The whole hunk
from line 1, old and new numbered
/
lines
from line 1
1---
2title: Create External Key
3url: https://platform.claude.com/docs/en/api/beta/organization/external_keys/create
4---
5
16# Create External Key
27
38**POST** `/v1/organizations/external_keys`
from line 17
1217
1318 - `BetaAWSExternalKeyConfig object`
1419
20 - `type: "aws"`
21
1522 - `kms_arn: string`
1623
1724 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
from line 25
1825
1926 maxLength: 2048
2027
21 - `type: "aws"`
22
2328 - `region: optional string or null`
2429
2530 AWS region. Derived from `kms_arn` if omitted.
from line 37
3237
3338 - `BetaGCPExternalKeyConfig object`
3439
40 - `type: "gcp"`
41
3542 - `key_name: string`
3643
3744 Full resource name of the Cloud KMS key.
3845
39 - `type: "gcp"`
40
4146 - `BetaAzureExternalKeyConfigParam object`
4247
4348 Azure Key Vault provider configuration.
4449
50 - `type: "azure"`
51
4552 - `key_name: string`
4653
4754 Name of the key within the vault.
from line 57
5057
5158 Azure AD tenant ID.
5259
53 - `type: "azure"`
54
5560 - `vault_uri: string`
5661
5762 Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
from line 85
8085 workspace references it, the provider fields become effectively immutable
8186 (existing encrypted data needs the config for decrypt).
8287
88 - `type: "external_key"`
89
90 default: external_key
91
8392 - `id: string`
8493
8594 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
from line 127
118127
119128 - `BetaAWSExternalKeyConfig object`
120129
130 - `type: "aws"`
131
121132 - `kms_arn: string`
122133
123134 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
from line 135
124135
125136 maxLength: 2048
126137
127 - `type: "aws"`
128
129138 - `region: optional string or null`
130139
131140 AWS region. Derived from `kms_arn` if omitted.
from line 147
138147
139148 - `BetaGCPExternalKeyConfig object`
140149
150 - `type: "gcp"`
151
141152 - `key_name: string`
142153
143154 Full resource name of the Cloud KMS key.
144155
145 - `type: "gcp"`
146
147156 - `BetaAzureExternalKeyConfig object`
148157
158 - `type: "azure"`
159
149160 - `key_name: string`
150161
151162 Name of the key within the vault.
from line 165
154165
155166 Azure AD tenant ID.
156167
157 - `type: "azure"`
158
159168 - `vault_uri: string`
160169
161170 Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
from line 172
163172 - `client_id: optional string or null`
164173
165174 Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.
166
167 - `type: "external_key"`
168
169 default: external_key
170175
171176 - `updated_at: string`
172177