swagger: "2.0"
schemes:
  - https
host: management.azure.com
info:
  description: The Azure management API provides a RESTful set of web services that interact with Azure Key Vault.
  title: KeyVaultManagementClient
  version: 2018-02-14
  x-apisguru-categories:
    - cloud
  x-logo:
    url: https://api.apis.guru/v2/cache/logo/https_assets.onestore.ms_cdnfiles_onestorerolling-1606-01000_shell_v3_images_logo_microsoft.png
  x-origin:
    - format: swagger
      url: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/master/specification/keyvault/resource-manager/Microsoft.KeyVault/stable/2018-02-14/keyvault.json
      version: "2.0"
  x-preferred: false
  x-providerName: azure.com
  x-serviceName: keyvault
  x-tags:
    - Azure
    - Microsoft
consumes:
  - application/json
produces:
  - application/json
securityDefinitions:
  azure_auth:
    authorizationUrl: https://login.microsoftonline.com/common/oauth2/authorize
    description: Azure Active Directory OAuth2 Flow
    flow: implicit
    scopes:
      user_impersonation: impersonate your user account
    type: oauth2
parameters:
  ApiVersionParameter:
    description: Client Api Version.
    in: query
    name: api-version
    required: true
    type: string
  SubscriptionIdParameter:
    description: Subscription credentials which uniquely identify Microsoft Azure subscription. The subscription ID forms part of the URI for every service call.
    in: path
    name: subscriptionId
    required: true
    type: string
paths:
  "/subscriptions/{subscriptionId}/providers/Microsoft.KeyVault/checkNameAvailability":
    post:
      description: Checks that the vault name is valid and is not already in use.
      operationId: Vaults_CheckNameAvailability
      parameters:
        - description: The name of the vault.
          in: body
          name: vaultName
          required: true
          schema:
            $ref: "#/definitions/VaultCheckNameAvailabilityParameters"
        - $ref: "#/parameters/ApiVersionParameter"
        - $ref: "#/parameters/SubscriptionIdParameter"
      responses:
        "200":
          description: OK -- Operation to check the vault name availability was successful.
          schema:
            $ref: "#/definitions/CheckNameAvailabilityResult"
      tags:
        - Vaults
      x-ms-examples:
        Validate a vault name:
          parameters:
            api-version: 2018-02-14
            subscriptionId: 00000000-0000-0000-0000-000000000000
            vaultName:
              name: sample-vault
              type: Microsoft.KeyVault/vaults
          responses:
            "200":
              body:
                nameAvailable: true
  "/subscriptions/{subscriptionId}/providers/Microsoft.KeyVault/deletedVaults":
    get:
      description: Gets information about the deleted vaults in a subscription.
      operationId: Vaults_ListDeleted
      parameters:
        - $ref: "#/parameters/ApiVersionParameter"
        - $ref: "#/parameters/SubscriptionIdParameter"
      responses:
        "200":
          description: Retrieved information about all deleted key vaults in a subscription.
          schema:
            $ref: "#/definitions/DeletedVaultListResult"
      tags:
        - Vaults
      x-ms-examples:
        List deleted vaults in the specified subscription:
          parameters:
            $top: 1
            api-version: 2018-02-14
            subscriptionId: 00000000-0000-0000-0000-000000000000
          responses:
            "200":
              body:
                nextLink: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.KeyVault/deletedVaults?api-version=2018-02-14&%24skiptoken=HY3RaoMwAEX%2fRcbeYhJrnRXKYNWOuqpME0sfNcYui0Yxade19N8ne7hcDlzOvVuKX81eKKmt4G4dooLQwgqsL2NGHUDYV6o68Z4rY1e388RtNvRQn2vNJjEaMSgNvcbneMUcsKg8BFwft8DndQ0w9hu2QOiFLRs4TsNFNHzSMBFsGvTQGvuD%2f5bVuTOw4R03vPkH%2fVqNAlzm5SxfOwh7ACOA8POTlvPjILlaU1ke8jImOc23JCppQVfZnna0DXc4ISc3vSVuRo5zJE6%2bj25C3vwk2v2kEV2mMn7PyOc1DbtNGkonnzuLym1G400uI5QRZj0efw%3d%3d
                value:
                  - id: /subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.KeyVault/locations/westus/deletedVaults/sample-vault
                    name: vault-agile-drawer-6404
                    properties:
                      deletionDate: 2017-01-01T00:00:59Z
                      location: westus
                      scheduledPurgeDate: 2017-04-01T00:00:59Z
                      tags: {}
                      vaultId: /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/sample-group/providers/Microsoft.KeyVault/vaults/sample-vault
                    type: Microsoft.KeyVault/deletedVaults
      x-ms-pageable:
        nextLinkName: nextLink
  "/subscriptions/{subscriptionId}/providers/Microsoft.KeyVault/locations/{location}/deletedVaults/{vaultName}":
    get:
      description: Gets the deleted Azure key vault.
      operationId: Vaults_GetDeleted
      parameters:
        - description: The name of the vault.
          in: path
          name: vaultName
          required: true
          type: string
        - description: The location of the deleted vault.
          in: path
          name: location
          required: true
          type: string
        - $ref: "#/parameters/ApiVersionParameter"
        - $ref: "#/parameters/SubscriptionIdParameter"
      responses:
        "200":
          description: Retrieved information about the deleted vault.
