--- title: External Keys url: https://platform.claude.com/docs/en/api/go/beta/organization/external_keys --- # External Keys ## Create External Key `client.Beta.Organization.ExternalKeys.New(ctx, body) (*BetaExternalKey, error)` **POST** `/v1/organizations/external_keys` Create an external key config owned by the caller's organization. ### Parameters - `body BetaOrganizationExternalKeyNewParams` - `ProviderConfig BetaOrganizationExternalKeyNewParamsProviderConfigUnion` KMS provider identity and auth coordinates. - `type BetaAWSExternalKeyConfig` - `Type AWS` - `KMSARN string` Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected. maxLength: 2048 - `Region string Optional` AWS region. Derived from `kms_arn` if omitted. - `RoleARN string Optional` **Deprecated** IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored. - `type BetaGCPExternalKeyConfig` - `Type GCP` - `KeyName string` Full resource name of the Cloud KMS key. - `type BetaAzureExternalKeyConfigParam` Azure Key Vault provider configuration. - `Type Azure` - `KeyName string` Name of the key within the vault. - `TenantID string` Azure AD tenant ID. - `VaultURI string` Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`. - `ClientID string Optional` Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory. - `DisplayName param.Opt[string] Optional` Human-friendly display name. minLength: 1, maxLength: 255 - `Geo BetaOrganizationExternalKeyNewParamsGeo Optional` Data residency geo. Only `us` is supported. - `const BetaOrganizationExternalKeyNewParamsGeoUs BetaOrganizationExternalKeyNewParamsGeo = "us"` ### Returns - `type BetaExternalKey` CMEK external key config belonging to the caller's organization. Configs are organization-scoped. Workspaces attach to a config; once any workspace references it, the provider fields become effectively immutable (existing encrypted data needs the config for decrypt). - `Type ExternalKey` default: external_key - `ID string` Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN. - `Attachment BetaExternalKeyAttachmentUnion` Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted. - `type BetaExternalKeyAttachedAttachment` - `Type Attached` default: attached - `type BetaExternalKeyUnattachedAttachment` - `Type Unattached` default: unattached - `CreatedAt Time` format: date-time - `DisplayName string` Human-friendly display name. Null if none was set. - `Geo string` Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips. - `ProviderConfig BetaExternalKeyProviderConfigUnion` KMS provider identity and auth coordinates. - `type BetaAWSExternalKeyConfig` - `Type AWS` - `KMSARN string` Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected. maxLength: 2048 - `Region string Optional` AWS region. Derived from `kms_arn` if omitted. - `RoleARN string Optional` **Deprecated** IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored. - `type BetaGCPExternalKeyConfig` - `Type GCP` - `KeyName string` Full resource name of the Cloud KMS key. - `type BetaAzureExternalKeyConfig` - `Type Azure` - `KeyName string` Name of the key within the vault. - `TenantID string` Azure AD tenant ID. - `VaultURI string` Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`. - `ClientID string Optional` Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory. - `UpdatedAt Time` format: date-time ### Example ```go package main import ( "context" "fmt" "github.com/anthropics/anthropic-sdk-go" "github.com/anthropics/anthropic-sdk-go/option" ) func main() { client := anthropic.NewClient( option.WithAPIKey("my-anthropic-api-key"), ) betaExternalKey, err := client.Beta.Organization.ExternalKeys.New(context.TODO(), anthropic.BetaOrganizationExternalKeyNewParams{ ProviderConfig: anthropic.BetaOrganizationExternalKeyNewParamsProviderConfigUnion{ OfAWS: &anthropic.BetaAWSExternalKeyConfigParam{ KMSARN: "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222", }, }, }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", betaExternalKey.ID) } ``` #### Response (200) ```json { "id": "ekey_01SDCCSbTxrXDpWc1phhtcfK", "attachment": { "type": "attached" }, "created_at": "2024-10-30T23:58:27.427722Z", "display_name": "prod-us-key", "geo": "us", "provider_config": { "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222", "type": "aws", "region": "us-east-1", "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek" }, "type": "external_key", "updated_at": "2024-10-30T23:58:27.427722Z" } ``` ## List