cmek-aws-kms changedmanage-claude/cmek-aws-kms
Nearest release: v2.1.247, published under an hour before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+339added
Lines−30removed
From line
137
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits19to this page, all time
The whole hunk
from line 137, old and new numbered
/
from line 137
137137 For organizations on [Claude Platform on AWS](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws), the external key endpoints are not yet available. Register and attach your key in the Claude Console instead. There is no separate validation step; the key policy is first exercised when a workspace starts using the key, so a key policy problem surfaces at that point rather than at registration.
138138 </Note>
139139
140 ```bash
141 curl -sS https://api.anthropic.com/v1/organizations/external_keys \
142 -H "x-api-key: <anthropic-admin-api-key>" \
143 -H "anthropic-version: 2023-06-01" \
144 -H "content-type: application/json" \
145 -d '{
146 "display_name": "<friendly-name>",
147 "geo": "us",
148 "provider_config": {
149 "type": "aws",
150 "kms_arn": "<key-arn-from-create-key-step>",
151 "role_arn": "arn:aws:iam::915198916910:role/anthropic-cmek-client-us"
140 <CodeGroup>
141 ```bash cURL
142 curl -sS "https://api.anthropic.com/v1/organizations/external_keys" \
143 -H "x-api-key: $ANTHROPIC_API_KEY" \
144 -H "anthropic-version: 2023-06-01" \
145 -H "content-type: application/json" \
146 -d '{
147 "display_name": "<friendly-name>",
148 "geo": "us",
149 "provider_config": {
150 "type": "aws",
151 "kms_arn": "<key-arn-from-create-key-step>"
152 }
153 }'
154 ```
155
156 ```bash CLI
157 ant beta:organization:external-keys create <<'YAML'
158 display_name: "<friendly-name>"
159 geo: us
160 provider_config:
161 type: aws
162 kms_arn: "<key-arn-from-create-key-step>"
163 YAML
164 ```
165
166 ```python Python
167 client = anthropic.Anthropic()
168
169 external_key = client.beta.organization.external_keys.create(
170 display_name="<friendly-name>",
171 geo="us",
172 provider_config={"type": "aws", "kms_arn": "<key-arn-from-create-key-step>"},
173 )
174
175 print(f"id: {external_key.id}")
176 print(f"display_name: {external_key.display_name}")
177 ```
178
179 ```typescript TypeScript
180 const client = new Anthropic();
181
182 const externalKey = await client.beta.organization.externalKeys.create({
183 display_name: "<friendly-name>",
184 geo: "us",
185 provider_config: {
186 type: "aws",
187 kms_arn: "<key-arn-from-create-key-step>"
152188 }
153 }'
154 ```
189 });
155190
191 console.log(`id: ${externalKey.id}`);
192 console.log(`display_name: ${externalKey.display_name}`);
193 ```
194
195 ```csharp C#
196 using Anthropic.Models.Beta.Organization.ExternalKeys;
197
198 AnthropicClient client = new();
199
200 var externalKey = await client.Beta.Organization.ExternalKeys.Create(new()
201 {
202 DisplayName = "<friendly-name>",
203 Geo = Geo.Us,
204 ProviderConfig = new BetaAwsExternalKeyConfig
205 {
206 KmsArn = "<key-arn-from-create-key-step>"
207 }
208 });
209
210 Console.WriteLine($"id: {externalKey.ID}");
211 Console.WriteLine($"display_name: {externalKey.DisplayName}");
212 ```
213
214 ```go Go
215 client := anthropic.NewClient()
216
217 externalKey, err := client.Beta.Organization.ExternalKeys.New(context.Background(), anthropic.BetaOrganizationExternalKeyNewParams{
218 DisplayName: anthropic.String("<friendly-name>"),
219 Geo: anthropic.BetaOrganizationExternalKeyNewParamsGeoUs,
220 ProviderConfig: anthropic.BetaOrganizationExternalKeyNewParamsProviderConfigUnion{
221 OfAWS: &anthropic.BetaAWSExternalKeyConfigParam{
222 KMSARN: "<key-arn-from-create-key-step>",
223 },
224 },
225 })
226 if err != nil {
227 log.Fatal(err)
228 }
229
230 fmt.Printf("id: %s\n", externalKey.ID)
231 fmt.Printf("display_name: %s\n", externalKey.DisplayName)
232 ```
233
234 ```java Java
235 import com.anthropic.models.beta.organization.externalkeys.BetaAwsExternalKeyConfig;
236 import com.anthropic.models.beta.organization.externalkeys.ExternalKeyCreateParams;
237
238 void main() {
239 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
240
241 var params = ExternalKeyCreateParams.builder()
242 .displayName("<friendly-name>")
243 .geo(ExternalKeyCreateParams.Geo.US)
244 .providerConfig(BetaAwsExternalKeyConfig.builder()
245 .kmsArn("<key-arn-from-create-key-step>")
246 .build())
247 .build();
248 var externalKey = client.beta().organization().externalKeys().create(params);
249
250 IO.println("id: " + externalKey.id());
251 IO.println("display_name: " + externalKey.displayName().orElseThrow());
252 }
253 ```
254
255 ```php PHP
256 use Anthropic\Beta\Organization\ExternalKeys\ExternalKeyCreateParams\Geo;
257 // ...
