swagger: "2.0"
schemes:
  - https
host: management.azure.com
info:
  description: The Azure SQL Database management API provides a RESTful set of web APIs that interact with Azure SQL Database services to manage your databases. The API enables users to create, retrieve, update, and delete databases, servers, and other entities.
  title: SqlManagementClient
  version: 2017-10-01-preview
  x-apisguru-categories:
    - cloud
  x-logo:
    url: https://api.apis.guru/v2/cache/logo/https_assets.onestore.ms_cdnfiles_onestorerolling-1606-01000_shell_v3_images_logo_microsoft.png
  x-origin:
    - format: swagger
      url: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/master/specification/sql/resource-manager/Microsoft.Sql/preview/2017-10-01-preview/ManagedInstanceEncryptionProtectors.json
      version: "2.0"
  x-providerName: azure.com
  x-serviceName: sql-ManagedInstanceEncryptionProtectors
  x-tags:
    - Azure
    - Microsoft
consumes:
  - application/json
produces:
  - application/json
securityDefinitions:
  azure_auth:
    authorizationUrl: https://login.microsoftonline.com/common/oauth2/authorize
    description: Azure Active Directory OAuth2 Flow
    flow: implicit
    scopes:
      user_impersonation: impersonate your user account
    type: oauth2
parameters:
  ApiVersionParameter:
    description: The API version to use for the request.
    in: query
    name: api-version
    required: true
    type: string
    x-ms-parameter-location: client
  BlobAuditingPolicyNameParameter:
    description: The name of the blob auditing policy.
    enum:
      - default
    in: path
    name: blobAuditingPolicyName
    required: true
    type: string
    x-ms-parameter-location: method
  DatabaseNameParameter:
    description: The name of the database.
    in: path
    name: databaseName
    required: true
    type: string
    x-ms-parameter-location: method
  ManagedInstanceNameParameter:
    description: The name of the managed instance.
    in: path
    name: managedInstanceName
    required: true
    type: string
    x-ms-parameter-location: method
  ResourceGroupParameter:
    description: The name of the resource group that contains the resource. You can obtain this value from the Azure Resource Manager API or the portal.
    in: path
    name: resourceGroupName
    required: true
    type: string
    x-ms-parameter-location: method
  ServerNameParameter:
    description: The name of the server.
    in: path
    name: serverName
    required: true
    type: string
    x-ms-parameter-location: method
  SqlVirtualMachineContainerNameParameter:
    description: The name of the SqlVirtualMachineContainer.
    in: path
    name: sqlVirtualMachineContainerName
    required: true
    type: string
    x-ms-parameter-location: method
  SqlVirtualMachineInstanceNameParameter:
    description: The name of the SqlVirtualMachineInstance.
    in: path
    name: sqlVirtualMachineInstanceName
    required: true
    type: string
    x-ms-parameter-location: method
  SubscriptionIdParameter:
    description: The subscription ID that identifies an Azure subscription.
    in: path
    name: subscriptionId
    required: true
    type: string
    x-ms-parameter-location: client
  VirtualClusterNameParameter:
    description: The name of the virtual cluster.
    in: path
    name: virtualClusterName
    required: true
    type: string
    x-ms-parameter-location: method
paths:
  "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Sql/managedInstances/{managedInstanceName}/encryptionProtector":
    get:
      description: Gets a list of managed instance encryption protectors
      operationId: ManagedInstanceEncryptionProtectors_ListByInstance
      parameters:
        - $ref: "#/parameters/ResourceGroupParameter"
        - $ref: "#/parameters/ManagedInstanceNameParameter"
        - $ref: "#/parameters/SubscriptionIdParameter"
        - $ref: "#/parameters/ApiVersionParameter"
      responses:
        "200":
          description: Successfully retrieved the list of managed instance encryption protector.
          schema:
            $ref: "#/definitions/ManagedInstanceEncryptionProtectorListResult"
        default:
          description: |-
            *** Error Responses: ***

             * 400 InvalidKeyName - An invalid value was given for the server key name.

             * 400 InvalidKeyType - The create server key type is not supported.

             * 400 InvalidUpsertKeyType - Service Managed type keys are managed by Azure SQL. This key type does not support create or update by the user.

