Organization changedapi/organization
Nearest release: v2.1.315, published under an hour before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+216added
Lines−153removed
From line
306
where the diff opens
First seen
30 Sep 2026
this site's first read of the page
Recorded edits13to this page, all time
The whole hunk
from line 306, old and new numbered
/
from line 306
306306 "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",
307307 "created_at": "2024-10-30T23:58:27.427722Z",
308308 "created_by": {
309 "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
309 "id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
310310 "type": "user"
311311 },
312312 "expires_at": "2024-10-30T23:58:27.427722Z",
from line 314
314314 "partial_key_hint": "sk-ant-api03-R2D...igAA",
315315 "principal": {
316316 "type": "user_actor",
317 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
317 "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
318318 },
319319 "scope": {
320320 "type": "workspace",
from line 483
483483 "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",
484484 "created_at": "2024-10-30T23:58:27.427722Z",
485485 "created_by": {
486 "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
486 "id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
487487 "type": "user"
488488 },
489489 "expires_at": "2024-10-30T23:58:27.427722Z",
from line 491
491491 "partial_key_hint": "sk-ant-api03-R2D...igAA",
492492 "principal": {
493493 "type": "user_actor",
494 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
494 "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
495495 },
496496 "scope": {
497497 "type": "workspace",
from line 675
675675 "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",
676676 "created_at": "2024-10-30T23:58:27.427722Z",
677677 "created_by": {
678 "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
678 "id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
679679 "type": "user"
680680 },
681681 "expires_at": "2024-10-30T23:58:27.427722Z",
from line 683
683683 "partial_key_hint": "sk-ant-api03-R2D...igAA",
684684 "principal": {
685685 "type": "user_actor",
686 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
686 "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
687687 },
688688 "scope": {
689689 "type": "workspace",
from line 722
722722
723723 - `kms_arn: string`
724724
725 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
725 Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
726726
727727 maxLength: 2048
728728
from line 734
734734
735735 **Deprecated**
736736
737 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
737 IAM role ARN. Deprecated; this field is ignored.
738738
739739 - `GCPExternalKeyConfig object`
740740
from line 776
776776
777777 Data residency geo. Only `us` is supported.
778778
779- `user_profile_id: optional string or null`
780
781 ID of a user profile to bind the key to. Omit this field for a key that isn't bound to a user profile. Such a key can be attached to a Workspace whatever its user profile. The binding cannot be changed later. A key bound to a user profile can only be attached to a Workspace that has the same user profile.
782
779783#### Returns
780784
781785- `ExternalKey object`
from line 796
792796
793797 - `id: string`
794798
795 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
799 Identifier of the external key config: a tagged ID prefixed `ekey_`, or, on Claude Platform on AWS, an AWS KMS key's ARN.
796800
797801 - `attachment: ExternalKeyAttachedAttachment or ExternalKeyUnattachedAttachment`
798802
from line 824
820824
821825 - `geo: string`
822826
823 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
827 Data residency geo. Selects the region that handles this key's encrypt/decrypt roundtrips.
824828
825829 - `provider_config: AWSExternalKeyConfig or GCPExternalKeyConfig or AzureExternalKeyConfig`
826830
from line 836
832836
833837 - `kms_arn: string`
834838
835 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
839 Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
836840
837841 maxLength: 2048
838842
from line 848
844848
845849 **Deprecated**
846850
847 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
851 IAM role ARN. Deprecated; this field is ignored.
848852
849853 - `GCPExternalKeyConfig object`
850854
from line 882
878882
879883 format: date-time
880884
885 - `user_profile_id: string or null`
886
887 ID of the user profile the key is bound to, or null if the key is not bound to one. A key bound to a user profile can only be attached to a Workspace that has the same user profile. A key that isn't bound can be attached to a Workspace whatever its user profile.
