---
title: "Create External Key"
method: POST
path: "/v1/organizations/external_keys?beta=true"
---

# Create External Key

`POST /v1/organizations/external_keys?beta=true`

Create an external key config owned by the caller's organization.

## Headers

- `anthropic-version` string — The version of the Claude API you want to use. Read more about versioning and our version history [here](https://platform.claude.com/docs/en/api/versioning).

## Request body

- BetaExternalKeyCreateParams
  - `display_name` string, nullable — Human-friendly display name.
  - `geo` 'us' — Data residency geo. Only `us` is supported.
  - `provider_config` union, required — KMS provider identity and auth coordinates.
    - BetaAwsExternalKeyConfig
      - `kms_arn` string, required — Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
      - `region` string, nullable — AWS region. Derived from `kms_arn` if omitted.
      - `role_arn` string, nullable — IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
      - `type` 'aws', required
    - BetaGcpExternalKeyConfig
      - `key_name` string, required — Full resource name of the Cloud KMS key.
      - `type` 'gcp', required
    - BetaAzureExternalKeyConfigParams — Azure Key Vault provider configuration.
      - `client_id` string, nullable — Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.
      - `key_name` string, required — Name of the key within the vault.
      - `tenant_id` string, required — Azure AD tenant ID.
      - `type` 'azure', required
      - `vault_uri` string, required — Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.

## Response `200`

Successful Response

- BetaExternalKey — CMEK external key config belonging to the caller's organization. Configs are organization-scoped. Workspaces attach to a config; once any workspace references it, the provider fields become effectively immutable (existing encrypted data needs the config for decrypt).
  - `attachment` union, required — Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.
    - BetaAttachedAttachment
      - `type` 'attached', required
    - BetaUnattachedAttachment
      - `type` 'unattached', required
  - `created_at` string, date-time, required
  - `display_name` string, nullable, required — Human-friendly display name. Null if none was set.
  - `geo` string, required — Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
  - `id` string, required — Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
  - `provider_config` union, required — KMS provider identity and auth coordinates.
    - BetaAwsExternalKeyConfig
      - `kms_arn` string, required — Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
      - `region` string, nullable — AWS region. Derived from `kms_arn` if omitted.
      - `role_arn` string, nullable — IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
      - `type` 'aws', required
    - BetaGcpExternalKeyConfig
      - `key_name` string, required — Full resource name of the Cloud KMS key.
      - `type` 'gcp', required
    - BetaAzureExternalKeyConfig
      - `client_id` string, nullable — Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.
      - `key_name` string, required — Name of the key within the vault.
      - `tenant_id` string, required — Azure AD tenant ID.
      - `type` 'azure', required
      - `vault_uri` string, required — Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.
  - `type` 'external_key', required
  - `updated_at` string, date-time, required

## Other responses

- `400` — Invalid argument - The client specified an invalid argument
- `401` — Unauthenticated - The request does not have valid authentication credentials
- `403` — Permission denied - The caller does not have permission to execute the specified operation
- `404` — Not found - Some requested entity was not found
- `408` — Deadline exceeded - The deadline expired before the operation could complete
- `409` — Aborted - The operation was aborted due to concurrency issue
- `412` — Failed precondition - Operation was rejected because the system is not in required state
- `413` — Out of range - Operation was attempted past the valid range
- `429` — Resource exhausted - Some resource has been exhausted (rate limiting)
- `431` — Request header fields too large - Request metadata was too large
- `499` — Cancelled - The operation was cancelled by the client
- `500` — Internal - Internal server error
- `501` — Unimplemented - The operation is not implemented or supported
- `503` — Unavailable - The service is currently unavailable
- `504` — Deadline exceeded - Upstream service did not respond in time
- `529` — Overloaded - The service is temporarily overloaded

## Changes

- **2026-09-02** `4789294140a2` — 16 info
  - added the non-success response with the status `400`
  - added the non-success response with the status `401`
  - added the non-success response with the status `403`
  - added the non-success response with the status `404`
  - …12 more
- **2026-08-26** `942a11636c42` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/anthropics/apis/anthropic-api/changes/v1/organizations/external_keys?beta=true/post.md)

---

[API](https://skmtc.dev/anthropics/apis/anthropic-api.md) · [All operations](https://skmtc.dev/anthropics/apis/anthropic-api/llms.txt) · [OpenAPI document](https://skmtc.dev/anthropics/apis/anthropic-api/revisions/1bb7c7a0a4a9?raw)