External Keys changedapi/beta/organization/external_keys
Nearest release: v2.1.268, published under an hour after this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+103added
Lines−98removed
From line
1
where the diff opens
First seen
26 Aug 2026
this site's first read of the page
Recorded edits9to this page, all time
The whole hunk
from line 1, old and new numbered
/
from line 1
1---
2title: External Keys
3url: https://platform.claude.com/docs/en/api/beta/organization/external_keys
4---
5
16# External Keys
27
38## Create External Key
from line 19
1419
1520 - `BetaAWSExternalKeyConfig object`
1621
22 - `type: "aws"`
23
1724 - `kms_arn: string`
1825
1926 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
from line 27
2027
2128 maxLength: 2048
2229
23 - `type: "aws"`
24
2530 - `region: optional string or null`
2631
2732 AWS region. Derived from `kms_arn` if omitted.
from line 39
3439
3540 - `BetaGCPExternalKeyConfig object`
3641
42 - `type: "gcp"`
43
3744 - `key_name: string`
3845
3946 Full resource name of the Cloud KMS key.
4047
41 - `type: "gcp"`
42
4348 - `BetaAzureExternalKeyConfigParam object`
4449
4550 Azure Key Vault provider configuration.
4651
52 - `type: "azure"`
53
4754 - `key_name: string`
4855
4956 Name of the key within the vault.
from line 59
5259
5360 Azure AD tenant ID.
5461
55 - `type: "azure"`
56
5762 - `vault_uri: string`
5863
5964 Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
from line 87
8287 workspace references it, the provider fields become effectively immutable
8388 (existing encrypted data needs the config for decrypt).
8489
90 - `type: "external_key"`
91
92 default: external_key
93
8594 - `id: string`
8695
8796 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
from line 129
120129
121130 - `BetaAWSExternalKeyConfig object`
122131
132 - `type: "aws"`
133
123134 - `kms_arn: string`
124135
125136 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
from line 137
126137
127138 maxLength: 2048
128139
129 - `type: "aws"`
130
131140 - `region: optional string or null`
132141
133142 AWS region. Derived from `kms_arn` if omitted.
from line 149
140149
141150 - `BetaGCPExternalKeyConfig object`
142151
152 - `type: "gcp"`
153
143154 - `key_name: string`
144155
145156 Full resource name of the Cloud KMS key.
146157
147 - `type: "gcp"`
148
149158 - `BetaAzureExternalKeyConfig object`
150159
160 - `type: "azure"`
161
151162 - `key_name: string`
152163
153164 Name of the key within the vault.
from line 167
156167
157168 Azure AD tenant ID.
158169
159 - `type: "azure"`
160
161170 - `vault_uri: string`
162171
163172 Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
from line 175
166175
167176 Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.
168177
169 - `type: "external_key"`
170
171 default: external_key
172
173178 - `updated_at: string`
174179
175180 format: date-time
from line 241
236241
237242- `data: array of BetaExternalKey`
238243
244 - `type: "external_key"`
245
246 default: external_key
247
239248 - `id: string`
240249
241250 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
from line 283
274283
275284 - `BetaAWSExternalKeyConfig object`
276285
286 - `type: "aws"`
287
277288 - `kms_arn: string`
278289
279290 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
from line 291
280291
281292 maxLength: 2048
282293
283 - `type: "aws"`
284
285294 - `region: optional string or null`
286295
287296 AWS region. Derived from `kms_arn` if omitted.
from line 303
294303
295304 - `BetaGCPExternalKeyConfig object`
296305
306 - `type: "gcp"`
307
297308 - `key_name: string`
298309
299310 Full resource name of the Cloud KMS key.
300311
301 - `type: "gcp"`
302
303312 - `BetaAzureExternalKeyConfig object`
304313
314 - `type: "azure"`
315
305316 - `key_name: string`
306317
307318 Name of the key within the vault.
from line 321
310321
311322 Azure AD tenant ID.
312323
313 - `type: "azure"`
314
315324 - `vault_uri: string`
316325
317326 Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
from line 329
320329
321330 Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.
