{ "swagger": "2.0", "schemes": [ "https" ], "host": "management.azure.com", "info": { "description": "The Azure management API provides a RESTful set of web services that interact with Azure Key Vault.", "title": "KeyVaultManagementClient", "version": "2018-02-14", "x-apisguru-categories": [ "cloud" ], "x-logo": { "url": "https://api.apis.guru/v2/cache/logo/https_assets.onestore.ms_cdnfiles_onestorerolling-1606-01000_shell_v3_images_logo_microsoft.png" }, "x-origin": [ { "format": "swagger", "url": "https://raw.githubusercontent.com/Azure/azure-rest-api-specs/master/specification/keyvault/resource-manager/Microsoft.KeyVault/stable/2018-02-14/keyvault.json", "version": "2.0" } ], "x-preferred": false, "x-providerName": "azure.com", "x-serviceName": "keyvault", "x-tags": [ "Azure", "Microsoft" ] }, "consumes": [ "application/json" ], "produces": [ "application/json" ], "securityDefinitions": { "azure_auth": { "authorizationUrl": "https://login.microsoftonline.com/common/oauth2/authorize", "description": "Azure Active Directory OAuth2 Flow", "flow": "implicit", "scopes": { "user_impersonation": "impersonate your user account" }, "type": "oauth2" } }, "parameters": { "ApiVersionParameter": { "description": "Client Api Version.", "in": "query", "name": "api-version", "required": true, "type": "string" }, "SubscriptionIdParameter": { "description": "Subscription credentials which uniquely identify Microsoft Azure subscription. The subscription ID forms part of the URI for every service call.", "in": "path", "name": "subscriptionId", "required": true, "type": "string" } }, "paths": { "/subscriptions/{subscriptionId}/providers/Microsoft.KeyVault/checkNameAvailability": { "post": { "description": "Checks that the vault name is valid and is not already in use.", "operationId": "Vaults_CheckNameAvailability", "parameters": [ { "description": "The name of the vault.", "in": "body", "name": "vaultName", "required": true, "schema": { "$ref": "#/definitions/VaultCheckNameAvailabilityParameters" } }, { "$ref": "#/parameters/ApiVersionParameter" }, { "$ref": "#/parameters/SubscriptionIdParameter" } ], "responses": { "200": { "description": "OK -- Operation to check the vault name availability was successful.", "schema": { "$ref": "#/definitions/CheckNameAvailabilityResult" } } }, "tags": [ "Vaults" ], "x-ms-examples": { "Validate a vault name": { "parameters": { "api-version": "2018-02-14", "subscriptionId": "00000000-0000-0000-0000-000000000000", "vaultName": { "name": "sample-vault", "type": "Microsoft.KeyVault/vaults" } }, "responses": { "200": { "body": { "nameAvailable": true } } } } } } }, "/subscriptions/{subscriptionId}/providers/Microsoft.KeyVault/deletedVaults": { "get": { "description": "Gets information about the deleted vaults in a subscription.", "operationId": "Vaults_ListDeleted", "parameters": [ { "$ref": "#/parameters/ApiVersionParameter" }, { "$ref": "#/parameters/SubscriptionIdParameter" } ], "responses": { "200": { "description": "Retrieved information about all deleted key vaults in a subscription.", "schema": { "$ref": "#/definitions/DeletedVaultListResult" } } }, "tags": [ "Vaults" ], "x-ms-examples": { "List deleted vaults in the specified subscription": { "parameters": { "$top": 1, "api-version": "2018-02-14", "subscriptionId": "00000000-0000-0000-0000-000000000000" }, "responses": { "200": { "body": { "nextLink": "https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.KeyVault/deletedVaults?api-version=2018-02-14&%24skiptoken=HY3RaoMwAEX%2fRcbeYhJrnRXKYNWOuqpME0sfNcYui0Yxade19N8ne7hcDlzOvVuKX81eKKmt4G4dooLQwgqsL2NGHUDYV6o68Z4rY1e388RtNvRQn2vNJjEaMSgNvcbneMUcsKg8BFwft8DndQ0w9hu2QOiFLRs4TsNFNHzSMBFsGvTQGvuD%2f5bVuTOw4R03vPkH%2fVqNAlzm5SxfOwh7ACOA8POTlvPjILlaU1ke8jImOc23JCppQVfZnna0DXc4ISc3vSVuRo5zJE6%2bj25C3vwk2v2kEV2mMn7PyOc1DbtNGkonnzuLym1G400uI5QRZj0efw%3d%3d", "value": [ { "id": "/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.KeyVault/locations/westus/deletedVaults/sample-vault", "name": "vault-agile-drawer-6404", "properties": { "deletionDate": "2017-01-01T00:00:59Z", "location": "westus", "scheduledPurgeDate": "2017-04-01T00:00:59Z", "tags": {}, "vaultId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/sample-group/providers/Microsoft.KeyVault/vaults/sample-vault" }, "type": "Microsoft.KeyVault/deletedVaults" } ] } } } } }, "x-ms-pageable": { "nextLinkName": "nextLink" } } }, "/subscriptions/{subscriptionId}/providers/Microsoft.KeyVault/locations/{location}/deletedVaults/{vaultName}": { "get": { "description": "Gets the deleted Azure key vault.", "operationId": "Vaults_GetDeleted", "parameters": [ { "description": "The name of the vault.", "in": "path", "name": "vaultName", "required": true, "type": "string" }, { "description": "The location of the deleted vault.", "in": "path", "name": "location", "required": true, "type": "string" }, { "$ref": "#/parameters/ApiVersionParameter" }, { "$ref": "#/parameters/SubscriptionIdParameter" } ], "responses": { "200": { "description": "Retrieved information about the deleted vault.", "schema": { "$ref": "#/definitions/DeletedVault" } } }, "tags": [ "Vaults" ], "x-ms-examples": { "Retrieve a deleted vault": { "parameters": { "api-version": "2018-02-14", "location": "westus", "subscriptionId": "00000000-0000-0000-0000-000000000000", "vaultName": "sample-vault" }, "responses": { "200": { "body": { "id": "/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.KeyVault/locations/westus/deletedVaults/sample-vault", "name": "sample-vault", "properties": { "deletionDate": "2017-01-01T00:00:59Z", "location": "westus", "scheduledPurgeDate": "2017-04-01T00:00:59Z", "tags": {}, "vaultId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/sample-group/providers/Microsoft.KeyVault/vaults/sample-vault" }, "type": "Microsoft.KeyVault/deletedVaults" }, "headers": {} } } } } } }, "/subscriptions/{subscriptionId}/providers/Microsoft.KeyVault/locations/{location}/deletedVaults/{vaultName}/purge": { "post": { "description": "Permanently