Package: azure-keyvault-keys
Azure Key Vault Keys client library for PythonAzure Key Vault helps solve the following problems:Cryptographic key management (this library) - create, store, and control
access to the keys used to encrypt your dataSecrets management
(azure-keyvault-secrets) -
securely store and control access to tokens, passwords, certificates, API keys,
and other secretsCertificate management
(azure-keyvault-certificates) -
create, manage, and deploy public and private SSL/TLS certificatesVault administration (azure-keyvault-administration) - role-based access control (RBAC), and vault-level backup and restore optionsSource code|Package (PyPI)|Package (Conda)|API reference documentation|Product documentation|SamplesDisclaimerAzure SDK Python packages support for Python 2.7 has ended 01 January 2022. For more information and questions, please refer tohttps://github.com/Azure/azure-sdk-for-python/issues/20691.Python 3.8 or later is required to use this package. For more details, please refer toAzure SDK for Python version support policy.Getting startedInstall the packageInstallazure-keyvault-keysandazure-identitywithpip:pipinstallazure-keyvault-keysazure-identityazure-identityis used for Azure Active Directory authentication as demonstrated below.PrerequisitesAnAzure subscriptionPython 3.8 or laterAn existingAzure Key Vault. If you need to create one, you can do so using the Azure CLI by following the steps inthis document.If using Managed HSM, an existingKey Vault Managed HSM. If you need to create a Managed HSM, you can do so using the Azure CLI by following the steps inthis document.Authenticate the clientIn order to interact with the Azure Key Vault service, you will need an instance of aKeyClient, as
well as avault URLand a credential object. This document demonstrates using aDefaultAzureCredential, which is appropriate for most scenarios. We recommend using amanaged identityfor authentication in production environments.Seeazure-identitydocumentation for more information about other methods of authentication and their
corresponding credential types.Create a clientAfter configuring your environment for theDefaultAzureCredentialto use a suitable method of
authentication, you can do the following to create a key client (replacing the value ofVAULT_URLwith your vault's
URL):fromazure.identityimportDefaultAzureCredentialfromazure.keyvault.keysimportKeyClientVAULT_URL=os.environ["VAULT_URL"]credential=DefaultAzureCredential()client=KeyClient(vault_url=VAULT_URL,credential=credential)NOTE:For an asynchronous client, importazure.keyvault.keys.aio'sKeyClientinstead.Key conceptsKeysAzure Key Vault can create and store RSA and elliptic curve keys. Both can optionally be protected by hardware security
modules (HSMs). Azure Key Vault can also perform cryptographic operations with them. For more information about keys
and supported operations and algorithms, see theKey Vault documentation.KeyClientcan create keys in the vault, get existing keys
from the vault, update key metadata, and delete keys, as shown in theexamplesbelow.ExamplesThis section contains code snippets covering common tasks:Create a keyRetrieve a keyUpdate an existing keyDelete a keyConfigure automatic key rotationList keysPerform cryptographic operationsAsync APIAsynchronously create a keyAsynchronously list keysCreate a keyThecreate_keymethod can be
used by aKeyClientto create a key of any type -- alternatively, specific helpers such ascreate_rsa_keyandcreate_ec_keycreate RSA and elliptic curve keys in the vault, respectively. If a key with the same name already exists, a new version
of that key is created.fromazure.identityimportDefaultAzureCredentialfromazure.keyvault.keysimportKeyClientcredential=DefaultAzureCredential()key_client=KeyClient(vault_url="https://my-key-vault.vault.azure.net/",credential=credential)# Create an RSA keyrsa_key=key_client.create_rsa_key("rsa-key-name",size=2048)print(rsa_key.name)print(rsa_key.key_type)# Create an elliptic curve keyec_key=key_client.create_ec_key("ec-key-name",curve="P-256")print(ec_key.name)print(ec_key.key_type)Retrieve a keyget_keyretrieves a key
previously stored in the Vault.fromazure.identityimportDefaultAzureCredentialfromazure.keyvault.keysimportKeyClientcredential=DefaultAzureCredential()key_client=KeyClient(vault_url="https://my-key-vault.vault.azure.net/",credential=credential)key=key_client.get_key("key-name")print(key.name)Update an existing keyupdate_key_propertiesupdates the properties of a key previously stored in the Key Vault.fromazure.identityimportDefaultAzureCredentialfromazure.keyvault.keysimportKeyClientcredential=DefaultAzureCredential()key_client=KeyClient(vault_url="https://my-key-vault.vault.azure.net/",credential=credential)# we will now disable the key for further useupdated_key=key_client.update_key_properties("key-name",enabled=False)print(updated_key.name)print(updated_key.properties.enabled)Delete a keybegin_delete_keyrequests Key Vault delete a key, returning a poller which allows you to wait for the deletion to finish. Waiting is
