Repository Public
1---2title: External Keys3url: https://platform.claude.com/docs/en/api/beta/organization/external_keys4---56# External Keys78## Create External Key910**POST** `/v1/organizations/external_keys`1112Create an external key config owned by the caller's organization.1314### Body parameters1516- `provider_config: BetaAWSExternalKeyConfig or BetaGCPExternalKeyConfig or BetaAzureExternalKeyConfigParam`1718 KMS provider identity and auth coordinates.1920 - `BetaAWSExternalKeyConfig object`2122 - `type: "aws"`2324 - `kms_arn: string`2526 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.2728 maxLength: 20482930 - `region: optional string or null`3132 AWS region. Derived from `kms_arn` if omitted.3334 - `role_arn: optional string or null`3536 **Deprecated**3738 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.3940 - `BetaGCPExternalKeyConfig object`4142 - `type: "gcp"`4344 - `key_name: string`4546 Full resource name of the Cloud KMS key.4748 - `BetaAzureExternalKeyConfigParam object`4950 Azure Key Vault provider configuration.5152 - `type: "azure"`5354 - `key_name: string`5556 Name of the key within the vault.5758 - `tenant_id: string`5960 Azure AD tenant ID.6162 - `vault_uri: string`6364 Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.6566 - `client_id: optional string or null`6768 Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.6970- `display_name: optional string or null`7172 Human-friendly display name.7374 maxLength: 255, minLength: 17576- `geo: optional "us"`7778 Data residency geo. Only `us` is supported.7980### Returns8182- `BetaExternalKey object`8384 CMEK external key config belonging to the caller's organization.8586 Configs are organization-scoped. Workspaces attach to a config; once any87 workspace references it, the provider fields become effectively immutable88 (existing encrypted data needs the config for decrypt).8990 - `type: "external_key"`9192 default: external_key9394 - `id: string`9596 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.9798 - `attachment: BetaExternalKeyAttachedAttachment or BetaExternalKeyUnattachedAttachment`99100 Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.101102 - `BetaExternalKeyAttachedAttachment object`103104 - `type: "attached"`105106 default: attached107108 - `BetaExternalKeyUnattachedAttachment object`109110 - `type: "unattached"`111112 default: unattached113114 - `created_at: string`115116 format: date-time117118 - `display_name: string or null`119120 Human-friendly display name. Null if none was set.121122 - `geo: string`123124 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.125126 - `provider_config: BetaAWSExternalKeyConfig or BetaGCPExternalKeyConfig or BetaAzureExternalKeyConfig`127128 KMS provider identity and auth coordinates.129130 - `BetaAWSExternalKeyConfig object`131132 - `type: "aws"`133134 - `kms_arn: string`135136 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.137138 maxLength: 2048139140 - `region: optional string or null`141142 AWS region. Derived from `kms_arn` if omitted.143144 - `role_arn: optional string or null`145146 **Deprecated**147148 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.149150 - `BetaGCPExternalKeyConfig object`151152 - `type: "gcp"`153154 - `key_name: string`155156 Full resource name of the Cloud KMS key.157158 - `BetaAzureExternalKeyConfig object`159160 - `type: "azure"`161162 - `key_name: string`163164 Name of the key within the vault.165166 - `tenant_id: string`167168 Azure AD tenant ID.169170 - `vault_uri: string`171172 Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.173174 - `client_id: optional string or null`175176 Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.177178 - `updated_at: string`179180 format: date-time181182### Example183184```bash185curl https://api.anthropic.com/v1/organizations/external_keys \186 -H 'Content-Type: application/json' \187 -H 'anthropic-version: 2023-06-01' \188 -H "X-Api-Key: $ANTHROPIC_API_KEY" \189 -d '{190 "provider_config": {191 "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",192 "type": "aws"193 }194 }'195```196197#### Response (200)198199```json200{201 "id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",202 "attachment": {203 "type": "attached"204 },205 "created_at": "2024-10-30T23:58:27.427722Z",206 "display_name": "prod-us-key",207 "geo": "us",208 "provider_config": {209 "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",210 "type": "aws",211 "region": "us-east-1",212 "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"213 },214 "type": "external_key",215 "updated_at": "2024-10-30T23:58:27.427722Z"216}217```218219## List External Keys220221**GET** `/v1/organizations/external_keys`222223List external key configs in the caller's organization.224225Results are ordered by creation time (newest first). Use the226`next_page` cursor from the response to fetch subsequent pages.227228### Query parameters229230- `limit: optional number`231232 Number of results per page.233234 default: 20, maximum: 100, minimum: 1235236- `page: optional string`237238 Opaque cursor from a previous response's `next_page`.239240### Returns241242- `data: array of BetaExternalKey`243244 - `type: "external_key"`245246 default: external_key247248 - `id: string`249250 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.251252 - `attachment: BetaExternalKeyAttachedAttachment or BetaExternalKeyUnattachedAttachment`253254 Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.255256 - `BetaExternalKeyAttachedAttachment object`257258 - `type: "attached"`259260 default: attached261262 - `BetaExternalKeyUnattachedAttachment object`263264 - `type: "unattached"`265266 default: unattached267268 - `created_at: string`269270 format: date-time271272 - `display_name: string or null`273274 Human-friendly display name. Null if none was set.275276 - `geo: string`277278 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.279280 - `provider_config: BetaAWSExternalKeyConfig or BetaGCPExternalKeyConfig or BetaAzureExternalKeyConfig`281282 KMS provider identity and auth coordinates.283284 - `BetaAWSExternalKeyConfig object`285286 - `type: "aws"`287288 - `kms_arn: string`289290 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.291292 maxLength: 2048293294 - `region: optional string or null`295296 AWS region. Derived from `kms_arn` if omitted.297298 - `role_arn: optional string or null`299300 **Deprecated**301302 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.303304 - `BetaGCPExternalKeyConfig object`305306 - `type: "gcp"`307308 - `key_name: string`309310 Full resource name of the Cloud KMS key.311312 - `BetaAzureExternalKeyConfig object`313314 - `type: "azure"`315316 - `key_name: string`317318 Name of the key within the vault.319320 - `tenant_id: string`321322 Azure AD tenant ID.323324 - `vault_uri: string`325326 Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.327328 - `client_id: optional string or null`329330 Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.331332 - `updated_at: string`333334 format: date-time335336- `next_page: string or null`337338 Opaque cursor for the next page, or null if no more results. Pass as `?page=` to fetch the next page.339340### Example341342```bash343curl https://api.anthropic.com/v1/organizations/external_keys \344 -H 'anthropic-version: 2023-06-01' \345 -H "X-Api-Key: $ANTHROPIC_API_KEY"346```347348#### Response (200)349350```json351{352 "data": [353 {354 "id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",355 "attachment": {356 "type": "attached"357 },358 "created_at": "2024-10-30T23:58:27.427722Z",359 "display_name": "prod-us-key",360 "geo": "us",361 "provider_config": {362 "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",363 "type": "aws",364 "region": "us-east-1",365 "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"366 },367 "type": "external_key",368 "updated_at": "2024-10-30T23:58:27.427722Z"369 }370 ],371 "next_page": "next_page"372}373```374375## Get External Key376377**GET** `/v1/organizations/external_keys/{external_key_id}`378379Retrieve a single external key config in the caller's organization by ID.380381### Path parameters382383- `external_key_id: string`384385 ID of the External Key.386387 maxLength: 2048388389### Returns390391- `BetaExternalKey object`392393 CMEK external key config belonging to the caller's organization.394395 Configs are organization-scoped. Workspaces attach to a config; once any396 workspace references it, the provider fields become effectively immutable397 (existing encrypted data needs the config for decrypt).398399 - `type: "external_key"`400401 default: external_key402403 - `id: string`404405 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.406407 - `attachment: BetaExternalKeyAttachedAttachment or BetaExternalKeyUnattachedAttachment`408409 Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.410411 - `BetaExternalKeyAttachedAttachment object`412413 - `type: "attached"`414415 default: attached416417 - `BetaExternalKeyUnattachedAttachment object`418419 - `type: "unattached"`420421 default: unattached422423 - `created_at: string`424425 format: date-time426427 - `display_name: string or null`428429 Human-friendly display