Claude Platform Docs

Mettre à jour une clé externe

ExternalKey organization().externalKeys().update(params = ExternalKeyUpdateParams.none(), requestOptions = RequestOptions.none())
POST/v1/organizations/external_keys/{external_key_id}

Mettez à jour partiellement une configuration de clé externe. Les champs omis restent inchangés.

display_name est toujours modifiable. geo et provider_config ne peuvent plus être modifiés dès qu'un espace de travail référence cette configuration, car les données chiffrées précédemment nécessitent l'identité de clé d'origine pour être déchiffrées.

Parameters
ExternalKeyUpdateParams params
Optional<String> externalKeyId⁠Path parameter

ID of the External Key.

maxLength2048
Optional<String> displayName

Human-friendly display name.

minLength1
maxLength255
Optional<Geo> geo

Data residency geo. Only us is supported.

US("us")
Optional<ProviderConfig> providerConfig

KMS provider identity and auth coordinates.

class AwsExternalKeyConfig { type = "aws"; kmsArn; region; }
JsonValue type = "aws"
String kmsArn

Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.

maxLength2048
Optional<String> region

AWS region. Derived from kms_arn if omitted.

class GcpExternalKeyConfig { type = "gcp"; keyName; }
JsonValue type = "gcp"
String keyName

Full resource name of the Cloud KMS key.

class AzureExternalKeyConfigParam { type = "azure"; keyName; tenantId; /* 2 more */ }

Azure Key Vault provider configuration.

JsonValue type = "azure"
String keyName

Name of the key within the vault.

String tenantId

Azure AD tenant ID.

String vaultUri

Key Vault data-plane URI — https://{vault-name}.vault.azure.net or https://{hsm-name}.managedhsm.azure.net.

Optional<String> clientId

Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.

Returns
class ExternalKey { type = "external_key"; id; attachment; /* 5 more */ }

CMEK external key config belonging to the caller's organization.

Configs are organization-scoped. Workspaces attach to a config; once any workspace references it, the provider fields become effectively immutable (existing encrypted data needs the config for decrypt).

Mettre à jour une clé externe
package com.anthropic.example;

import com.anthropic.client.AnthropicClient;
import com.anthropic.client.okhttp.AnthropicOkHttpClient;
import com.anthropic.models.organization.externalkeys.ExternalKey;
import com.anthropic.models.organization.externalkeys.ExternalKeyUpdateParams;

public final class Main {
    private Main() {}

    public static void main(String[] args) {
        AnthropicClient client = AnthropicOkHttpClient.fromEnv();

        ExternalKey externalKey = client.organization().externalKeys().update("external_key_id");
    }
}
Returns Examples
Response 200
{
  "id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
  "attachment": {
    "type": "attached"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "display_name": "prod-us-key",
  "geo": "us",
  "provider_config": {
    "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
    "type": "aws",
    "region": "us-east-1",
    "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
  },
  "type": "external_key",
  "updated_at": "2024-10-30T23:58:27.427722Z"
}