helpful when the vault hassoft-deleteenabled, and you want to purge (permanently delete) the key as
soon as possible. Whensoft-deleteis disabled,begin_delete_keyitself is permanent.fromazure.identityimportDefaultAzureCredentialfromazure.keyvault.keysimportKeyClientcredential=DefaultAzureCredential()key_client=KeyClient(vault_url="https://my-key-vault.vault.azure.net/",credential=credential)deleted_key=key_client.begin_delete_key("key-name").result()print(deleted_key.name)print(deleted_key.deleted_date)Configure automatic key rotationupdate_key_rotation_policycan be used by aKeyClientto configure automatic key rotation for a key by specifying a rotation policy.fromazure.keyvault.keysimportKeyRotationLifetimeAction,KeyRotationPolicy,KeyRotationPolicyAction# Here we set the key's automated rotation policy to rotate the key two months after the key was created.# If you pass an empty KeyRotationPolicy() as the `policy` parameter, the rotation policy will be set to the# default policy. Any keyword arguments will update specified properties of the policy.actions=[KeyRotationLifetimeAction(KeyRotationPolicyAction.rotate,time_after_create="P2M")]updated_policy=client.update_key_rotation_policy("rotation-sample-key",policy=KeyRotationPolicy(),expires_in="P90D",lifetime_actions=actions)assertupdated_policy.expires_in=="P90D"In addition,rotate_keyallows you to rotate a key on-demand by creating a new version of the given key.rotated_key=client.rotate_key("rotation-sample-key")print(f"Rotated the key on-demand; new version is{rotated_key.properties.version}")List keyslist_properties_of_keyslists the properties of all of the keys in the client's vault.fromazure.identityimportDefaultAzureCredentialfromazure.keyvault.keysimportKeyClientcredential=DefaultAzureCredential()key_client=KeyClient(vault_url="https://my-key-vault.vault.azure.net/",credential=credential)keys=key_client.list_properties_of_keys()forkeyinkeys:# the list doesn't include values or versions of the keysprint(key.name)Cryptographic operationsCryptographyClientenables cryptographic operations (encrypt/decrypt, wrap/unwrap, sign/verify) using a particular key.fromazure.identityimportDefaultAzureCredentialfromazure.keyvault.keysimportKeyClientfromazure.keyvault.keys.cryptoimportCryptographyClient,EncryptionAlgorithmcredential=DefaultAzureCredential()key_client=KeyClient(vault_url="https://my-key-vault.vault.azure.net/",credential=credential)key=key_client.get_key("key-name")crypto_client=CryptographyClient(key,credential=credential)plaintext=b"plaintext"result=crypto_client.encrypt(EncryptionAlgorithm.rsa_oaep,plaintext)decrypted=crypto_client.decrypt(result.algorithm,result.ciphertext)See thepackage documentationfor more details of the cryptography API.Async APIThis library includes a complete set of async APIs. To use them, you must
first install an async transport, such asaiohttp.
Seeazure-core documentationfor more information.Async clients and credentials should be closed when they're no longer needed. These
objects are async context managers and define asyncclosemethods. For
example:fromazure.identity.aioimportDefaultAzureCredentialfromazure.keyvault.keys.aioimportKeyClientcredential=DefaultAzureCredential()# call close when the client and credential are no longer neededclient=KeyClient(vault_url="https://my-key-vault.vault.azure.net/",credential=credential)...awaitclient.close()awaitcredential.close()# alternatively, use them as async context managers (contextlib.AsyncExitStack can help)client=KeyClient(vault_url="https://my-key-vault.vault.azure.net/",credential=credential)asyncwithclient:asyncwithcredential:...Asynchronously create a keycreate_rsa_keyandcreate_ec_keycreate RSA and elliptic curve keys in the vault, respectively. If a key with the same name already exists, a new
version of the key is created.fromazure.identity.aioimportDefaultAzureCredentialfromazure.keyvault.keys.aioimportKeyClientcredential=DefaultAzureCredential()key_client=KeyClient(vault_url="https://my-key-vault.vault.azure.net/",credential=credential)# Create an RSA keyrsa_key=awaitkey_client.create_rsa_key("rsa-key-name",size=2048)print(rsa_key.name)print(rsa_key.key_type)# Create an elliptic curve keyec_key=awaitkey_client.create_ec_key("ec-key-name",curve="P-256")print(ec_key.name)print(ec_key.key_type)Asynchronously list keyslist_properties_of_keyslists the properties of all of the keys in the client's vault.fromazure.identity.aioimportDefaultAzureCredentialfromazure.keyvault.keys.aioimportKeyClientcredential=DefaultAzureCredential()key_client=KeyClient(vault_url="https://my-key-vault.vault.azure.net/",credential=credential)keys=key_client.list_properties_of_keys()asyncforkeyinkeys:print(key.name)TroubleshootingSee theazure-keyvault-keystroubleshooting guidefor details on how to diagnose various failure scenarios.GeneralKey Vault clients raise exceptions defined inazure-core.