deletes the specified vault. aka Purges the deleted Azure key vault.", "operationId": "Vaults_PurgeDeleted", "parameters": [ { "description": "The name of the soft-deleted vault.", "in": "path", "name": "vaultName", "required": true, "type": "string" }, { "description": "The location of the soft-deleted vault.", "in": "path", "name": "location", "required": true, "type": "string" }, { "$ref": "#/parameters/ApiVersionParameter" }, { "$ref": "#/parameters/SubscriptionIdParameter" } ], "responses": { "200": { "description": "The vault is purged." }, "202": { "description": "Vault is being purged." } }, "tags": [ "Vaults" ], "x-ms-examples": { "Purge a deleted vault": { "parameters": { "api-version": "2018-02-14", "location": "westus", "subscriptionId": "00000000-0000-0000-0000-000000000000", "vaultName": "sample-vault" }, "responses": { "200": { "body": "" }, "202": { "body": "" } } } }, "x-ms-long-running-operation": true } }, "/subscriptions/{subscriptionId}/providers/Microsoft.KeyVault/vaults": { "get": { "description": "The List operation gets information about the vaults associated with the subscription.", "operationId": "Vaults_ListBySubscription", "parameters": [ { "description": "Maximum number of results to return.", "format": "int32", "in": "query", "name": "$top", "type": "integer" }, { "$ref": "#/parameters/ApiVersionParameter" }, { "$ref": "#/parameters/SubscriptionIdParameter" } ], "responses": { "200": { "description": "Get information about all key vaults in the specified subscription.", "schema": { "$ref": "#/definitions/VaultListResult" } } }, "tags": [ "Vaults" ], "x-ms-examples": { "List vaults in the specified subscription": { "parameters": { "$top": 1, "api-version": "2018-02-14", "subscriptionId": "00000000-0000-0000-0000-000000000000" }, "responses": { "200": { "body": { "nextLink": "https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resources?api-version=22018-02-14&$skiptoken=dmF1bHQtcGVza3ktanVyeS03MzA3Ng==", "value": [ { "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/sample-group/providers/Microsoft.KeyVault/vaults/sample-vault", "location": "westus", "name": "sample-vault", "properties": { "accessPolicies": [ { "objectId": "00000000-0000-0000-0000-000000000000", "permissions": { "certificates": [ "get", "list", "delete", "create", "import", "update", "managecontacts", "getissuers", "listissuers", "setissuers", "deleteissuers", "manageissuers", "recover", "purge" ], "keys": [ "encrypt", "decrypt", "wrapKey", "unwrapKey", "sign", "verify", "get", "list", "create", "update", "import", "delete", "backup", "restore", "recover", "purge" ], "secrets": [ "get", "list", "set", "delete", "backup", "restore", "recover", "purge" ] }, "tenantId": "00000000-0000-0000-0000-000000000000" } ], "enableSoftDelete": true, "enabledForDeployment": true, "enabledForDiskEncryption": true, "enabledForTemplateDeployment": true, "sku": { "family": "A", "name": "premium" }, "tenantId": "00000000-0000-0000-0000-000000000000", "vaultUri": "https://sample-vault.vault.azure.net/" }, "tags": {}, "type": "Microsoft.KeyVault/vaults" } ] } } } } }, "x-ms-pageable": { "nextLinkName": "nextLink" } } }, "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.KeyVault/vaults": { "get": { "description": "The List operation gets information about the vaults associated with the subscription and within the specified resource group.", "operationId": "Vaults_ListByResourceGroup", "parameters": [ { "description": "The name of the Resource Group to which the vault belongs.", "in": "path", "name": "resourceGroupName", "required": true, "type": "string" }, { "description": "Maximum number of results to return.", "format": "int32", "in": "query", "name": "$top", "type": "integer" }, { "$ref": "#/parameters/ApiVersionParameter" }, { "$ref": "#/parameters/SubscriptionIdParameter" } ], "responses": { "200": { "description": "Get information about all key vaults in the specified resource group.", "schema": { "$ref": "#/definitions/VaultListResult" } } }, "tags": [ "Vaults" ], "x-ms-examples": { "List vaults in the specified resource group": { "parameters": { "$top": 1, "api-version": "2018-02-14", "resourceGroupName": "sample-group", "subscriptionId": "00000000-0000-0000-0000-000000000000" }, "responses": { "200": { "body": { "nextLink": "https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/sample-group/providers/Microsoft.KeyVault/vaults?api-version=2018-02-14&$skiptoken=dmF1bHQtcGVza3ktanVyeS03MzA3Ng==", "value": [ { "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/sample-group/providers/Microsoft.KeyVault/vaults/sample-vault", "location": "westus", "name": "sample-vault", "properties": { "accessPolicies": [ { "objectId": "00000000-0000-0000-0000-000000000000", "permissions": { "certificates": [ "get", "list", "delete", "create", "import", "update", "managecontacts", "getissuers", "listissuers", "setissuers", "deleteissuers", "manageissuers", "recover", "purge" ], "keys": [ "encrypt", "decrypt", "wrapKey", "unwrapKey", "sign", "verify", "get", "list", "create", "update", "import", "delete", "backup", "restore", "recover", "purge" ], "secrets": [ "get", "list", "set", "delete", "backup", "restore", "recover", "purge" ] }, "tenantId": "00000000-0000-0000-0000-000000000000" } ], "enableSoftDelete": true, "enabledForDeployment": true, "enabledForDiskEncryption": true, "enabledForTemplateDeployment": true, "sku": { "family": "A", "name": "premium" }, "tenantId": "00000000-0000-0000-0000-000000000000", "vaultUri": "https://sample-vault.vault.azure.net/" }, "tags": {}, "type": "Microsoft.KeyVault/vaults" } ] } } } } }, "x-ms-pageable": { "nextLinkName": "nextLink" } } }, "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.KeyVault/vaults/{vaultName}": { "delete": { "description": "Deletes the specified Azure key vault.", "operationId": "Vaults_Delete", "parameters": [ { "description": "The name of the Resource Group to which the vault belongs.", "in": "path", "name": "resourceGroupName", "required": true, "type": "string" }, { "description": "The name of the vault to delete", "in": "path", "name": "vaultName", "required": true, "type": "string" }, { "$ref": "#/parameters/ApiVersionParameter" }, { "$ref": "#/parameters/SubscriptionIdParameter" } ], "responses": { "200": { "description": "OK Response." } }, "tags": [ "Vaults" ], "x-ms-examples": { "Delete a vault": { "parameters": { "api-version": "2018-02-14", "resourceGroupName": "sample-resource-group", "subscriptionId": "00000000-0000-0000-0000-000000000000", "vaultName": "sample-vault" }, "responses": { "200": { "body": "", "headers": {} } } } } }, "get": { "description": "Gets the specified Azure key vault.", "operationId": "Vaults_Get", "parameters": [ { "description": "The name of the Resource Group to which the vault belongs.", "in": "path", "name": "resourceGroupName", "required": true, "type": "string" }, { "description": "The name of the vault.", "in": "path", "name": "vaultName", "required": true, "type": "string" }, { "$ref": "#/parameters/ApiVersionParameter" }, { "$ref": "#/parameters/SubscriptionIdParameter" } ], "responses": { "200": { "description": "Retrieved vault", "schema": { "$ref": "#/definitions/Vault" } } }, "tags": [ "Vaults" ], "x-ms-examples": { "Retrieve a vault": { "parameters": { "api-version": "2018-02-14", "resourceGroupName": "sample-resource-group", "subscriptionId": "00000000-0000-0000-0000-000000000000", "vaultName": "sample-vault" }, "responses": { "200": { "body": { "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/sample-resource-group/providers/Microsoft.KeyVault/vaults/sample-vault", "location": "westus", "name": "sample-vault", "properties": { "accessPolicies": [ { "objectId": "00000000-0000-0000-0000-000000000000", "permissions": { "certificates": [ "get", "list", "delete", "create", "import", "update", "managecontacts", "getissuers", "listissuers", "setissuers", "deleteissuers", "manageissuers", "recover", "purge" ], "keys": [ "encrypt", "decrypt", "wrapKey", "unwrapKey", "sign", "verify", "get", "list", "create", "update", "import", "delete", "backup", "restore", "recover", "purge" ], "secrets": [ "get", "list", "set", "delete", "backup", "restore", "recover", "purge" ] }, "tenantId": "00000000-0000-0000-0000-000000000000" } ], "enabledForDeployment": true, "enabledForDiskEncryption": true, "enabledForTemplateDeployment": true, "sku": { "family": "A", "name": "standard" }, "tenantId": "00000000-0000-0000-0000-000000000000", "vaultUri": "https://sample-vault.vault.azure.net" }, "tags": {}, "type": "Microsoft.KeyVault/vaults" } } } } } }, "patch": { "description": "Update a key vault in the specified subscription.", "operationId": "Vaults_Update", "parameters": [ { "description": "The name of the Resource Group to which the server belongs.", "in": "path", "name": "resourceGroupName", "required": true, "type": "string" }, { "description": "Name of the vault", "in": "path", "name": "vaultName", "pattern": "^[a-zA-Z0-9-]{3,24}$", "required": true, "type": "string" }, { "$ref": "#/parameters/ApiVersionParameter" }, { "description": "Parameters to patch the vault", "in": "body", "name": "parameters", "required": true, "schema": { "$ref": "#/definitions/VaultPatchParameters" } }, { "$ref": "#/parameters/SubscriptionIdParameter" } ], "responses": { "200": { "description": "Patched vault", "schema": { "$ref": "#/definitions/Vault" } }, "201": { "description": "Patched vault", "schema": { "$ref": "#/definitions/Vault" } } }, "tags": [ "Vaults" ], "x-ms-examples": { "Update an existing vault": { "parameters": { "api-version": "2018-02-14", "parameters": { "properties": { "accessPolicies": [ { "objectId": "00000000-0000-0000-0000-000000000000", "permissions": { "certificates": [ "get", "list", "delete", "create", "import", "update", "managecontacts", "getissuers", "listissuers", "setissuers", "deleteissuers", "manageissuers", "recover", "purge" ], "keys": [ "encrypt", "decrypt", "wrapKey", "unwrapKey", "sign", "verify", "get", "list", "create", "update", "import", "delete", "backup", "restore", "recover", "purge" ], "secrets": [ "get", "list", "set", "delete", "backup", "restore", "recover", "purge" ] }, "tenantId": "00000000-0000-0000-0000-000000000000" } ], "enabledForDeployment": true, "enabledForDiskEncryption": true, "enabledForTemplateDeployment": true, "sku": { "family": "A", "name": "standard" }, "tenantId": "00000000-0000-0000-0000-000000000000" } }, "resourceGroupName": "sample-resource-group", "subscriptionId": "00000000-0000-0000-0000-000000000000", "vaultName": "sample-vault" }, "responses": { "200": { "body": { "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/sample-resource-group/providers/Microsoft.KeyVault/vaults/sample-vault", "location": "westus", "name": "sample-vault", "properties": { "accessPolicies": [ { "objectId": "00000000-0000-0000-0000-000000000000", "permissions": { "certificates": [ "get", "list", "delete", "create", "import", "update", "managecontacts", "getissuers", "listissuers", "setissuers", "deleteissuers", "manageissuers", "recover", "purge" ], "keys": [ "encrypt", "decrypt", "wrapKey", "unwrapKey", "sign", "verify", "get", "list", "create", "update", "import", "delete", "backup", "restore", "recover", "purge" ], "secrets": [ "get", "list", "set", "delete", "backup", "restore", "recover", "purge" ] }, "tenantId": "00000000-0000-0000-0000-000000000000" } ], "enabledForDeployment": true, "enabledForDiskEncryption": true, "enabledForTemplateDeployment": true, "sku": { "family": "A", "name": "standard" }, "tenantId": "00000000-0000-0000-0000-000000000000", "vaultUri": "https://sample-vault.vault.azure.net" }, "tags": {}, "type": "Microsoft.KeyVault/vaults" } }, "201": { "body": { "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/sample-resource-group/providers/Microsoft.KeyVault/vaults/sample-vault", "location": "westus", "name": "sample-vault", "properties": { "accessPolicies": [ { "objectId": "00000000-0000-0000-0000-000000000000", "permissions": { "certificates": [ "get", "list", "delete", "create", "import", "update", "managecontacts", "getissuers", "listissuers", "setissuers", "deleteissuers", "manageissuers", "recover", "purge" ], "keys": [ "encrypt", "decrypt", "wrapKey", "unwrapKey", "sign", "verify", "get", "list", "create", "update", "import", "delete", "backup", "restore", "recover", "purge" ], "secrets": [ "get", "list", "set", "delete", "backup", "restore", "recover", "purge" ] }, "tenantId": "00000000-0000-0000-0000-000000000000" } ], "enabledForDeployment": true, "enabledForDiskEncryption": true, "enabledForTemplateDeployment": true, "sku": { "family": "A", "name": "standard" }, "tenantId": "00000000-0000-0000-0000-000000000000", "vaultUri": "https://sample-vault.vault.azure.net" }, "tags": {}, "type": "Microsoft.KeyVault/vaults" } } } } } }, "put": { "description": "Create or update a key vault in the specified subscription.", "operationId": "Vaults_CreateOrUpdate", "parameters": [ { "description": "The name of the Resource Group to which the server belongs.", "in": "path", "name": "resourceGroupName", "required": true, "type": "string" }, { "description": "Name of the vault", "in": "path", "name": "vaultName", "pattern": "^[a-zA-Z0-9-]{3,24}$", "required": true, "type": "string" }, { "$ref": "#/parameters/ApiVersionParameter" }, { "description": "Parameters to create or update the vault", "in": "body", "name": "parameters", "required": true, "schema": { "$ref": "#/definitions/VaultCreateOrUpdateParameters" } }, { "$ref": "#/parameters/SubscriptionIdParameter" } ], "responses": { "200": { "description": "Created or updated vault", "schema": { "$ref": "#/definitions/Vault" } }, "201": { "description": "Created or updated vault", "schema": { "$ref": "#/definitions/Vault" } } }, "tags": [ "Vaults" ], "x-ms-examples": { "Create a new vault or update an existing vault": { "parameters": { "api-version": "2018-02-14", "parameters": { "location": "westus", "properties": { "accessPolicies": [ { "objectId": "00000000-0000-0000-0000-000000000000", "permissions": { "certificates": [ "get", "list", "delete", "create", "import", "update", "managecontacts", "getissuers", "listissuers", "setissuers", "deleteissuers", "manageissuers", "recover", "purge" ], "keys": [ "encrypt", "decrypt", "wrapKey", "unwrapKey", "sign", "verify", "get", "list", "create", "update", "import", "delete", "backup", "restore", "recover", "purge" ], "secrets": [ "get", "list", "set", "delete", "backup", "restore", "recover", "purge" ] }, "tenantId": "00000000-0000-0000-0000-000000000000" } ], "enabledForDeployment": true, "enabledForDiskEncryption": true, "enabledForTemplateDeployment": true, "sku": { "family": "A", "name": "standard" }, "tenantId": "00000000-0000-0000-0000-000000000000" } }, "resourceGroupName": "sample-resource-group", "subscriptionId": "00000000-0000-0000-0000-000000000000", "vaultName": "sample-vault" }, "responses": { "200": { "body": { "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/sample-resource-group/providers/Microsoft.KeyVault/vaults/sample-vault", "location": "westus", "name": "sample-vault", "properties": { "accessPolicies": [ { "objectId": "00000000-0000-0000-0000-000000000000", "permissions": { "certificates": [ "get", "list", "delete", "create", "import", "update", "managecontacts", "getissuers", "listissuers", "setissuers", "deleteissuers", "manageissuers", "recover", "purge" ], "keys": [ "encrypt", "decrypt", "wrapKey", "unwrapKey", "sign", "verify", "get", "list", "create", "update", "import", "delete", "backup", "restore", "recover", "purge" ], "secrets": [ "get", "list", "set", "delete", "backup", "restore", "recover", "purge" ] }, "tenantId": "00000000-0000-0000-0000-000000000000" } ], "enabledForDeployment": true, "enabledForDiskEncryption": true, "enabledForTemplateDeployment": true, "sku": { "family": "A", "name": "standard" }, "tenantId": "00000000-0000-0000-0000-000000000000", "vaultUri": "https://sample-vault.vault.azure.net" }, "tags": {}, "type": "Microsoft.KeyVault/vaults" } }, "201": { "body": { "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/sample-resource-group/providers/Microsoft.KeyVault/vaults/sample-vault", "location": "westus", "name": "sample-vault", "properties": { "accessPolicies": [ { "objectId": "00000000-0000-0000-0000-000000000000", "permissions": { "certificates": [ "get", "list", "delete", "create", "import", "update", "managecontacts", "getissuers", "listissuers", "setissuers", "deleteissuers", "manageissuers", "recover", "purge" ], "keys": [ "encrypt", "decrypt", "wrapKey", "unwrapKey", "sign", "verify", "get", "list", "create", "update", "import", "delete", "backup", "restore", "recover", "purge" ], "secrets": [ "get", "list", "set", "delete", "backup", "restore", "recover", "purge" ] }, "tenantId": "00000000-0000-0000-0000-000000000000" } ], "enabledForDeployment": true, "enabledForDiskEncryption": true, "enabledForTemplateDeployment": true, "sku": { "family": "A", "name": "standard" }, "tenantId": "00000000-0000-0000-0000-000000000000", "vaultUri": "https://sample-vault.vault.azure.net" }, "tags": {}, "type": "Microsoft.KeyVault/vaults" } } } }, "Create or update a vault with network acls": { "parameters": { "api-version": "2018-02-14", "parameters": { "location": "westus", "properties": { "enabledForDeployment": true, "enabledForDiskEncryption": true, "enabledForTemplateDeployment": true, "networkAcls": { "bypass": "AzureServices", "defaultAction": "Deny", "ipRules": [ { "value": "124.56.78.91" }, { "value": "'10.91.4.0/24'" } ], "virtualNetworkRules": [ { "id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1" } ] }, "sku": { "family": "A", "name": "standard" }, "tenantId": "00000000-0000-0000-0000-000000000000" } }, "resourceGroupName": "sample-resource-group", "subscriptionId": "00000000-0000-0000-0000-000000000000", "vaultName": "sample-vault" }, "responses": { "200": { "body": { "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/sample-resource-group/providers/Microsoft.KeyVault/vaults/sample-vault", "location": "westus", "name": "sample-vault", "properties": { "enabledForDeployment": true, "enabledForDiskEncryption": true, "enabledForTemplateDeployment": true, "networkAcls": { "bypass": "AzureServices", "defaultAction": "Deny", "ipRules": [ { "value": "124.56.78.91/32" }, { "value": "'10.91.4.0/24'" } ], "virtualNetworkRules": [ { "id": "/subscriptions/subid/resourcegroups/rg1/providers/microsoft.network/virtualnetworks/test-vnet/subnets/subnet1" } ] }, "sku": { "family": "A", "name": "standard" }, "tenantId": "00000000-0000-0000-0000-000000000000", "vaultUri": "https://sample-vault.vault.azure.net" }, "tags": {}, "type": "Microsoft.KeyVault/vaults" } }, "201": { "body": { "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/sample-resource-group/providers/Microsoft.KeyVault/vaults/sample-vault", "location": "westus", "name": "sample-vault", "properties": { "enabledForDeployment": true, "enabledForDiskEncryption": true, "enabledForTemplateDeployment": true, "networkAcls": { "bypass": "AzureServices", "defaultAction": "Deny", "ipRules": [ { "value": "124.56.78.91/32" }, { "value": "'10.91.4.0/24'" } ], "virtualNetworkRules": [ { "id": "/subscriptions/subid/resourcegroups/rg1/providers/microsoft.network/virtualnetworks/test-vnet/subnets/subnet1" } ] }, "sku": { "family": "A", "name": "standard" }, "tenantId": "00000000-0000-0000-0000-000000000000", "vaultUri": "https://sample-vault.vault.azure.net" }, "tags": {}, "type": "Microsoft.KeyVault/vaults" } } } } }, "x-ms-long-running-operation": true } }, "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.KeyVault/vaults/{vaultName}/accessPolicies/{operationKind}": { "put": { "description": "Update access policies in a key vault in the specified subscription.", "operationId": "Vaults_UpdateAccessPolicy", "parameters": [ { "description": "The name of the Resource Group to which the vault belongs.", "in": "path", "name": "resourceGroupName", "required": true, "type": "string" }, { "description": "Name of the vault", "in": "path", "name": "vaultName", "pattern": "^[a-zA-Z0-9-]{3,24}$", "required": true, "type": "string" }, { "description": "Name of the operation", "enum": [ "add", "replace", "remove" ], "in": "path", "name": "operationKind", "required": true, "type": "string", "x-ms-enum": { "modelAsString": false, "name": "AccessPolicyUpdateKind" } }, { "$ref": "#/parameters/ApiVersionParameter" }, { "description": "Access policy to merge into the vault", "in": "body", "name": "parameters", "required": true, "schema": { "$ref": "#/definitions/VaultAccessPolicyParameters" } }, { "$ref": "#/parameters/SubscriptionIdParameter" } ], "responses": { "200": { "description": "The updated access policies", "schema": { "$ref": "#/definitions/VaultAccessPolicyParameters" } }, "201": { "description": "The updated access policies", "schema": { "$ref": "#/definitions/VaultAccessPolicyParameters" } } }, "tags": [ "Vaults" ], "x-ms-examples": { "Add an access policy, or update an access policy with new permissions": { "parameters": { "api-version": "2018-02-14", "operationKind": "add", "parameters": { "properties": { "accessPolicies": [ { "objectId": "00000000-0000-0000-0000-000000000000", "permissions": { "certificates": [ "get" ], "keys": [ "encrypt" ], "secrets": [ "get" ] }, "tenantId": "00000000-0000-0000-0000-000000000000" } ] } }, "resourceGroupName": "sample-group", "subscriptionId": "00000000-0000-0000-0000-000000000000", "vaultName": "sample-vault" }, "responses": { "200": { "body": { "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/sample-group/providers/Microsoft.KeyVault/vaults/sample-vault/accessPolicies/", "properties": { "accessPolicies": [ { "objectId": "00000000-0000-0000-0000-000000000000", "permissions": { "certificates": [ "get" ], "keys": [ "encrypt" ], "secrets": [ "get" ] }, "tenantId": "00000000-0000-0000-0000-000000000000" } ] }, "type": "Microsoft.KeyVault/vaults/accessPolicies" } }, "201": { "body": { "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/sample-group/providers/Microsoft.KeyVault/vaults/sample-vault/accessPolicies/", "properties": { "accessPolicies": [ { "objectId": "00000000-0000-0000-0000-000000000000", "permissions": { "certificates": [ "get" ], "keys": [ "encrypt" ], "secrets": [ "get" ] }, "tenantId": "00000000-0000-0000-0000-000000000000" } ] }, "type": "Microsoft.KeyVault/vaults/accessPolicies" } } } } } } }, "/subscriptions/{subscriptionId}/resources": { "get": { "description": "The List operation gets information about the vaults associated with the subscription.", "operationId": "Vaults_List", "parameters": [ { "description": "The filter to apply on the operation.", "enum": [ "resourceType eq 'Microsoft.KeyVault/vaults'" ], "in": "query", "name": "$filter", "required": true, "type": "string" }, { "description": "Maximum number of results to return.", "format": "int32", "in": "query", "name": "$top", "type": "integer" }, { "description": "Azure Resource Manager Api Version.", "enum": [ "2015-11-01" ], "in": "query", "name": "api-version", "required": true, "type": "string" }, { "$ref": "#/parameters/SubscriptionIdParameter" } ], "responses": { "200": { "description": "Get information about all key vaults in the subscription.", "schema": { "$ref": "#/definitions/ResourceListResult" } } }, "tags": [ "Vaults" ], "x-ms-examples": { "List vaults in the specified subscription": { "parameters": { "$filter": "resourceType eq 'Microsoft.KeyVault/vaults'", "$top": 1, "api-version": "2015-11-01", "subscriptionId": "00000000-0000-0000-0000-000000000000" }, "responses": { "200": { "body": { "nextLink": "https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resources?%24filter=resourceType+eq+%27Microsoft.KeyVault%2fvaults%27&%24top=4&api-version=2015-11-01&%24skiptoken=eyJuZXh0UGFydGl0aW9uS2V5IjoiMSE4IVEwTTJNVGMtIiwibmV4dFJvd0tleSI6IjEhMTMyIU5rUTRSVEU1UXpJelFUWXdORGd4UmpoRlFrSXhNVGhFUXpNd01EZEROVVJmVkVkT1RDMU5TVU5TVDFOUFJsUTZNa1ZMUlZsV1FWVk1WRG95UmxaQlZVeFVVeTFUVTFKSExVcEpUVG95UkZSRlUxUTZNa1JXUVZWTVZDMVhSVk5VVlZNLSJ9", "value": [ { "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/sample-group/providers/Microsoft.KeyVault/vaults/sample-vault", "location": "westus", "name": "sample-vault", "tags": {}, "type": "Microsoft.KeyVault/vaults" } ] } } } } }, "x-ms-pageable": { "nextLinkName": "nextLink" } } } }, "definitions": { "AccessPolicyEntry": { "description": "An identity that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID.", "properties": { "applicationId": { "description": " Application ID of the client making request on behalf of a principal", "format": "uuid", "type": "string" }, "objectId": { "description": "The object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies.", "type": "string" }, "permissions": { "$ref": "#/definitions/Permissions", "description": "Permissions the identity has for keys, secrets and certificates." }, "tenantId": { "description": "The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.", "format": "uuid", "type": "string" } }, "required": [ "tenantId", "objectId", "permissions" ] }, "CheckNameAvailabilityResult": { "description": "The CheckNameAvailability operation response.", "properties": { "message": { "description": "An error message explaining the Reason value in more detail.", "readOnly": true, "type": "string" }, "nameAvailable": { "description": "A boolean value that indicates whether the name is available for you to use. If true, the name is available. If false, the name has already been taken or is invalid and cannot be used.", "readOnly": true, "type": "boolean" }, "reason": { "description": "The reason that a vault name could not be used. The Reason element is only returned if NameAvailable is false.", "enum": [ "AccountNameInvalid", "AlreadyExists" ], "readOnly": true, "type": "string", "x-ms-enum": { "modelAsString": false, "name": "Reason" } } } }, "DeletedVault": { "description": "Deleted vault information with extended details.", "properties": { "id": { "description": "The resource ID for the deleted key vault.", "readOnly": true, "type": "string" }, "name": { "description": "The name of the key vault.", "readOnly": true, "type": "string" }, "properties": { "$ref": "#/definitions/DeletedVaultProperties", "description": "Properties of the vault" }, "type": { "description": "The resource type of the key vault.", "readOnly": true, "type": "string" } } }, "DeletedVaultListResult": { "description": "List of vaults", "properties": { "nextLink": { "description": "The URL to get the next set of deleted vaults.", "type": "string" }, "value": { "description": "The list of deleted vaults.", "items": { "$ref": "#/definitions/DeletedVault" }, "type": "array" } } }, "DeletedVaultProperties": { "description": "Properties of the deleted vault.", "properties": { "deletionDate": { "description": "The deleted date.", "format": "date-time", "readOnly": true, "type": "string" }, "location": { "description": "The location of the original vault.", "readOnly": true, "type": "string" }, "scheduledPurgeDate": { "description": "The scheduled purged date.", "format": "date-time", "readOnly": true, "type": "string" }, "tags": { "additionalProperties": { "type": "string" }, "description": "Tags of the original vault.", "readOnly": true, "type": "object" }, "vaultId": { "description": "The resource id of the original vault.", "readOnly": true, "type": "string" } } }, "IPRule": { "description": "A rule governing the accessibility of a vault from a specific ip address or ip range.", "properties": { "value": { "description": "An IPv4 address range in CIDR notation, such as '124.56.78.91' (simple IP address) or '124.56.78.0/24' (all addresses that start with 124.56.78).", "type": "string" } }, "required": [ "value" ] }, "NetworkRuleSet": { "description": "A set of rules governing the network accessibility of a