          schema:
            $ref: "#/definitions/DeletedVault"
      tags:
        - Vaults
      x-ms-examples:
        Retrieve a deleted vault:
          parameters:
            api-version: 2018-02-14
            location: westus
            subscriptionId: 00000000-0000-0000-0000-000000000000
            vaultName: sample-vault
          responses:
            "200":
              body:
                id: /subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.KeyVault/locations/westus/deletedVaults/sample-vault
                name: sample-vault
                properties:
                  deletionDate: 2017-01-01T00:00:59Z
                  location: westus
                  scheduledPurgeDate: 2017-04-01T00:00:59Z
                  tags: {}
                  vaultId: /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/sample-group/providers/Microsoft.KeyVault/vaults/sample-vault
                type: Microsoft.KeyVault/deletedVaults
              headers: {}
  "/subscriptions/{subscriptionId}/providers/Microsoft.KeyVault/locations/{location}/deletedVaults/{vaultName}/purge":
    post:
      description: Permanently deletes the specified vault. aka Purges the deleted Azure key vault.
      operationId: Vaults_PurgeDeleted
      parameters:
        - description: The name of the soft-deleted vault.
          in: path
          name: vaultName
          required: true
          type: string
        - description: The location of the soft-deleted vault.
          in: path
          name: location
          required: true
          type: string
        - $ref: "#/parameters/ApiVersionParameter"
        - $ref: "#/parameters/SubscriptionIdParameter"
      responses:
        "200":
          description: The vault is purged.
        "202":
          description: Vault is being purged.
      tags:
        - Vaults
      x-ms-examples:
        Purge a deleted vault:
          parameters:
            api-version: 2018-02-14
            location: westus
            subscriptionId: 00000000-0000-0000-0000-000000000000
            vaultName: sample-vault
          responses:
            "200":
              body: ""
            "202":
              body: ""
      x-ms-long-running-operation: true
  "/subscriptions/{subscriptionId}/providers/Microsoft.KeyVault/vaults":
    get:
      description: The List operation gets information about the vaults associated with the subscription.
      operationId: Vaults_ListBySubscription
      parameters:
        - description: Maximum number of results to return.
          format: int32
          in: query
          name: $top
          type: integer
        - $ref: "#/parameters/ApiVersionParameter"
        - $ref: "#/parameters/SubscriptionIdParameter"
      responses:
        "200":
          description: Get information about all key vaults in the specified subscription.
          schema:
            $ref: "#/definitions/VaultListResult"
      tags:
        - Vaults
      x-ms-examples:
        List vaults in the specified subscription:
          parameters:
            $top: 1
            api-version: 2018-02-14
            subscriptionId: 00000000-0000-0000-0000-000000000000
          responses:
            "200":
              body:
                nextLink: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resources?api-version=22018-02-14&$skiptoken=dmF1bHQtcGVza3ktanVyeS03MzA3Ng==
                value:
                  - id: /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/sample-group/providers/Microsoft.KeyVault/vaults/sample-vault
                    location: westus
                    name: sample-vault
                    properties:
                      accessPolicies:
                        - objectId: 00000000-0000-0000-0000-000000000000
                          permissions:
                            certificates:
                              - get
                              - list
                              - delete
                              - create
                              - import
                              - update
                              - managecontacts
                              - getissuers
                              - listissuers
                              - setissuers
                              - deleteissuers
                              - manageissuers
                              - recover
                              - purge
                            keys:
                              - encrypt
                              - decrypt
                              - wrapKey
                              - unwrapKey
                              - sign
                              - verify
                              - get
                              - list
                              - create
                              - update
                              - import
                              - delete
                              - backup
                              - restore
                              - recover
                              - purge
                            secrets:
                              - get
                              - list
                              - set
                              - delete
                              - backup
                              - restore
                              - recover
                              - purge
                          tenantId: 00000000-0000-0000-0000-000000000000
                      enableSoftDelete: true
                      enabledForDeployment: true
                      enabledForDiskEncryption: true
                      enabledForTemplateDeployment: true
                      sku:
                        family: A
                        name: premium
                      tenantId: 00000000-0000-0000-0000-000000000000
                      vaultUri: https://sample-vault.vault.azure.net/
                    tags: {}
                    type: Microsoft.KeyVault/vaults
      x-ms-pageable:
        nextLinkName: nextLink
  "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.KeyVault/vaults":
    get:
      description: The List operation gets information about the vaults associated with the subscription and within the specified resource group.
      operationId: Vaults_ListByResourceGroup
      parameters:
        - description: The name of the Resource Group to which the vault belongs.
          in: path
          name: resourceGroupName
          required: true
          type: string
        - description: Maximum number of results to return.
          format: int32
          in: query
          name: $top
          type: integer
        - $ref: "#/parameters/ApiVersionParameter"
        - $ref: "#/parameters/SubscriptionIdParameter"
      responses:
        "200":
          description: Get information about all key vaults in the specified resource group.