             * 400 InvalidKeyUpsertRequest - The create server key request does not exist or has no properties object.

             * 400 InvalidEncryptionProtectorName - The encryption protector key name is not supported.

             * 404 ServerNotInSubscriptionResourceGroup - Specified server does not exist in the specified resource group and subscription.

             * 404 SubscriptionDoesNotHaveServer - The requested server was not found
      tags:
        - ManagedInstanceEncryptionProtectors
      x-ms-examples:
        List encryption protectors by managed instance:
          parameters:
            api-version: 2017-10-01-preview
            managedInstanceName: sqlcrudtest-4645
            resourceGroupName: sqlcrudtest-7398
            subscriptionId: 00000000-1111-2222-3333-444444444444
          responses:
            "200":
              body:
                value:
                  - id: /subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/sqlcrudtest-7398/providers/Microsoft.Sql/managedInstances/sqlcrudtest-4645/encryptionProtector/current
                    kind: azurekeyvault
                    name: current
                    properties:
                      serverKeyName: someVault_someKey_01234567890123456789012345678901
                      serverKeyType: AzureKeyVault
                      uri: https://someVault.vault.azure.net/keys/someKey/01234567890123456789012345678901
                    type: Microsoft.Sql/managedInstances/encryptionProtector
      x-ms-pageable:
        nextLinkName: nextLink
  "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Sql/managedInstances/{managedInstanceName}/encryptionProtector/{encryptionProtectorName}":
    get:
      description: Gets a managed instance encryption protector.
      operationId: ManagedInstanceEncryptionProtectors_Get
      parameters:
        - $ref: "#/parameters/ResourceGroupParameter"
        - $ref: "#/parameters/ManagedInstanceNameParameter"
        - description: The name of the encryption protector to be retrieved.
          enum:
            - current
          in: path
          name: encryptionProtectorName
          required: true
          type: string
          x-ms-enum:
            modelAsString: true
            name: EncryptionProtectorName
        - $ref: "#/parameters/SubscriptionIdParameter"
        - $ref: "#/parameters/ApiVersionParameter"
      responses:
        "200":
          description: Successfully retrieved the specified managed instance encryption protector.
          schema:
            $ref: "#/definitions/ManagedInstanceEncryptionProtector"
        default:
          description: |-
            *** Error Responses: ***

             * 400 InvalidKeyName - An invalid value was given for the server key name.

             * 400 InvalidKeyType - The create server key type is not supported.

             * 400 InvalidUpsertKeyType - Service Managed type keys are managed by Azure SQL. This key type does not support create or update by the user.

             * 400 InvalidKeyUpsertRequest - The create server key request does not exist or has no properties object.

             * 400 InvalidEncryptionProtectorName - The encryption protector key name is not supported.

             * 404 ServerNotInSubscriptionResourceGroup - Specified server does not exist in the specified resource group and subscription.

             * 404 SubscriptionDoesNotHaveServer - The requested server was not found

             * 404 ResourceNotFound - The requested resource was not found.
      tags:
        - ManagedInstanceEncryptionProtectors
      x-ms-examples:
        Get the encryption protector:
          parameters:
            api-version: 2017-10-01-preview
            encryptionProtectorName: current
            managedInstanceName: sqlcrudtest-4645
            resourceGroupName: sqlcrudtest-7398
            subscriptionId: 00000000-1111-2222-3333-444444444444
          responses:
            "200":
              body:
                id: /subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/sqlcrudtest-7398/providers/Microsoft.Sql/managedInstances/sqlcrudtest-4645/encryptionProtector/current
                kind: azurekeyvault
                name: current
                properties:
                  serverKeyName: someVault_someKey_01234567890123456789012345678901
                  serverKeyType: AzureKeyVault
                  uri: https://someVault.vault.azure.net/keys/someKey/01234567890123456789012345678901
                type: Microsoft.Sql/managedInstances/encryptionProtector
    put:
      description: Updates an existing encryption protector.
      operationId: ManagedInstanceEncryptionProtectors_CreateOrUpdate
      parameters:
        - $ref: "#/parameters/ResourceGroupParameter"
        - $ref: "#/parameters/ManagedInstanceNameParameter"
        - description: The name of the encryption protector to be updated.
          enum:
            - current
          in: path
          name: encryptionProtectorName
          required: true
          type: string
          x-ms-enum:
            modelAsString: true
            name: EncryptionProtectorName
        - description: The requested encryption protector resource state.
          in: body
          name: parameters
          required: true
          schema:
            $ref: "#/definitions/ManagedInstanceEncryptionProtector"
        - $ref: "#/parameters/SubscriptionIdParameter"
        - $ref: "#/parameters/ApiVersionParameter"
      responses:
        "200":
          description: Successfully updated the encryption protector.
          schema:
            $ref: "#/definitions/ManagedInstanceEncryptionProtector"
        "202":
          description: Accepted
        default:
          description: |-
            *** Error Responses: ***

