Claude Platform Docs

Внешние ключи

Создать внешний ключ
$client->beta->organization->externalKeys->create(ProviderConfig providerConfig, ?string displayName, ?Geo geo, ?string userProfileID): ExternalKey
POST/v1/organizations/external_keys

Создаёт конфигурацию внешнего ключа, принадлежащую организации вызывающей стороны.

Список внешних ключей
$client->beta->organization->externalKeys->list(?int limit, ?string page): PageCursor<ExternalKey>
GET/v1/organizations/external_keys

Возвращает список конфигураций внешних ключей в организации вызывающей стороны.

Получить внешний ключ
$client->beta->organization->externalKeys->retrieve(string externalKeyID): ExternalKey
GET/v1/organizations/external_keys/{external_key_id}

Возвращает одну конфигурацию внешнего ключа в организации вызывающей стороны по идентификатору.

Обновить внешний ключ
$client->beta->organization->externalKeys->update(string externalKeyID, ?string displayName, ?Geo geo, ?ProviderConfig providerConfig): ExternalKey
POST/v1/organizations/external_keys/{external_key_id}

Частично обновляет конфигурацию внешнего ключа. Пропущенные поля остаются без изменений.

Удалить внешний ключ
$client->beta->organization->externalKeys->delete(string externalKeyID): ExternalKeyDeleteResponse
DELETE/v1/organizations/external_keys/{external_key_id}

Удаляет конфигурацию внешнего ключа.

Проверить внешний ключ
$client->beta->organization->externalKeys->validate(string externalKeyID): ExternalKeyValidateResponse
POST/v1/organizations/external_keys/{external_key_id}/validate

Проверяет конфигурацию внешнего ключа в KMS клиента.

Models
class AWSExternalKeyConfig { $type = 'aws'; $kmsARN; $region; $roleARN; }
"aws" type
string kmsARN

Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.

?string region

AWS region. Derived from kms_arn if omitted.

?string roleARN⁠Deprecated

IAM role ARN. Deprecated; this field is ignored.

class AzureExternalKeyConfig { $type = 'azure'; $keyName; $tenantID; /* 2 more */ }
"azure" type
string keyName

Name of the key within the vault.

string tenantID

Azure AD tenant ID.

string vaultURI

Key Vault data-plane URI — https://{vault-name}.vault.azure.net or https://{hsm-name}.managedhsm.azure.net.

?string clientID

Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.

class AzureExternalKeyConfigParam { $type = 'azure'; $keyName; $tenantID; /* 2 more */ }
"azure" type
string keyName

Name of the key within the vault.

string tenantID

Azure AD tenant ID.

string vaultURI

Key Vault data-plane URI — https://{vault-name}.vault.azure.net or https://{hsm-name}.managedhsm.azure.net.

?string clientID

Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.

class ExternalKey { $type = 'external_key'; $id; $attachment; /* 6 more */ }
"external_key" type
string id

Identifier of the external key config: a tagged ID prefixed ekey_, or, on Claude Platform on AWS, an AWS KMS key's ARN.

Attachment attachment

Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an unattached config is inert and can be deleted.

\Datetime createdAt
?string displayName

Human-friendly display name. Null if none was set.

string geo

Data residency geo. Selects the region this key is used in.

ProviderConfig providerConfig

KMS provider identity and auth coordinates.

\Datetime updatedAt
?string userProfileID

ID of the user profile the key is bound to, or null if the key is not bound to one. A key bound to a user profile can only be attached to a Workspace that has the same user profile. A key that isn't bound can be attached to a Workspace whatever its user profile.

class ExternalKeyAttachedAttachment { $type = 'attached'; }
"attached" type
class ExternalKeyUnattachedAttachment { $type = 'unattached'; }
"unattached" type
class GCPExternalKeyConfig { $type = 'gcp'; $keyName; }
"gcp" type
string keyName

Full resource name of the Cloud KMS key.