---
title: "List External Keys"
method: GET
path: "/v1/organizations/external_keys?beta=true"
---

# List External Keys

`GET /v1/organizations/external_keys?beta=true`

List external key configs in the caller's organization.

Results are ordered by creation time (newest first). Use the
`next_page` cursor from the response to fetch subsequent pages.

## Query parameters

- `limit` integer — Number of results per page.
- `page` string, nullable — Opaque cursor from a previous response's `next_page`.

## Headers

- `x-api-key` string — Your unique Admin API key for authentication. This key is required in the header of all Admin API requests, to authenticate your account and access Anthropic's services. Get your Admin API key through the [Console](https://console.anthropic.com/settings/admin-keys).
- `anthropic-version` string — The version of the Claude API you want to use. Read more about versioning and our version history [here](https://platform.claude.com/docs/en/api/versioning).

## Response `200`

Successful Response

- BetaExternalKeyListResponse — Opaque-cursor page of external keys, ordered by creation time (newest first).
  - `data` BetaExternalKey[], required
    - `attachment` union, required — Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
      - BetaAttachedAttachment
        - `type` 'attached', required
      - BetaUnattachedAttachment
        - `type` 'unattached', required
    - `created_at` string, date-time, required
    - `display_name` string, nullable, required — Human-friendly display name. Null if none was set.
    - `geo` string, required — Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
    - `id` string, required — Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
    - `provider_config` union, required — KMS provider identity and auth coordinates.
      - BetaAwsExternalKeyConfig
        - `kms_arn` string, required — Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
        - `region` string, nullable — AWS region. Derived from `kms_arn` if omitted.
        - `role_arn` string, nullable — IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
        - `type` 'aws', required
      - BetaGcpExternalKeyConfig
        - `key_name` string, required — Full resource name of the Cloud KMS key.
        - `type` 'gcp', required
      - BetaAzureExternalKeyConfig
        - `client_id` string, nullable — Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.
        - `key_name` string, required — Name of the key within the vault.
        - `tenant_id` string, required — Azure AD tenant ID.
        - `type` 'azure', required
        - `vault_uri` string, required — Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
    - `type` 'external_key', required
    - `updated_at` string, date-time, required
  - `next_page` string, nullable, required — Opaque cursor for the next page, or null if no more results. Pass as `?page=` to fetch the next page.

## Other responses

- `400` — Invalid argument - The client specified an invalid argument
- `401` — Unauthenticated - The request does not have valid authentication credentials
- `403` — Permission denied - The caller does not have permission to execute the specified operation
- `404` — Not found - Some requested entity was not found
- `408` — Deadline exceeded - The deadline expired before the operation could complete
- `409` — Aborted - The operation was aborted due to concurrency issue
- `412` — Failed precondition - Operation was rejected because the system is not in required state
- `413` — Out of range - Operation was attempted past the valid range
- `429` — Resource exhausted - Some resource has been exhausted (rate limiting)
- `431` — Request header fields too large - Request metadata was too large
- `499` — Cancelled - The operation was cancelled by the client
- `500` — Internal - Internal server error
- `501` — Unimplemented - The operation is not implemented or supported
- `503` — Unavailable - The service is currently unavailable
- `504` — Deadline exceeded - Upstream service did not respond in time
- `529` — Overloaded - The service is temporarily overloaded

## Changes

- **2026-09-02** `4789294140a2` — 16 info
  - added the non-success response with the status `400`
  - added the non-success response with the status `401`
  - added the non-success response with the status `403`
  - added the non-success response with the status `404`
  - …12 more
- **2026-08-26** `942a11636c42` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/anthropics/apis/anthropic-api/changes/v1/organizations/external_keys?beta=true/get.md)

---

[API](https://skmtc.dev/anthropics/apis/anthropic-api.md) · [All operations](https://skmtc.dev/anthropics/apis/anthropic-api/llms.txt) · [OpenAPI document](https://skmtc.dev/anthropics/apis/anthropic-api/revisions/1bb7c7a0a4a9?raw)