---
title: "Add an external key config for an organization"
method: POST
path: "/organization/external_keys"
---

# Add an external key config for an organization

`POST /organization/external_keys`

## Request

- Base URL: `https://api.openai.com/v1`
- URL: `https://api.openai.com/v1/organization/external_keys`
- Auth: HTTP bearer

Add an external key config for an organization

## Request body

- union
  - AwsExternalKeyParams
    - `name` string, required: A friendly name to identify this config
    - `type` 'aws', required
    - `role_arn` string, required: The Role ARN that OpenAI will assume to call your KMS
    - `kms_arn` string, required: The Key Management System ARN for the master key you manage
    - `external_id` string, required: The ExternalID that OpenAI will pass in the AssumeRole call for the customer's AWS account. This must be the OpenAI organization ID or an API project ID that belongs to the organization.
    - `purpose` 'ekm' | 'psp_decryption'
  - GcpExternalKeyParams
    - `name` string, required: A friendly name to identify this config
    - `type` 'gcp', required
    - `workload_identity_project_number` string, required: The numeric GCP project number where you registered OpenAI's workload identity
    - `workload_identity_pool_id` string, required: The pool containing the Workload Identity provider that you registered for OpenAI
    - `workload_identity_provider_id` string, required: The Workload Identity provider that you registered for OpenAI
    - `kms_project_id` string, required: The string GCP project name where your KMS resides
    - `kms_key_ring_name` string, required: The Key Management System key ring for the master key you manage
    - `kms_key_name` string, required: The name of the Key Management System master key you manage
    - `kms_key_location` string, required: The region where your Key Management System master key is located
    - `audience` string, required: The aud field in the identity token OpenAI will pass in the call to the customer's GCP STS. This must be the OpenAI organization ID or an API project ID that belongs to the organization.
    - `purpose` 'ekm' | 'psp_decryption'
    - `kms_key_version` string: An exact CryptoKeyVersion number. Required for PSP decryption; not accepted for EKM.
  - AzureExternalKeyParams
    - `name` string, required: A friendly name to identify this config
    - `type` 'azure', required
    - `tenant_id` string, required: Your Azure tenant UUID
    - `vault_uri` string, required: The URI of the Azure vault containing the master key you manage
    - `key_name` string, required: The name of the Azure Key Vault master key that you manage
    - `purpose` 'ekm' | 'psp_decryption'
    - `key_version` string: An exact Azure Key Vault key version. Required for PSP decryption; not accepted for EKM.

## Response `200`

Success

- ExternalKeyResource
  - `object` string, required
  - `id` string, required
  - `type` string, required
  - `purpose` 'ekm' | 'psp_decryption'
  - `name` string, required
  - `api_project_ids` string[], required
  - `workspace_id` string, required
  - `created_at` integer, required
  - `role_arn` string
  - `external_id` string
  - `kms_arn` string
  - `workload_identity_project_number` string
  - `workload_identity_pool_id` string
  - `workload_identity_provider_id` string
  - `audience` string
  - `kms_project_id` string
  - `kms_key_ring_name` string
  - `kms_key_name` string
  - `kms_key_location` string
  - `kms_key_version` string
  - `tenant_id` string
  - `vault_uri` string
  - `key_name` string
  - `key_version` string

## Changes

- **2026-10-28** `fdbca2edb862`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/omnistack-sh/apis/openai-api/changes/organization/external_keys/post.md)

---

[API](https://skmtc.dev/omnistack-sh/apis/openai-api.md) - [All operations](https://skmtc.dev/omnistack-sh/apis/openai-api/llms.txt) - [OpenAPI document](https://skmtc.dev/omnistack-sh/apis/openai-api/revisions/0a26f104d35f?raw)