888
881889#### Example
882890
883891```bash
from line 897
889897 "provider_config": {
890898 "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
891899 "type": "aws"
892 }
900 },
901 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
893902 }'
894903```
895904
from line 920
911920 "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
912921 },
913922 "type": "external_key",
914 "updated_at": "2024-10-30T23:58:27.427722Z"
923 "updated_at": "2024-10-30T23:58:27.427722Z",
924 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
915925}
916926```
917927
from line 964
954964
955965 - `id: string`
956966
957 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
967 Identifier of the external key config: a tagged ID prefixed `ekey_`, or, on Claude Platform on AWS, an AWS KMS key's ARN.
958968
959969 - `attachment: ExternalKeyAttachedAttachment or ExternalKeyUnattachedAttachment`
960970
from line 992
982992
983993 - `geo: string`
984994
985 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
995 Data residency geo. Selects the region that handles this key's encrypt/decrypt roundtrips.
986996
987997 - `provider_config: AWSExternalKeyConfig or GCPExternalKeyConfig or AzureExternalKeyConfig`
988998
from line 1004
9941004
9951005 - `kms_arn: string`
9961006
997 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
1007 Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
9981008
9991009 maxLength: 2048
10001010
from line 1016
10061016
10071017 **Deprecated**
10081018
1009 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
1019 IAM role ARN. Deprecated; this field is ignored.
10101020
10111021 - `GCPExternalKeyConfig object`
10121022
from line 1050
10401050
10411051 format: date-time
10421052
1053 - `user_profile_id: string or null`
1054
1055 ID of the user profile the key is bound to, or null if the key is not bound to one. A key bound to a user profile can only be attached to a Workspace that has the same user profile. A key that isn't bound can be attached to a Workspace whatever its user profile.
1056
10431057- `next_page: string or null`
10441058
10451059 Opaque cursor for the next page, or null if no more results. Pass as `?page=` to fetch the next page.
from line 1086
10721086 "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
10731087 },
10741088 "type": "external_key",
1075 "updated_at": "2024-10-30T23:58:27.427722Z"
1089 "updated_at": "2024-10-30T23:58:27.427722Z",
1090 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
10761091 }
10771092 ],
10781093 "next_page": "next_page"
from line 1132
11171132
11181133 - `id: string`
11191134
1120 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
1135 Identifier of the external key config: a tagged ID prefixed `ekey_`, or, on Claude Platform on AWS, an AWS KMS key's ARN.
11211136
11221137 - `attachment: ExternalKeyAttachedAttachment or ExternalKeyUnattachedAttachment`
11231138
from line 1160
11451160
11461161 - `geo: string`
11471162
1148 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
1163 Data residency geo. Selects the region that handles this key's encrypt/decrypt roundtrips.
11491164
11501165 - `provider_config: AWSExternalKeyConfig or GCPExternalKeyConfig or AzureExternalKeyConfig`
11511166
from line 1172
11571172
11581173 - `kms_arn: string`
11591174
1160 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
1175 Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
11611176
11621177 maxLength: 2048
11631178
from line 1184
11691184
11701185 **Deprecated**
11711186
1172 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
1187 IAM role ARN. Deprecated; this field is ignored.
11731188
11741189 - `GCPExternalKeyConfig object`
11751190
from line 1218
12031218
12041219 format: date-time
12051220
1221 - `user_profile_id: string or null`
1222
1223 ID of the user profile the key is bound to, or null if the key is not bound to one. A key bound to a user profile can only be attached to a Workspace that has the same user profile. A key that isn't bound can be attached to a Workspace whatever its user profile.
