External Keys changedapi/admin/external_keys
Nearest release: v2.1.245, published an hour after this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+220added
Lines−203removed
From line
1
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits6to this page, all time
### Body parameters #### Response (200) ### Query parameters #### Response (200) ### Path parameters #### Response (200) ### Path parameters ### Body parameters #### Response (200) ### Path parameters #### Response (200) ### Path parameters #### Response (200) ## Domain types ### Body Parameters #### Response ### Query Parameters #### Response ### Path Parameters #### Response ### Path Parameters ### Body Parameters #### Response ### Path Parameters #### Response ### Path Parameters #### Response ## Domain Types
The whole hunk
from line 1, old and new numbered
/
The two sides of this change are more than 400 edits apart, too far apart to line up, so this is the differ's own diff of it and the words inside a line are not marked.
from line 1
1---
2title: External Keys
3url: https://platform.claude.com/docs/en/api/admin/external_keys
4---
5
61# External Keys
72
83## Create External Key
94
10**post** `/v1/organizations/external_keys`
5**POST** `/v1/organizations/external_keys`
116
127Create an external key config owned by the caller's organization.
138
14### Body Parameters
15
16- `provider_config: object { kms_arn, type, region, role_arn } or object { key_name, type } or object { key_name, tenant_id, type, 2 more }`
9### Body parameters
10
11- `provider_config: object or object or object`
1712
1813 KMS provider identity and auth coordinates.
1914
20 - `Aws object { kms_arn, type, region, role_arn }`
15 - `Aws object`
2116
2217 - `kms_arn: string`
2318
2419 Full ARN of the AWS KMS key.
2520
21 maxLength: 2048
22
2623 - `type: "aws"`
2724
28 - `"aws"`
29
3025 - `region: optional string or null`
3126
3227 AWS region. Derived from kms_arn if omitted.
3328
3429 - `role_arn: optional string or null`
3530
31 **Deprecated**
32
3633 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
3734
38 - `Gcp object { key_name, type }`
35 - `Gcp object`
3936
4037 - `key_name: string`
4138
from line 40
4340
4441 - `type: "gcp"`
4542
46 - `"gcp"`
47
48 - `Azure object { key_name, tenant_id, type, 2 more }`
43 - `Azure object`
4944
5045 Azure Key Vault provider configuration.
5146
from line 54
5954
6055 - `type: "azure"`
6156
62 - `"azure"`
63
6457 - `vault_uri: string`
6558
6659 Key Vault data-plane URI — https://<vault-name>.vault.azure.net or https://<hsm-name>.managedhsm.azure.net.
from line 66
7366
7467 Human-friendly display name.
7568
69 maxLength: 255, minLength: 1
70
7671- `geo: optional "us"`
7772
7873 Data residency geo. Only `us` is supported.
7974
80 - `"us"`
81
8275### Returns
8376
8477- `id: string`
8578
8679 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
8780
88- `attachment: object { type } or object { type }`
81- `attachment: object or object`
8982
9083 Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
9184
92 - `Attached object { type }`
85 - `Attached object`
9386
9487 - `type: "attached"`
9588
96 - `"attached"`
97
98 - `Unattached object { type }`
89 default: attached
90
91 - `Unattached object`
9992
10093 - `type: "unattached"`
10194
102 - `"unattached"`
95 default: unattached
10396
10497- `created_at: string`
10598
99 format: date-time
100
106101- `display_name: string or null`
107102
108103 Human-friendly display name. Null if none was set.
from line 106
111106
112107 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
113108
114- `provider_config: object { kms_arn, type, region, role_arn } or object { key_name, type } or object { key_name, tenant_id, type, 2 more }`