258
259 $client = new Client();
260
261 $externalKey = $client->beta->organization->externalKeys->create(
262 displayName: '<friendly-name>',
263 geo: Geo::US,
264 providerConfig: [
265 'type' => 'aws',
266 'kmsARN' => '<key-arn-from-create-key-step>',
267 ],
268 );
269
270 echo "id: {$externalKey->id}\n";
271 echo "display_name: {$externalKey->displayName}\n";
272 ```
273
274 ```ruby Ruby
275 client = Anthropic::Client.new
276
277 external_key = client.beta.organization.external_keys.create(
278 display_name: "<friendly-name>",
279 geo: :us,
280 provider_config: {
281 type: :aws,
282 kms_arn: "<key-arn-from-create-key-step>"
283 }
284 )
285
286 puts "id: #{external_key.id}"
287 puts "display_name: #{external_key.display_name}"
288 ```
289 </CodeGroup>
290
156291 The response contains the external key ID:
157292
158293 ```json
from line 302
167302 <Step title="Validate the key">
168303 Trigger an encrypt and decrypt round-trip against your key.
169304
170 ```bash
171 curl -sS -X POST https://api.anthropic.com/v1/organizations/external_keys/ekey_<id>/validate \
172 -H "x-api-key: <anthropic-admin-api-key>" \
173 -H "anthropic-version: 2023-06-01" \
174 -H "content-type: application/json" \
175 -d '{}'
176 ```
305 <CodeGroup>
306 ```bash cURL
307 curl -sS -X POST "https://api.anthropic.com/v1/organizations/external_keys/ekey_<id>/validate" \
308 -H "x-api-key: $ANTHROPIC_API_KEY" \
309 -H "anthropic-version: 2023-06-01"
310 ```
177311
312 ```bash CLI
313 ant beta:organization:external-keys validate --external-key-id "ekey_<id>"
314 ```
315
316 ```python Python
317 client = anthropic.Anthropic()
318
319 validation = client.beta.organization.external_keys.validate("ekey_<id>")
320
321 print(f"status: {validation.status}")
322 print(f"error: {validation.error}")
323 ```
324
325 ```typescript TypeScript
326 const client = new Anthropic();
327
328 const validation = await client.beta.organization.externalKeys.validate("ekey_<id>");
329
330 console.log(`status: ${validation.status}`);
331 console.log(`error: ${validation.error}`);
332 ```
333
334 ```csharp C#
335 AnthropicClient client = new();
336
337 var validation = await client.Beta.Organization.ExternalKeys.Validate("ekey_<id>");
338
339 Console.WriteLine($"status: {validation.Status.Raw()}");
340 Console.WriteLine($"error: {validation.Error}");
341 ```
342
343 ```go Go
344 client := anthropic.NewClient()
345
346 validation, err := client.Beta.Organization.ExternalKeys.Validate(context.Background(), "ekey_<id>")
347 if err != nil {
348 log.Fatal(err)
349 }
350
351 fmt.Printf("status: %s\n", validation.Status)
352 fmt.Printf("error: %s\n", validation.Error)
353 ```
354
355 ```java Java
356 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
357
358 var validation = client.beta().organization().externalKeys().validate("ekey_<id>");
359
360 IO.println("status: " + validation.status().asString());
361 IO.println("error: " + validation.error().orElse(""));
362 ```
363
364 ```php PHP
365 $client = new Client();
366
367 $validation = $client->beta->organization->externalKeys->validate(
368 externalKeyID: 'ekey_<id>',
369 );
370
371 echo "status: {$validation->status}\n";
372 echo "error: {$validation->error}\n";
373 ```
374
375 ```ruby Ruby
376 client = Anthropic::Client.new
377
378 external_key_id = "ekey_<id>"
379 validation = client.beta.organization.external_keys.validate(external_key_id)
380
381 puts "status: #{validation.status}"
382 puts "error: #{validation.error}"
383 ```
384 </CodeGroup>
385
178386 A successful response looks like this:
179387
180388 ```json
from line 400
192400 <Step title="Attach the key to a workspace">
193401 Once the key is validated, attach it to a new workspace before you send any requests to that workspace. For a workspace that already receives requests, the key can take [up to a day to take effect](https://platform.claude.com/docs/en/manage-claude/cmek#how-it-works).