For example, if you try to get a key that doesn't exist in the vault,KeyClientraisesResourceNotFoundError:fromazure.identityimportDefaultAzureCredentialfromazure.keyvault.keysimportKeyClientfromazure.core.exceptionsimportResourceNotFoundErrorcredential=DefaultAzureCredential()key_client=KeyClient(vault_url="https://my-key-vault.vault.azure.net/",credential=credential)try:key_client.get_key("which-does-not-exist")exceptResourceNotFoundErrorase:print(e.message)LoggingThis library uses the standardlogginglibrary for logging.
Basic information about HTTP sessions (URLs, headers, etc.) is logged at INFO
level.Detailed DEBUG level logging, including request/response bodies and unredacted
headers, can be enabled on a client with thelogging_enableargument:fromazure.identityimportDefaultAzureCredentialfromazure.keyvault.keysimportKeyClientimportsysimportlogging# Create a logger for the 'azure' SDKlogger=logging.getLogger('azure')logger.setLevel(logging.DEBUG)# Configure a console outputhandler=logging.StreamHandler(stream=sys.stdout)logger.addHandler(handler)credential=DefaultAzureCredential()# This client will log detailed information about its HTTP sessions, at DEBUG levelclient=KeyClient(vault_url="https://my-key-vault.vault.azure.net/",credential=credential,logging_enable=True)Similarly,logging_enablecan enable detailed logging for a single operation,
even when it isn't enabled for the client:client.get_key("my-key",logging_enable=True)Next stepsSeveral samples are available in the Azure SDK for Python GitHub repository.
These provide example code for additional Key Vault scenarios:Create/get/update/delete keys(async version)Basic list operations for keys(async version)Back up and recover keys(async version)Recover and purge keys(async version)Create/update key rotation policies and rotate keys on-demand(async version)Use thesend_requestclient methodAdditional documentationFor more extensive documentation on Azure Key Vault, see theAPI reference documentation.ContributingThis project welcomes contributions and suggestions. Most contributions require
you to agree to a Contributor License Agreement (CLA) declaring that you have
the right to, and actually do, grant us the rights to use your contribution.
For details, visithttps://cla.microsoft.com.When you submit a pull request, a CLA-bot will automatically determine whether
you need to provide a CLA and decorate the PR appropriately (e.g., label,
comment). Simply follow the instructions provided by the bot. You will only
need to do this once across all repos using our CLA.This project has adopted theMicrosoft Open Source Code of Conduct.