109- `provider_config: object or object or object`
115110
116111 KMS provider identity and auth coordinates.
117112
118 - `Aws object { kms_arn, type, region, role_arn }`
113 - `Aws object`
119114
120115 - `kms_arn: string`
121116
122117 Full ARN of the AWS KMS key.
123118
119 maxLength: 2048
120
124121 - `type: "aws"`
125122
126 - `"aws"`
127
128123 - `region: optional string or null`
129124
130125 AWS region. Derived from kms_arn if omitted.
131126
132127 - `role_arn: optional string or null`
133128
129 **Deprecated**
130
134131 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
135132
136 - `Gcp object { key_name, type }`
133 - `Gcp object`
137134
138135 - `key_name: string`
139136
from line 138
141138
142139 - `type: "gcp"`
143140
144 - `"gcp"`
145
146 - `Azure object { key_name, tenant_id, type, 2 more }`
141 - `Azure object`
147142
148143 - `key_name: string`
149144
from line 150
155150
156151 - `type: "azure"`
157152
158 - `"azure"`
159
160153 - `vault_uri: string`
161154
162155 Key Vault data-plane URI — https://<vault-name>.vault.azure.net or https://<hsm-name>.managedhsm.azure.net.
from line 160
167160
168161- `type: "external_key"`
169162
170 - `"external_key"`
163 default: external_key
171164
172165- `updated_at: string`
173166
167 format: date-time
168
174169### Example
175170
176```http
171```bash
177172curl https://api.anthropic.com/v1/organizations/external_keys \
178173 -H 'Content-Type: application/json' \
179174 -H 'anthropic-version: 2023-06-01' \
from line 181
186181 }'
187182```
188183
189#### Response
184#### Response (200)
190185
191186```json
192187{
from line 205
210205
211206## List External Keys
212207
213**get** `/v1/organizations/external_keys`
208**GET** `/v1/organizations/external_keys`
214209
215210List external key configs in the caller's organization.
216211
217212Results are ordered by creation time (newest first). Use the
218213`next_page` cursor from the response to fetch subsequent pages.
219214
220### Query Parameters
215### Query parameters
221216
222217- `limit: optional number`
223218
224219 Number of results per page.
225220
221 default: 20, maximum: 100, minimum: 1
222
226223- `page: optional string`
227224
228225 Opaque cursor from a previous response's `next_page`.
229226
230227### Returns
231228
232- `data: array of object { id, attachment, created_at, 5 more }`
229- `data: array of object`
233230
234231 - `id: string`
235232
236233 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
237234
238 - `attachment: object { type } or object { type }`
235 - `attachment: object or object`
239236
240237 Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
241238
242 - `Attached object { type }`
239 - `Attached object`
243240
244241 - `type: "attached"`
245242
246 - `"attached"`
247
248 - `Unattached object { type }`
243 default: attached
244
245 - `Unattached object`
249246
250247 - `type: "unattached"`
251248
252 - `"unattached"`
249 default: unattached
253250
254251 - `created_at: string`
255252
253 format: date-time
254
256255 - `display_name: string or null`
257256
258257 Human-friendly display name. Null if none was set.
from line 260
261260
262261 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
263262
264 - `provider_config: object { kms_arn, type, region, role_arn } or object { key_name, type } or object { key_name, tenant_id, type, 2 more }`
263 - `provider_config: object or object or object`
265264
266265 KMS provider identity and auth coordinates.
267266
268 - `Aws object { kms_arn, type, region, role_arn }`
267 - `Aws object`
269268
270269 - `kms_arn: string`
271270
272271 Full ARN of the AWS KMS key.
273272
273 maxLength: 2048
274
274275 - `type: "aws"`
275276
276 - `"aws"`
277
278277 - `region: optional string or null`
279278
280279 AWS region. Derived from kms_arn if omitted.
281280
282281 - `role_arn: optional string or null`
283282
283 **Deprecated**
284
284285 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
285286
286 - `Gcp object { key_name, type }`
287 - `Gcp object`
287288
288289 - `key_name: string`
289290
from line 292
291292
292293 - `type: "gcp"`
293294
294 - `"gcp"`
295
296 - `Azure object { key_name, tenant_id, type, 2 more }`
295 - `Azure object`
297296
298297 - `key_name: string`
299298
from line 304
305304
306305 - `type: "azure"`
307306
308 - `"azure"`
309
310307 - `vault_uri: string`
311308
312309 Key Vault data-plane URI — https://<vault-name>.vault.azure.net or https://<hsm-name>.managedhsm.azure.net.
from line 314
317314
318315 - `type: "external_key"`
319316
320 - `"external_key"`
317 default: external_key
321318
322319 - `updated_at: string`
323320
321 format: date-time
322
324323- `next_page: string or null`
325324
326325 Opaque cursor for the next page, or null if no more results. Pass as `?page=` to fetch the next page.
327326
328327### Example
329328
330```http
329```bash
331330curl https://api.anthropic.com/v1/organizations/external_keys \
332331 -H 'anthropic-version: 2023-06-01' \
333332 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
334333```
335334
336#### Response
335#### Response (200)
337336
338337```json
339338{
from line 361
362361
363362## Get External Key
364363
365**get** `/v1/organizations/external_keys/{external_key_id}`
364**GET** `/v1/organizations/external_keys/{external_key_id}`
366365
367366Retrieve a single external key config in the caller's organization by ID.