name. Null if none was set.430431 - `geo: string`432433 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.434435 - `provider_config: BetaAWSExternalKeyConfig or BetaGCPExternalKeyConfig or BetaAzureExternalKeyConfig`436437 KMS provider identity and auth coordinates.438439 - `BetaAWSExternalKeyConfig object`440441 - `type: "aws"`442443 - `kms_arn: string`444445 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.446447 maxLength: 2048448449 - `region: optional string or null`450451 AWS region. Derived from `kms_arn` if omitted.452453 - `role_arn: optional string or null`454455 **Deprecated**456457 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.458459 - `BetaGCPExternalKeyConfig object`460461 - `type: "gcp"`462463 - `key_name: string`464465 Full resource name of the Cloud KMS key.466467 - `BetaAzureExternalKeyConfig object`468469 - `type: "azure"`470471 - `key_name: string`472473 Name of the key within the vault.474475 - `tenant_id: string`476477 Azure AD tenant ID.478479 - `vault_uri: string`480481 Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.482483 - `client_id: optional string or null`484485 Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.486487 - `updated_at: string`488489 format: date-time490491### Example492493```bash494curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID \495 -H 'anthropic-version: 2023-06-01' \496 -H "X-Api-Key: $ANTHROPIC_API_KEY"497```498499#### Response (200)500501```json502{503 "id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",504 "attachment": {505 "type": "attached"506 },507 "created_at": "2024-10-30T23:58:27.427722Z",508 "display_name": "prod-us-key",509 "geo": "us",510 "provider_config": {511 "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",512 "type": "aws",513 "region": "us-east-1",514 "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"515 },516 "type": "external_key",517 "updated_at": "2024-10-30T23:58:27.427722Z"518}519```520521## Update External Key522523**POST** `/v1/organizations/external_keys/{external_key_id}`524525Partially update an external key config. Omitted fields are left unchanged.526527`display_name` is always editable. `geo` and `provider_config` cannot528be changed once any workspace references this config, because previously529encrypted data requires the original key identity to decrypt.530531### Path parameters532533- `external_key_id: string`534535 ID of the External Key.536537 maxLength: 2048538539### Body parameters540541- `display_name: optional string or null`542543 Human-friendly display name.544545 maxLength: 255, minLength: 1546547- `geo: optional "us" or null`548549 Data residency geo. Only `us` is supported.550551- `provider_config: optional BetaAWSExternalKeyConfig or BetaGCPExternalKeyConfig or BetaAzureExternalKeyConfigParam or null`552553 KMS provider identity and auth coordinates.554555 - `BetaAWSExternalKeyConfig object`556557 - `type: "aws"`558559 - `kms_arn: string`560561 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.562563 maxLength: 2048564565 - `region: optional string or null`566567 AWS region. Derived from `kms_arn` if omitted.568569 - `role_arn: optional string or null`570571 **Deprecated**572573 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.574575 - `BetaGCPExternalKeyConfig object`576577 - `type: "gcp"`578579 - `key_name: string`580581 Full resource name of the Cloud KMS key.582583 - `BetaAzureExternalKeyConfigParam object`584585 Azure Key Vault provider configuration.586587 - `type: "azure"`588589 - `key_name: string`590591 Name of the key within the vault.592593 - `tenant_id: string`594595 Azure AD tenant ID.596597 - `vault_uri: string`598599 Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.600601 - `client_id: optional string or null`602603 Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.604605### Returns606607- `BetaExternalKey object`608609 CMEK external key config belonging to the caller's organization.610611 Configs are organization-scoped. Workspaces attach to a config; once any612 workspace references it, the provider fields become effectively immutable613 (existing encrypted data needs the config for decrypt).614615 - `type: "external_key"`616617 default: external_key618619 - `id: string`620621 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.622623 - `attachment: BetaExternalKeyAttachedAttachment or BetaExternalKeyUnattachedAttachment`624625 Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.626627 - `BetaExternalKeyAttachedAttachment object`628629 - `type: "attached"`630631 default: attached632633 - `BetaExternalKeyUnattachedAttachment