For more information, see theCode of Conduct FAQor
contactopencode@microsoft.comwith any additional questions or comments.Release History4.9.0 (2024-02-22)Features AddedAdded support for service API version7.5(From 4.9.0b2) Thecryptographylibrary'sRSAPrivateKeyandRSAPublicKeyinterfaces are now implemented byKeyVaultRSAPrivateKeyandKeyVaultRSAPublicKeyclasses that can use keys managed by Key Vault(From 4.9.0b2)CryptographyClienthascreate_rsa_private_keyandcreate_rsa_public_keymethods that return aKeyVaultRSAPrivateKeyandKeyVaultRSAPublicKey, respectively(From 4.9.0b3) AddedKeyProperties.hsm_platformto get the underlying HSM platformBugs Fixed(From 4.9.0b1) Token requests made during AD FS authentication no longer specify an erroneous "adfs" tenant ID
(#29888)Other ChangesPython 3.7 is no longer supported. Please use Python version 3.8 or later.asynciois no longer directly referenced by the library
(#33819)Updated minimumazure-coreversion to 1.29.5Droppedazure-commonrequirement4.9.0b3 (2023-11-03)Features AddedAdded support for service API version7.5-preview.1AddedKeyProperties.hsm_platformto get the underlying HSM platformOther ChangesKey Vault API version7.5-preview.1is now the default4.9.0b2 (2023-10-12)Features AddedThecryptographylibrary'sRSAPrivateKeyandRSAPublicKeyinterfaces are now implemented byKeyVaultRSAPrivateKeyandKeyVaultRSAPublicKeyclasses that can use keys managed by Key VaultCryptographyClienthascreate_rsa_private_keyandcreate_rsa_public_keymethods that return aKeyVaultRSAPrivateKeyandKeyVaultRSAPublicKey, respectively4.9.0b1 (2023-05-16)Bugs FixedToken requests made during AD FS authentication no longer specify an erroneous "adfs" tenant ID
(#29888)4.8.0 (2023-03-16)Features AddedAdded support for service API version7.4Clients each have asend_requestmethod that can be used to send custom requests using the
client's existing pipeline (#25172)(From 4.8.0b1) An attempt will be made to generate an IV if one isn't provided for local encryption
(#25380)Breaking ChangesThese changes do not impact the API of stable versions such as 4.7.0. Only code written against a beta version such as 4.8.0b2 may be affected.Removed support for octet key pair (OKP) keys and operationsOther ChangesKey Vault API version7.4is now the default(From 4.8.0b1) Python 3.6 is no longer supported. Please use Python version 3.7 or later.(From 4.8.0b1) Updated minimumazure-coreversion to 1.24.0(From 4.8.0b1) Updated minimummsrestversion to 0.7.1(From 4.8.0b2) Droppedmsrestrequirement(From 4.8.0b2) Droppedsixrequirement(From 4.8.0b2) Added requirement forisodate>=0.6.1(isodatewas required bymsrest)(From 4.8.0b2) Added requirement fortyping-extensions>=4.0.14.8.0b2 (2022-11-15)Features AddedAdded support for service API version7.4-preview.1KeyClienthas acreate_okp_keymethod to create an octet key pair (OKP) on Managed HSMAddededdsatoSignatureAlgorithmenum to support signing and verifying using an
Edwards-Curve Digital Signature Algorithm (EdDSA) on Managed HSMAddedokpandokp_hsmtoKeyTypeenum for octet key pairsAddeded25519toKeyCurveNameenum to support use of the Ed25519 Edwards curveOther ChangesKey Vault API version7.4-preview.1is now the defaultDroppedmsrestrequirementDroppedsixrequirementAdded requirement forisodate>=0.6.1(isodatewas required bymsrest)Added requirement fortyping-extensions>=4.0.14.8.0b1 (2022-09-22)Features AddedAn attempt will be made to generate an IV if one isn't provided for local encryption
(#25380)Other ChangesPython 3.6 is no longer supported. Please use Python version 3.7 or later.Updated minimumazure-coreversion to 1.24.0Updated minimummsrestversion to 0.7.14.7.0 (2022-09-19)Breaking ChangesClients verify the challenge resource matches the vault domain. This should affect few customers,
who can provideverify_challenge_resource=Falseto client constructors to disable.
Seehttps://aka.ms/azsdk/blog/vault-urifor more information.Other ChangesChanges from version 4.7.0b1 have been reverted and will be included in version 4.8.0b14.7.0b1 (2022-08-12)Features AddedAn attempt will be made to generate an IV if one isn't provided for local encryption
(#25380)Other ChangesThe most recent release was version 4.6.1 instead of the intended version, 4.5.2.
