The whole hunk
from line 1, old and new numbered
/
lines
from line 1
1---
2title: External Keys
3url: https://platform.claude.com/docs/en/api/beta/organization/external_keys
4---
5
16# External Keys
27
38## Create External Key
from line 19
1419
1520 - `BetaAWSExternalKeyConfig object`
1621
22 - `type: "aws"`
23
1724 - `kms_arn: string`
1825
1926 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
from line 27
2027
2128 maxLength: 2048
2229
23 - `type: "aws"`
24
2530 - `region: optional string or null`
2631
2732 AWS region. Derived from `kms_arn` if omitted.
from line 39
3439
3540 - `BetaGCPExternalKeyConfig object`
3641
42 - `type: "gcp"`
43
3744 - `key_name: string`
3845
3946 Full resource name of the Cloud KMS key.
4047
41 - `type: "gcp"`
42
4348 - `BetaAzureExternalKeyConfigParam object`
4449
4550 Azure Key Vault provider configuration.
4651
52 - `type: "azure"`
53
4754 - `key_name: string`
4855
4956 Name of the key within the vault.
from line 59
5259
5360 Azure AD tenant ID.
5461
55 - `type: "azure"`
56
5762 - `vault_uri: string`
5863
5964 Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
from line 87
8287 workspace references it, the provider fields become effectively immutable
8388 (existing encrypted data needs the config for decrypt).
8489
90 - `type: "external_key"`
91
92 default: external_key
93
8594 - `id: string`
8695
8796 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
from line 129
120129
121130 - `BetaAWSExternalKeyConfig object`
122131
132 - `type: "aws"`
133
123134 - `kms_arn: string`
124135
125136 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
from line 137
126137
127138 maxLength: 2048
128139
129 - `type: "aws"`
130
131140 - `region: optional string or null`
132141
133142 AWS region. Derived from `kms_arn` if omitted.
from line 149
140149
141150 - `BetaGCPExternalKeyConfig object`
142151
152 - `type: "gcp"`
153
143154 - `key_name: string`
144155
145156 Full resource name of the Cloud KMS key.
146157
147 - `type: "gcp"`
148
149158 - `BetaAzureExternalKeyConfig object`
150159
160 - `type: "azure"`
161
151162 - `key_name: string`
152163
153164 Name of the key within the vault.
from line 167
156167
157168 Azure AD tenant ID.
158169
159 - `type: "azure"`
160
161170 - `vault_uri: string`
162171
163172 Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
from line 175
166175
167176 Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.
168177
169 - `type: "external_key"`
170
171 default: external_key
172
173178 - `updated_at: string`
174179
175180 format: date-time
from line 241
236241
237242- `data: array of BetaExternalKey`
238243
244 - `type: "external_key"`
245
246 default: external_key
247
239248 - `id: string`
240249
241250 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
from line 283
274283
275284 - `BetaAWSExternalKeyConfig object`
276285
286 - `type: "aws"`
287
277288 - `kms_arn: string`
278289
279290 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
from line 291
280291
281292 maxLength: 2048
282293
283 - `type: "aws"`
284
285294 - `region: optional string or null`
286295
287296 AWS region. Derived from `kms_arn` if omitted.
from line 303
294303
295304 - `BetaGCPExternalKeyConfig object`
296305
306 - `type: "gcp"`
307
297308 - `key_name: string`
298309
299310 Full resource name of the Cloud KMS key.
300311
301 - `type: "gcp"`
302
303312 - `BetaAzureExternalKeyConfig object`
304313
314 - `type: "azure"`
315
305316 - `key_name: string`
306317
307318 Name of the key within the vault.
from line 321
310321
311322 Azure AD tenant ID.
312323
313 - `type: "azure"`
314
315324 - `vault_uri: string`
316325
317326 Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
from line 329
320329
321330 Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.
322331
323 - `type: "external_key"`
324
325 default: external_key
326
327332 - `updated_at: string`
328333
329334 format: date-time
from line 396
391396 workspace references it, the provider fields become effectively immutable
392397 (existing encrypted data needs the config for decrypt).