object`634635 - `type: "unattached"`636637 default: unattached638639 - `created_at: string`640641 format: date-time642643 - `display_name: string or null`644645 Human-friendly display name. Null if none was set.646647 - `geo: string`648649 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.650651 - `provider_config: BetaAWSExternalKeyConfig or BetaGCPExternalKeyConfig or BetaAzureExternalKeyConfig`652653 KMS provider identity and auth coordinates.654655 - `BetaAWSExternalKeyConfig object`656657 - `type: "aws"`658659 - `kms_arn: string`660661 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.662663 maxLength: 2048664665 - `region: optional string or null`666667 AWS region. Derived from `kms_arn` if omitted.668669 - `role_arn: optional string or null`670671 **Deprecated**672673 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.674675 - `BetaGCPExternalKeyConfig object`676677 - `type: "gcp"`678679 - `key_name: string`680681 Full resource name of the Cloud KMS key.682683 - `BetaAzureExternalKeyConfig object`684685 - `type: "azure"`686687 - `key_name: string`688689 Name of the key within the vault.690691 - `tenant_id: string`692693 Azure AD tenant ID.694695 - `vault_uri: string`696697 Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.698699 - `client_id: optional string or null`700701 Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.702703 - `updated_at: string`704705 format: date-time706707### Example708709```bash710curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID \711 -H 'Content-Type: application/json' \712 -H 'anthropic-version: 2023-06-01' \713 -H "X-Api-Key: $ANTHROPIC_API_KEY" \714 -d '{}'715```716717#### Response (200)718719```json720{721 "id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",722 "attachment": {723 "type": "attached"724 },725 "created_at": "2024-10-30T23:58:27.427722Z",726 "display_name": "prod-us-key",727 "geo": "us",728 "provider_config": {729 "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",730 "type": "aws",731 "region": "us-east-1",732 "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"733 },734 "type": "external_key",735 "updated_at": "2024-10-30T23:58:27.427722Z"736}737```738739## Delete External Key740741**DELETE** `/v1/organizations/external_keys/{external_key_id}`742743Delete an external key config.744745The request is rejected if any workspace still references this config.746747### Path parameters748749- `external_key_id: string`750751 ID of the External Key.752753 maxLength: 2048754755### Returns756757- `type: "external_key_deleted"`758759 default: external_key_deleted760761- `id: string`762763 ID of the deleted External Key.764765### Example766767```bash768curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID \769 -X DELETE \770 -H 'anthropic-version: 2023-06-01' \771 -H "X-Api-Key: $ANTHROPIC_API_KEY"772```773774#### Response (200)775776```json777{778 "id": "ekey_01AbCdEfGhIjKlMnOpQrStUv",779 "type": "external_key_deleted"780}781```782783## Validate External Key784785**POST** `/v1/organizations/external_keys/{external_key_id}/validate`786787Validate an external key config against the customer's KMS.788789Anthropic performs an encrypt/decrypt roundtrip against the configured790KMS key and waits up to 30 seconds for the result. The response status is791`success` if the roundtrip succeeded, or `failure` with an error792message if it failed or timed out.793794### Path parameters795796- `external_key_id: string`797798 ID of the External Key.799800 maxLength: 2048801802### Returns803804- `type: "external_key_validation"`805806 default: external_key_validation807808- `error: string or null`809810 Error message when status is `failure`. Null otherwise.811812- `status: "failure" or "success"`813814 `success` — encrypt/decrypt roundtrip succeeded. `failure` — the roundtrip failed or timed out; see `error`.815816 - `"failure"`817818 - `"success"`819820### Example821822```bash823curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID/validate \824 -X POST \825 -H 'anthropic-version: 2023-06-01' \826 -H "X-Api-Key: $ANTHROPIC_API_KEY"827```828829#### Response (200)830831```json832{833 "error": "error",834 "status": "failure",835 "type": "external_key_validation"836}837```838839## Domain types840841### Beta AWS External Key Config842843- `BetaAWSExternalKeyConfig object`844845 - `type: "aws"`846847 - `kms_arn: string`848849 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.850851 maxLength: 2048852853 - `region: optional string or null`854855 AWS region. Derived from `kms_arn` if omitted.856857 - `role_arn: optional string or