368367
369### Path Parameters
368### Path parameters
370369
371370- `external_key_id: string`
372371
373372 ID of the External Key.
374373
374 maxLength: 2048
375
375376### Returns
376377
377378- `id: string`
378379
379380 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
380381
381- `attachment: object { type } or object { type }`
382- `attachment: object or object`
382383
383384 Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
384385
385 - `Attached object { type }`
386 - `Attached object`
386387
387388 - `type: "attached"`
388389
389 - `"attached"`
390
391 - `Unattached object { type }`
390 default: attached
391
392 - `Unattached object`
392393
393394 - `type: "unattached"`
394395
395 - `"unattached"`
396 default: unattached
396397
397398- `created_at: string`
398399
400 format: date-time
401
399402- `display_name: string or null`
400403
401404 Human-friendly display name. Null if none was set.
from line 407
404407
405408 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
406409
407- `provider_config: object { kms_arn, type, region, role_arn } or object { key_name, type } or object { key_name, tenant_id, type, 2 more }`
410- `provider_config: object or object or object`
408411
409412 KMS provider identity and auth coordinates.
410413
411 - `Aws object { kms_arn, type, region, role_arn }`
414 - `Aws object`
412415
413416 - `kms_arn: string`
414417
415418 Full ARN of the AWS KMS key.
416419
420 maxLength: 2048
421
417422 - `type: "aws"`
418423
419 - `"aws"`
420
421424 - `region: optional string or null`
422425
423426 AWS region. Derived from kms_arn if omitted.
424427
425428 - `role_arn: optional string or null`
426429
430 **Deprecated**
431
427432 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
428433
429 - `Gcp object { key_name, type }`
434 - `Gcp object`
430435
431436 - `key_name: string`
432437
from line 439
434439
435440 - `type: "gcp"`
436441
437 - `"gcp"`
438
439 - `Azure object { key_name, tenant_id, type, 2 more }`
442 - `Azure object`
440443
441444 - `key_name: string`
442445
from line 451
448451
449452 - `type: "azure"`
450453
451 - `"azure"`
452
453454 - `vault_uri: string`
454455
455456 Key Vault data-plane URI — https://<vault-name>.vault.azure.net or https://<hsm-name>.managedhsm.azure.net.
from line 461
460461
461462- `type: "external_key"`
462463
463 - `"external_key"`
464 default: external_key
464465
465466- `updated_at: string`
466467
468 format: date-time
469
467470### Example
468471
469```http
472```bash
470473curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID \
471474 -H 'anthropic-version: 2023-06-01' \
472475 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
473476```
474477
475#### Response
478#### Response (200)
476479
477480```json
478481{
from line 499
496499
497500## Update External Key
498501
499**post** `/v1/organizations/external_keys/{external_key_id}`
502**POST** `/v1/organizations/external_keys/{external_key_id}`
500503
501504Partially update an external key config. Omitted fields are left unchanged.
502505
from line 507
504507be changed once any workspace references this config, because previously
505508encrypted data requires the original key identity to decrypt.
506509
507### Path Parameters
510### Path parameters
508511
509512- `external_key_id: string`
510513
511514 ID of the External Key.
512515
513### Body Parameters
516 maxLength: 2048
517
518### Body parameters
514519
515520- `display_name: optional string or null`
516521
517522 Human-friendly display name.
518523
524 maxLength: 255, minLength: 1
525
519526- `geo: optional "us" or null`
520527
521528 Data residency geo. Only `us` is supported.
522529
523 - `"us"`
524
525- `provider_config: optional object { kms_arn, type, region, role_arn } or object { key_name, type } or object { key_name, tenant_id, type, 2 more } or null`