External Keys `client.Beta.Organization.ExternalKeys.List(ctx, query) (*PageCursor[BetaExternalKey], error)` **GET** `/v1/organizations/external_keys` List external key configs in the caller's organization. Results are ordered by creation time (newest first). Use the `next_page` cursor from the response to fetch subsequent pages. ### Parameters - `query BetaOrganizationExternalKeyListParams` - `Limit param.Opt[int64] Optional` (query parameter) Number of results per page. minimum: 1, maximum: 100 - `Page param.Opt[string] Optional` (query parameter) Opaque cursor from a previous response's `next_page`. ### Returns - `type BetaExternalKey` CMEK external key config belonging to the caller's organization. Configs are organization-scoped. Workspaces attach to a config; once any workspace references it, the provider fields become effectively immutable (existing encrypted data needs the config for decrypt). - `Type ExternalKey` default: external_key - `ID string` Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN. - `Attachment BetaExternalKeyAttachmentUnion` Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted. - `type BetaExternalKeyAttachedAttachment` - `Type Attached` default: attached - `type BetaExternalKeyUnattachedAttachment` - `Type Unattached` default: unattached - `CreatedAt Time` format: date-time - `DisplayName string` Human-friendly display name. Null if none was set. - `Geo string` Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips. - `ProviderConfig BetaExternalKeyProviderConfigUnion` KMS provider identity and auth coordinates. - `type BetaAWSExternalKeyConfig` - `Type AWS` - `KMSARN string` Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected. maxLength: 2048 - `Region string Optional` AWS region. Derived from `kms_arn` if omitted. - `RoleARN string Optional` **Deprecated** IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored. - `type BetaGCPExternalKeyConfig` - `Type GCP` - `KeyName string` Full resource name of the Cloud KMS key. - `type BetaAzureExternalKeyConfig` - `Type Azure` - `KeyName string` Name of the key within the vault. - `TenantID string` Azure AD tenant ID. - `VaultURI string` Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`. - `ClientID string Optional` Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory. - `UpdatedAt Time` format: date-time ### Example ```go package main import ( "context" "fmt" "github.com/anthropics/anthropic-sdk-go" "github.com/anthropics/anthropic-sdk-go/option" ) func main() { client := anthropic.NewClient( option.WithAPIKey("my-anthropic-api-key"), ) page, err := client.Beta.Organization.ExternalKeys.List(context.TODO(), anthropic.BetaOrganizationExternalKeyListParams{}) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", page) } ``` #### Response (200) ```json { "data": [ { "id": "ekey_01SDCCSbTxrXDpWc1phhtcfK", "attachment": { "type": "attached" }, "created_at": "2024-10-30T23:58:27.427722Z", "display_name": "prod-us-key", "geo": "us", "provider_config": { "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222", "type": "aws", "region": "us-east-1", "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek" }, "type": "external_key", "updated_at": "2024-10-30T23:58:27.427722Z" } ], "next_page": "next_page" } ``` ## Get External Key `client.Beta.Organization.ExternalKeys.Get(ctx, externalKeyID) (*BetaExternalKey, error)` **GET** `/v1/organizations/external_keys/{external_key_id}` Retrieve a single external key config in the caller's organization by ID. ### Parameters - `externalKeyID string` (path parameter) ID of the External Key. maxLength: 2048 ### Returns - `type BetaExternalKey` CMEK external key config belonging to the caller's organization. Configs are organization-scoped. Workspaces attach to a config; once any workspace references it, the provider fields become effectively immutable (existing encrypted data needs the config for decrypt). - `Type ExternalKey` default: external_key - `ID string` Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN. - `Attachment BetaExternalKeyAttachmentUnion` Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted. - `type