# KeyVaultClient API

> KeyVaultClient API on Apizie: 25 endpoints (Lists the deleted keys in the specified vault., Gets the public part of a deleted key., Permanently deletes the specified key., Recovers the deleted key to its latest version., …) returned as clean JSON through one API key. Send your own provider key in the x-upstream-key header. Call it over REST at https://apizie.tech/v1/cloud:azure-keyvault-keys/{endpoint} or from Claude, ChatGPT and Cursor through the Apizie MCP server. Free plan: 1,000 requests a month.

- Project key: `cloud:azure-keyvault-keys`
- Category: Cloud
- Status: byok
- Source: https://learn.microsoft.com/rest/api/azure/
- Page: https://apizie.tech/api/cloud/azure-keyvault-keys
- OpenAPI: https://apizie.tech/api/cloud/azure-keyvault-keys/openapi.json

The key vault client performs cryptographic key operations and vault operations against the Key Vault service.

## Endpoints

### Lists the deleted keys in the specified vault.
`GET https://apizie.tech/v1/cloud:azure-keyvault-keys/get-deleted-keys` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | Your KeyVaultClient endpoint URL, for example https://myresource.azure.com |
| api-version | string | no | The API version to use for this operation. |
| maxresults | integer | no | Maximum number of results to return in a page. If not specified the service will return up to 25 results. |

### Gets the public part of a deleted key.
`GET https://apizie.tech/v1/cloud:azure-keyvault-keys/get-deleted-key` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | Your KeyVaultClient endpoint URL, for example https://myresource.azure.com |
| api-version | string | no | The API version to use for this operation. |
| key-name | string | yes | The name of the key. |

### Permanently deletes the specified key.
`POST https://apizie.tech/v1/cloud:azure-keyvault-keys/purge-deleted-key` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | Your KeyVaultClient endpoint URL, for example https://myresource.azure.com |
| api-version | string | no | The API version to use for this operation. |
| key-name | string | yes | The name of the key |

### Recovers the deleted key to its latest version.
`POST https://apizie.tech/v1/cloud:azure-keyvault-keys/recover-deleted-key` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | Your KeyVaultClient endpoint URL, for example https://myresource.azure.com |
| api-version | string | no | The API version to use for this operation. |
| key-name | string | yes | The name of the deleted key. |

### List keys in the specified vault.
`GET https://apizie.tech/v1/cloud:azure-keyvault-keys/get-keys` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | Your KeyVaultClient endpoint URL, for example https://myresource.azure.com |
| api-version | string | no | The API version to use for this operation. |
| maxresults | integer | no | Maximum number of results to return in a page. If not specified the service will return up to 25 results. |

### Imports an externally created key, stores it, and returns key parameters and attributes to the client.
`POST https://apizie.tech/v1/cloud:azure-keyvault-keys/import-key` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | Your KeyVaultClient endpoint URL, for example https://myresource.azure.com |
| api-version | string | no | The API version to use for this operation. |
| key-name | string | yes | Name for the imported key. The value you provide may be copied globally for the purpose of running the service. The value provided should… |
| body | object | yes | JSON request body |

### Deletes a key of any type from storage in Azure Key Vault.
`POST https://apizie.tech/v1/cloud:azure-keyvault-keys/delete-key` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | Your KeyVaultClient endpoint URL, for example https://myresource.azure.com |
| api-version | string | no | The API version to use for this operation. |
| key-name | string | yes | The name of the key to delete. |

### Gets the public part of a stored key.
`GET https://apizie.tech/v1/cloud:azure-keyvault-keys/get-key` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | Your KeyVaultClient endpoint URL, for example https://myresource.azure.com |
| api-version | string | no | The API version to use for this operation. |
| key-name | string | yes | The name of the key to get. |
| key-version | string | yes | Adding the version parameter retrieves a specific version of a key. This URI fragment is optional. If not specified, the latest version of… |