          schema:
            $ref: "#/definitions/VaultListResult"
      tags:
        - Vaults
      x-ms-examples:
        List vaults in the specified resource group:
          parameters:
            $top: 1
            api-version: 2018-02-14
            resourceGroupName: sample-group
            subscriptionId: 00000000-0000-0000-0000-000000000000
          responses:
            "200":
              body:
                nextLink: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/sample-group/providers/Microsoft.KeyVault/vaults?api-version=2018-02-14&$skiptoken=dmF1bHQtcGVza3ktanVyeS03MzA3Ng==
                value:
                  - id: /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/sample-group/providers/Microsoft.KeyVault/vaults/sample-vault
                    location: westus
                    name: sample-vault
                    properties:
                      accessPolicies:
                        - objectId: 00000000-0000-0000-0000-000000000000
                          permissions:
                            certificates:
                              - get
                              - list
                              - delete
                              - create
                              - import
                              - update
                              - managecontacts
                              - getissuers
                              - listissuers
                              - setissuers
                              - deleteissuers
                              - manageissuers
                              - recover
                              - purge
                            keys:
                              - encrypt
                              - decrypt
                              - wrapKey
                              - unwrapKey
                              - sign
                              - verify
                              - get
                              - list
                              - create
                              - update
                              - import
                              - delete
                              - backup
                              - restore
                              - recover
                              - purge
                            secrets:
                              - get
                              - list
                              - set
                              - delete
                              - backup
                              - restore
                              - recover
                              - purge
                          tenantId: 00000000-0000-0000-0000-000000000000
                      enableSoftDelete: true
                      enabledForDeployment: true
                      enabledForDiskEncryption: true
                      enabledForTemplateDeployment: true
                      sku:
                        family: A
                        name: premium
                      tenantId: 00000000-0000-0000-0000-000000000000
                      vaultUri: https://sample-vault.vault.azure.net/
                    tags: {}
                    type: Microsoft.KeyVault/vaults
      x-ms-pageable:
        nextLinkName: nextLink
  "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.KeyVault/vaults/{vaultName}":
    delete:
      description: Deletes the specified Azure key vault.
      operationId: Vaults_Delete
      parameters:
        - description: The name of the Resource Group to which the vault belongs.
          in: path
          name: resourceGroupName
          required: true
          type: string
        - description: The name of the vault to delete
          in: path
          name: vaultName
          required: true
          type: string
        - $ref: "#/parameters/ApiVersionParameter"
        - $ref: "#/parameters/SubscriptionIdParameter"
      responses:
        "200":
          description: OK Response.
      tags:
        - Vaults
      x-ms-examples:
        Delete a vault:
          parameters:
            api-version: 2018-02-14
            resourceGroupName: sample-resource-group
            subscriptionId: 00000000-0000-0000-0000-000000000000
            vaultName: sample-vault
          responses:
            "200":
              body: ""
              headers: {}
    get:
      description: Gets the specified Azure key vault.
      operationId: Vaults_Get
      parameters:
        - description: The name of the Resource Group to which the vault belongs.
          in: path
          name: resourceGroupName
          required: true
          type: string
        - description: The name of the vault.
          in: path
          name: vaultName
          required: true
          type: string
        - $ref: "#/parameters/ApiVersionParameter"
        - $ref: "#/parameters/SubscriptionIdParameter"
      responses:
        "200":
          description: Retrieved vault
          schema:
            $ref: "#/definitions/Vault"
      tags:
        - Vaults
      x-ms-examples:
        Retrieve a vault:
          parameters:
            api-version: 2018-02-14
            resourceGroupName: sample-resource-group
            subscriptionId: 00000000-0000-0000-0000-000000000000
            vaultName: sample-vault
          responses:
            "200":
              body:
                id: /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/sample-resource-group/providers/Microsoft.KeyVault/vaults/sample-vault
                location: westus
                name: sample-vault
                properties:
                  accessPolicies:
                    - objectId: 00000000-0000-0000-0000-000000000000
                      permissions:
                        certificates:
                          - get
                          - list
                          - delete
                          - create
                          - import
                          - update
                          - managecontacts
                          - getissuers
                          - listissuers
                          - setissuers
                          - deleteissuers
                          - manageissuers
                          - recover
                          - purge
                        keys:
                          - encrypt
                          - decrypt
                          - wrapKey
                          - unwrapKey
                          - sign
                          - verify
                          - get
                          - list
                          - create
                          - update
                          - import
                          - delete
                          - backup
                          - restore
                          - recover
                          - purge
                        secrets:
                          - get
                          - list
                          - set
                          - delete
                          - backup
                          - restore
                          - recover
                          - purge
                      tenantId: 00000000-0000-0000-0000-000000000000
                  enabledForDeployment: true
                  enabledForDiskEncryption: true
                  enabledForTemplateDeployment: true
                  sku:
                    family: A
                    name: standard
                  tenantId: 00000000-0000-0000-0000-000000000000
                  vaultUri: https://sample-vault.vault.azure.net
                tags: {}
                type: Microsoft.KeyVault/vaults
    patch:
      description: Update a key vault in the specified subscription.
      operationId: Vaults_Update
      parameters:
        - description: The name of the Resource Group to which the server belongs.