393398
399 - `type: "external_key"`
400
401 default: external_key
402
394403 - `id: string`
395404
396405 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
from line 438
429438
430439 - `BetaAWSExternalKeyConfig object`
431440
441 - `type: "aws"`
442
432443 - `kms_arn: string`
433444
434445 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
from line 446
435446
436447 maxLength: 2048
437448
438 - `type: "aws"`
439
440449 - `region: optional string or null`
441450
442451 AWS region. Derived from `kms_arn` if omitted.
from line 458
449458
450459 - `BetaGCPExternalKeyConfig object`
451460
461 - `type: "gcp"`
462
452463 - `key_name: string`
453464
454465 Full resource name of the Cloud KMS key.
455466
456 - `type: "gcp"`
457
458467 - `BetaAzureExternalKeyConfig object`
459468
469 - `type: "azure"`
470
460471 - `key_name: string`
461472
462473 Name of the key within the vault.
from line 476
465476
466477 Azure AD tenant ID.
467478
468 - `type: "azure"`
469
470479 - `vault_uri: string`
471480
472481 Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
from line 484
475484
476485 Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.
477486
478 - `type: "external_key"`
479
480 default: external_key
481
482487 - `updated_at: string`
483488
484489 format: date-time
from line 554
549554
550555 - `BetaAWSExternalKeyConfig object`
551556
557 - `type: "aws"`
558
552559 - `kms_arn: string`
553560
554561 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
from line 562
555562
556563 maxLength: 2048
557564
558 - `type: "aws"`
559
560565 - `region: optional string or null`
561566
562567 AWS region. Derived from `kms_arn` if omitted.
from line 574
569574
570575 - `BetaGCPExternalKeyConfig object`
571576
577 - `type: "gcp"`
578
572579 - `key_name: string`
573580
574581 Full resource name of the Cloud KMS key.
575582
576 - `type: "gcp"`
577
578583 - `BetaAzureExternalKeyConfigParam object`
579584
580585 Azure Key Vault provider configuration.
581586
587 - `type: "azure"`
588
582589 - `key_name: string`
583590
584591 Name of the key within the vault.
from line 594
587594
588595 Azure AD tenant ID.
589596
590 - `type: "azure"`
591
592597 - `vault_uri: string`
593598
594599 Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
from line 612
607612 workspace references it, the provider fields become effectively immutable
608613 (existing encrypted data needs the config for decrypt).
609614
615 - `type: "external_key"`
616
617 default: external_key
618
610619 - `id: string`
611620
612621 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
from line 654
645654
646655 - `BetaAWSExternalKeyConfig object`
647656
657 - `type: "aws"`
658
648659 - `kms_arn: string`
649660
650661 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
from line 662
651662
652663 maxLength: 2048
653664
654 - `type: "aws"`
655
656665 - `region: optional string or null`
657666
658667 AWS region. Derived from `kms_arn` if omitted.
from line 674
665674
666675 - `BetaGCPExternalKeyConfig object`
667676
677 - `type: "gcp"`
678
668679 - `key_name: string`
669680
670681 Full resource name of the Cloud KMS key.
671682
672 - `type: "gcp"`
673
674683 - `BetaAzureExternalKeyConfig object`
675684
685 - `type: "azure"`
686
676687 - `key_name: string`
677688
678689 Name of the key within the vault.
from line 692
681692
682693 Azure AD tenant ID.
683694
684 - `type: "azure"`
685
686695 - `vault_uri: string`
687696
688697 Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
from line 700
691700
692701 Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.