### The update key operation changes specified attributes of a stored key and can be applied to any key type and…
`POST https://apizie.tech/v1/cloud:azure-keyvault-keys/update-key` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | Your KeyVaultClient endpoint URL, for example https://myresource.azure.com |
| api-version | string | no | The API version to use for this operation. |
| key-name | string | yes | The name of key to update. |
| key-version | string | yes | The version of the key to update. |
| body | object | yes | JSON request body |

### Gets the public part of a stored key along with its attestation blob.
`GET https://apizie.tech/v1/cloud:azure-keyvault-keys/get-key-attestation` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | Your KeyVaultClient endpoint URL, for example https://myresource.azure.com |
| api-version | string | no | The API version to use for this operation. |
| key-name | string | yes | The name of the key to retrieve attestation for. |
| key-version | string | yes | Adding the version parameter retrieves attestation blob for specific version of a key. This URI fragment is optional. If not specified,… |

### Decrypts a single block of encrypted data.
`POST https://apizie.tech/v1/cloud:azure-keyvault-keys/decrypt` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | Your KeyVaultClient endpoint URL, for example https://myresource.azure.com |
| api-version | string | no | The API version to use for this operation. |
| key-name | string | yes | The name of the key. |
| key-version | string | yes | The version of the key. |
| body | object | yes | JSON request body |

### Encrypts an arbitrary sequence of bytes using an encryption key that is stored in a key vault.
`POST https://apizie.tech/v1/cloud:azure-keyvault-keys/encrypt` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | Your KeyVaultClient endpoint URL, for example https://myresource.azure.com |
| api-version | string | no | The API version to use for this operation. |
| key-name | string | yes | The name of the key. |
| key-version | string | yes | The version of the key. |
| body | object | yes | JSON request body |

### Releases a key.
`POST https://apizie.tech/v1/cloud:azure-keyvault-keys/release` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | Your KeyVaultClient endpoint URL, for example https://myresource.azure.com |
| api-version | string | no | The API version to use for this operation. |
| key-name | string | yes | The name of the key to get. |
| key-version | string | yes | Adding the version parameter retrieves a specific version of a key. |
| body | object | yes | JSON request body |

### Creates a signature from a digest using the specified key.
`POST https://apizie.tech/v1/cloud:azure-keyvault-keys/sign` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | Your KeyVaultClient endpoint URL, for example https://myresource.azure.com |
| api-version | string | no | The API version to use for this operation. |
| key-name | string | yes | The name of the key. |
| key-version | string | yes | The version of the key. |
| body | object | yes | JSON request body |

### Unwraps a symmetric key using the specified key that was initially used for wrapping that key.
`POST https://apizie.tech/v1/cloud:azure-keyvault-keys/unwrap-key` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | Your KeyVaultClient endpoint URL, for example https://myresource.azure.com |
| api-version | string | no | The API version to use for this operation. |
| key-name | string | yes | The name of the key. |
| key-version | string | yes | The version of the key. |
| body | object | yes | JSON request body |

### Verifies a signature using a specified key.
`POST https://apizie.tech/v1/cloud:azure-keyvault-keys/verify` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | Your KeyVaultClient endpoint URL, for example https://myresource.azure.com |
| api-version | string | no | The API version to use for this operation. |
| key-name | string | yes | The name of the key. |
| key-version | string | yes | The version of the key. |
| body | object | yes | JSON request body |

### Wraps a symmetric key using a specified key.
`POST https://apizie.tech/v1/cloud:azure-keyvault-keys/wrap-key` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | Your KeyVaultClient endpoint URL, for example https://myresource.azure.com |
| api-version | string | no | The API version to use for this operation. |
| key-name | string | yes | The name of the key. |
| key-version | string | yes | The version of the key. |
| body | object | yes | JSON request body |