          in: path
          name: resourceGroupName
          required: true
          type: string
        - description: Name of the vault
          in: path
          name: vaultName
          pattern: ^[a-zA-Z0-9-]{3,24}$
          required: true
          type: string
        - $ref: "#/parameters/ApiVersionParameter"
        - description: Parameters to patch the vault
          in: body
          name: parameters
          required: true
          schema:
            $ref: "#/definitions/VaultPatchParameters"
        - $ref: "#/parameters/SubscriptionIdParameter"
      responses:
        "200":
          description: Patched vault
          schema:
            $ref: "#/definitions/Vault"
        "201":
          description: Patched vault
          schema:
            $ref: "#/definitions/Vault"
      tags:
        - Vaults
      x-ms-examples:
        Update an existing vault:
          parameters:
            api-version: 2018-02-14
            parameters:
              properties:
                accessPolicies:
                  - objectId: 00000000-0000-0000-0000-000000000000
                    permissions:
                      certificates:
                        - get
                        - list
                        - delete
                        - create
                        - import
                        - update
                        - managecontacts
                        - getissuers
                        - listissuers
                        - setissuers
                        - deleteissuers
                        - manageissuers
                        - recover
                        - purge
                      keys:
                        - encrypt
                        - decrypt
                        - wrapKey
                        - unwrapKey
                        - sign
                        - verify
                        - get
                        - list
                        - create
                        - update
                        - import
                        - delete
                        - backup
                        - restore
                        - recover
                        - purge
                      secrets:
                        - get
                        - list
                        - set
                        - delete
                        - backup
                        - restore
                        - recover
                        - purge
                    tenantId: 00000000-0000-0000-0000-000000000000
                enabledForDeployment: true
                enabledForDiskEncryption: true
                enabledForTemplateDeployment: true
                sku:
                  family: A
                  name: standard
                tenantId: 00000000-0000-0000-0000-000000000000
            resourceGroupName: sample-resource-group
            subscriptionId: 00000000-0000-0000-0000-000000000000
            vaultName: sample-vault
          responses:
            "200":
              body:
                id: /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/sample-resource-group/providers/Microsoft.KeyVault/vaults/sample-vault
                location: westus
                name: sample-vault
                properties:
                  accessPolicies:
                    - objectId: 00000000-0000-0000-0000-000000000000
                      permissions:
                        certificates:
                          - get
                          - list
                          - delete
                          - create
                          - import
                          - update
                          - managecontacts
                          - getissuers
                          - listissuers
                          - setissuers
                          - deleteissuers
                          - manageissuers
                          - recover
                          - purge
                        keys:
                          - encrypt
                          - decrypt
                          - wrapKey
                          - unwrapKey
                          - sign
                          - verify
                          - get
                          - list
                          - create
                          - update
                          - import
                          - delete
                          - backup
                          - restore
                          - recover
                          - purge
                        secrets:
                          - get
                          - list
                          - set
                          - delete
                          - backup
                          - restore
                          - recover
                          - purge
                      tenantId: 00000000-0000-0000-0000-000000000000
                  enabledForDeployment: true
                  enabledForDiskEncryption: true
                  enabledForTemplateDeployment: true
                  sku:
                    family: A
                    name: standard
                  tenantId: 00000000-0000-0000-0000-000000000000
                  vaultUri: https://sample-vault.vault.azure.net
                tags: {}
                type: Microsoft.KeyVault/vaults
            "201":
              body:
                id: /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/sample-resource-group/providers/Microsoft.KeyVault/vaults/sample-vault
                location: westus
                name: sample-vault
                properties:
                  accessPolicies:
                    - objectId: 00000000-0000-0000-0000-000000000000
                      permissions:
                        certificates:
                          - get
                          - list
                          - delete
                          - create
                          - import
                          - update
                          - managecontacts
                          - getissuers
                          - listissuers
                          - setissuers
                          - deleteissuers
                          - manageissuers
                          - recover
                          - purge
                        keys:
                          - encrypt
                          - decrypt
                          - wrapKey
                          - unwrapKey
                          - sign
                          - verify
                          - get
                          - list
                          - create
                          - update
                          - import
                          - delete
                          - backup
                          - restore
                          - recover
                          - purge
                        secrets:
                          - get
                          - list
                          - set
                          - delete
                          - backup
                          - restore
                          - recover
                          - purge
                      tenantId: 00000000-0000-0000-0000-000000000000
                  enabledForDeployment: true
                  enabledForDiskEncryption: true
                  enabledForTemplateDeployment: true
                  sku:
                    family: A
                    name: standard
                  tenantId: 00000000-0000-0000-0000-000000000000
                  vaultUri: https://sample-vault.vault.azure.net
                tags: {}
                type: Microsoft.KeyVault/vaults
    put:
      description: Create or update a key vault in the specified subscription.
      operationId: Vaults_CreateOrUpdate
      parameters:
        - description: The name of the Resource Group to which the server belongs.
          in: path
          name: resourceGroupName
          required: true
          type: string
        - description: Name of the vault
          in: path
          name: vaultName
          pattern: ^[a-zA-Z0-9-]{3,24}$
          required: true
          type: string
        - $ref: "#/parameters/ApiVersionParameter"
        - description: Parameters to create or update the vault
          in: body
          name: parameters
          required: true
          schema:
            $ref: "#/definitions/VaultCreateOrUpdateParameters"
        - $ref: "#/parameters/SubscriptionIdParameter"
      responses:
        "200":
          description: Created or updated vault
          schema:
            $ref: "#/definitions/Vault"
        "201":
          description: Created or updated vault
          schema:
            $ref: "#/definitions/Vault"
      tags:
        - Vaults
      x-ms-examples:
        Create a new vault or update an existing vault:
          parameters:
            api-version: 2018-02-14
            parameters:
              location: westus
              properties:
                accessPolicies:
                  - objectId: 00000000-0000-0000-0000-000000000000
                    permissions:
                      certificates:
                        - get
                        - list
                        - delete
                        - create
                        - import
                        - update
                        - managecontacts
                        - getissuers
                        - listissuers
                        - setissuers
                        - deleteissuers
                        - manageissuers
                        - recover
                        - purge
