workspace that has the same user profile. A key that isn't bound can be attached to a Workspace whatever its user profile.
533
515534### Example
516535
517536```bash
from line 557
538557 "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
539558 },
540559 "type": "external_key",
541 "updated_at": "2024-10-30T23:58:27.427722Z"
560 "updated_at": "2024-10-30T23:58:27.427722Z",
561 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
542562}
543563```
544564
from line 610
590610
591611 - `kms_arn: string`
592612
593 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
613 Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
594614
595615 maxLength: 2048
596616
from line 622
602622
603623 **Deprecated**
604624
605 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
625 IAM role ARN. Deprecated; this field is ignored.
606626
607627 - `BetaGCPExternalKeyConfig object`
608628
from line 670
650670
651671 - `id: string`
652672
653 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
673 Identifier of the external key config: a tagged ID prefixed `ekey_`, or, on Claude Platform on AWS, an AWS KMS key's ARN.
654674
655675 - `attachment: BetaExternalKeyAttachedAttachment or BetaExternalKeyUnattachedAttachment`
656676
from line 698
678698
679699 - `geo: string`
680700
681 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
701 Data residency geo. Selects the region that handles this key's encrypt/decrypt roundtrips.
682702
683703 - `provider_config: BetaAWSExternalKeyConfig or BetaGCPExternalKeyConfig or BetaAzureExternalKeyConfig`
684704
from line 710
690710
691711 - `kms_arn: string`
692712
693 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
713 Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
694714
695715 maxLength: 2048
696716
from line 722
702722
703723 **Deprecated**
704724
705 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
725 IAM role ARN. Deprecated; this field is ignored.
706726
707727 - `BetaGCPExternalKeyConfig object`
708728
from line 756
736756
737757 format: date-time
738758
759 - `user_profile_id: string or null`
760
761 ID of the user profile the key is bound to, or null if the key is not bound to one. A key bound to a user profile can only be attached to a Workspace that has the same user profile. A key that isn't bound can be attached to a Workspace whatever its user profile.
762
739763### Example
740764
741765```bash
from line 788
764788 "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
765789 },
766790 "type": "external_key",
767 "updated_at": "2024-10-30T23:58:27.427722Z"
791 "updated_at": "2024-10-30T23:58:27.427722Z",
792 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
768793}
769794```
770795
from line 919
894919
895920 - `kms_arn: string`
896921
897 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
922 Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
898923
899924 maxLength: 2048
900925
from line 931
906931
907932 **Deprecated**
908933
909 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
934 IAM role ARN. Deprecated; this field is ignored.
910935
911936### Beta Azure External Key Config
912937
from line 995
970995
971996 - `id: string`
972997
973 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
998 Identifier of the external key config: a tagged ID prefixed `ekey_`, or, on Claude Platform on AWS, an AWS KMS key's ARN.
974999
9751000 - `attachment: BetaExternalKeyAttachedAttachment or BetaExternalKeyUnattachedAttachment`
9761001
from line 1023
9981023
9991024 - `geo: string`
10001025
1001 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
1026 Data residency geo. Selects the region that handles this key's encrypt/decrypt roundtrips.
10021027
10031028 - `provider_config: BetaAWSExternalKeyConfig or BetaGCPExternalKeyConfig or BetaAzureExternalKeyConfig`
10041029
from line 1035
10101035
10111036 - `kms_arn: string`
10121037
1013 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
1038 Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
10141039
10151040 maxLength: 2048
10161041
from line 1047
10221047
10231048 **Deprecated**
10241049
1025 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
1050 IAM role ARN. Deprecated; this field is ignored.
10261051
10271052 - `BetaGCPExternalKeyConfig object`
10281053
from line 1080
10551080 - `updated_at: string`
10561081
10571082 format: date-time
1083
1084 - `user_profile_id: string or null`
1085
1086 ID of the user profile the key is bound to, or null if the key is not bound to one. A key bound to a user profile can only be attached to a Workspace that has the same user profile. A key that isn't bound can be attached to a Workspace whatever its user profile.
10581087
10591088### Beta External Key Attached Attachment
10601089
No line in this hunk matches that.