322331
323 - `type: "external_key"`
324
325 default: external_key
326
327332 - `updated_at: string`
328333
329334 format: date-time
from line 396
391396 workspace references it, the provider fields become effectively immutable
392397 (existing encrypted data needs the config for decrypt).
393398
399 - `type: "external_key"`
400
401 default: external_key
402
394403 - `id: string`
395404
396405 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
from line 438
429438
430439 - `BetaAWSExternalKeyConfig object`
431440
441 - `type: "aws"`
442
432443 - `kms_arn: string`
433444
434445 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
from line 446
435446
436447 maxLength: 2048
437448
438 - `type: "aws"`
439
440449 - `region: optional string or null`
441450
442451 AWS region. Derived from `kms_arn` if omitted.
from line 458
449458
450459 - `BetaGCPExternalKeyConfig object`
451460
461 - `type: "gcp"`
462
452463 - `key_name: string`
453464
454465 Full resource name of the Cloud KMS key.
455466
456 - `type: "gcp"`
457
458467 - `BetaAzureExternalKeyConfig object`
459468
469 - `type: "azure"`
470
460471 - `key_name: string`
461472
462473 Name of the key within the vault.
from line 476
465476
466477 Azure AD tenant ID.
467478
468 - `type: "azure"`
469
470479 - `vault_uri: string`
471480
472481 Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
from line 484
475484
476485 Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.
477486
478 - `type: "external_key"`
479
480 default: external_key
481
482487 - `updated_at: string`
483488
484489 format: date-time
from line 554
549554
550555 - `BetaAWSExternalKeyConfig object`
551556
557 - `type: "aws"`
558
552559 - `kms_arn: string`
553560
554561 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
from line 562
555562
556563 maxLength: 2048
557564
558 - `type: "aws"`
559
560565 - `region: optional string or null`
561566
562567 AWS region. Derived from `kms_arn` if omitted.
from line 574
569574
570575 - `BetaGCPExternalKeyConfig object`
571576
577 - `type: "gcp"`
578
572579 - `key_name: string`
573580
574581 Full resource name of the Cloud KMS key.
575582
576 - `type: "gcp"`
577
578583 - `BetaAzureExternalKeyConfigParam object`
579584
580585 Azure Key Vault provider configuration.
581586
587 - `type: "azure"`
588
582589 - `key_name: string`
583590
584591 Name of the key within the vault.
from line 594
587594
588595 Azure AD tenant ID.
589596
590 - `type: "azure"`
591
592597 - `vault_uri: string`
593598
594599 Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
from line 612
607612 workspace references it, the provider fields become effectively immutable
608613 (existing encrypted data needs the config for decrypt).
609614
615 - `type: "external_key"`
616
617 default: external_key
618
610619 - `id: string`
611620
612621 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
from line 654
645654
646655 - `BetaAWSExternalKeyConfig object`
647656
657 - `type: "aws"`
658
648659 - `kms_arn: string`
649660
650661 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
from line 662
651662
652663 maxLength: 2048
653664
654 - `type: "aws"`
655
656665 - `region: optional string or null`
657666
658667 AWS region. Derived from `kms_arn` if omitted.
from line 674
665674
666675 - `BetaGCPExternalKeyConfig object`
667676
677 - `type: "gcp"`
678
668679 - `key_name: string`
669680
670681 Full resource name of the Cloud KMS key.
671682
672 - `type: "gcp"`
673
674683 - `BetaAzureExternalKeyConfig object`
675684
685 - `type: "azure"`
686
676687 - `key_name: string`
677688
678689 Name of the key within the vault.
from line 692
681692
682693 Azure AD tenant ID.
683694
684 - `type: "azure"`
685
686695 - `vault_uri: string`
687696
688697 Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
from line 700
691700
692701 Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.