                      keys:
                        - encrypt
                        - decrypt
                        - wrapKey
                        - unwrapKey
                        - sign
                        - verify
                        - get
                        - list
                        - create
                        - update
                        - import
                        - delete
                        - backup
                        - restore
                        - recover
                        - purge
                      secrets:
                        - get
                        - list
                        - set
                        - delete
                        - backup
                        - restore
                        - recover
                        - purge
                    tenantId: 00000000-0000-0000-0000-000000000000
                enabledForDeployment: true
                enabledForDiskEncryption: true
                enabledForTemplateDeployment: true
                sku:
                  family: A
                  name: standard
                tenantId: 00000000-0000-0000-0000-000000000000
            resourceGroupName: sample-resource-group
            subscriptionId: 00000000-0000-0000-0000-000000000000
            vaultName: sample-vault
          responses:
            "200":
              body:
                id: /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/sample-resource-group/providers/Microsoft.KeyVault/vaults/sample-vault
                location: westus
                name: sample-vault
                properties:
                  accessPolicies:
                    - objectId: 00000000-0000-0000-0000-000000000000
                      permissions:
                        certificates:
                          - get
                          - list
                          - delete
                          - create
                          - import
                          - update
                          - managecontacts
                          - getissuers
                          - listissuers
                          - setissuers
                          - deleteissuers
                          - manageissuers
                          - recover
                          - purge
                        keys:
                          - encrypt
                          - decrypt
                          - wrapKey
                          - unwrapKey
                          - sign
                          - verify
                          - get
                          - list
                          - create
                          - update
                          - import
                          - delete
                          - backup
                          - restore
                          - recover
                          - purge
                        secrets:
                          - get
                          - list
                          - set
                          - delete
                          - backup
                          - restore
                          - recover
                          - purge
                      tenantId: 00000000-0000-0000-0000-000000000000
                  enabledForDeployment: true
                  enabledForDiskEncryption: true
                  enabledForTemplateDeployment: true
                  sku:
                    family: A
                    name: standard
                  tenantId: 00000000-0000-0000-0000-000000000000
                  vaultUri: https://sample-vault.vault.azure.net
                tags: {}
                type: Microsoft.KeyVault/vaults
            "201":
              body:
                id: /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/sample-resource-group/providers/Microsoft.KeyVault/vaults/sample-vault
                location: westus
                name: sample-vault
                properties:
                  accessPolicies:
                    - objectId: 00000000-0000-0000-0000-000000000000
                      permissions:
                        certificates:
                          - get
                          - list
                          - delete
                          - create
                          - import
                          - update
                          - managecontacts
                          - getissuers
                          - listissuers
                          - setissuers
                          - deleteissuers
                          - manageissuers
                          - recover
                          - purge
                        keys:
                          - encrypt
                          - decrypt
                          - wrapKey
                          - unwrapKey
                          - sign
                          - verify
                          - get
                          - list
                          - create
                          - update
                          - import
                          - delete
                          - backup
                          - restore
                          - recover
                          - purge
                        secrets:
                          - get
                          - list
                          - set
                          - delete
                          - backup
                          - restore
                          - recover
                          - purge
                      tenantId: 00000000-0000-0000-0000-000000000000
                  enabledForDeployment: true
                  enabledForDiskEncryption: true
                  enabledForTemplateDeployment: true
                  sku:
                    family: A
                    name: standard
                  tenantId: 00000000-0000-0000-0000-000000000000
                  vaultUri: https://sample-vault.vault.azure.net
                tags: {}
                type: Microsoft.KeyVault/vaults
        Create or update a vault with network acls:
          parameters:
            api-version: 2018-02-14
            parameters:
              location: westus
              properties:
                enabledForDeployment: true
                enabledForDiskEncryption: true
                enabledForTemplateDeployment: true
                networkAcls:
                  bypass: AzureServices
                  defaultAction: Deny
                  ipRules:
                    - value: 124.56.78.91
                    - value: "'10.91.4.0/24'"
                  virtualNetworkRules:
                    - id: /subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1
                sku:
                  family: A
                  name: standard
                tenantId: 00000000-0000-0000-0000-000000000000
            resourceGroupName: sample-resource-group
            subscriptionId: 00000000-0000-0000-0000-000000000000
            vaultName: sample-vault
          responses:
            "200":
              body:
                id: /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/sample-resource-group/providers/Microsoft.KeyVault/vaults/sample-vault
                location: westus
                name: sample-vault
                properties:
                  enabledForDeployment: true
                  enabledForDiskEncryption: true
                  enabledForTemplateDeployment: true
                  networkAcls:
                    bypass: AzureServices
                    defaultAction: Deny
                    ipRules:
                      - value: 124.56.78.91/32
                      - value: "'10.91.4.0/24'"
                    virtualNetworkRules:
                      - id: /subscriptions/subid/resourcegroups/rg1/providers/microsoft.network/virtualnetworks/test-vnet/subnets/subnet1
                  sku:
                    family: A
                    name: standard
                  tenantId: 00000000-0000-0000-0000-000000000000
                  vaultUri: https://sample-vault.vault.azure.net
                tags: {}
                type: Microsoft.KeyVault/vaults
            "201":
              body:
                id: /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/sample-resource-group/providers/Microsoft.KeyVault/vaults/sample-vault
                location: westus
                name: sample-vault
                properties:
                  enabledForDeployment: true
                  enabledForDiskEncryption: true
                  enabledForTemplateDeployment: true
                  networkAcls:
                    bypass: AzureServices
                    defaultAction: Deny
                    ipRules:
                      - value: 124.56.78.91/32
                      - value: "'10.91.4.0/24'"
                    virtualNetworkRules:
                      - id: /subscriptions/subid/resourcegroups/rg1/providers/microsoft.network/virtualnetworks/test-vnet/subnets/subnet1
                  sku:
                    family: A
                    name: standard
                  tenantId: 00000000-0000-0000-0000-000000000000
                  vaultUri: https://sample-vault.vault.azure.net
                tags: {}
                type: Microsoft.KeyVault/vaults
      x-ms-long-running-operation: true
  "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.KeyVault/vaults/{vaultName}/accessPolicies/{operationKind}":
    put:
      description: Update access policies in a key vault in the specified subscription.
      operationId: Vaults_UpdateAccessPolicy
      parameters:
        - description: The name of the Resource Group to which the vault belongs.