530- `provider_config: optional object or object or object or null`
526531
527532 KMS provider identity and auth coordinates.
528533
529 - `Aws object { kms_arn, type, region, role_arn }`
534 - `Aws object`
530535
531536 - `kms_arn: string`
532537
533538 Full ARN of the AWS KMS key.
534539
540 maxLength: 2048
541
535542 - `type: "aws"`
536543
537 - `"aws"`
538
539544 - `region: optional string or null`
540545
541546 AWS region. Derived from kms_arn if omitted.
542547
543548 - `role_arn: optional string or null`
544549
550 **Deprecated**
551
545552 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
546553
547 - `Gcp object { key_name, type }`
554 - `Gcp object`
548555
549556 - `key_name: string`
550557
from line 559
552559
553560 - `type: "gcp"`
554561
555 - `"gcp"`
556
557 - `Azure object { key_name, tenant_id, type, 2 more }`
562 - `Azure object`
558563
559564 Azure Key Vault provider configuration.
560565
from line 573
568573
569574 - `type: "azure"`
570575
571 - `"azure"`
572
573576 - `vault_uri: string`
574577
575578 Key Vault data-plane URI — https://<vault-name>.vault.azure.net or https://<hsm-name>.managedhsm.azure.net.
from line 587
584587
585588 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
586589
587- `attachment: object { type } or object { type }`
590- `attachment: object or object`
588591
589592 Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
590593
591 - `Attached object { type }`
594 - `Attached object`
592595
593596 - `type: "attached"`
594597
595 - `"attached"`
596
597 - `Unattached object { type }`
598 default: attached
599
600 - `Unattached object`
598601
599602 - `type: "unattached"`
600603
601 - `"unattached"`
604 default: unattached
602605
603606- `created_at: string`
604607
608 format: date-time
609
605610- `display_name: string or null`
606611
607612 Human-friendly display name. Null if none was set.
from line 615
610615
611616 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
612617
613- `provider_config: object { kms_arn, type, region, role_arn } or object { key_name, type } or object { key_name, tenant_id, type, 2 more }`
618- `provider_config: object or object or object`
614619
615620 KMS provider identity and auth coordinates.
616621
617 - `Aws object { kms_arn, type, region, role_arn }`
622 - `Aws object`
618623
619624 - `kms_arn: string`
620625
621626 Full ARN of the AWS KMS key.
622627
628 maxLength: 2048
629
623630 - `type: "aws"`
624631
625 - `"aws"`
626
627632 - `region: optional string or null`
628633
629634 AWS region. Derived from kms_arn if omitted.
630635
631636 - `role_arn: optional string or null`
632637
638 **Deprecated**
639
633640 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
634641
635 - `Gcp object { key_name, type }`
642 - `Gcp object`
636643
637644 - `key_name: string`
638645
from line 647
640647
641648 - `type: "gcp"`
642649
643 - `"gcp"`
644
645 - `Azure object { key_name, tenant_id, type, 2 more }`
650 - `Azure object`
646651
647652 - `key_name: string`
648653
from line 659
654659
655660 - `type: "azure"`
656661
657 - `"azure"`
658
659662 - `vault_uri: string`
660663
661664 Key Vault data-plane URI — https://<vault-name>.vault.azure.net or https://<hsm-name>.managedhsm.azure.net.
from line 669
666669
667670- `type: "external_key"`
668671
669 - `"external_key"`
672 default: external_key
670673
671674- `updated_at: string`
672675
676 format: date-time
677
673678### Example
674679
675```http
680```bash
676681curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID \
677682 -H 'Content-Type: application/json' \
678683 -H 'anthropic-version: 2023-06-01' \
from line 685
680685 -d '{}'
681686```
682687
683#### Response
688#### Response (200)
684689
685690```json
686691{
from line 709
704709
705710## Delete External Key
706711
707**delete** `/v1/organizations/external_keys/{external_key_id}`
712**DELETE** `/v1/organizations/external_keys/{external_key_id}`
708713
709714Delete an external key config.
710715
711716The request is rejected if any workspace still references this config.
