Update External Key

client.Beta.Organization.ExternalKeys.Update(ctx, externalKeyID, body) (*BetaExternalKey, error)

POST/v1/organizations/external_keys/{external_key_id}

Partially update an external key config. Omitted fields are left unchanged.

display_name is always editable. geo and provider_config cannot be changed once any workspace references this config, because previously encrypted data requires the original key identity to decrypt.

Parameters

externalKeyID string

ID of the External Key.

maxLength2048

body BetaOrganizationExternalKeyUpdateParams

DisplayName param.Field[string] Optional

Human-friendly display name.

maxLength255

minLength1

Geo param.Field[BetaOrganizationExternalKeyUpdateParamsGeo] Optional

Data residency geo. Only us is supported.

const BetaOrganizationExternalKeyUpdateParamsGeoUs BetaOrganizationExternalKeyUpdateParamsGeo = "us"

ProviderConfig param.Field[BetaOrganizationExternalKeyUpdateParamsProviderConfigUnion] Optional

KMS provider identity and auth coordinates.

type BetaAWSExternalKeyConfig struct{…}

KMSARN string

Full ARN of the AWS KMS key.

maxLength2048

Type AWS

Region string Optional

AWS region. Derived from kms_arn if omitted.

RoleARN string Optional⁠Deprecated

IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.

type BetaGCPExternalKeyConfig struct{…}

KeyName string

Full resource name of the Cloud KMS key.

Type GCP

type BetaAzureExternalKeyConfigParamResp struct{…}

Azure Key Vault provider configuration.

KeyName string

Name of the key within the vault.

TenantID string

Azure AD tenant ID.

Type Azure

VaultURI string

Key Vault data-plane URI — https://{vault-name}.vault.azure.net or https://{hsm-name}.managedhsm.azure.net.

ClientID string Optional

Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.

Returns

type BetaExternalKey struct{…}

CMEK external key config belonging to the caller's organization.

Configs are organization-scoped. Workspaces attach to a config; once any workspace references it, the provider fields become effectively immutable (existing encrypted data needs the config for decrypt).

Update External Key

package main

import (
	"context"
	"fmt"

	"github.com/anthropics/anthropic-sdk-go"
	"github.com/anthropics/anthropic-sdk-go/option"
)

func main() {
	client := anthropic.NewClient(
		option.WithAPIKey("my-anthropic-api-key"),
	)
	betaExternalKey, err := client.Beta.Organization.ExternalKeys.Update(
		context.TODO(),
		"external_key_id",
		anthropic.BetaOrganizationExternalKeyUpdateParams{},
	)
	if err != nil {
		panic(err.Error())
	}
	fmt.Printf("%+v\n", betaExternalKey.ID)
}

{
  "id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
  "attachment": {
    "type": "attached"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "display_name": "prod-us-key",
  "geo": "us",
  "provider_config": {
    "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
    "type": "aws",
    "region": "us-east-1",
    "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
  },
  "type": "external_key",
  "updated_at": "2024-10-30T23:58:27.427722Z"
}

Returns Examples

{
  "id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
  "attachment": {
    "type": "attached"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "display_name": "prod-us-key",
  "geo": "us",
  "provider_config": {
    "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
    "type": "aws",
    "region": "us-east-1",
    "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
  },
  "type": "external_key",
  "updated_at": "2024-10-30T23:58:27.427722Z"
}