vault.", "properties": { "bypass": { "description": "Tells what traffic can bypass network rules. This can be 'AzureServices' or 'None'. If not specified the default is 'AzureServices'.", "enum": [ "AzureServices", "None" ], "type": "string", "x-ms-enum": { "modelAsString": true, "name": "NetworkRuleBypassOptions" } }, "defaultAction": { "description": "The default action when no rule from ipRules and from virtualNetworkRules match. This is only used after the bypass property has been evaluated.", "enum": [ "Allow", "Deny" ], "type": "string", "x-ms-enum": { "modelAsString": true, "name": "NetworkRuleAction" } }, "ipRules": { "description": "The list of IP address rules.", "items": { "$ref": "#/definitions/IPRule" }, "type": "array" }, "virtualNetworkRules": { "description": "The list of virtual network rules.", "items": { "$ref": "#/definitions/VirtualNetworkRule" }, "type": "array" } } }, "Permissions": { "description": "Permissions the identity has for keys, secrets, certificates and storage.", "properties": { "certificates": { "description": "Permissions to certificates", "items": { "enum": [ "get", "list", "delete", "create", "import", "update", "managecontacts", "getissuers", "listissuers", "setissuers", "deleteissuers", "manageissuers", "recover", "purge", "backup", "restore" ], "type": "string", "x-ms-enum": { "modelAsString": true, "name": "CertificatePermissions" } }, "type": "array" }, "keys": { "description": "Permissions to keys", "items": { "enum": [ "encrypt", "decrypt", "wrapKey", "unwrapKey", "sign", "verify", "get", "list", "create", "update", "import", "delete", "backup", "restore", "recover", "purge" ], "type": "string", "x-ms-enum": { "modelAsString": true, "name": "KeyPermissions" } }, "type": "array" }, "secrets": { "description": "Permissions to secrets", "items": { "enum": [ "get", "list", "set", "delete", "backup", "restore", "recover", "purge" ], "type": "string", "x-ms-enum": { "modelAsString": true, "name": "SecretPermissions" } }, "type": "array" }, "storage": { "description": "Permissions to storage accounts", "items": { "enum": [ "get", "list", "delete", "set", "update", "regeneratekey", "recover", "purge", "backup", "restore", "setsas", "listsas", "getsas", "deletesas" ], "type": "string", "x-ms-enum": { "modelAsString": true, "name": "StoragePermissions" } }, "type": "array" } } }, "Resource": { "description": "Key Vault resource", "properties": { "id": { "description": "The Azure Resource Manager resource ID for the key vault.", "readOnly": true, "type": "string" }, "location": { "description": "The supported Azure location where the key vault should be created.", "type": "string" }, "name": { "description": "The name of the key vault.", "readOnly": true, "type": "string" }, "tags": { "additionalProperties": { "type": "string" }, "description": "The tags that will be assigned to the key vault. ", "type": "object" }, "type": { "description": "The resource type of the key vault.", "readOnly": true, "type": "string" } }, "required": [ "location" ], "x-ms-azure-resource": true }, "ResourceListResult": { "description": "List of vault resources.", "properties": { "nextLink": { "description": "The URL to get the next set of vault resources.", "type": "string" }, "value": { "description": "The list of vault resources.", "items": { "$ref": "#/definitions/Resource" }, "type": "array" } } }, "Sku": { "description": "SKU details", "properties": { "family": { "description": "SKU family name", "enum": [ "A" ], "type": "string", "x-ms-enum": { "modelAsString": true, "name": "SkuFamily" } }, "name": { "description": "SKU name to specify whether the key vault is a standard vault or a premium vault.", "enum": [ "standard", "premium" ], "type": "string", "x-ms-enum": { "modelAsString": false, "name": "SkuName" } } }, "required": [ "name", "family" ] }, "Vault": { "allOf": [ { "$ref": "#/definitions/Resource" } ], "description": "Resource information with extended details.", "properties": { "properties": { "$ref": "#/definitions/VaultProperties", "description": "Properties of the vault" } }, "required": [ "properties" ] }, "VaultAccessPolicyParameters": { "description": "Parameters for updating the access policy in a vault", "properties": { "id": { "description": "The resource id of the access policy.", "readOnly": true, "type": "string" }, "location": { "description": "The resource type of the access policy.", "readOnly": true, "type": "string" }, "name": { "description": "The resource name of the access policy.", "readOnly": true, "type": "string" }, "properties": { "$ref": "#/definitions/VaultAccessPolicyProperties", "description": "Properties of the access policy" }, "type": { "description": "The resource name of the access policy.", "readOnly": true, "type": "string" } }, "required": [ "properties" ], "x-ms-azure-resource": true }, "VaultAccessPolicyProperties": { "description": "Properties of the vault access policy", "properties": { "accessPolicies": { "description": "An array of 0 to 16 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID.", "items": { "$ref": "#/definitions/AccessPolicyEntry" }, "type": "array" } }, "required": [ "accessPolicies" ] }, "VaultCheckNameAvailabilityParameters": { "description": "The parameters used to check the availability of the vault name.", "properties": { "name": { "description": "The vault name.", "type": "string" }, "type": { "description": "The type of resource, Microsoft.KeyVault/vaults", "enum": [ "Microsoft.KeyVault/vaults" ], "type": "string", "x-ms-enum": { "modelAsString": false, "name": "Type" } } }, "required": [ "name", "type" ] }, "VaultCreateOrUpdateParameters": { "description": "Parameters