### Requests that a backup of the specified key be downloaded to the client.
`POST https://apizie.tech/v1/cloud:azure-keyvault-keys/backup-key` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | Your KeyVaultClient endpoint URL, for example https://myresource.azure.com |
| api-version | string | no | The API version to use for this operation. |
| key-name | string | yes | The name of the key. |

### Creates a new key, stores it, then returns key parameters and attributes to the client.
`POST https://apizie.tech/v1/cloud:azure-keyvault-keys/create-key` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | Your KeyVaultClient endpoint URL, for example https://myresource.azure.com |
| api-version | string | no | The API version to use for this operation. |
| key-name | string | yes | The name for the new key. The system will generate the version name for the new key. The value you provide may be copied globally for the… |
| body | object | yes | JSON request body |

### Creates a new key version, stores it, then returns key parameters, attributes and policy to the client.
`POST https://apizie.tech/v1/cloud:azure-keyvault-keys/rotate-key` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | Your KeyVaultClient endpoint URL, for example https://myresource.azure.com |
| api-version | string | no | The API version to use for this operation. |
| key-name | string | yes | The name of key to be rotated. The system will generate a new version in the specified key. |

### Lists the policy for a key.
`GET https://apizie.tech/v1/cloud:azure-keyvault-keys/get-key-rotation-policy` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | Your KeyVaultClient endpoint URL, for example https://myresource.azure.com |
| api-version | string | no | The API version to use for this operation. |
| key-name | string | yes | The name of the key in a given key vault. |

### Updates the rotation policy for a key.
`POST https://apizie.tech/v1/cloud:azure-keyvault-keys/update-key-rotation-policy` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | Your KeyVaultClient endpoint URL, for example https://myresource.azure.com |
| api-version | string | no | The API version to use for this operation. |
| key-name | string | yes | The name of the key in the given vault. |
| body | object | yes | JSON request body |

### Retrieves a list of individual key versions with the same key name.
`GET https://apizie.tech/v1/cloud:azure-keyvault-keys/get-key-versions` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | Your KeyVaultClient endpoint URL, for example https://myresource.azure.com |
| api-version | string | no | The API version to use for this operation. |
| key-name | string | yes | The name of the key. |
| maxresults | integer | no | Maximum number of results to return in a page. If not specified the service will return up to 25 results. |

### Restores a backed up key to a vault.
`POST https://apizie.tech/v1/cloud:azure-keyvault-keys/restore-key` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | Your KeyVaultClient endpoint URL, for example https://myresource.azure.com |
| api-version | string | no | The API version to use for this operation. |
| body | object | yes | JSON request body |

### Get the requested number of bytes containing random values.
`POST https://apizie.tech/v1/cloud:azure-keyvault-keys/get-random-bytes` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| vaultBaseUrl | string | yes | Your KeyVaultClient endpoint URL, for example https://myresource.azure.com |
| api-version | string | no | The API version to use for this operation. |
| body | object | yes | JSON request body |

## Example
```
curl "https://apizie.tech/v1/cloud:azure-keyvault-keys/get-deleted-keys" \
  -H "x-api-key: $APIZIE_KEY" \
  -H "x-upstream-key: $PROVIDER_KEY"
```

## FAQ

### How do I call the KeyVaultClient API?
Create a free Apizie key, then send GET https://apizie.tech/v1/cloud:azure-keyvault-keys/get-deleted-keys with the header x-api-key. Every endpoint returns { project, data, timestamp }.

### Is the KeyVaultClient API free on Apizie?
Yes. The Free plan includes 1,000 requests a month at 100 requests a minute, no credit card. KeyVaultClient itself also needs your own key from azure.com.

### Can AI agents use the KeyVaultClient API?
Yes. Add the Apizie MCP server (https://apizie.tech/mcp) to Claude, ChatGPT, Cursor or VS Code, then ask in plain language. The agent calls run_scraper with project key cloud:azure-keyvault-keys.

### What is the status of the KeyVaultClient API?
Needs your own provider key (bring your own key)