Get External Key changedapi/beta/organization/external_keys/retrieve
Nearest release: v2.1.315, published under an hour before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+10added
Lines−5removed
From line
41
where the diff opens
First seen
26 Aug 2026
this site's first read of the page
Recorded edits8to this page, all time
The whole hunk
from line 41, old and new numbered
/
from line 41
4141
4242 - `id: string`
4343
44 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
44 Identifier of the external key config: a tagged ID prefixed `ekey_`, or, on Claude Platform on AWS, an AWS KMS key's ARN.
4545
4646 - `attachment: BetaExternalKeyAttachedAttachment or BetaExternalKeyUnattachedAttachment`
4747
from line 69
6969
7070 - `geo: string`
7171
72 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
72 Data residency geo. Selects the region that handles this key's encrypt/decrypt roundtrips.
7373
7474 - `provider_config: BetaAWSExternalKeyConfig or BetaGCPExternalKeyConfig or BetaAzureExternalKeyConfig`
7575
from line 81
8181
8282 - `kms_arn: string`
8383
84 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
84 Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
8585
8686 maxLength: 2048
8787
from line 93
9393
9494 **Deprecated**
9595
96 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
96 IAM role ARN. Deprecated; this field is ignored.
9797
9898 - `BetaGCPExternalKeyConfig object`
9999
from line 127
127127
128128 format: date-time
129129
130 - `user_profile_id: string or null`
131
132 ID of the user profile the key is bound to, or null if the key is not bound to one. A key bound to a user profile can only be attached to a Workspace that has the same user profile. A key that isn't bound can be attached to a Workspace whatever its user profile.
133
130134## Example
131135
132136```bash
from line 157
153157 "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
154158 },
155159 "type": "external_key",
156 "updated_at": "2024-10-30T23:58:27.427722Z"
160 "updated_at": "2024-10-30T23:58:27.427722Z",
161 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
157162}
158163```
159164
No line in this hunk matches that.