693702
694 - `type: "external_key"`
695
696 default: external_key
697
698703 - `updated_at: string`
699704
700705 format: date-time
from line 754
749754
750755### Returns
751756
752- `id: string`
753
754 ID of the deleted External Key.
755
756757- `type: "external_key_deleted"`
757758
758759 default: external_key_deleted
759760
761- `id: string`
762
763 ID of the deleted External Key.
764
760765### Example
761766
762767```bash
from line 801
796801
797802### Returns
798803
804- `type: "external_key_validation"`
805
806 default: external_key_validation
807
799808- `error: string or null`
800809
801810 Error message when status is `failure`. Null otherwise.
from line 817
808817
809818 - `"success"`
810819
811- `type: "external_key_validation"`
812
813 default: external_key_validation
814
815820### Example
816821
817822```bash
from line 842
837842
838843- `BetaAWSExternalKeyConfig object`
839844
845 - `type: "aws"`
846
840847 - `kms_arn: string`
841848
842849 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
from line 850
843850
844851 maxLength: 2048
845852
846 - `type: "aws"`
847
848853 - `region: optional string or null`
849854
850855 AWS region. Derived from `kms_arn` if omitted.
from line 864
859864
860865- `BetaAzureExternalKeyConfig object`
861866
867 - `type: "azure"`
868
862869 - `key_name: string`
863870
864871 Name of the key within the vault.
from line 874
867874
868875 Azure AD tenant ID.
869876
870 - `type: "azure"`
871
872877 - `vault_uri: string`
873878
874879 Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
from line 888
883888
884889 Azure Key Vault provider configuration.
885890
891 - `type: "azure"`
892
886893 - `key_name: string`
887894
888895 Name of the key within the vault.
from line 898
891898
892899 Azure AD tenant ID.
893900
894 - `type: "azure"`
895
896901 - `vault_uri: string`
897902
898903 Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
from line 916
911916 workspace references it, the provider fields become effectively immutable
912917 (existing encrypted data needs the config for decrypt).
913918
919 - `type: "external_key"`
920
921 default: external_key
922
914923 - `id: string`
915924
916925 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
from line 958
949958
950959 - `BetaAWSExternalKeyConfig object`
951960
961 - `type: "aws"`
962
952963 - `kms_arn: string`
953964
954965 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
from line 966
955966
956967 maxLength: 2048
957968
958 - `type: "aws"`
959
960969 - `region: optional string or null`
961970
962971 AWS region. Derived from `kms_arn` if omitted.
from line 978
969978
970979 - `BetaGCPExternalKeyConfig object`
971980
981 - `type: "gcp"`
982
972983 - `key_name: string`
973984
974985 Full resource name of the Cloud KMS key.
975986
976 - `type: "gcp"`
977
978987 - `BetaAzureExternalKeyConfig object`
979988
989 - `type: "azure"`
990
980991 - `key_name: string`
981992
982993 Name of the key within the vault.
from line 996
985996
986997 Azure AD tenant ID.
987998
988 - `type: "azure"`
989
990999 - `vault_uri: string`
9911000
9921001 Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
from line 1004
9951004
9961005 Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.
9971006
998 - `type: "external_key"`
999
1000 default: external_key
1001
10021007 - `updated_at: string`
10031008
10041009 format: date-time
from line 1028
10231028
10241029- `BetaGCPExternalKeyConfig object`
10251030
1031 - `type: "gcp"`
1032
10261033 - `key_name: string`
10271034
10281035 Full resource name of the Cloud KMS key.
10291036
1030 - `type: "gcp"`
1031
10321037### External Key Delete Response
10331038
10341039- `ExternalKeyDeleteResponse object`
10351040
1036 - `id: string`
1037
1038 ID of the deleted External Key.
1039
10401041 - `type: "external_key_deleted"`
10411042
10421043 default: external_key_deleted
10431044
1045 - `id: string`
1046
1047 ID of the deleted External Key.
1048
10441049### External Key Validate Response
10451050
10461051- `ExternalKeyValidateResponse object`
from line 1055
10501055 HTTP 200 for both outcomes — the operation completed; `status` says
10511056 whether the key works.
10521057
1058 - `type: "external_key_validation"`
1059
1060 default: external_key_validation
1061
10531062 - `error: string or null`
10541063
10551064 Error message when status is `failure`. Null otherwise.
from line 1070
10611070 - `"failure"`
10621071
10631072 - `"success"`
1064
1065 - `type: "external_key_validation"`
1066
1067 default: external_key_validation
10681073
No line in this hunk matches that.