Get External Key changedapi/admin/external_keys/retrieve
Nearest release: v2.1.245, published an hour after this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+27added
Lines−28removed
From line
1
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits5to this page, all time
# Get External Key ## Path parameters ## Returns ## Example ### Response (200) ## Get External Key ### Path Parameters ### Returns ### Example #### Response
The whole hunk
from line 1, old and new numbered
/
from line 1
1---
2title: Get External Key
3url: https://platform.claude.com/docs/en/api/admin/external_keys/retrieve
4---
1# Get External Key
52
6## Get External Key
3**GET** `/v1/organizations/external_keys/{external_key_id}`
74
8**get** `/v1/organizations/external_keys/{external_key_id}`
9
105Retrieve a single external key config in the caller's organization by ID.
116
12### Path Parameters
7## Path parameters
138
149- `external_key_id: string`
1510
1611 ID of the External Key.
1712
18### Returns
13 maxLength: 2048
1914
15## Returns
16
2017- `id: string`
2118
2219 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
2320
24- `attachment: object { type } or object { type }`
21- `attachment: object or object`
2522
2623 Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
2724
28 - `Attached object { type }`
25 - `Attached object`
2926
3027 - `type: "attached"`
3128
32 - `"attached"`
29 default: attached
3330
34 - `Unattached object { type }`
31 - `Unattached object`
3532
3633 - `type: "unattached"`
3734
38 - `"unattached"`
35 default: unattached
3936
4037- `created_at: string`
4138
39 format: date-time
40
4241- `display_name: string or null`
4342
4443 Human-friendly display name. Null if none was set.
from line 46
4746
4847 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
4948
50- `provider_config: object { kms_arn, type, region, role_arn } or object { key_name, type } or object { key_name, tenant_id, type, 2 more }`
49- `provider_config: object or object or object`
5150
5251 KMS provider identity and auth coordinates.
5352
54 - `Aws object { kms_arn, type, region, role_arn }`
53 - `Aws object`
5554
5655 - `kms_arn: string`
5756
5857 Full ARN of the AWS KMS key.
5958
59 maxLength: 2048
60
6061 - `type: "aws"`
6162
62 - `"aws"`
63
6463 - `region: optional string or null`
6564
6665 AWS region. Derived from kms_arn if omitted.
from line 66
6766
6867 - `role_arn: optional string or null`
6968
69 **Deprecated**
70
7071 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
7172
72 - `Gcp object { key_name, type }`
73 - `Gcp object`
7374
7475 - `key_name: string`
7576
from line 78
7778
7879 - `type: "gcp"`
7980
80 - `"gcp"`
81 - `Azure object`
8182
82 - `Azure object { key_name, tenant_id, type, 2 more }`
83
8483 - `key_name: string`
8584
8685 Name of the key within the vault.
from line 90
9190
9291 - `type: "azure"`
9392
94 - `"azure"`
95
9693 - `vault_uri: string`
9794
9895 Key Vault data-plane URI — https://<vault-name>.vault.azure.net or https://<hsm-name>.managedhsm.azure.net.
from line 100
103100
104101- `type: "external_key"`
105102
106 - `"external_key"`
103 default: external_key
107104
108105- `updated_at: string`
109106
110### Example
107 format: date-time
111108
112```http
109## Example
110
111```bash
113112curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID \
114113 -H 'anthropic-version: 2023-06-01' \
115114 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
116115```
117116
118#### Response
117### Response (200)
119118
120119```json
121120{
No line in this hunk matches that.