for creating or updating a vault", "properties": { "location": { "description": "The supported Azure location where the key vault should be created.", "type": "string" }, "properties": { "$ref": "#/definitions/VaultProperties", "description": "Properties of the vault" }, "tags": { "additionalProperties": { "type": "string" }, "description": "The tags that will be assigned to the key vault.", "type": "object" } }, "required": [ "location", "properties" ], "x-ms-azure-resource": true }, "VaultListResult": { "description": "List of vaults", "properties": { "nextLink": { "description": "The URL to get the next set of vaults.", "type": "string" }, "value": { "description": "The list of vaults.", "items": { "$ref": "#/definitions/Vault" }, "type": "array" } } }, "VaultPatchParameters": { "description": "Parameters for creating or updating a vault", "properties": { "properties": { "$ref": "#/definitions/VaultPatchProperties", "description": "Properties of the vault" }, "tags": { "additionalProperties": { "type": "string" }, "description": "The tags that will be assigned to the key vault. ", "type": "object" } }, "x-ms-azure-resource": true }, "VaultPatchProperties": { "description": "Properties of the vault", "properties": { "accessPolicies": { "description": "An array of 0 to 16 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID.", "items": { "$ref": "#/definitions/AccessPolicyEntry" }, "type": "array" }, "createMode": { "description": "The vault's create mode to indicate whether the vault need to be recovered or not.", "enum": [ "recover", "default" ], "type": "string", "x-ms-enum": { "modelAsString": false, "name": "CreateMode" } }, "enablePurgeProtection": { "description": "Property specifying whether protection against purge is enabled for this vault. Setting this property to true activates protection against purge for this vault and its content - only the Key Vault service may initiate a hard, irrecoverable deletion. The setting is effective only if soft delete is also enabled. Enabling this functionality is irreversible - that is, the property does not accept false as its value.", "type": "boolean" }, "enableSoftDelete": { "description": "Property to specify whether the 'soft delete' functionality is enabled for this key vault. It does not accept false value.", "type": "boolean" }, "enabledForDeployment": { "description": "Property to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault.", "type": "boolean" }, "enabledForDiskEncryption": { "description": "Property to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.", "type": "boolean" }, "enabledForTemplateDeployment": { "description": "Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.", "type": "boolean" }, "networkAcls": { "$ref": "#/definitions/NetworkRuleSet", "description": "A collection of rules governing the accessibility of the vault from specific network locations." }, "sku": { "$ref": "#/definitions/Sku", "description": "SKU details" }, "tenantId": { "description": "The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.", "format": "uuid", "type": "string" } } }, "VaultProperties": { "description": "Properties of the vault", "properties": { "accessPolicies": { "description": "An array of 0 to 16 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID. When `createMode` is set to `recover`, access policies are not required. Otherwise, access policies are required.", "items": { "$ref": "#/definitions/AccessPolicyEntry" }, "type": "array" }, "createMode": { "description": "The vault's create mode to indicate whether the vault need to be recovered or not.", "enum": [ "recover", "default" ], "type": "string", "x-ms-enum": { "modelAsString": false, "name": "CreateMode" } }, "enablePurgeProtection": { "description": "Property specifying whether protection against purge is enabled for this vault. Setting this property to true activates protection against purge for this vault and its content - only the Key Vault service may initiate a hard, irrecoverable deletion. The setting is effective only if soft delete is also enabled. Enabling this functionality is irreversible - that is, the property does not accept false as its value.", "type": "boolean" }, "enableSoftDelete": { "description": "Property to specify whether the 'soft delete' functionality is enabled for this key vault. It does not accept false value.", "type": "boolean" }, "enabledForDeployment": { "description": "Property to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault.", "type": "boolean" }, "enabledForDiskEncryption": { "description": "Property to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.", "type": "boolean" }, "enabledForTemplateDeployment": { "description": "Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.", "type": "boolean" }, "networkAcls": { "$ref": "#/definitions/NetworkRuleSet", "description": "A collection of rules governing the accessibility of the vault from specific network locations." }, "sku": { "$ref": "#/definitions/Sku", "description": "SKU details" }, "tenantId": { "description": "The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.", "format": "uuid", "type": "string" }, "vaultUri": { "description": "The URI of the vault for performing operations on keys and secrets.", "type": "string" } }, "required": [ "tenantId", "sku" ] }, "VirtualNetworkRule": { "description": "A rule governing the accessibility of a vault from a specific virtual network.", "properties": { "id": { "description": "Full resource id of a vnet subnet, such as '/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1'.", "type": "string" } }, "required": [ "id" ] } } }