null`858859 **Deprecated**860861 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.862863### Beta Azure External Key Config864865- `BetaAzureExternalKeyConfig object`866867 - `type: "azure"`868869 - `key_name: string`870871 Name of the key within the vault.872873 - `tenant_id: string`874875 Azure AD tenant ID.876877 - `vault_uri: string`878879 Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.880881 - `client_id: optional string or null`882883 Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.884885### Beta Azure External Key Config Param886887- `BetaAzureExternalKeyConfigParam object`888889 Azure Key Vault provider configuration.890891 - `type: "azure"`892893 - `key_name: string`894895 Name of the key within the vault.896897 - `tenant_id: string`898899 Azure AD tenant ID.900901 - `vault_uri: string`902903 Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.904905 - `client_id: optional string or null`906907 Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.908909### Beta External Key910911- `BetaExternalKey object`912913 CMEK external key config belonging to the caller's organization.914915 Configs are organization-scoped. Workspaces attach to a config; once any916 workspace references it, the provider fields become effectively immutable917 (existing encrypted data needs the config for decrypt).918919 - `type: "external_key"`920921 default: external_key922923 - `id: string`924925 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.926927 - `attachment: BetaExternalKeyAttachedAttachment or BetaExternalKeyUnattachedAttachment`928929 Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.930931 - `BetaExternalKeyAttachedAttachment object`932933 - `type: "attached"`934935 default: attached936937 - `BetaExternalKeyUnattachedAttachment object`938939 - `type: "unattached"`940941 default: unattached942943 - `created_at: string`944945 format: date-time946947 - `display_name: string or null`948949 Human-friendly display name. Null if none was set.950951 - `geo: string`952953 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.954955 - `provider_config: BetaAWSExternalKeyConfig or BetaGCPExternalKeyConfig or BetaAzureExternalKeyConfig`956957 KMS provider identity and auth coordinates.958959 - `BetaAWSExternalKeyConfig object`960961 - `type: "aws"`962963 - `kms_arn: string`964965 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.966967 maxLength: 2048968969 - `region: optional string or null`970971 AWS region. Derived from `kms_arn` if omitted.972973 - `role_arn: optional string or null`974975 **Deprecated**976977 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.978979 - `BetaGCPExternalKeyConfig object`980981 - `type: "gcp"`982983 - `key_name: string`984985 Full resource name of the Cloud KMS key.986987 - `BetaAzureExternalKeyConfig object`988989 - `type: "azure"`990991 - `key_name: string`992993 Name of the key within the vault.994995 - `tenant_id: string`996997 Azure AD tenant ID.998999 - `vault_uri: string`10001001 Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.10021003 - `client_id: optional string or null`10041005 Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.10061007 - `updated_at: string`10081009 format: date-time10101011### Beta External Key Attached Attachment10121013- `BetaExternalKeyAttachedAttachment object`10141015 - `type: "attached"`10161017 default: attached10181019### Beta External Key Unattached Attachment10201021- `BetaExternalKeyUnattachedAttachment object`10221023 - `type: "unattached"`10241025 default: unattached10261027### Beta GCP External Key Config10281029- `BetaGCPExternalKeyConfig object`10301031 - `type: "gcp"`10321033 - `key_name: string`10341035 Full resource name of the Cloud KMS key.10361037### External Key Delete Response10381039- `ExternalKeyDeleteResponse object`10401041 - `type: "external_key_deleted"`10421043 default: external_key_deleted10441045 - `id: string`10461047 ID of the deleted External Key.10481049### External Key Validate Response10501051- `ExternalKeyValidateResponse object`10521053 Result of a validation roundtrip against the customer's KMS.10541055 HTTP 200 for both outcomes — the operation completed; `status` says1056 whether the key works.10571058 - `type: "external_key_validation"`10591060 default: external_key_validation10611062 - `error: string or null`10631064 Error message when status is `failure`. Null otherwise.10651066 - `status: "failure" or "success"`10671068 `success` — encrypt/decrypt roundtrip succeeded. `failure` — the roundtrip failed or timed out; see `error`.10691070 - `"failure"`10711072 - `"success"`1073