---
title: "Create External Key"
method: POST
path: "/v1/organizations/external_keys"
---

# Create External Key

`POST /v1/organizations/external_keys`

## Request

- Base URL: `https://api.anthropic.com`
- URL: `https://api.anthropic.com/v1/organizations/external_keys`
- Auth: none declared

Create an external key config owned by the caller's organization.

## Headers

- `anthropic-version` string: The version of the Claude API you want to use. Read more about versioning and our version history [here](https://platform.claude.com/docs/en/api/versioning).

## Request body

- ExternalKeyCreateParams
  - `display_name` string, nullable: Human-friendly display name.
  - `geo` 'us': Data residency geo. Only `us` is supported.
  - `provider_config` union, required: KMS provider identity and auth coordinates.
    - AwsExternalKeyConfig
      - `kms_arn` string, required: Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
      - `region` string, nullable: AWS region. Derived from `kms_arn` if omitted.
      - `role_arn` string, nullable: IAM role ARN. Deprecated; this field is ignored.
      - `type` 'aws', required
    - GcpExternalKeyConfig
      - `key_name` string, required: Full resource name of the Cloud KMS key.
      - `type` 'gcp', required
    - AzureExternalKeyConfigParams: Azure Key Vault provider configuration.
      - `client_id` string, nullable: Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.
      - `key_name` string, required: Name of the key within the vault.
      - `tenant_id` string, required: Azure AD tenant ID.
      - `type` 'azure', required
      - `vault_uri` string, required: Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
  - `user_profile_id` string, nullable: ID of a user profile to bind the key to. Omit this field for a key that isn't bound to a user profile. Such a key can be attached to a Workspace whatever its user profile. The binding cannot be changed later. A key bound to a user profile can only be attached to a Workspace that has the same user profile.

## Response `200`

Successful Response

- ExternalKey: CMEK external key config belonging to the caller's organization. Configs are organization-scoped. Workspaces attach to a config; once any workspace references it, the provider fields become effectively immutable (existing encrypted data needs the config for decrypt).
  - `attachment` union, required: Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
    - AttachedAttachment
      - `type` 'attached', required
    - UnattachedAttachment
      - `type` 'unattached', required
  - `created_at` string, date-time, required
  - `display_name` string, nullable, required: Human-friendly display name. Null if none was set.
  - `geo` string, required: Data residency geo. Selects the region this key is used in.
  - `id` string, required: Identifier of the external key config: a tagged ID prefixed `ekey_`, or, on Claude Platform on AWS, an AWS KMS key's ARN.
  - `provider_config` union, required: KMS provider identity and auth coordinates.
    - AwsExternalKeyConfig
      - `kms_arn` string, required: Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
      - `region` string, nullable: AWS region. Derived from `kms_arn` if omitted.
      - `role_arn` string, nullable: IAM role ARN. Deprecated; this field is ignored.
      - `type` 'aws', required
    - GcpExternalKeyConfig
      - `key_name` string, required: Full resource name of the Cloud KMS key.
      - `type` 'gcp', required
    - AzureExternalKeyConfig
      - `client_id` string, nullable: Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.
      - `key_name` string, required: Name of the key within the vault.
      - `tenant_id` string, required: Azure AD tenant ID.
      - `type` 'azure', required
      - `vault_uri` string, required: Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
  - `type` 'external_key', required
  - `updated_at` string, date-time, required
  - `user_profile_id` string, nullable, required: ID of the user profile the key is bound to, or null if the key is not bound to one. A key bound to a user profile can only be attached to a Workspace that has the same user profile. A key that isn't bound can be attached to a Workspace whatever its user profile.

## Other responses

- `400`: Invalid argument - The client specified an invalid argument
- `401`: Unauthenticated - The request does not have valid authentication credentials
- `403`: Permission denied - The caller does not have permission to execute the specified operation
- `404`: Not found - Some requested entity was not found
- `408`: Deadline exceeded - The deadline expired before the operation could complete
- `409`: Aborted - The operation was aborted due to concurrency issue
- `412`: Failed precondition - Operation was rejected because the system is not in required state
- `413`: Out of range - Operation was attempted past the valid range
- `429`: Resource exhausted - Some resource has been exhausted (rate limiting)
- `431`: Request header fields too large - Request metadata was too large
- `499`: Cancelled - The operation was cancelled by the client
- `500`: Internal - Internal server error
- `501`: Unimplemented - The operation is not implemented or supported
- `503`: Unavailable - The service is currently unavailable
- `504`: Deadline exceeded - Upstream service did not respond in time
- `529`: Overloaded - The service is temporarily overloaded

## Changes

- **2026-10-26** `0ecac88a7d77`: 1 breaking, 7 info
  - the `error` response's property type changed from no type to `object` for status `400`
  - added the new optional request property `user_profile_id`
  - added the optional property `error/details` to the response with the `400` status
  - removed discriminator from `error` response property for the response status `400`
  - …4 more
- **2026-09-30** `51c5260134e8`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/anthropics/apis/anthropic-api/changes/v1/organizations/external_keys/post.md)

---

[API](https://skmtc.dev/anthropics/apis/anthropic-api.md) - [All operations](https://skmtc.dev/anthropics/apis/anthropic-api/llms.txt) - [OpenAPI document](https://skmtc.dev/anthropics/apis/anthropic-api/revisions/328591af84ad?raw)