          in: path
          name: resourceGroupName
          required: true
          type: string
        - description: Name of the vault
          in: path
          name: vaultName
          pattern: ^[a-zA-Z0-9-]{3,24}$
          required: true
          type: string
        - description: Name of the operation
          enum:
            - add
            - replace
            - remove
          in: path
          name: operationKind
          required: true
          type: string
          x-ms-enum:
            modelAsString: false
            name: AccessPolicyUpdateKind
        - $ref: "#/parameters/ApiVersionParameter"
        - description: Access policy to merge into the vault
          in: body
          name: parameters
          required: true
          schema:
            $ref: "#/definitions/VaultAccessPolicyParameters"
        - $ref: "#/parameters/SubscriptionIdParameter"
      responses:
        "200":
          description: The updated access policies
          schema:
            $ref: "#/definitions/VaultAccessPolicyParameters"
        "201":
          description: The updated access policies
          schema:
            $ref: "#/definitions/VaultAccessPolicyParameters"
      tags:
        - Vaults
      x-ms-examples:
        "Add an access policy, or update an access policy with new permissions":
          parameters:
            api-version: 2018-02-14
            operationKind: add
            parameters:
              properties:
                accessPolicies:
                  - objectId: 00000000-0000-0000-0000-000000000000
                    permissions:
                      certificates:
                        - get
                      keys:
                        - encrypt
                      secrets:
                        - get
                    tenantId: 00000000-0000-0000-0000-000000000000
            resourceGroupName: sample-group
            subscriptionId: 00000000-0000-0000-0000-000000000000
            vaultName: sample-vault
          responses:
            "200":
              body:
                id: /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/sample-group/providers/Microsoft.KeyVault/vaults/sample-vault/accessPolicies/
                properties:
                  accessPolicies:
                    - objectId: 00000000-0000-0000-0000-000000000000
                      permissions:
                        certificates:
                          - get
                        keys:
                          - encrypt
                        secrets:
                          - get
                      tenantId: 00000000-0000-0000-0000-000000000000
                type: Microsoft.KeyVault/vaults/accessPolicies
            "201":
              body:
                id: /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/sample-group/providers/Microsoft.KeyVault/vaults/sample-vault/accessPolicies/
                properties:
                  accessPolicies:
                    - objectId: 00000000-0000-0000-0000-000000000000
                      permissions:
                        certificates:
                          - get
                        keys:
                          - encrypt
                        secrets:
                          - get
                      tenantId: 00000000-0000-0000-0000-000000000000
                type: Microsoft.KeyVault/vaults/accessPolicies
  "/subscriptions/{subscriptionId}/resources":
    get:
      description: The List operation gets information about the vaults associated with the subscription.
      operationId: Vaults_List
      parameters:
        - description: The filter to apply on the operation.
          enum:
            - resourceType eq 'Microsoft.KeyVault/vaults'
          in: query
          name: $filter
          required: true
          type: string
        - description: Maximum number of results to return.
          format: int32
          in: query
          name: $top
          type: integer
        - description: Azure Resource Manager Api Version.
          enum:
            - 2015-11-01
          in: query
          name: api-version
          required: true
          type: string
        - $ref: "#/parameters/SubscriptionIdParameter"
      responses:
        "200":
          description: Get information about all key vaults in the subscription.
          schema:
            $ref: "#/definitions/ResourceListResult"
      tags:
        - Vaults
      x-ms-examples:
        List vaults in the specified subscription:
          parameters:
            $filter: resourceType eq 'Microsoft.KeyVault/vaults'
            $top: 1
            api-version: 2015-11-01
            subscriptionId: 00000000-0000-0000-0000-000000000000
          responses:
            "200":
              body:
                nextLink: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resources?%24filter=resourceType+eq+%27Microsoft.KeyVault%2fvaults%27&%24top=4&api-version=2015-11-01&%24skiptoken=eyJuZXh0UGFydGl0aW9uS2V5IjoiMSE4IVEwTTJNVGMtIiwibmV4dFJvd0tleSI6IjEhMTMyIU5rUTRSVEU1UXpJelFUWXdORGd4UmpoRlFrSXhNVGhFUXpNd01EZEROVVJmVkVkT1RDMU5TVU5TVDFOUFJsUTZNa1ZMUlZsV1FWVk1WRG95UmxaQlZVeFVVeTFUVTFKSExVcEpUVG95UkZSRlUxUTZNa1JXUVZWTVZDMVhSVk5VVlZNLSJ9
                value:
                  - id: /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/sample-group/providers/Microsoft.KeyVault/vaults/sample-vault
                    location: westus
                    name: sample-vault
                    tags: {}
                    type: Microsoft.KeyVault/vaults
      x-ms-pageable:
        nextLinkName: nextLink
definitions:
  AccessPolicyEntry:
    description: An identity that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID.
    properties:
      applicationId:
        description: " Application ID of the client making request on behalf of a principal"
        format: uuid
        type: string
      objectId:
        description: The object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies.
        type: string
      permissions:
        $ref: "#/definitions/Permissions"
        description: Permissions the identity has for keys, secrets and certificates.
      tenantId:
        description: The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
        format: uuid
        type: string
    required:
      - tenantId
      - objectId
      - permissions
  CheckNameAvailabilityResult:
    description: The CheckNameAvailability operation response.
    properties:
      message:
        description: An error message explaining the Reason value in more detail.
        readOnly: true
        type: string
      nameAvailable:
        description: A boolean value that indicates whether the name is available for you to use. If true, the name is available. If false, the name has already been taken or is invalid and cannot be used.
