# KeyVaultClient API

> KeyVaultClient API on Apizie: 18 endpoints (Gets role assignments for a scope., Get the specified role assignment., Creates a role assignment., Deletes a role assignment., …) returned as clean JSON through one API key. Send your own provider key in the x-upstream-key header. Call it over REST at https://www.apizie.tech/v1/cloud:azure-keyvault-administration/{endpoint} or from Claude, ChatGPT and Cursor through the Apizie MCP server. Free plan: 1,000 requests a month.

- Project key: `cloud:azure-keyvault-administration`
- Category: Cloud
- Status: byok
- Source: https://learn.microsoft.com/rest/api/azure/
- Page: https://www.apizie.tech/api/cloud/azure-keyvault-administration
- OpenAPI: https://www.apizie.tech/api/cloud/azure-keyvault-administration/openapi.json

The Azure Key Vault Administration service client performs administrative operations including RBAC, BackupRestore, and settings management against the Azure Key Vault service.

## Endpoints

### Gets role assignments for a scope.
`GET https://www.apizie.tech/v1/cloud:azure-keyvault-administration/role-assignments-list-for-scope` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | The base URL of the Key Vault instance (e.g. https://myvault.vault.azure.net/) |
| api-version | string | no | The API version to use for this operation. |
| scope | string | yes | The scope of the role assignments. |
| $filter | string | no | The filter to apply on the operation. Use $filter=atScope() to return all role assignments at or above the scope. Use $filter=principalId… |

### Get the specified role assignment.
`GET https://www.apizie.tech/v1/cloud:azure-keyvault-administration/role-assignments-get` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | The base URL of the Key Vault instance (e.g. https://myvault.vault.azure.net/) |
| api-version | string | no | The API version to use for this operation. |
| scope | string | yes | The scope of the role assignment. |
| roleAssignmentName | string | yes | The name of the role assignment to get. |

### Creates a role assignment.
`POST https://www.apizie.tech/v1/cloud:azure-keyvault-administration/role-assignments-create` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | The base URL of the Key Vault instance (e.g. https://myvault.vault.azure.net/) |
| api-version | string | no | The API version to use for this operation. |
| scope | string | yes | The scope of the role assignment to create. |
| roleAssignmentName | string | yes | The name of the role assignment to create. It can be any valid GUID. |
| body | object | yes | JSON request body |

### Deletes a role assignment.
`POST https://www.apizie.tech/v1/cloud:azure-keyvault-administration/role-assignments-delete` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | The base URL of the Key Vault instance (e.g. https://myvault.vault.azure.net/) |
| api-version | string | no | The API version to use for this operation. |
| scope | string | yes | The scope of the role assignment to delete. |
| roleAssignmentName | string | yes | The name of the role assignment to delete. |

### Get all role definitions that are applicable at scope and above.
`GET https://www.apizie.tech/v1/cloud:azure-keyvault-administration/role-definitions-list` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | The base URL of the Key Vault instance (e.g. https://myvault.vault.azure.net/) |
| api-version | string | no | The API version to use for this operation. |
| scope | string | yes | The scope of the role definition. |
| $filter | string | no | The filter to apply on the operation. Use atScopeAndBelow filter to search below the given scope as well. |

### Get the specified role definition.
`GET https://www.apizie.tech/v1/cloud:azure-keyvault-administration/role-definitions-get` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | The base URL of the Key Vault instance (e.g. https://myvault.vault.azure.net/) |
| api-version | string | no | The API version to use for this operation. |
| scope | string | yes | The scope of the role definition to get. Managed HSM only supports '/'. |
| roleDefinitionName | string | yes | The name of the role definition to get. |

### Creates or updates a custom role definition.
`POST https://www.apizie.tech/v1/cloud:azure-keyvault-administration/role-definitions-create-or-update` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | The base URL of the Key Vault instance (e.g. https://myvault.vault.azure.net/) |
| api-version | string | no | The API version to use for this operation. |
| scope | string | yes | The scope of the role definition to create or update. Managed HSM only supports '/'. |
| roleDefinitionName | string | yes | The name of the role definition to create or update. It can be any valid GUID. |
| body | object | yes | JSON request body |

### Deletes a custom role definition.
`POST https://www.apizie.tech/v1/cloud:azure-keyvault-administration/role-definitions-delete` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | The base URL of the Key Vault instance (e.g. https://myvault.vault.azure.net/) |
| api-version | string | no | The API version to use for this operation. |
| scope | string | yes | The scope of the role definition to delete. Managed HSM only supports '/'. |
| roleDefinitionName | string | yes | The name (GUID) of the role definition to delete. |