1224
12061225#### Example
12071226
12081227```bash
from line 1248
12291248 "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
12301249 },
12311250 "type": "external_key",
1232 "updated_at": "2024-10-30T23:58:27.427722Z"
1251 "updated_at": "2024-10-30T23:58:27.427722Z",
1252 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
12331253}
12341254```
12351255
from line 1301
12811301
12821302 - `kms_arn: string`
12831303
1284 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
1304 Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
12851305
12861306 maxLength: 2048
12871307
from line 1313
12931313
12941314 **Deprecated**
12951315
1296 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
1316 IAM role ARN. Deprecated; this field is ignored.
12971317
12981318 - `GCPExternalKeyConfig object`
12991319
from line 1361
13411361
13421362 - `id: string`
13431363
1344 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
1364 Identifier of the external key config: a tagged ID prefixed `ekey_`, or, on Claude Platform on AWS, an AWS KMS key's ARN.
13451365
13461366 - `attachment: ExternalKeyAttachedAttachment or ExternalKeyUnattachedAttachment`
13471367
from line 1389
13691389
13701390 - `geo: string`
13711391
1372 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
1392 Data residency geo. Selects the region that handles this key's encrypt/decrypt roundtrips.
13731393
13741394 - `provider_config: AWSExternalKeyConfig or GCPExternalKeyConfig or AzureExternalKeyConfig`
13751395
from line 1401
13811401
13821402 - `kms_arn: string`
13831403
1384 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
1404 Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
13851405
13861406 maxLength: 2048
13871407
from line 1413
13931413
13941414 **Deprecated**
13951415
1396 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
1416 IAM role ARN. Deprecated; this field is ignored.
13971417
13981418 - `GCPExternalKeyConfig object`
13991419
from line 1447
14271447
14281448 format: date-time
14291449
1450 - `user_profile_id: string or null`
1451
1452 ID of the user profile the key is bound to, or null if the key is not bound to one. A key bound to a user profile can only be attached to a Workspace that has the same user profile. A key that isn't bound can be attached to a Workspace whatever its user profile.
1453
14301454#### Example
14311455
14321456```bash
from line 1479
14551479 "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
14561480 },
14571481 "type": "external_key",
1458 "updated_at": "2024-10-30T23:58:27.427722Z"
1482 "updated_at": "2024-10-30T23:58:27.427722Z",
1483 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
14591484}
14601485```
14611486
from line 5857
58325857{
58335858 "data": [
58345859 {
5835 "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
5860 "id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
58365861 "added_at": "2024-10-30T23:58:27.427722Z",
58385863 "name": "Jane Doe",
from line 5955
59305955
59315956```json
59325957{
5933 "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
5958 "id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
59345959 "added_at": "2024-10-30T23:58:27.427722Z",
59365961 "name": "Jane Doe",
from line 6070
60456070
60466071```json
60476072{
6048 "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
6073 "id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
60496074 "added_at": "2024-10-30T23:58:27.427722Z",
60516076 "name": "Jane Doe",
from line 6126
61016126
61026127```json
61036128{
6104 "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
6129 "id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
61056130 "type": "user_deleted"
61066131}
61076132```
from line 6201
61766201
61776202 - `compartment_id: string`
61786203
6179 Identifier for this Workspace's encryption compartment. When you configure a
6180 customer-managed encryption key (CMEK) on AWS, reference this value in your
6181 KMS key-policy condition so the key is scoped to this compartment. On GCP and
6182 Azure, Anthropic enforces the compartment binding automatically; you do not
6183 need to reference this value in your key configuration. See the CMEK
6184 integration guide for the required key configuration; unless your organization
6185 is on Claude Platform on AWS, it includes a separate value used during key
6186 validation. On Claude Platform on AWS there is no separate validation value:
6187 the key is validated against this Workspace's own value when it is attached, so
6188 if your key policy uses the compartment condition, add this value to it before
6189 attaching the key.
6204 Identifier for this Workspace's encryption compartment. When you configure an
6205 AWS KMS customer-managed encryption key (CMEK) that isn't bound to a user
6206 profile, reference this value in your KMS key-policy condition so the key is
6207 scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment
6208 binding automatically; you do not need to reference this value in your key
6209 configuration. See the CMEK integration guide for the required key
6210 configuration; unless your organization is on Claude Platform on AWS, it
6211 includes a separate value used during key validation. On Claude Platform on AWS
6212 there is no separate validation value: your organization's own key is validated
6213 against this Workspace's own value when it is attached, so if its key policy
6214 uses the compartment condition, add this value to it before attaching the key.