194402
195 ```bash
196 curl -sS -X POST https://api.anthropic.com/v1/organizations/workspaces/<workspace-id> \
197 -H "x-api-key: <anthropic-admin-api-key>" \
198 -H "anthropic-version: 2023-06-01" \
199 -H "content-type: application/json" \
200 -d '{
201 "external_key_id": "ekey_<id>"
202 }'
203 ```
403 <CodeGroup>
404 ```bash cURL
405 curl -sS -X POST "https://api.anthropic.com/v1/organizations/workspaces/<workspace-id>" \
406 -H "x-api-key: $ANTHROPIC_API_KEY" \
407 -H "anthropic-version: 2023-06-01" \
408 -H "content-type: application/json" \
409 -d '{
410 "external_key_id": "ekey_<id>"
411 }'
412 ```
413
414 ```bash CLI
415 ant beta:organization:workspaces update \
416 --workspace-id "<workspace-id>" \
417 --external-key-id "ekey_<id>"
418 ```
419
420 ```python Python
421 client = anthropic.Anthropic()
422
423 workspace = client.beta.organization.workspaces.update(
424 "<workspace-id>", external_key_id="ekey_<id>"
425 )
426
427 print(f"id: {workspace.id}")
428 print(f"external_key_id: {workspace.external_key_id}")
429 ```
430
431 ```typescript TypeScript
432 const client = new Anthropic();
433
434 const workspace = await client.beta.organization.workspaces.update("<workspace-id>", {
435 external_key_id: "ekey_<id>"
436 });
437
438 console.log(`id: ${workspace.id}`);
439 console.log(`external_key_id: ${workspace.external_key_id}`);
440 ```
441
442 ```csharp C#
443 AnthropicClient client = new();
444
445 var workspace = await client.Beta.Organization.Workspaces.Update("<workspace-id>", new()
446 {
447 ExternalKeyID = "ekey_<id>"
448 });
449
450 Console.WriteLine($"id: {workspace.ID}");
451 Console.WriteLine($"external_key_id: {workspace.ExternalKeyID}");
452 ```
453
454 ```go Go
455 client := anthropic.NewClient()
456
457 workspace, err := client.Beta.Organization.Workspaces.Update(
458 context.Background(),
459 "<workspace-id>",
460 anthropic.BetaOrganizationWorkspaceUpdateParams{
461 ExternalKeyID: anthropic.String("ekey_<id>"),
462 },
463 )
464 if err != nil {
465 log.Fatal(err)
466 }
467
468 fmt.Printf("id: %s\n", workspace.ID)
469 fmt.Printf("external_key_id: %s\n", workspace.ExternalKeyID)
470 ```
471
472 ```java Java
473 import com.anthropic.models.beta.organization.workspaces.WorkspaceUpdateParams;
474
475 void main() {
476 AnthropicClient client = AnthropicOkHttpClient.fromEnv();
477
478 var params = WorkspaceUpdateParams.builder()
479 .externalKeyId("ekey_<id>")
480 .build();
481 var workspace = client.beta().organization().workspaces().update("<workspace-id>", params);
482
483 IO.println("id: " + workspace.id());
484 IO.println("external_key_id: " + workspace.externalKeyId().orElseThrow());
485 }
486 ```
487
488 ```php PHP
489 $client = new Client();
490
491 $workspace = $client->beta->organization->workspaces->update(
492 workspaceID: '<workspace-id>',
493 externalKeyID: 'ekey_<id>',
494 );
495
496 echo "id: {$workspace->id}\n";
497 echo "external_key_id: {$workspace->externalKeyID}\n";
498 ```
499
500 ```ruby Ruby
501 client = Anthropic::Client.new
502
503 workspace_id = "<workspace-id>"
504 workspace = client.beta.organization.workspaces.update(
505 workspace_id,
506 external_key_id: "ekey_<id>"
507 )
508
509 puts "id: #{workspace.id}"
510 puts "external_key_id: #{workspace.external_key_id}"
511 ```
512 </CodeGroup>
204513 </Step>
205514 </Steps>
206515 </Tab>
No line in this hunk matches that.