Create External Key changedapi/admin/external_keys/create
Nearest release: v2.1.245, published an hour after this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+39added
Lines−44removed
From line
1
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits5to this page, all time
# Create External Key ## Body parameters ## Returns ## Example ### Response (200) ## Create External Key ### Body Parameters ### Returns ### Example #### Response
The whole hunk
from line 1, old and new numbered
/
from line 1
1---
2title: Create External Key
3url: https://platform.claude.com/docs/en/api/admin/external_keys/create
4---
1# Create External Key
52
6## Create External Key
3**POST** `/v1/organizations/external_keys`
74
8**post** `/v1/organizations/external_keys`
9
105Create an external key config owned by the caller's organization.
116
12### Body Parameters
7## Body parameters
138
14- `provider_config: object { kms_arn, type, region, role_arn } or object { key_name, type } or object { key_name, tenant_id, type, 2 more }`
9- `provider_config: object or object or object`
1510
1611 KMS provider identity and auth coordinates.
1712
18 - `Aws object { kms_arn, type, region, role_arn }`
13 - `Aws object`
1914
2015 - `kms_arn: string`
2116
2217 Full ARN of the AWS KMS key.
2318
19 maxLength: 2048
20
2421 - `type: "aws"`
2522
26 - `"aws"`
27
2823 - `region: optional string or null`
2924
3025 AWS region. Derived from kms_arn if omitted.
from line 26
3126
3227 - `role_arn: optional string or null`
3328
29 **Deprecated**
30
3431 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
3532
36 - `Gcp object { key_name, type }`
33 - `Gcp object`
3734
3835 - `key_name: string`
3936
from line 38
4138
4239 - `type: "gcp"`
4340
44 - `"gcp"`
41 - `Azure object`
4542
46 - `Azure object { key_name, tenant_id, type, 2 more }`
47
4843 Azure Key Vault provider configuration.
4944
5045 - `key_name: string`
from line 52
5752
5853 - `type: "azure"`
5954
60 - `"azure"`
61
6255 - `vault_uri: string`
6356
6457 Key Vault data-plane URI — https://<vault-name>.vault.azure.net or https://<hsm-name>.managedhsm.azure.net.
from line 64
7164
7265 Human-friendly display name.
7366
67 maxLength: 255, minLength: 1
68
7469- `geo: optional "us"`
7570
7671 Data residency geo. Only `us` is supported.
7772
78 - `"us"`
73## Returns
7974
80### Returns
81
8275- `id: string`
8376
8477 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
8578
86- `attachment: object { type } or object { type }`
79- `attachment: object or object`
8780
8881 Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
8982
90 - `Attached object { type }`
83 - `Attached object`
9184
9285 - `type: "attached"`
9386
94 - `"attached"`
87 default: attached
9588
96 - `Unattached object { type }`
89 - `Unattached object`
9790
9891 - `type: "unattached"`
9992
100 - `"unattached"`
93 default: unattached
10194
10295- `created_at: string`
10396
97 format: date-time
98
10499- `display_name: string or null`
105100
106101 Human-friendly display name. Null if none was set.
from line 104
109104
110105 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
111106
112- `provider_config: object { kms_arn, type, region, role_arn } or object { key_name, type } or object { key_name, tenant_id, type, 2 more }`
107- `provider_config: object or object or object`
113108
114109 KMS provider identity and auth coordinates.
115110
116 - `Aws object { kms_arn, type, region, role_arn }`
111 - `Aws object`
117112
118113 - `kms_arn: string`
119114
120115 Full ARN of the AWS KMS key.
121116
117 maxLength: 2048
118
122119 - `type: "aws"`
123120
124 - `"aws"`
125
126121 - `region: optional string or null`
127122
128123 AWS region. Derived from kms_arn if omitted.
from line 124
129124
130125 - `role_arn: optional string or null`
131126
127 **Deprecated**
128
132129 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
133130
134 - `Gcp object { key_name, type }`
131 - `Gcp object`
135132
136133 - `key_name: string`
137134
from line 136
139136
140137 - `type: "gcp"`
141138
142 - `"gcp"`
139 - `Azure object`
143140
144 - `Azure object { key_name, tenant_id, type, 2 more }`
145
146141 - `key_name: string`
147142
148143 Name of the key within the vault.
from line 148
153148
154149 - `type: "azure"`
155150
156 - `"azure"`
157
158151 - `vault_uri: string`
159152
160153 Key Vault data-plane URI — https://<vault-name>.vault.azure.net or https://<hsm-name>.managedhsm.azure.net.
from line 158
165158
166159- `type: "external_key"`
167160
168 - `"external_key"`
161 default: external_key
169162
170163- `updated_at: string`
171164
172### Example
165 format: date-time
173166
174```http
167## Example
168
169```bash
175170curl https://api.anthropic.com/v1/organizations/external_keys \
176171 -H 'Content-Type: application/json' \
177172 -H 'anthropic-version: 2023-06-01' \
from line 179
184179 }'
185180```
186181
187#### Response
182### Response (200)
188183
189184```json
190185{
No line in this hunk matches that.