             * 400 InvalidKeyName - An invalid value was given for the server key name.

             * 400 InvalidKeyType - The create server key type is not supported.

             * 400 InvalidUpsertKeyType - Service Managed type keys are managed by Azure SQL. This key type does not support create or update by the user.

             * 400 InvalidKeyUpsertRequest - The create server key request does not exist or has no properties object.

             * 400 InvalidEncryptionProtectorName - The encryption protector key name is not supported.

             * 400 SecurityAzureKeyVaultGeoChainError - Creating secondary of secondary (a process known as chaining) is not supported when enabling Transparent Data Encryption using Azure Key Vault (BYOK).

             * 400 AzureKeyVaultInvalidExpirationDate - The operation could not be completed because the Azure Key Vault key expiration date is invalid.

             * 400 SecurityAzureKeyVaultUrlNullOrEmpty - The operation could not be completed because the Azure Key Vault Uri is null or empty.

             * 400 AzureKeyVaultInvalidUri - An invalid response from Azure Key Vault. Please use a valid Azure Key Vault URI.

             * 400 SecurityAzureKeyVaultInvalidKeyName - The operation could not be completed because of an invalid Server Key name.

             * 400 AzureKeyVaultMalformedVaultUri - The provided Key Vault uri is not valid.

             * 400 SecurityAdalPrincipalCertExpiredError - The operation could not be completed because the Azure Key Vault principal certificate has expired.

             * 400 SecurityInvalidAzureKeyVaultRecoveryLevel - The provided Key Vault uri is not valid.

             * 400 KeyMaterialNotFoundOnRemoteServer - Remote server does not have access to key material used as a TDE protector.

             * 400 AzureKeyVaultMismatchError - Unexpected Key Vault region found in the http response.

             * 400 AzureKeyVaultRsaKeyNotSupported - The provided key vault uses unsupported RSA Key Size or Key Type. The supported RSA key size is 2048 and Key Type is RSA.

             * 401 AzureKeyVaultKeyDisabled - The operation could not be completed on the server because the Azure Key Vault key is disabled.

             * 401 AzureKeyVaultNoServerIdentity - The server identity is not correctly configured.

             * 401 AzureKeyVaultMissingPermissions - The server is missing required permissions on the Azure Key Vault. 

             * 401 AdalGenericError - The operation could not be completed because an Azure Active Directory error was encountered.

             * 401 AdalServicePrincipalNotFound - The operation could not be completed because an Azure Active Directory library Service Principal not found error was encountered.

             * 404 ServerNotInSubscriptionResourceGroup - Specified server does not exist in the specified resource group and subscription.

             * 404 SubscriptionDoesNotHaveServer - The requested server was not found

             * 404 ResourceNotFound - The requested resource was not found.

             * 404 ServerKeyNotFound - The requested server key was not found on the current subscription.

             * 409 ServerKeyNameAlreadyExists - The server key already exists on the server.

             * 409 ServerKeyUriAlreadyExists - The server key URI already exists on the server.

             * 409 ServerKeyDoesNotExists - The server key does not exist.

             * 409 AzureKeyVaultKeyNameNotFound - The operation could not be completed because the Azure Key Vault Key name does not exist.

             * 409 AzureKeyVaultKeyInUse - The key is currently being used by the server.