712717
713### Path Parameters
718### Path parameters
714719
715720- `external_key_id: string`
716721
717722 ID of the External Key.
718723
724 maxLength: 2048
725
719726### Returns
720727
721728- `id: string`
from line 731
724731
725732- `type: "external_key_deleted"`
726733
727 - `"external_key_deleted"`
734 default: external_key_deleted
728735
729736### Example
730737
731```http
738```bash
732739curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID \
733740 -X DELETE \
734741 -H 'anthropic-version: 2023-06-01' \
735742 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
736743```
737744
738#### Response
745#### Response (200)
739746
740747```json
741748{
from line 753
746753
747754## Validate External Key
748755
749**post** `/v1/organizations/external_keys/{external_key_id}/validate`
756**POST** `/v1/organizations/external_keys/{external_key_id}/validate`
750757
751758Validate an external key config against the customer's KMS.
752759
from line 762
755762`success` if the roundtrip succeeded, or `failure` with an error
756763message if it failed or timed out.
757764
758### Path Parameters
765### Path parameters
759766
760767- `external_key_id: string`
761768
762769 ID of the External Key.
763770
771 maxLength: 2048
772
764773### Returns
765774
766775- `error: string or null`
from line 786
777786
778787- `type: "external_key_validation"`
779788
780 - `"external_key_validation"`
789 default: external_key_validation
781790
782791### Example
783792
784```http
793```bash
785794curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID/validate \
786795 -X POST \
787796 -H 'anthropic-version: 2023-06-01' \
788797 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
789798```
790799
791#### Response
800#### Response (200)
792801
793802```json
794803{
from line 807
798807}
799808```
800809
801## Domain Types
810## Domain types
802811
803812### External Key Create Response
804813
805- `ExternalKeyCreateResponse object { id, attachment, created_at, 5 more }`
814- `ExternalKeyCreateResponse object`
806815
807816 CMEK external key config belonging to the caller's organization.
808817
from line 823
814823
815824 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
816825
817 - `attachment: object { type } or object { type }`
826 - `attachment: object or object`
818827
819828 Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
820829
821 - `Attached object { type }`
830 - `Attached object`
822831
823832 - `type: "attached"`
824833
825 - `"attached"`
826
827 - `Unattached object { type }`
834 default: attached
835
836 - `Unattached object`
828837
829838 - `type: "unattached"`
830839
831 - `"unattached"`
840 default: unattached
832841
833842 - `created_at: string`
834843
844 format: date-time
845
835846 - `display_name: string or null`
836847
837848 Human-friendly display name. Null if none was set.
from line 851
840851
841852 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
842853
843 - `provider_config: object { kms_arn, type, region, role_arn } or object { key_name, type } or object { key_name, tenant_id, type, 2 more }`