61906215
61916216 - `created_at: string`
61926217
from line 6257
62326257 Workspace. Setting this field requires CMEK to be enabled for your
62336258 organization. When set, data stored for this Workspace is encrypted with the
62346259 referenced key. Create key configurations with the External Keys API. On
6235 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
6236 single-Region key in the same AWS account and Region as the Workspace. On that
6237 platform the key is validated against this Workspace when it is attached, so a
6238 key-policy problem is reported as an error on this request. This field is write-once:
6239 once a key is attached to a Workspace it cannot be detached or replaced. To
6240 rotate key material, rotate the underlying key on your cloud KMS; the
6241 `external_key_id` stays the same.
6260 Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your
6261 organization's own key must be a single-Region key in the same AWS account and
6262 Region as the Workspace. On that platform the key is validated against this
6263 Workspace when it is attached, so a key-policy problem is reported as an error
6264 on this request. This field is write-once: once a key is attached to a Workspace
6265 it cannot be detached or replaced. To rotate key material, rotate the underlying
6266 key on your cloud KMS; the `external_key_id` stays the same.
62426267
62436268 - `name: string`
62446269
from line 6273
62486273
62496274 User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.
62506275
6276 - `user_profile_id: string or null`
6277
6278 ID of the user profile attached to the Workspace, or null if it has none. Every inference request through a Workspace that has a user profile must name that profile.
6279
62516280- `first_id: string or null`
62526281
62536282 First ID in the `data` list. Can be used as the `before_id` for the previous page.
from line 6319
62906319 "env": "prod",
62916320 "team": "platform"
62926321 },
6293 "type": "workspace"
6322 "type": "workspace",
6323 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
62946324 }
62956325 ],
62966326 "first_id": "first_id",
from line 6391
63616391 Workspace. Setting this field requires CMEK to be enabled for your
63626392 organization. When set, data stored for this Workspace is encrypted with the
63636393 referenced key. Create key configurations with the External Keys API. On
6364 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
6365 single-Region key in the same AWS account and Region as the Workspace. On that
6366 platform the key is validated against this Workspace when it is attached, so a
6367 key-policy problem is reported as an error on this request. This field is write-once:
6368 once a key is attached to a Workspace it cannot be detached or replaced. To
6369 rotate key material, rotate the underlying key on your cloud KMS; the
6370 `external_key_id` stays the same.
6394 Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your
6395 organization's own key must be a single-Region key in the same AWS account and
6396 Region as the Workspace. On that platform the key is validated against this
6397 Workspace when it is attached, so a key-policy problem is reported as an error
6398 on this request. This field is write-once: once a key is attached to a Workspace
6399 it cannot be detached or replaced. To rotate key material, rotate the underlying
6400 key on your cloud KMS; the `external_key_id` stays the same.
63716401
63726402- `tags: optional map[string] or null`
63736403
63746404 User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.
63756405
6406- `user_profile_id: optional string or null`
6407
6408 ID of a user profile to attach to the Workspace. Every inference request through the Workspace must then name this user profile; the API rejects a request that names none or a different one. The user profile can't be replaced or removed later; only deleting the user profile clears it.
6409
63766410#### Returns
63776411
63786412- `Workspace object`
from line 6431
63976431
63986432 - `compartment_id: string`
63996433
6400 Identifier for this Workspace's encryption compartment. When you configure a
6401 customer-managed encryption key (CMEK) on AWS, reference this value in your
6402 KMS key-policy condition so the key is scoped to this compartment. On GCP and
6403 Azure, Anthropic enforces the compartment binding automatically; you do not
6404 need to reference this value in your key configuration. See the CMEK
6405 integration guide for the required key configuration; unless your organization
6406 is on Claude Platform on AWS, it includes a separate value used during key
6407 validation. On Claude Platform on AWS there is no separate validation value:
6408 the key is validated against this Workspace's own value when it is attached, so
6409 if your key policy uses the compartment condition, add this value to it before
6410 attaching the key.