             * 503 AzureKeyVaultConnectionFailed - The operation could not be completed on the server because attempts to connect to Azure Key Vault have failed

             * 503 AzureKeyVaultGenericConnectionError - The operation could not be completed because an error was encountered when attempting to retrieve Key Vault information .
      tags:
        - ManagedInstanceEncryptionProtectors
      x-ms-examples:
        Update the encryption protector to key vault:
          parameters:
            api-version: 2017-10-01-preview
            encryptionProtectorName: current
            managedInstanceName: sqlcrudtest-4645
            parameters:
              properties:
                serverKeyName: someVault_someKey_01234567890123456789012345678901
                serverKeyType: AzureKeyVault
            resourceGroupName: sqlcrudtest-7398
            subscriptionId: 00000000-1111-2222-3333-444444444444
          responses:
            "200":
              body:
                id: /subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/sqlcrudtest-7398/providers/Microsoft.Sql/managedInstances/sqlcrudtest-4645/encryptionProtector/current
                kind: azurekeyvault
                name: current
                properties:
                  serverKeyName: someVault_someKey_01234567890123456789012345678901
                  serverKeyType: AzureKeyVault
                type: Microsoft.Sql/managedInstances/encryptionProtector
            "202": {}
        Update the encryption protector to service managed:
          parameters:
            api-version: 2017-10-01-preview
            encryptionProtectorName: current
            managedInstanceName: sqlcrudtest-4645
            parameters:
              properties:
                serverKeyName: ServiceManaged
                serverKeyType: ServiceManaged
            resourceGroupName: sqlcrudtest-7398
            subscriptionId: 00000000-1111-2222-3333-444444444444
          responses:
            "200":
              body:
                id: /subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/sqlcrudtest-7398/providers/Microsoft.Sql/managedInstances/sqlcrudtest-4645/encryptionProtector/current
                kind: servicemanaged
                name: current
                properties:
                  serverKeyName: ServiceManaged
                  serverKeyType: ServiceManaged
                type: Microsoft.Sql/managedInstances/encryptionProtector
            "202": {}
      x-ms-long-running-operation: true
  "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Sql/managedInstances/{managedInstanceName}/encryptionProtector/{encryptionProtectorName}/revalidate":
    post:
      description: Revalidates an existing encryption protector.
      operationId: ManagedInstanceEncryptionProtectors_Revalidate
      parameters:
        - $ref: "#/parameters/ResourceGroupParameter"
        - $ref: "#/parameters/ManagedInstanceNameParameter"
        - description: The name of the encryption protector to be updated.
          enum:
            - current
          in: path
          name: encryptionProtectorName
          required: true
          type: string
          x-ms-enum:
            modelAsString: true
            name: EncryptionProtectorName
        - $ref: "#/parameters/SubscriptionIdParameter"
        - $ref: "#/parameters/ApiVersionParameter"
      responses:
        "200":
          description: Successfully revalidated the encryption protector.
        "202":
          description: Accepted
        default:
          description: |-
            *** Error Responses: ***

             * 400 InvalidKeyName - An invalid value was given for the server key name.

             * 400 InvalidKeyType - The create server key type is not supported.

             * 400 InvalidUpsertKeyType - Service Managed type keys are managed by Azure SQL. This key type does not support create or update by the user.

             * 400 InvalidKeyUpsertRequest - The create server key request does not exist or has no properties object.

             * 400 InvalidEncryptionProtectorName - The encryption protector key name is not supported.

             * 400 SecurityAzureKeyVaultGeoChainError - Creating secondary of secondary (a process known as chaining) is not supported when enabling Transparent Data Encryption using Azure Key Vault (BYOK).

             * 400 AzureKeyVaultInvalidExpirationDate - The operation could not be completed because the Azure Key Vault key expiration date is invalid.

             * 400 SecurityAzureKeyVaultUrlNullOrEmpty - The operation could not be completed because the Azure Key Vault Uri is null or empty.

             * 400 AzureKeyVaultInvalidUri - An invalid response from Azure Key Vault. Please use a valid Azure Key Vault URI.

             * 400 SecurityAzureKeyVaultInvalidKeyName - The operation could not be completed because of an invalid Server Key name.

             * 400 AzureKeyVaultMalformedVaultUri - The provided Key Vault uri is not valid.

             * 400 SecurityAdalPrincipalCertExpiredError - The operation could not be completed because the Azure Key Vault principal certificate has expired.

             * 400 SecurityInvalidAzureKeyVaultRecoveryLevel - The provided Key Vault uri is not valid.