        readOnly: true
        type: boolean
      reason:
        description: The reason that a vault name could not be used. The Reason element is only returned if NameAvailable is false.
        enum:
          - AccountNameInvalid
          - AlreadyExists
        readOnly: true
        type: string
        x-ms-enum:
          modelAsString: false
          name: Reason
  DeletedVault:
    description: Deleted vault information with extended details.
    properties:
      id:
        description: The resource ID for the deleted key vault.
        readOnly: true
        type: string
      name:
        description: The name of the key vault.
        readOnly: true
        type: string
      properties:
        $ref: "#/definitions/DeletedVaultProperties"
        description: Properties of the vault
      type:
        description: The resource type of the key vault.
        readOnly: true
        type: string
  DeletedVaultListResult:
    description: List of vaults
    properties:
      nextLink:
        description: The URL to get the next set of deleted vaults.
        type: string
      value:
        description: The list of deleted vaults.
        items:
          $ref: "#/definitions/DeletedVault"
        type: array
  DeletedVaultProperties:
    description: Properties of the deleted vault.
    properties:
      deletionDate:
        description: The deleted date.
        format: date-time
        readOnly: true
        type: string
      location:
        description: The location of the original vault.
        readOnly: true
        type: string
      scheduledPurgeDate:
        description: The scheduled purged date.
        format: date-time
        readOnly: true
        type: string
      tags:
        additionalProperties:
          type: string
        description: Tags of the original vault.
        readOnly: true
        type: object
      vaultId:
        description: The resource id of the original vault.
        readOnly: true
        type: string
  IPRule:
    description: A rule governing the accessibility of a vault from a specific ip address or ip range.
    properties:
      value:
        description: An IPv4 address range in CIDR notation, such as '124.56.78.91' (simple IP address) or '124.56.78.0/24' (all addresses that start with 124.56.78).
        type: string
    required:
      - value
  NetworkRuleSet:
    description: A set of rules governing the network accessibility of a vault.
    properties:
      bypass:
        description: Tells what traffic can bypass network rules. This can be 'AzureServices' or 'None'.  If not specified the default is 'AzureServices'.
        enum:
          - AzureServices
          - None
        type: string
        x-ms-enum:
          modelAsString: true
          name: NetworkRuleBypassOptions
      defaultAction:
        description: The default action when no rule from ipRules and from virtualNetworkRules match. This is only used after the bypass property has been evaluated.
        enum:
          - Allow
          - Deny
        type: string
        x-ms-enum:
          modelAsString: true
          name: NetworkRuleAction
      ipRules:
        description: The list of IP address rules.
        items:
          $ref: "#/definitions/IPRule"
        type: array
      virtualNetworkRules:
        description: The list of virtual network rules.
        items:
          $ref: "#/definitions/VirtualNetworkRule"
        type: array
  Permissions:
    description: Permissions the identity has for keys, secrets, certificates and storage.
    properties:
      certificates:
        description: Permissions to certificates
        items:
          enum:
            - get
            - list
            - delete
            - create
            - import
            - update
            - managecontacts
            - getissuers
            - listissuers
            - setissuers
            - deleteissuers
            - manageissuers
            - recover
            - purge
            - backup
            - restore
          type: string
          x-ms-enum:
            modelAsString: true
            name: CertificatePermissions
        type: array
      keys:
        description: Permissions to keys
        items:
          enum:
            - encrypt
            - decrypt
            - wrapKey
            - unwrapKey
            - sign
            - verify
            - get
            - list
            - create
            - update
            - import
            - delete
            - backup
            - restore
            - recover
            - purge
          type: string
          x-ms-enum:
            modelAsString: true
            name: KeyPermissions
        type: array
      secrets:
        description: Permissions to secrets
        items:
          enum:
            - get
            - list
            - set
            - delete
            - backup
            - restore
            - recover
            - purge
          type: string
          x-ms-enum:
            modelAsString: true
            name: SecretPermissions
        type: array
      storage:
        description: Permissions to storage accounts
        items:
          enum:
            - get
            - list
            - delete
            - set
            - update
            - regeneratekey
            - recover
            - purge
            - backup
            - restore
            - setsas
            - listsas
            - getsas
            - deletesas
          type: string
          x-ms-enum:
            modelAsString: true
            name: StoragePermissions
        type: array
  Resource:
    description: Key Vault resource
    properties:
      id:
        description: The Azure Resource Manager resource ID for the key vault.
        readOnly: true
        type: string
      location:
        description: The supported Azure location where the key vault should be created.
        type: string
      name:
        description: The name of the key vault.
        readOnly: true
        type: string
      tags:
        additionalProperties:
          type: string
        description: "The tags that will be assigned to the key vault. "
        type: object
      type:
        description: The resource type of the key vault.
        readOnly: true
        type: string
    required:
      - location
    x-ms-azure-resource: true
  ResourceListResult:
    description: List of vault resources.
    properties:
      nextLink:
        description: The URL to get the next set of vault resources.
        type: string
      value:
        description: The list of vault resources.
        items:
          $ref: "#/definitions/Resource"
        type: array
  Sku:
    description: SKU details
    properties:
      family:
        description: SKU family name
        enum:
          - A
        type: string
        x-ms-enum:
          modelAsString: true
          name: SkuFamily
      name:
        description: SKU name to specify whether the key vault is a standard vault or a premium vault.
        enum:
          - standard
          - premium
        type: string
        x-ms-enum:
          modelAsString: false
          name: SkuName
    required:
      - name
      - family
  Vault:
    allOf:
      - $ref: "#/definitions/Resource"
    description: Resource information with extended details.