6434 Identifier for this Workspace's encryption compartment. When you configure an
6435 AWS KMS customer-managed encryption key (CMEK) that isn't bound to a user
6436 profile, reference this value in your KMS key-policy condition so the key is
6437 scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment
6438 binding automatically; you do not need to reference this value in your key
6439 configuration. See the CMEK integration guide for the required key
6440 configuration; unless your organization is on Claude Platform on AWS, it
6441 includes a separate value used during key validation. On Claude Platform on AWS
6442 there is no separate validation value: your organization's own key is validated
6443 against this Workspace's own value when it is attached, so if its key policy
6444 uses the compartment condition, add this value to it before attaching the key.
64116445
64126446 - `created_at: string`
64136447
from line 6487
64536487 Workspace. Setting this field requires CMEK to be enabled for your
64546488 organization. When set, data stored for this Workspace is encrypted with the
64556489 referenced key. Create key configurations with the External Keys API. On
6456 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
6457 single-Region key in the same AWS account and Region as the Workspace. On that
6458 platform the key is validated against this Workspace when it is attached, so a
6459 key-policy problem is reported as an error on this request. This field is write-once:
6460 once a key is attached to a Workspace it cannot be detached or replaced. To
6461 rotate key material, rotate the underlying key on your cloud KMS; the
6462 `external_key_id` stays the same.
6490 Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your
6491 organization's own key must be a single-Region key in the same AWS account and
6492 Region as the Workspace. On that platform the key is validated against this
6493 Workspace when it is attached, so a key-policy problem is reported as an error
6494 on this request. This field is write-once: once a key is attached to a Workspace
6495 it cannot be detached or replaced. To rotate key material, rotate the underlying
6496 key on your cloud KMS; the `external_key_id` stays the same.
64636497
64646498 - `name: string`
64656499
from line 6503
64696503
64706504 User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.
64716505
6506 - `user_profile_id: string or null`
6507
6508 ID of the user profile attached to the Workspace, or null if it has none. Every inference request through a Workspace that has a user profile must name that profile.
6509
64726510#### Example
64736511
64746512```bash
from line 6521
64836521 "tags": {
64846522 "env": "prod",
64856523 "team": "platform"
6486 }
6524 },
6525 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
64876526 }'
64886527```
64896528
from line 6546
65076546 "env": "prod",
65086547 "team": "platform"
65096548 },
6510 "type": "workspace"
6549 "type": "workspace",
6550 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
65116551}
65126552```
65136553
from line 6595
65556595
65566596 - `compartment_id: string`
65576597
6558 Identifier for this Workspace's encryption compartment. When you configure a
6559 customer-managed encryption key (CMEK) on AWS, reference this value in your
6560 KMS key-policy condition so the key is scoped to this compartment. On GCP and
6561 Azure, Anthropic enforces the compartment binding automatically; you do not
6562 need to reference this value in your key configuration. See the CMEK
6563 integration guide for the required key configuration; unless your organization
6564 is on Claude Platform on AWS, it includes a separate value used during key
6565 validation. On Claude Platform on AWS there is no separate validation value:
6566 the key is validated against this Workspace's own value when it is attached, so
6567 if your key policy uses the compartment condition, add this value to it before
6568 attaching the key.
