Claude Platform Docs

Mettre à jour une clé externe

BetaExternalKey beta().organization().externalKeys().update(params = ExternalKeyUpdateParams.none(), requestOptions = RequestOptions.none())
POST/v1/organizations/external_keys/{external_key_id}

Mettez à jour partiellement une configuration de clé externe. Les champs omis restent inchangés.

display_name est toujours modifiable. geo et provider_config ne peuvent plus être modifiés dès qu'un espace de travail référence cette configuration, car les données chiffrées précédemment nécessitent l'identité de clé d'origine pour être déchiffrées.

Parameters
ExternalKeyUpdateParams params
Optional<String> externalKeyId⁠Path parameter

ID of the External Key.

maxLength2048
Optional<String> displayName

Human-friendly display name.

minLength1
maxLength255
Optional<Geo> geo

Data residency geo. Only us is supported.

US("us")
Optional<ProviderConfig> providerConfig

KMS provider identity and auth coordinates.

class BetaAwsExternalKeyConfig { type = "aws"; kmsArn; region; roleArn; }
JsonValue type = "aws"
String kmsArn

Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.

maxLength2048
Optional<String> region

AWS region. Derived from kms_arn if omitted.

Optional<String> roleArn⁠Deprecated

IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.

class BetaGcpExternalKeyConfig { type = "gcp"; keyName; }
JsonValue type = "gcp"
String keyName

Full resource name of the Cloud KMS key.

class BetaAzureExternalKeyConfigParam { type = "azure"; keyName; tenantId; /* 2 more */ }

Azure Key Vault provider configuration.

JsonValue type = "azure"
String keyName

Name of the key within the vault.

String tenantId

Azure AD tenant ID.

String vaultUri

Key Vault data-plane URI — https://{vault-name}.vault.azure.net or https://{hsm-name}.managedhsm.azure.net.

Optional<String> clientId

Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.

Returns
class BetaExternalKey { type = "external_key"; id; attachment; /* 5 more */ }

CMEK external key config belonging to the caller's organization.

Configs are organization-scoped. Workspaces attach to a config; once any workspace references it, the provider fields become effectively immutable (existing encrypted data needs the config for decrypt).

Mettre à jour une clé externe
package com.anthropic.example;

import com.anthropic.client.AnthropicClient;
import com.anthropic.client.okhttp.AnthropicOkHttpClient;
import com.anthropic.models.beta.organization.externalkeys.BetaExternalKey;
import com.anthropic.models.beta.organization.externalkeys.ExternalKeyUpdateParams;

public final class Main {
    private Main() {}

    public static void main(String[] args) {
        AnthropicClient client = AnthropicOkHttpClient.fromEnv();

        BetaExternalKey betaExternalKey = client.beta().organization().externalKeys().update("external_key_id");
    }
}
Returns Examples
Response 200
{
  "id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
  "attachment": {
    "type": "attached"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "display_name": "prod-us-key",
  "geo": "us",
  "provider_config": {
    "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
    "type": "aws",
    "region": "us-east-1",
    "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
  },
  "type": "external_key",
  "updated_at": "2024-10-30T23:58:27.427722Z"
}