---
title: "List External Keys"
method: GET
path: "/v1/organizations/external_keys"
---

# List External Keys

`GET /v1/organizations/external_keys`

## Request

- Base URL: `https://api.anthropic.com`
- URL: `https://api.anthropic.com/v1/organizations/external_keys`
- Auth: none declared

List external key configs in the caller's organization.

Results are ordered by creation time (newest first). Use the
`next_page` cursor from the response to fetch subsequent pages.

## Query parameters

- `limit` integer: Number of results per page.
- `page` string, nullable: Opaque cursor from a previous response's `next_page`.

## Headers

- `anthropic-version` string: The version of the Claude API you want to use. Read more about versioning and our version history [here](https://platform.claude.com/docs/en/api/versioning).

## Response `200`

Successful Response

- ExternalKeyListResponse: Opaque-cursor page of external keys, ordered by creation time (newest first).
  - `data` ExternalKey[], required
    - `attachment` union, required: Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
      - AttachedAttachment
        - `type` 'attached', required
      - UnattachedAttachment
        - `type` 'unattached', required
    - `created_at` string, date-time, required
    - `display_name` string, nullable, required: Human-friendly display name. Null if none was set.
    - `geo` string, required: Data residency geo. Selects the region this key is used in.
    - `id` string, required: Identifier of the external key config: a tagged ID prefixed `ekey_`, or, on Claude Platform on AWS, an AWS KMS key's ARN.
    - `provider_config` union, required: KMS provider identity and auth coordinates.
      - AwsExternalKeyConfig
        - `kms_arn` string, required: Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
        - `region` string, nullable: AWS region. Derived from `kms_arn` if omitted.
        - `role_arn` string, nullable: IAM role ARN. Deprecated; this field is ignored.
        - `type` 'aws', required
      - GcpExternalKeyConfig
        - `key_name` string, required: Full resource name of the Cloud KMS key.
        - `type` 'gcp', required
      - AzureExternalKeyConfig
        - `client_id` string, nullable: Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.
        - `key_name` string, required: Name of the key within the vault.
        - `tenant_id` string, required: Azure AD tenant ID.
        - `type` 'azure', required
        - `vault_uri` string, required: Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
    - `type` 'external_key', required
    - `updated_at` string, date-time, required
    - `user_profile_id` string, nullable, required: ID of the user profile the key is bound to, or null if the key is not bound to one. A key bound to a user profile can only be attached to a Workspace that has the same user profile. A key that isn't bound can be attached to a Workspace whatever its user profile.
  - `next_page` string, nullable, required: Opaque cursor for the next page, or null if no more results. Pass as `?page=` to fetch the next page.

## Other responses

- `400`: Invalid argument - The client specified an invalid argument
- `401`: Unauthenticated - The request does not have valid authentication credentials
- `403`: Permission denied - The caller does not have permission to execute the specified operation
- `404`: Not found - Some requested entity was not found
- `408`: Deadline exceeded - The deadline expired before the operation could complete
- `409`: Aborted - The operation was aborted due to concurrency issue
- `412`: Failed precondition - Operation was rejected because the system is not in required state
- `413`: Out of range - Operation was attempted past the valid range
- `429`: Resource exhausted - Some resource has been exhausted (rate limiting)
- `431`: Request header fields too large - Request metadata was too large
- `499`: Cancelled - The operation was cancelled by the client
- `500`: Internal - Internal server error
- `501`: Unimplemented - The operation is not implemented or supported
- `503`: Unavailable - The service is currently unavailable
- `504`: Deadline exceeded - Upstream service did not respond in time
- `529`: Overloaded - The service is temporarily overloaded

## Changes

- **2026-10-26** `0ecac88a7d77`: 1 info
  - added the required property `data/items/user_profile_id` to the response with the `200` status
- **2026-10-21** `94c83daca660`: 1 warning
  - deleted the `header` request parameter `x-api-key`
- **2026-09-30** `51c5260134e8`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/anthropics/apis/anthropic-api/changes/v1/organizations/external_keys/get.md)

---

[API](https://skmtc.dev/anthropics/apis/anthropic-api.md) - [All operations](https://skmtc.dev/anthropics/apis/anthropic-api/llms.txt) - [OpenAPI document](https://skmtc.dev/anthropics/apis/anthropic-api/revisions/328591af84ad?raw)