6598 Identifier for this Workspace's encryption compartment. When you configure an
6599 AWS KMS customer-managed encryption key (CMEK) that isn't bound to a user
6600 profile, reference this value in your KMS key-policy condition so the key is
6601 scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment
6602 binding automatically; you do not need to reference this value in your key
6603 configuration. See the CMEK integration guide for the required key
6604 configuration; unless your organization is on Claude Platform on AWS, it
6605 includes a separate value used during key validation. On Claude Platform on AWS
6606 there is no separate validation value: your organization's own key is validated
6607 against this Workspace's own value when it is attached, so if its key policy
6608 uses the compartment condition, add this value to it before attaching the key.
65696609
65706610 - `created_at: string`
65716611
from line 6651
66116651 Workspace. Setting this field requires CMEK to be enabled for your
66126652 organization. When set, data stored for this Workspace is encrypted with the
66136653 referenced key. Create key configurations with the External Keys API. On
6614 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
6615 single-Region key in the same AWS account and Region as the Workspace. On that
6616 platform the key is validated against this Workspace when it is attached, so a
6617 key-policy problem is reported as an error on this request. This field is write-once:
6618 once a key is attached to a Workspace it cannot be detached or replaced. To
6619 rotate key material, rotate the underlying key on your cloud KMS; the
6620 `external_key_id` stays the same.
6654 Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your
6655 organization's own key must be a single-Region key in the same AWS account and
6656 Region as the Workspace. On that platform the key is validated against this
6657 Workspace when it is attached, so a key-policy problem is reported as an error
6658 on this request. This field is write-once: once a key is attached to a Workspace
6659 it cannot be detached or replaced. To rotate key material, rotate the underlying
6660 key on your cloud KMS; the `external_key_id` stays the same.
66216661
66226662 - `name: string`
66236663
from line 6667
66276667
66286668 User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.
66296669
6670 - `user_profile_id: string or null`
6671
6672 ID of the user profile attached to the Workspace, or null if it has none. Every inference request through a Workspace that has a user profile must name that profile.
6673
66306674#### Example
66316675
66326676```bash
from line 6699
66556699 "env": "prod",
66566700 "team": "platform"
66576701 },
6658 "type": "workspace"
6702 "type": "workspace",
6703 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
66596704}
66606705```
66616706
from line 6760
67156760 Workspace. Setting this field requires CMEK to be enabled for your
67166761 organization. When set, data stored for this Workspace is encrypted with the
67176762 referenced key. Create key configurations with the External Keys API. On
6718 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
6719 single-Region key in the same AWS account and Region as the Workspace. On that
6720 platform the key is validated against this Workspace when it is attached, so a
6721 key-policy problem is reported as an error on this request. This field is write-once:
6722 once a key is attached to a Workspace it cannot be detached or replaced. To
6723 rotate key material, rotate the underlying key on your cloud KMS; the
6724 `external_key_id` stays the same.
6763 Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your
6764 organization's own key must be a single-Region key in the same AWS account and
6765 Region as the Workspace. On that platform the key is validated against this
6766 Workspace when it is attached, so a key-policy problem is reported as an error
6767 on this request. This field is write-once: once a key is attached to a Workspace
6768 it cannot be detached or replaced. To rotate key material, rotate the underlying
6769 key on your cloud KMS; the `external_key_id` stays the same.
67256770
67266771- `name: optional string`
67276772
from line 6778
67336778
67346779 User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.
67356780
6781- `user_profile_id: optional string`
6782
6783 ID of a user profile to attach to the Workspace. Every inference request through the Workspace must then name this user profile; the API rejects a request that names none or a different one. Once set, it can't be replaced or removed (sending the same ID again changes nothing); only deleting the user profile clears it. The default Workspace can't have a user profile.
