Update External Key changedapi/beta/organization/external_keys/update
Nearest release: v2.1.315, published under an hour before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+12added
Lines−7removed
From line
51
where the diff opens
First seen
26 Aug 2026
this site's first read of the page
Recorded edits9to this page, all time
The whole hunk
from line 51, old and new numbered
/
from line 51
5151
5252 - `kms_arn: string`
5353
54 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
54 Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
5555
5656 maxLength: 2048
5757
from line 63
6363
6464 **Deprecated**
6565
66 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
66 IAM role ARN. Deprecated; this field is ignored.
6767
6868 - `BetaGCPExternalKeyConfig object`
6969
from line 111
111111
112112 - `id: string`
113113
114 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
114 Identifier of the external key config: a tagged ID prefixed `ekey_`, or, on Claude Platform on AWS, an AWS KMS key's ARN.
115115
116116 - `attachment: BetaExternalKeyAttachedAttachment or BetaExternalKeyUnattachedAttachment`
117117
from line 139
139139
140140 - `geo: string`
141141
142 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
142 Data residency geo. Selects the region that handles this key's encrypt/decrypt roundtrips.
143143
144144 - `provider_config: BetaAWSExternalKeyConfig or BetaGCPExternalKeyConfig or BetaAzureExternalKeyConfig`
145145
from line 151
151151
152152 - `kms_arn: string`
153153
154 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
154 Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
155155
156156 maxLength: 2048
157157
from line 163
163163
164164 **Deprecated**
165165
166 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
166 IAM role ARN. Deprecated; this field is ignored.
167167
168168 - `BetaGCPExternalKeyConfig object`
169169
from line 197
197197
198198 format: date-time
199199
200 - `user_profile_id: string or null`
201
202 ID of the user profile the key is bound to, or null if the key is not bound to one. A key bound to a user profile can only be attached to a Workspace that has the same user profile. A key that isn't bound can be attached to a Workspace whatever its user profile.
203
200204## Example
201205
202206```bash
from line 229
225229 "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
226230 },
227231 "type": "external_key",
228 "updated_at": "2024-10-30T23:58:27.427722Z"
232 "updated_at": "2024-10-30T23:58:27.427722Z",
233 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
229234}
230235```
231236
No line in this hunk matches that.