693702
694 - `type: "external_key"`
695
696 default: external_key
697
698703 - `updated_at: string`
699704
700705 format: date-time
from line 754
749754
750755### Returns
751756
752- `id: string`
753
754 ID of the deleted External Key.
755
756757- `type: "external_key_deleted"`
757758
758759 default: external_key_deleted
759760
761- `id: string`
762
763 ID of the deleted External Key.
764
760765### Example
761766
762767```bash
from line 801
796801
797802### Returns
798803
804- `type: "external_key_validation"`
805
806 default: external_key_validation
807
799808- `error: string or null`
800809
801810 Error message when status is `failure`. Null otherwise.
from line 817
808817
809818 - `"success"`
810819
811- `type: "external_key_validation"`
812
813 default: external_key_validation
814
815820### Example
816821
817822```bash
from line 842
837842
838843- `BetaAWSExternalKeyConfig object`
839844
845 - `type: "aws"`
846
840847 - `kms_arn: string`
841848
842849 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
from line 850
843850
844851 maxLength: 2048
845852
846 - `type: "aws"`
847
848853 - `region: optional string or null`
849854
850855 AWS region. Derived from `kms_arn` if omitted.
from line 864
859864
860865- `BetaAzureExternalKeyConfig object`
861866
867 - `type: "azure"`
868
862869 - `key_name: string`
863870
864871 Name of the key within the vault.
from line 874
867874
868875 Azure AD tenant ID.
869876
870 - `type: "azure"`
871
872877 - `vault_uri: string`
873878
874879 Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
from line 888
883888
884889 Azure Key Vault provider configuration.
885890
891 - `type: "azure"`
892
886893 - `key_name: string`
887894
888895 Name of the key within the vault.
from line 898
891898
892899 Azure AD tenant ID.
893900
894 - `type: "azure"`
895
896901 - `vault_uri: string`
897902
898903 Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
from line 916
911916 workspace references it, the provider fields become effectively immutable
912917 (existing encrypted data needs the config for decrypt).
913918
919 - `type: "external_key"`
920
921 default: external_key
922
914923 - `id: string`
915924
916925 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
from line 958
949958
950959 - `BetaAWSExternalKeyConfig object`
951960
961 - `type: "aws"`
962
952963 - `kms_arn: string`
953964
954965 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
from line 966
955966
956967 maxLength: 2048
957968
958 - `type: "aws"`
959
960969 - `region: optional string or null`
961970
962971 AWS region. Derived from `kms_arn` if omitted.
from line 978
969978
970979 - `BetaGCPExternalKeyConfig object`
971980
981 - `type: "gcp"`
982
972983 - `key_name: string`
973984
974985 Full resource name of the Cloud KMS key.
975986
976 - `type: "gcp"`
977
978987 - `BetaAzureExternalKeyConfig object`
979988
989 - `type: "azure"`
990
980991 - `key_name: string`
981992
982993 Name of the key within the vault.
from line 996
985996
986997 Azure AD tenant ID.
987998
988 - `type: "azure"`
989
990999 - `vault_uri: string`
9911000
9921001 Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
from line 1004
9951004
9961005 Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.
9971006
998 - `type: "external_key"`
999
1000 default: external_key
1001
10021007 - `updated_at: string`
10031008
10041009 format: date-time
from line 1028
10231028
10241029- `BetaGCPExternalKeyConfig object`
10251030
1031 - `type: "gcp"`
1032
10261033 - `key_name: string`
10271034
10281035 Full resource name of the Cloud KMS key.
10291036
1030 - `type: "gcp"`
1031
10321037### External Key Delete Response
10331038
10341039- `ExternalKeyDeleteResponse object`
10351040
1036 - `id: string`
1037
1038 ID of the deleted External Key.
1039
10401041 - `type: "external_key_deleted"`
10411042
10421043 default: external_key_deleted
10431044
1045 - `id: string`
1046
1047 ID of the deleted External Key.
1048
10441049### External Key Validate Response
10451050
10461051- `ExternalKeyValidateResponse object`
from line 1055
10501055 HTTP 200 for both outcomes — the operation completed; `status` says
10511056 whether the key works.
10521057
1058 - `type: "external_key_validation"`
1059
1060 default: external_key_validation
1061
10531062 - `error: string or null`
10541063
10551064 Error message when status is `failure`. Null otherwise.
from line 1070
10611070 - `"failure"`
10621071
10631072 - `"success"`
1064
1065 - `type: "external_key_validation"`
1066
1067 default: external_key_validation
10681073