6784
67366785#### Returns
67376786
67386787- `Workspace object`
from line 6806
67576806
67586807 - `compartment_id: string`
67596808
6760 Identifier for this Workspace's encryption compartment. When you configure a
6761 customer-managed encryption key (CMEK) on AWS, reference this value in your
6762 KMS key-policy condition so the key is scoped to this compartment. On GCP and
6763 Azure, Anthropic enforces the compartment binding automatically; you do not
6764 need to reference this value in your key configuration. See the CMEK
6765 integration guide for the required key configuration; unless your organization
6766 is on Claude Platform on AWS, it includes a separate value used during key
6767 validation. On Claude Platform on AWS there is no separate validation value:
6768 the key is validated against this Workspace's own value when it is attached, so
6769 if your key policy uses the compartment condition, add this value to it before
6770 attaching the key.
6809 Identifier for this Workspace's encryption compartment. When you configure an
6810 AWS KMS customer-managed encryption key (CMEK) that isn't bound to a user
6811 profile, reference this value in your KMS key-policy condition so the key is
6812 scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment
6813 binding automatically; you do not need to reference this value in your key
6814 configuration. See the CMEK integration guide for the required key
6815 configuration; unless your organization is on Claude Platform on AWS, it
6816 includes a separate value used during key validation. On Claude Platform on AWS
6817 there is no separate validation value: your organization's own key is validated
6818 against this Workspace's own value when it is attached, so if its key policy
6819 uses the compartment condition, add this value to it before attaching the key.
67716820
67726821 - `created_at: string`
67736822
from line 6862
68136862 Workspace. Setting this field requires CMEK to be enabled for your
68146863 organization. When set, data stored for this Workspace is encrypted with the
68156864 referenced key. Create key configurations with the External Keys API. On
6816 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
6817 single-Region key in the same AWS account and Region as the Workspace. On that
6818 platform the key is validated against this Workspace when it is attached, so a
6819 key-policy problem is reported as an error on this request. This field is write-once:
6820 once a key is attached to a Workspace it cannot be detached or replaced. To
6821 rotate key material, rotate the underlying key on your cloud KMS; the
6822 `external_key_id` stays the same.
6865 Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your
6866 organization's own key must be a single-Region key in the same AWS account and
6867 Region as the Workspace. On that platform the key is validated against this
6868 Workspace when it is attached, so a key-policy problem is reported as an error
6869 on this request. This field is write-once: once a key is attached to a Workspace
6870 it cannot be detached or replaced. To rotate key material, rotate the underlying
6871 key on your cloud KMS; the `external_key_id` stays the same.
68236872
68246873 - `name: string`
68256874
from line 6878
68296878
68306879 User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.
68316880
6881 - `user_profile_id: string or null`
6882
6883 ID of the user profile attached to the Workspace, or null if it has none. Every inference request through a Workspace that has a user profile must name that profile.
6884
68326885#### Example
68336886
68346887```bash
from line 6895
68426895 "tags": {
68436896 "env": "prod",
68446897 "team": "platform"
6845 }
6898 },
6899 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
68466900 }'
68476901```
68486902
from line 6920
68666920 "env": "prod",
68676921 "team": "platform"
68686922 },
6869 "type": "workspace"
6923 "type": "workspace",
6924 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
68706925}
68716926```
68726927
from line 6967
69126967
69136968 - `compartment_id: string`
69146969
6915 Identifier for this Workspace's encryption compartment. When you configure a
6916 customer-managed encryption key (CMEK) on AWS, reference this value in your
6917 KMS key-policy condition so the key is scoped to this compartment. On GCP and
6918 Azure, Anthropic enforces the compartment binding automatically; you do not
6919 need to reference this value in your key configuration. See the CMEK
6920 integration guide for the required key configuration; unless your organization
6921 is on Claude Platform on AWS, it includes a separate value used during key
6922 validation. On Claude Platform on AWS there is no separate validation value:
6923 the key is validated against this Workspace's own value when it is attached, so
6924 if your key policy uses the compartment condition, add this value to it before
6925 attaching the key.