854 - `provider_config: object or object or object`
844855
845856 KMS provider identity and auth coordinates.
846857
847 - `Aws object { kms_arn, type, region, role_arn }`
858 - `Aws object`
848859
849860 - `kms_arn: string`
850861
851862 Full ARN of the AWS KMS key.
852863
864 maxLength: 2048
865
853866 - `type: "aws"`
854867
855 - `"aws"`
856
857868 - `region: optional string or null`
858869
859870 AWS region. Derived from kms_arn if omitted.
860871
861872 - `role_arn: optional string or null`
862873
874 **Deprecated**
875
863876 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
864877
865 - `Gcp object { key_name, type }`
878 - `Gcp object`
866879
867880 - `key_name: string`
868881
from line 883
870883
871884 - `type: "gcp"`
872885
873 - `"gcp"`
874
875 - `Azure object { key_name, tenant_id, type, 2 more }`
886 - `Azure object`
876887
877888 - `key_name: string`
878889
from line 895
884895
885896 - `type: "azure"`
886897
887 - `"azure"`
888
889898 - `vault_uri: string`
890899
891900 Key Vault data-plane URI — https://<vault-name>.vault.azure.net or https://<hsm-name>.managedhsm.azure.net.
from line 905
896905
897906 - `type: "external_key"`
898907
899 - `"external_key"`
908 default: external_key
900909
901910 - `updated_at: string`
902911
912 format: date-time
913
903914### External Key List Response
904915
905- `ExternalKeyListResponse object { id, attachment, created_at, 5 more }`
916- `ExternalKeyListResponse object`
906917
907918 CMEK external key config belonging to the caller's organization.
908919
from line 925
914925
915926 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
916927
917 - `attachment: object { type } or object { type }`
928 - `attachment: object or object`
918929
919930 Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
920931
921 - `Attached object { type }`
932 - `Attached object`
922933
923934 - `type: "attached"`
924935
925 - `"attached"`
926
927 - `Unattached object { type }`
936 default: attached
937
938 - `Unattached object`
928939
929940 - `type: "unattached"`
930941
931 - `"unattached"`
942 default: unattached
932943
933944 - `created_at: string`
934945
946 format: date-time
947
935948 - `display_name: string or null`
936949
937950 Human-friendly display name. Null if none was set.
from line 953
940953
941954 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
942955
943 - `provider_config: object { kms_arn, type, region, role_arn } or object { key_name, type } or object { key_name, tenant_id, type, 2 more }`
956 - `provider_config: object or object or object`
944957
945958 KMS provider identity and auth coordinates.
946959
947 - `Aws object { kms_arn, type, region, role_arn }`
960 - `Aws object`
948961
949962 - `kms_arn: string`
950963
951964 Full ARN of the AWS KMS key.
952965
966 maxLength: 2048
967
953968 - `type: "aws"`
954969
955 - `"aws"`
956
957970 - `region: optional string or null`
958971
959972 AWS region. Derived from kms_arn if omitted.
960973
961974 - `role_arn: optional string or null`
962975
976 **Deprecated**
977
963978 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
964979
965 - `Gcp object { key_name, type }`
980 - `Gcp object`
966981
967982 - `key_name: string`
968983
from line 985
970985
971986 - `type: "gcp"`
972987
973 - `"gcp"`
974
975 - `Azure object { key_name, tenant_id, type, 2 more }`
988 - `Azure object`
976989
977990 - `key_name: string`
978991
from line 997
984997
985998 - `type: "azure"`
986999
987 - `"azure"`
988
9891000 - `vault_uri: string`
9901001
9911002 Key Vault data-plane URI — https://<vault-name>.vault.azure.net or https://<hsm-name>.managedhsm.azure.net.
from line 1007
9961007
9971008 - `type: "external_key"`
9981009
999 - `"external_key"`
1010 default: external_key
10001011
10011012 - `updated_at: string`
10021013
1014 format: date-time
1015
10031016### External Key Retrieve Response
10041017
1005- `ExternalKeyRetrieveResponse object { id, attachment, created_at, 5 more }`
1018- `ExternalKeyRetrieveResponse object`
10061019
10071020 CMEK external key config belonging to the caller's organization.
10081021
from line 1027
10141027
10151028 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
10161029
1017 - `attachment: object { type } or object { type }`
1030 - `attachment: object or object`
10181031
10191032 Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
10201033
1021 - `Attached object { type }`
1034 - `Attached object`
10221035
10231036 - `type: "attached"`
10241037
1025 - `"attached"`
1026
1027 - `Unattached object { type }`
1038 default: attached
1039
1040 - `Unattached object`
10281041
10291042 - `type: "unattached"`
10301043
1031 - `"unattached"`
1044 default: unattached
10321045
10331046 - `created_at: string`
10341047
1048 format: date-time
1049
10351050 - `display_name: string or null`
10361051
10371052 Human-friendly display name. Null if none was set.
from line 1055
10401055
10411056 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
10421057
1043 - `provider_config: object { kms_arn, type, region, role_arn } or object { key_name, type } or object { key_name, tenant_id, type, 2 more }`