### Creates a full backup using a user-provided SAS token to an Azure blob storage container.
`POST https://www.apizie.tech/v1/cloud:azure-keyvault-administration/full-backup` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | The base URL of the Key Vault instance (e.g. https://myvault.vault.azure.net/) |
| api-version | string | no | The API version to use for this operation. |
| body | object | yes | JSON request body |

### Returns the status of full backup operation
`GET https://www.apizie.tech/v1/cloud:azure-keyvault-administration/full-backup-status` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | The base URL of the Key Vault instance (e.g. https://myvault.vault.azure.net/) |
| api-version | string | no | The API version to use for this operation. |
| jobId | string | yes | The id returned as part of the backup request |

### Restores all key versions of a given key using user supplied SAS token pointing to a previously stored Azure…
`POST https://www.apizie.tech/v1/cloud:azure-keyvault-administration/selective-key-restore-operation` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | The base URL of the Key Vault instance (e.g. https://myvault.vault.azure.net/) |
| api-version | string | no | The API version to use for this operation. |
| keyName | string | yes | The name of the key to be restored from the user supplied backup |
| body | object | yes | JSON request body |

### Pre-backup operation for checking whether the customer can perform a full backup operation.
`POST https://www.apizie.tech/v1/cloud:azure-keyvault-administration/pre-full-backup` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | The base URL of the Key Vault instance (e.g. https://myvault.vault.azure.net/) |
| api-version | string | no | The API version to use for this operation. |
| body | object | yes | JSON request body |

### Pre-restore operation for checking whether the customer can perform a full restore operation.
`POST https://www.apizie.tech/v1/cloud:azure-keyvault-administration/pre-full-restore-operation` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | The base URL of the Key Vault instance (e.g. https://myvault.vault.azure.net/) |
| api-version | string | no | The API version to use for this operation. |
| body | object | yes | JSON request body |

### Restores all key materials using the SAS token pointing to a previously stored Azure Blob storage backup…
`POST https://www.apizie.tech/v1/cloud:azure-keyvault-administration/full-restore-operation` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | The base URL of the Key Vault instance (e.g. https://myvault.vault.azure.net/) |
| api-version | string | no | The API version to use for this operation. |
| body | object | yes | JSON request body |

### Returns the status of restore operation
`GET https://www.apizie.tech/v1/cloud:azure-keyvault-administration/restore-status` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | The base URL of the Key Vault instance (e.g. https://myvault.vault.azure.net/) |
| api-version | string | no | The API version to use for this operation. |
| jobId | string | yes | The Job Id returned part of the restore operation |

### List account settings.
`GET https://www.apizie.tech/v1/cloud:azure-keyvault-administration/get-settings` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | The base URL of the Key Vault instance (e.g. https://myvault.vault.azure.net/) |
| api-version | string | no | The API version to use for this operation. |

### Get specified account setting object.
`GET https://www.apizie.tech/v1/cloud:azure-keyvault-administration/get-setting` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | The base URL of the Key Vault instance (e.g. https://myvault.vault.azure.net/) |
| api-version | string | no | The API version to use for this operation. |
| setting-name | string | yes | The name of the account setting. Must be a valid settings option. |

### Updates key vault account setting, stores it, then returns the setting name and value to the client.
`POST https://www.apizie.tech/v1/cloud:azure-keyvault-administration/update-setting` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | The base URL of the Key Vault instance (e.g. https://myvault.vault.azure.net/) |
| api-version | string | no | The API version to use for this operation. |
| setting-name | string | yes | The name of the account setting. Must be a valid settings option. |
| body | object | yes | JSON request body |

## Example
```
curl "https://www.apizie.tech/v1/cloud:azure-keyvault-administration/role-assignments-list-for-scope" \
  -H "x-api-key: $APIZIE_KEY" \
  -H "x-upstream-key: $PROVIDER_KEY"
```

## FAQ

### How do I call the KeyVaultClient API?
Create a free Apizie key, then send GET https://www.apizie.tech/v1/cloud:azure-keyvault-administration/role-assignments-list-for-scope with the header x-api-key. Every endpoint returns { project, data, timestamp }.

### Is the KeyVaultClient API free on Apizie?
Yes. The Free plan includes 1,000 requests a month at 100 requests a minute, no credit card. KeyVaultClient itself also needs your own key from azure.com.

### Can AI agents use the KeyVaultClient API?
Yes. Add the Apizie MCP server (https://www.apizie.tech/mcp) to Claude, ChatGPT, Cursor or VS Code, then ask in plain language. The agent calls run_scraper with project key cloud:azure-keyvault-administration.

### What is the status of the KeyVaultClient API?
Needs your own provider key (bring your own key)