             * 400 KeyMaterialNotFoundOnRemoteServer - Remote server does not have access to key material used as a TDE protector.

             * 400 AzureKeyVaultMismatchError - Unexpected Key Vault region found in the http response.

             * 400 AzureKeyVaultRsaKeyNotSupported - The provided key vault uses unsupported RSA Key Size or Key Type. The supported RSA key size is 2048 and Key Type is RSA.

             * 401 AzureKeyVaultKeyDisabled - The operation could not be completed on the server because the Azure Key Vault key is disabled.

             * 401 AzureKeyVaultNoServerIdentity - The server identity is not correctly configured.

             * 401 AzureKeyVaultMissingPermissions - The server is missing required permissions on the Azure Key Vault. 

             * 401 AdalGenericError - The operation could not be completed because an Azure Active Directory error was encountered.

             * 401 AdalServicePrincipalNotFound - The operation could not be completed because an Azure Active Directory library Service Principal not found error was encountered.

             * 404 ServerNotInSubscriptionResourceGroup - Specified server does not exist in the specified resource group and subscription.

             * 404 SubscriptionDoesNotHaveServer - The requested server was not found

             * 404 ResourceNotFound - The requested resource was not found.

             * 404 ServerKeyNotFound - The requested server key was not found on the current subscription.

             * 409 ServerKeyNameAlreadyExists - The server key already exists on the server.

             * 409 ServerKeyUriAlreadyExists - The server key URI already exists on the server.

             * 409 ServerKeyDoesNotExists - The server key does not exist.

             * 409 AzureKeyVaultKeyNameNotFound - The operation could not be completed because the Azure Key Vault Key name does not exist.

             * 409 AzureKeyVaultKeyInUse - The key is currently being used by the server.

             * 503 AzureKeyVaultConnectionFailed - The operation could not be completed on the server because attempts to connect to Azure Key Vault have failed

             * 503 AzureKeyVaultGenericConnectionError - The operation could not be completed because an error was encountered when attempting to retrieve Key Vault information .
      tags:
        - ManagedInstanceEncryptionProtectors
      x-ms-examples:
        Revalidates the encryption protector:
          parameters:
            api-version: 2017-10-01-preview
            encryptionProtectorName: current
            managedInstanceName: sqlcrudtest-4645
            resourceGroupName: sqlcrudtest-7398
            subscriptionId: 00000000-1111-2222-3333-444444444444
          responses:
            "200": {}
            "202": {}
      x-ms-long-running-operation: true
definitions:
  ManagedInstanceEncryptionProtector:
    allOf:
      - allOf:
          - description: ARM resource.
            properties:
              id:
                description: Resource ID.
                readOnly: true
                type: string
              name:
                description: Resource name.
                readOnly: true
                type: string
              type:
                description: Resource type.
                readOnly: true
                type: string
            type: object
            x-ms-azure-resource: true
        description: ARM proxy resource.
        properties: {}
        type: object
    description: The managed instance encryption protector.
    properties:
      kind:
        description: Kind of encryption protector. This is metadata used for the Azure portal experience.
        readOnly: true
        type: string
      properties:
        $ref: "#/definitions/ManagedInstanceEncryptionProtectorProperties"
        description: Resource properties.
        x-ms-client-flatten: true
    type: object
  ManagedInstanceEncryptionProtectorListResult:
    description: A list of managed instance encryption protectors.
    properties:
      nextLink:
        description: Link to retrieve next page of results.
        readOnly: true
        type: string
      value:
        description: Array of results.
        items:
          $ref: "#/definitions/ManagedInstanceEncryptionProtector"
        readOnly: true
        type: array
    type: object
  ManagedInstanceEncryptionProtectorProperties:
    description: Properties for an encryption protector execution.
    properties:
      serverKeyName:
        description: The name of the managed instance key.
        type: string
      serverKeyType:
        description: The encryption protector type like 'ServiceManaged', 'AzureKeyVault'.
        enum:
          - ServiceManaged
          - AzureKeyVault
        type: string
        x-ms-enum:
          modelAsString: true
          name: ServerKeyType
      thumbprint:
        description: Thumbprint of the server key.
        readOnly: true
        type: string
      uri:
        description: The URI of the server key.
        readOnly: true
        type: string
    required:
      - serverKeyType
    type: object