1058 - `provider_config: object or object or object`
10441059
10451060 KMS provider identity and auth coordinates.
10461061
1047 - `Aws object { kms_arn, type, region, role_arn }`
1062 - `Aws object`
10481063
10491064 - `kms_arn: string`
10501065
10511066 Full ARN of the AWS KMS key.
10521067
1068 maxLength: 2048
1069
10531070 - `type: "aws"`
10541071
1055 - `"aws"`
1056
10571072 - `region: optional string or null`
10581073
10591074 AWS region. Derived from kms_arn if omitted.
10601075
10611076 - `role_arn: optional string or null`
10621077
1078 **Deprecated**
1079
10631080 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
10641081
1065 - `Gcp object { key_name, type }`
1082 - `Gcp object`
10661083
10671084 - `key_name: string`
10681085
from line 1087
10701087
10711088 - `type: "gcp"`
10721089
1073 - `"gcp"`
1074
1075 - `Azure object { key_name, tenant_id, type, 2 more }`
1090 - `Azure object`
10761091
10771092 - `key_name: string`
10781093
from line 1099
10841099
10851100 - `type: "azure"`
10861101
1087 - `"azure"`
1088
10891102 - `vault_uri: string`
10901103
10911104 Key Vault data-plane URI — https://<vault-name>.vault.azure.net or https://<hsm-name>.managedhsm.azure.net.
from line 1109
10961109
10971110 - `type: "external_key"`
10981111
1099 - `"external_key"`
1112 default: external_key
11001113
11011114 - `updated_at: string`
11021115
1116 format: date-time
1117
11031118### External Key Update Response
11041119
1105- `ExternalKeyUpdateResponse object { id, attachment, created_at, 5 more }`
1120- `ExternalKeyUpdateResponse object`
11061121
11071122 CMEK external key config belonging to the caller's organization.
11081123
from line 1129
11141129
11151130 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
11161131
1117 - `attachment: object { type } or object { type }`
1132 - `attachment: object or object`
11181133
11191134 Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
11201135
1121 - `Attached object { type }`
1136 - `Attached object`
11221137
11231138 - `type: "attached"`
11241139
1125 - `"attached"`
1126
1127 - `Unattached object { type }`
1140 default: attached
1141
1142 - `Unattached object`
11281143
11291144 - `type: "unattached"`
11301145
1131 - `"unattached"`
1146 default: unattached
11321147
11331148 - `created_at: string`
11341149
1150 format: date-time
1151
11351152 - `display_name: string or null`
11361153
11371154 Human-friendly display name. Null if none was set.
from line 1157
11401157
11411158 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
11421159
1143 - `provider_config: object { kms_arn, type, region, role_arn } or object { key_name, type } or object { key_name, tenant_id, type, 2 more }`
1160 - `provider_config: object or object or object`
11441161
11451162 KMS provider identity and auth coordinates.
11461163
1147 - `Aws object { kms_arn, type, region, role_arn }`
1164 - `Aws object`
11481165
11491166 - `kms_arn: string`
11501167
11511168 Full ARN of the AWS KMS key.
11521169
1170 maxLength: 2048
1171
11531172 - `type: "aws"`
11541173
1155 - `"aws"`
1156
11571174 - `region: optional string or null`
11581175
11591176 AWS region. Derived from kms_arn if omitted.
11601177
11611178 - `role_arn: optional string or null`
11621179
1180 **Deprecated**
1181
11631182 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
11641183
1165 - `Gcp object { key_name, type }`
1184 - `Gcp object`
11661185
11671186 - `key_name: string`
11681187
from line 1189
11701189
11711190 - `type: "gcp"`
11721191
1173 - `"gcp"`
1174
1175 - `Azure object { key_name, tenant_id, type, 2 more }`
1192 - `Azure object`
11761193
11771194 - `key_name: string`
11781195
from line 1201
11841201
11851202 - `type: "azure"`
11861203
1187 - `"azure"`
1188
11891204 - `vault_uri: string`
11901205
11911206 Key Vault data-plane URI — https://<vault-name>.vault.azure.net or https://<hsm-name>.managedhsm.azure.net.
from line 1211
11961211
11971212 - `type: "external_key"`
11981213
1199 - `"external_key"`
1214 default: external_key
12001215
12011216 - `updated_at: string`
12021217
1218 format: date-time
1219
12031220### External Key Delete Response
12041221
1205- `ExternalKeyDeleteResponse object { id, type }`
1222- `ExternalKeyDeleteResponse object`
12061223
12071224 - `id: string`
12081225
from line 1227
12101227
12111228 - `type: "external_key_deleted"`
12121229
1213 - `"external_key_deleted"`
1230 default: external_key_deleted
12141231
12151232### External Key Validate Response
12161233
1217- `ExternalKeyValidateResponse object { error, status, type }`
1234- `ExternalKeyValidateResponse object`
12181235
12191236 Result of a validation roundtrip against the customer's KMS.
12201237
from line 1252
12351252
12361253 - `type: "external_key_validation"`
12371254
1238 - `"external_key_validation"`
1255 default: external_key_validation
12391256
No line in this hunk matches that.