    properties:
      properties:
        $ref: "#/definitions/VaultProperties"
        description: Properties of the vault
    required:
      - properties
  VaultAccessPolicyParameters:
    description: Parameters for updating the access policy in a vault
    properties:
      id:
        description: The resource id of the access policy.
        readOnly: true
        type: string
      location:
        description: The resource type of the access policy.
        readOnly: true
        type: string
      name:
        description: The resource name of the access policy.
        readOnly: true
        type: string
      properties:
        $ref: "#/definitions/VaultAccessPolicyProperties"
        description: Properties of the access policy
      type:
        description: The resource name of the access policy.
        readOnly: true
        type: string
    required:
      - properties
    x-ms-azure-resource: true
  VaultAccessPolicyProperties:
    description: Properties of the vault access policy
    properties:
      accessPolicies:
        description: An array of 0 to 16 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID.
        items:
          $ref: "#/definitions/AccessPolicyEntry"
        type: array
    required:
      - accessPolicies
  VaultCheckNameAvailabilityParameters:
    description: The parameters used to check the availability of the vault name.
    properties:
      name:
        description: The vault name.
        type: string
      type:
        description: The type of resource, Microsoft.KeyVault/vaults
        enum:
          - Microsoft.KeyVault/vaults
        type: string
        x-ms-enum:
          modelAsString: false
          name: Type
    required:
      - name
      - type
  VaultCreateOrUpdateParameters:
    description: Parameters for creating or updating a vault
    properties:
      location:
        description: The supported Azure location where the key vault should be created.
        type: string
      properties:
        $ref: "#/definitions/VaultProperties"
        description: Properties of the vault
      tags:
        additionalProperties:
          type: string
        description: The tags that will be assigned to the key vault.
        type: object
    required:
      - location
      - properties
    x-ms-azure-resource: true
  VaultListResult:
    description: List of vaults
    properties:
      nextLink:
        description: The URL to get the next set of vaults.
        type: string
      value:
        description: The list of vaults.
        items:
          $ref: "#/definitions/Vault"
        type: array
  VaultPatchParameters:
    description: Parameters for creating or updating a vault
    properties:
      properties:
        $ref: "#/definitions/VaultPatchProperties"
        description: Properties of the vault
      tags:
        additionalProperties:
          type: string
        description: "The tags that will be assigned to the key vault. "
        type: object
    x-ms-azure-resource: true
  VaultPatchProperties:
    description: Properties of the vault
    properties:
      accessPolicies:
        description: An array of 0 to 16 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID.
        items:
          $ref: "#/definitions/AccessPolicyEntry"
        type: array
      createMode:
        description: The vault's create mode to indicate whether the vault need to be recovered or not.
        enum:
          - recover
          - default
        type: string
        x-ms-enum:
          modelAsString: false
          name: CreateMode
      enablePurgeProtection:
        description: Property specifying whether protection against purge is enabled for this vault. Setting this property to true activates protection against purge for this vault and its content - only the Key Vault service may initiate a hard, irrecoverable deletion. The setting is effective only if soft delete is also enabled. Enabling this functionality is irreversible - that is, the property does not accept false as its value.
        type: boolean
      enableSoftDelete:
        description: Property to specify whether the 'soft delete' functionality is enabled for this key vault. It does not accept false value.
        type: boolean
      enabledForDeployment:
        description: Property to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault.
        type: boolean
      enabledForDiskEncryption:
        description: Property to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.
        type: boolean
      enabledForTemplateDeployment:
        description: Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.
        type: boolean
      networkAcls:
        $ref: "#/definitions/NetworkRuleSet"
        description: A collection of rules governing the accessibility of the vault from specific network locations.
      sku:
        $ref: "#/definitions/Sku"
        description: SKU details
      tenantId:
        description: The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
        format: uuid
        type: string
  VaultProperties:
    description: Properties of the vault
    properties:
      accessPolicies:
        description: An array of 0 to 16 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID. When `createMode` is set to `recover`, access policies are not required. Otherwise, access policies are required.
        items:
          $ref: "#/definitions/AccessPolicyEntry"
        type: array
      createMode:
        description: The vault's create mode to indicate whether the vault need to be recovered or not.
        enum:
          - recover
          - default
        type: string
        x-ms-enum:
          modelAsString: false
          name: CreateMode
      enablePurgeProtection:
        description: Property specifying whether protection against purge is enabled for this vault. Setting this property to true activates protection against purge for this vault and its content - only the Key Vault service may initiate a hard, irrecoverable deletion. The setting is effective only if soft delete is also enabled. Enabling this functionality is irreversible - that is, the property does not accept false as its value.
        type: boolean
      enableSoftDelete:
        description: Property to specify whether the 'soft delete' functionality is enabled for this key vault. It does not accept false value.
        type: boolean
      enabledForDeployment:
        description: Property to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault.
        type: boolean
      enabledForDiskEncryption:
        description: Property to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.
        type: boolean
      enabledForTemplateDeployment:
        description: Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.
        type: boolean
      networkAcls:
        $ref: "#/definitions/NetworkRuleSet"
        description: A collection of rules governing the accessibility of the vault from specific network locations.
      sku:
        $ref: "#/definitions/Sku"
        description: SKU details
      tenantId:
        description: The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
        format: uuid
        type: string
      vaultUri:
        description: The URI of the vault for performing operations on keys and secrets.
        type: string
    required:
      - tenantId
      - sku
  VirtualNetworkRule:
    description: A rule governing the accessibility of a vault from a specific virtual network.
    properties:
      id:
        description: Full resource id of a vnet subnet, such as '/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1'.
        type: string
    required:
      - id