6970 Identifier for this Workspace's encryption compartment. When you configure an
6971 AWS KMS customer-managed encryption key (CMEK) that isn't bound to a user
6972 profile, reference this value in your KMS key-policy condition so the key is
6973 scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment
6974 binding automatically; you do not need to reference this value in your key
6975 configuration. See the CMEK integration guide for the required key
6976 configuration; unless your organization is on Claude Platform on AWS, it
6977 includes a separate value used during key validation. On Claude Platform on AWS
6978 there is no separate validation value: your organization's own key is validated
6979 against this Workspace's own value when it is attached, so if its key policy
6980 uses the compartment condition, add this value to it before attaching the key.
69266981
69276982 - `created_at: string`
69286983
from line 7023
69687023 Workspace. Setting this field requires CMEK to be enabled for your
69697024 organization. When set, data stored for this Workspace is encrypted with the
69707025 referenced key. Create key configurations with the External Keys API. On
6971 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
6972 single-Region key in the same AWS account and Region as the Workspace. On that
6973 platform the key is validated against this Workspace when it is attached, so a
6974 key-policy problem is reported as an error on this request. This field is write-once:
6975 once a key is attached to a Workspace it cannot be detached or replaced. To
6976 rotate key material, rotate the underlying key on your cloud KMS; the
6977 `external_key_id` stays the same.
7026 Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your
7027 organization's own key must be a single-Region key in the same AWS account and
7028 Region as the Workspace. On that platform the key is validated against this
7029 Workspace when it is attached, so a key-policy problem is reported as an error
7030 on this request. This field is write-once: once a key is attached to a Workspace
7031 it cannot be detached or replaced. To rotate key material, rotate the underlying
7032 key on your cloud KMS; the `external_key_id` stays the same.
69787033
69797034 - `name: string`
69807035
from line 7039
69847039
69857040 User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.
69867041
7042 - `user_profile_id: string or null`
7043
7044 ID of the user profile attached to the Workspace, or null if it has none. Every inference request through a Workspace that has a user profile must name that profile.
7045
69877046#### Example
69887047
69897048```bash
from line 7072
70137072 "env": "prod",
70147073 "team": "platform"
70157074 },
7016 "type": "workspace"
7075 "type": "workspace",
7076 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
70177077}
70187078```
70197079
from line 7684
76247684 "data": [
76257685 {
76267686 "type": "workspace_member",
7627 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
7687 "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
76287688 "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
76297689 "workspace_role": "workspace_admin"
76307690 }
from line 7775
77157775 -H 'anthropic-version: 2026-10-21' \
77167776 -H "Authorization: Bearer $ANTHROPIC_API_KEY" \
77177777 -d '{
7718 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
7778 "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
77197779 "workspace_role": "workspace_admin"
77207780 }'
77217781```
from line 7785
77257785```json
77267786{
77277787 "type": "workspace_member",
7728 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
7788 "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
77297789 "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
77307790 "workspace_role": "workspace_admin"
77317791}
from line 7862
78027862```json
78037863{
78047864 "type": "workspace_member",
7805 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
7865 "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
78067866 "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
78077867 "workspace_role": "workspace_admin"
78087868}
from line 7959
78997959```json
79007960{
79017961 "type": "workspace_member",
7902 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
7962 "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
79037963 "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
79047964 "workspace_role": "workspace_admin"
79057965}
from line 8021
79618021```json
79628022{
79638023 "type": "workspace_member_deleted",
7964 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
8024 "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
79658025 "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
79668026}
79678027```
from line 8799
87398799
87408800Setting `state` to `enabled` turns on the Compliance API and begins
87418801capturing organization activity events. Setting it to `disabled` turns
8742both off. `state` reflects whether the Compliance API is enabled.
8802both off. Access Transparency events are an exception: they are still
8803captured while the Compliance API is disabled, and the Compliance API
8804activity feed returns them once it is enabled again. `state` reflects
8805whether the Compliance API is enabled.
87438806
87448807A request that sets `state` to its current value succeeds and leaves the
87458808resource unchanged. A `disabled` request stays in effect until a later
No line in this hunk matches that.