Update External Key changedapi/admin/external_keys/update
Nearest release: v2.1.245, published an hour after this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+41added
Lines−44removed
From line
1
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits5to this page, all time
# Update External Key ## Path parameters ## Body parameters ## Returns ## Example ### Response (200) ## Update External Key ### Path Parameters ### Body Parameters ### Returns ### Example #### Response
The whole hunk
from line 1, old and new numbered
/
from line 1
1---
2title: Update External Key
3url: https://platform.claude.com/docs/en/api/admin/external_keys/update
4---
1# Update External Key
52
6## Update External Key
3**POST** `/v1/organizations/external_keys/{external_key_id}`
74
8**post** `/v1/organizations/external_keys/{external_key_id}`
9
105Partially update an external key config. Omitted fields are left unchanged.
116
127`display_name` is always editable. `geo` and `provider_config` cannot
from line 8
138be changed once any workspace references this config, because previously
149encrypted data requires the original key identity to decrypt.
1510
16### Path Parameters
11## Path parameters
1712
1813- `external_key_id: string`
1914
2015 ID of the External Key.
2116
22### Body Parameters
17 maxLength: 2048
2318
19## Body parameters
20
2421- `display_name: optional string or null`
2522
2623 Human-friendly display name.
2724
25 maxLength: 255, minLength: 1
26
2827- `geo: optional "us" or null`
2928
3029 Data residency geo. Only `us` is supported.
3130
32 - `"us"`
31- `provider_config: optional object or object or object or null`
3332
34- `provider_config: optional object { kms_arn, type, region, role_arn } or object { key_name, type } or object { key_name, tenant_id, type, 2 more } or null`
35
3633 KMS provider identity and auth coordinates.
3734
38 - `Aws object { kms_arn, type, region, role_arn }`
35 - `Aws object`
3936
4037 - `kms_arn: string`
4138
4239 Full ARN of the AWS KMS key.
4340
41 maxLength: 2048
42
4443 - `type: "aws"`
4544
46 - `"aws"`
47
4845 - `region: optional string or null`
4946
5047 AWS region. Derived from kms_arn if omitted.
from line 48
5148
5249 - `role_arn: optional string or null`
5350
51 **Deprecated**
52
5453 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
5554
56 - `Gcp object { key_name, type }`
55 - `Gcp object`
5756
5857 - `key_name: string`
5958
from line 60
6160
6261 - `type: "gcp"`
6362
64 - `"gcp"`
63 - `Azure object`
6564
66 - `Azure object { key_name, tenant_id, type, 2 more }`
67
6865 Azure Key Vault provider configuration.
6966
7067 - `key_name: string`
from line 74
7774
7875 - `type: "azure"`
7976
80 - `"azure"`
81
8277 - `vault_uri: string`
8378
8479 Key Vault data-plane URI — https://<vault-name>.vault.azure.net or https://<hsm-name>.managedhsm.azure.net.
from line 82
8782
8883 Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.
8984
90### Returns
85## Returns
9186
9287- `id: string`
9388
9489 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
9590
96- `attachment: object { type } or object { type }`
91- `attachment: object or object`
9792
9893 Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
9994
100 - `Attached object { type }`
95 - `Attached object`
10196
10297 - `type: "attached"`
10398
104 - `"attached"`
99 default: attached
105100
106 - `Unattached object { type }`
101 - `Unattached object`
107102
108103 - `type: "unattached"`
109104
110 - `"unattached"`
105 default: unattached
111106
112107- `created_at: string`
113108
109 format: date-time
110
114111- `display_name: string or null`
115112
116113 Human-friendly display name. Null if none was set.
from line 116
119116
120117 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
121118
122- `provider_config: object { kms_arn, type, region, role_arn } or object { key_name, type } or object { key_name, tenant_id, type, 2 more }`
119- `provider_config: object or object or object`
123120
124121 KMS provider identity and auth coordinates.
125122
126 - `Aws object { kms_arn, type, region, role_arn }`
123 - `Aws object`
127124
128125 - `kms_arn: string`
129126
130127 Full ARN of the AWS KMS key.
131128
129 maxLength: 2048
130
132131 - `type: "aws"`
133132
134 - `"aws"`
135
136133 - `region: optional string or null`
137134
138135 AWS region. Derived from kms_arn if omitted.
from line 136
139136
140137 - `role_arn: optional string or null`
141138
139 **Deprecated**
140
142141 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.
143142
144 - `Gcp object { key_name, type }`
143 - `Gcp object`
145144
146145 - `key_name: string`
147146
from line 148
149148
150149 - `type: "gcp"`
151150
152 - `"gcp"`
151 - `Azure object`
153152
154 - `Azure object { key_name, tenant_id, type, 2 more }`
155
156153 - `key_name: string`
157154
158155 Name of the key within the vault.
from line 160
163160
164161 - `type: "azure"`
165162
166 - `"azure"`
167
168163 - `vault_uri: string`
169164
170165 Key Vault data-plane URI — https://<vault-name>.vault.azure.net or https://<hsm-name>.managedhsm.azure.net.
from line 170
175170
176171- `type: "external_key"`
177172
178 - `"external_key"`
173 default: external_key
179174
180175- `updated_at: string`
181176
182### Example
177 format: date-time
183178
184```http
179## Example
180
181```bash
185182curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID \
186183 -H 'Content-Type: application/json' \
187184 -H 'anthropic-version: 2023-06-01' \
from line 186
189186 -d '{}'
190187```
191188
192#### Response
189### Response (200)
193190
194191```json
195192{
No line in this hunk matches that.