The whole hunk
from line 1, old and new numbered
/
lines
from line 1
1---
2title: Update External Key
3url: https://platform.claude.com/docs/en/api/beta/organization/external_keys/update
4---
5
16# Update External Key
27
38**POST** `/v1/organizations/external_keys/{external_key_id}`
from line 39
3439
3540 - `BetaAWSExternalKeyConfig object`
3641
42 - `type: "aws"`
43
3744 - `kms_arn: string`
3845
3946 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
from line 47
4047
4148 maxLength: 2048
4249
43 - `type: "aws"`
44
4550 - `region: optional string or null`
4651
4752 AWS region. Derived from `kms_arn` if omitted.
from line 59
5459
5560 - `BetaGCPExternalKeyConfig object`
5661
62 - `type: "gcp"`
63
5764 - `key_name: string`
5865
5966 Full resource name of the Cloud KMS key.
6067
61 - `type: "gcp"`
62
6368 - `BetaAzureExternalKeyConfigParam object`
6469
6570 Azure Key Vault provider configuration.
6671
72 - `type: "azure"`
73
6774 - `key_name: string`
6875
6976 Name of the key within the vault.
from line 79
7279
7380 Azure AD tenant ID.
7481
75 - `type: "azure"`
76
7782 - `vault_uri: string`
7883
7984 Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
from line 97
9297 workspace references it, the provider fields become effectively immutable
9398 (existing encrypted data needs the config for decrypt).
9499
100 - `type: "external_key"`
101
102 default: external_key
103
95104 - `id: string`
96105
97106 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
from line 139
130139
131140 - `BetaAWSExternalKeyConfig object`
132141
142 - `type: "aws"`
143
133144 - `kms_arn: string`
134145
135146 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
from line 147
136147
137148 maxLength: 2048
138149
139 - `type: "aws"`
140
141150 - `region: optional string or null`
142151
143152 AWS region. Derived from `kms_arn` if omitted.
from line 159
150159
151160 - `BetaGCPExternalKeyConfig object`
152161
162 - `type: "gcp"`
163
153164 - `key_name: string`
154165
155166 Full resource name of the Cloud KMS key.
156167
157 - `type: "gcp"`
158
159168 - `BetaAzureExternalKeyConfig object`
160169
170 - `type: "azure"`
171
161172 - `key_name: string`
162173
163174 Name of the key within the vault.
from line 177
166177
167178 Azure AD tenant ID.
168179
169 - `type: "azure"`
170
171180 - `vault_uri: string`
172181
173182 Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
from line 184
175184 - `client_id: optional string or null`
176185
177186 Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.
178
179 - `type: "external_key"`
180
181 default: external_key
182187
183188 - `updated_at: string`
184189