BetaExternalKeyAttachedAttachment` - `Type Attached` default: attached - `type BetaExternalKeyUnattachedAttachment` - `Type Unattached` default: unattached - `CreatedAt Time` format: date-time - `DisplayName string` Human-friendly display name. Null if none was set. - `Geo string` Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips. - `ProviderConfig BetaExternalKeyProviderConfigUnion` KMS provider identity and auth coordinates. - `type BetaAWSExternalKeyConfig` - `Type AWS` - `KMSARN string` Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected. maxLength: 2048 - `Region string Optional` AWS region. Derived from `kms_arn` if omitted. - `RoleARN string Optional` **Deprecated** IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored. - `type BetaGCPExternalKeyConfig` - `Type GCP` - `KeyName string` Full resource name of the Cloud KMS key. - `type BetaAzureExternalKeyConfig` - `Type Azure` - `KeyName string` Name of the key within the vault. - `TenantID string` Azure AD tenant ID. - `VaultURI string` Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`. - `ClientID string Optional` Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory. - `UpdatedAt Time` format: date-time ### Example ```go package main import ( "context" "fmt" "github.com/anthropics/anthropic-sdk-go" "github.com/anthropics/anthropic-sdk-go/option" ) func main() { client := anthropic.NewClient( option.WithAPIKey("my-anthropic-api-key"), ) betaExternalKey, err := client.Beta.Organization.ExternalKeys.Get(context.TODO(), "external_key_id") if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", betaExternalKey.ID) } ``` #### Response (200) ```json { "id": "ekey_01SDCCSbTxrXDpWc1phhtcfK", "attachment": { "type": "attached" }, "created_at": "2024-10-30T23:58:27.427722Z", "display_name": "prod-us-key", "geo": "us", "provider_config": { "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222", "type": "aws", "region": "us-east-1", "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek" }, "type": "external_key", "updated_at": "2024-10-30T23:58:27.427722Z" } ``` ## Update External Key `client.Beta.Organization.ExternalKeys.Update(ctx, externalKeyID, body) (*BetaExternalKey, error)` **POST** `/v1/organizations/external_keys/{external_key_id}` Partially update an external key config. Omitted fields are left unchanged. `display_name` is always editable. `geo` and `provider_config` cannot be changed once any workspace references this config, because previously encrypted data requires the original key identity to decrypt. ### Parameters - `externalKeyID string` (path parameter) ID of the External Key. maxLength: 2048 - `body BetaOrganizationExternalKeyUpdateParams` - `DisplayName param.Opt[string] Optional` Human-friendly display name. minLength: 1, maxLength: 255 - `Geo BetaOrganizationExternalKeyUpdateParamsGeo Optional` Data residency geo. Only `us` is supported. - `const BetaOrganizationExternalKeyUpdateParamsGeoUs BetaOrganizationExternalKeyUpdateParamsGeo = "us"` - `ProviderConfig BetaOrganizationExternalKeyUpdateParamsProviderConfigUnion Optional` KMS provider identity and auth coordinates. - `type BetaAWSExternalKeyConfig` - `Type AWS` - `KMSARN string` Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected. maxLength: 2048 - `Region string Optional` AWS region. Derived from `kms_arn` if omitted. - `RoleARN string Optional` **Deprecated** IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored. - `type BetaGCPExternalKeyConfig` - `Type GCP` - `KeyName string` Full resource name of the Cloud KMS key. - `type BetaAzureExternalKeyConfigParam` Azure Key Vault provider configuration. - `Type Azure` - `KeyName string` Name of the key within the vault. - `TenantID string` Azure AD tenant ID. - `VaultURI string` Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`. - `ClientID string Optional` Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory. ### Returns - `type BetaExternalKey` CMEK external key config belonging to the caller's organization. Configs are organization-scoped. Workspaces attach to a config; once any workspace references it, the provider fields become effectively immutable (existing encrypted data needs the config for decrypt). - `Type ExternalKey` default: external_key - `ID string` Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN. - `Attachment BetaExternalKeyAttachmentUnion` Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted. - `type BetaExternalKeyAttachedAttachment` - `Type Attached` default: attached - `type BetaExternalKeyUnattachedAttachment` - `Type Unattached` default: unattached - `CreatedAt Time` format: date-time - `DisplayName string` Human-friendly display name. Null if none was set. - `Geo string` Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips. - `ProviderConfig BetaExternalKeyProviderConfigUnion` KMS provider identity and auth coordinates. - `type BetaAWSExternalKeyConfig` - `Type AWS` - `KMSARN string` Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected. maxLength: 2048 - `Region string Optional` AWS region. Derived from `kms_arn` if omitted. - `RoleARN string Optional` **Deprecated** IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored. - `type BetaGCPExternalKeyConfig` - `Type GCP` - `KeyName string` Full resource name of the Cloud KMS key. - `type BetaAzureExternalKeyConfig` - `Type Azure` - `KeyName string` Name of the key within the vault. - `TenantID string` Azure AD tenant ID. - `VaultURI string` Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`. - `ClientID string Optional` Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory. - `UpdatedAt Time` format: date-time ### Example ```go package main import ( "context" "fmt" "github.com/anthropics/anthropic-sdk-go" "github.com/anthropics/anthropic-sdk-go/option" ) func main() { client := anthropic.NewClient( option.WithAPIKey("my-anthropic-api-key"), ) betaExternalKey, err := client.Beta.Organization.ExternalKeys.Update( context.TODO(), "external_key_id", anthropic.BetaOrganizationExternalKeyUpdateParams{}, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", betaExternalKey.ID) } ``` #### Response (200) ```json { "id": "ekey_01SDCCSbTxrXDpWc1phhtcfK", "attachment": { "type": "attached" }, "created_at": "2024-10-30T23:58:27.427722Z", "display_name": "prod-us-key", "geo": "us", "provider_config": { "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222", "type": "aws", "region": "us-east-1", "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek" }, "type": "external_key", "updated_at": "2024-10-30T23:58:27.427722Z" } ``` ## Delete External Key `client.Beta.Organization.ExternalKeys.Delete(ctx, externalKeyID) (*BetaOrganizationExternalKeyDeleteResponse, error)` **DELETE** `/v1/organizations/external_keys/{external_key_id}` Delete an external key config. The request is rejected if any workspace still references this config. ### Parameters - `externalKeyID string` (path parameter) ID of the External Key. maxLength: 2048 ### Returns - `type BetaOrganizationExternalKeyDeleteResponse` - `Type ExternalKeyDeleted` default: external_key_deleted - `ID string` ID of the deleted External Key. ### Example ```go package main import ( "context" "fmt" "github.com/anthropics/anthropic-sdk-go" "github.com/anthropics/anthropic-sdk-go/option" ) func main() { client := anthropic.NewClient( option.WithAPIKey("my-anthropic-api-key"), ) externalKey, err := client.Beta.Organization.ExternalKeys.Delete(context.TODO(), "external_key_id") if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", externalKey.ID) } ``` #### Response (200) ```json { "id": "ekey_01AbCdEfGhIjKlMnOpQrStUv", "type": "external_key_deleted" } ``` ## Validate External Key `client.Beta.Organization.ExternalKeys.Validate(ctx, externalKeyID) (*BetaOrganizationExternalKeyValidateResponse, error)` **POST** `/v1/organizations/external_keys/{external_key_id}/validate` Validate an external key config against the customer's KMS. Anthropic performs an encrypt/decrypt roundtrip against the configured KMS key and waits up to 30 seconds for the result. The response status is `success` if the roundtrip succeeded, or `failure` with an error message if it failed or timed out. ### Parameters - `externalKeyID string` (path parameter) ID of the External Key. maxLength: 2048 ### Returns - `type BetaOrganizationExternalKeyValidateResponse` Result of a validation roundtrip against the customer's KMS. HTTP 200 for both outcomes — the operation completed; `status` says whether the key works. - `Type ExternalKeyValidation` default: external_key_validation - `Error string` Error message when status is `failure`. Null otherwise. - `Status BetaOrganizationExternalKeyValidateResponseStatus` `success` — encrypt/decrypt roundtrip succeeded. `failure` — the roundtrip failed or timed out; see `error`. - `const BetaOrganizationExternalKeyValidateResponseStatusFailure BetaOrganizationExternalKeyValidateResponseStatus = "failure"` - `const BetaOrganizationExternalKeyValidateResponseStatusSuccess BetaOrganizationExternalKeyValidateResponseStatus = "success"` ### Example ```go package main import ( "context" "fmt" "github.com/anthropics/anthropic-sdk-go" "github.com/anthropics/anthropic-sdk-go/option" ) func main() { client := anthropic.NewClient( option.WithAPIKey("my-anthropic-api-key"), ) response, err := client.Beta.Organization.ExternalKeys.Validate(context.TODO(), "external_key_id") if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", response.Error) } ``` #### Response (200) ```json { "error": "error", "status": "failure", "type": "external_key_validation" } ``` ## Domain types ### Beta AWS External Key Config - `type BetaAWSExternalKeyConfig` - `Type AWS` - `KMSARN string` Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected. maxLength: 2048 - `Region string Optional` AWS region. Derived from `kms_arn` if omitted. - `RoleARN string Optional` **Deprecated** IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored. ### Beta Azure External Key Config - `type BetaAzureExternalKeyConfig` - `Type Azure` - `KeyName string` Name of the key within the vault. - `TenantID string` Azure AD tenant ID. - `VaultURI string` Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`. - `ClientID string Optional` Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory. ### Beta Azure External Key Config Param - `type BetaAzureExternalKeyConfigParam` Azure Key Vault provider configuration. - `Type Azure` - `KeyName string` Name of the key within the vault. - `TenantID string` Azure AD tenant ID. - `VaultURI string` Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`. - `ClientID string Optional` Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory. ### Beta External Key - `type BetaExternalKey` CMEK external key config belonging to the caller's organization. Configs are organization-scoped. Workspaces attach to a config; once any workspace references it, the provider fields become effectively immutable (existing encrypted data needs the config for decrypt). - `Type ExternalKey` default: external_key - `ID string` Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN. - `Attachment BetaExternalKeyAttachmentUnion` Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted. - `type BetaExternalKeyAttachedAttachment` - `Type Attached` default: attached - `type BetaExternalKeyUnattachedAttachment` - `Type Unattached` default: unattached - `CreatedAt Time` format: date-time - `DisplayName string` Human-friendly display name. Null if none was set. - `Geo string` Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips. - `ProviderConfig BetaExternalKeyProviderConfigUnion` KMS provider identity and auth coordinates. - `type BetaAWSExternalKeyConfig` - `Type AWS` - `KMSARN string` Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected. maxLength: 2048 - `Region string Optional` AWS region. Derived from `kms_arn` if omitted. - `RoleARN string Optional` **Deprecated** IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored. - `type BetaGCPExternalKeyConfig` - `Type GCP` - `KeyName string` Full resource name of the Cloud KMS key. - `type BetaAzureExternalKeyConfig` - `Type Azure` - `KeyName string` Name of the key within the vault. - `TenantID string` Azure AD tenant ID. - `VaultURI string` Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`. - `ClientID string Optional` Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory. - `UpdatedAt Time` format: date-time ### Beta External Key Attached Attachment - `type BetaExternalKeyAttachedAttachment` - `Type Attached` default: attached ### Beta External Key Unattached Attachment - `type BetaExternalKeyUnattachedAttachment` - `Type Unattached` default: unattached ### Beta GCP External Key Config - `type BetaGCPExternalKeyConfig` - `Type GCP` - `KeyName string` Full resource name of the Cloud KMS key.