The next stable release is planned to be version 4.7.0.Python 3.6 is no longer supported. Please use Python version 3.7 or later.Updated minimumazure-coreversion to 1.24.04.6.1 (2022-08-11)Other ChangesDocumentation improvements
(#25039)4.6.0b1 (2022-06-07)Bugs FixedIf a key's ID contains a port number, this port will now be preserved in the vault URL of aCryptographyClientinstance created from this key
(#24446)Port numbers are now preserved in thevault_urlproperty of aKeyVaultKeyIdentifier4.5.1 (2022-04-18)Bugs FixedFixed error that could occur when fetching a key rotation policy that has no definedlifetime_actions.4.5.0 (2022-03-28)Features AddedKey Vault API version 7.3 is now the defaultAdded support for multi-tenant authentication when usingazure-identity1.8.0 or newer (#20698)(From 4.5.0b1)KeyClienthas aget_random_bytesmethod for getting a requested number of
random bytes from a managed HSM(From 4.5.0b2) Added support for secure key release from a Managed HSM
(#19588)Addedrelease_keymethod toKeyClientfor releasing the private component of a keyAddedexportableandrelease_policykeyword-only arguments to key creation and import
methodsAddedKeyExportEncryptionAlgorithmenum for specifying an encryption algorithm to be used
in key release(From 4.5.0b4) AddedKeyClient.get_cryptography_client, which provides a simple way to
create aCryptographyClientfor a key, given its name and optionally a version
(#20621)(From 4.5.0b4) Added support for automated and on-demand key rotation in Azure Key Vault
(#19840)AddedKeyClient.rotate_keyto rotate a key on-demandAddedKeyClient.update_key_rotation_policyto update a key's automated rotation policy(From 4.5.0b6) Addedimmutablekeyword-only argument and property toKeyReleasePolicyto
support immutable release policies. Once a release policy is marked as immutable, it can no
longer be modified.Breaking ChangesThese changes do not impact the API of stable versions such as 4.4.0.
Only code written against a beta version such as 4.5.0b1 may be affected.KeyClient.update_key_rotation_policyaccepts a requiredpolicyargument
(#22981)The optionalversionparameter inKeyClient.release_keyis now a keyword-only argument
(#22981)Renamed thenameparameter inKeyClient.get_key_rotation_policyandKeyClient.update_key_rotation_policytokey_name(#22981)Enum values inazure-keyvault-keysare now uniformly lower-cased
(#22981)Bugs FixedKeyTypenow ignores casing during declaration, which resolves a scenario where Key Vault
keys created with non-standard casing could not be fetched with the SDK
(#22797)Other Changes(From 4.5.0b6) Python 2.7 is no longer supported. Please use Python version 3.6 or later.(From 4.5.0b6) Updated minimumazure-coreversion to 1.20.0(From 4.5.0b3) Updated type hints to fix mypy errors
(#19158)(From 4.5.0b4)CryptographyClientno longer requires a key version when providing a key ID to its constructor
(though providing a version is still recommended)(From 4.5.0b5) To support multi-tenant authentication,get_tokencalls during challenge
authentication requests now pass in atenant_idkeyword argument
(#20698). Seehttps://aka.ms/azsdk/python/identity/tokencredentialfor more details on how to integrate
this parameter ifget_tokenis implemented by a custom credential.(From 4.5.0b6) Updated type hints forKeyPropertiesmodel'smanaged,exportable, andrelease_policyproperties (#22368)4.5.0b6 (2022-02-08)Features AddedAddedimmutablekeyword-only argument and property toKeyReleasePolicyto support immutable
release policies. Once a release policy is marked as immutable, it can no longer be modified.Breaking ChangesThese changes do not impact the API of stable versions such as 4.4.0.
Only code written against a beta version such as 4.5.0b1 may be affected.Renamed the required argumentdatainKeyReleasePolicy's constructor toencoded_policyOther ChangesPython 2.7 is no longer supported. Please use Python version 3.6 or later.Updated minimumazure-coreversion to 1.20.0Updated type hints forKeyPropertiesmodel'smanaged,exportable, andrelease_policyproperties (#22368)(From 4.5.0b5) To support multi-tenant authentication,get_tokencalls during challenge
authentication requests now pass in atenant_idkeyword argument
(#20698)4.5.0b5 (2021-11-11)Features AddedAdded support for multi-tenant authentication when usingazure-identity1.7.1 or newer
(#20698)Breaking ChangesThese changes do not impact the API of stable versions such as 4.4.0.
Only code written against a beta version such as 4.5.0b1 may be affected.KeyClient.get_random_bytesnow returns bytes instead of RandomBytes. The RandomBytes class
has been removedRenamed theversionkeyword-only argument inKeyClient.get_cryptography_clienttokey_versionRenamedKeyReleasePolicy.datatoKeyReleasePolicy.encoded_policyRenamed thetargetparameter inKeyClient.release_keytotarget_attestation_tokenOther ChangesUpdated minimumazure-coreversion to 1.15.04.5.0b4 (2021-10-07)Features AddedAddedKeyClient.get_cryptography_client, which provides a simple way to create aCryptographyClientfor a key, given its name and optionally a version
(#20621)Added support for automated and on-demand key rotation in Azure Key Vault
(#19840)AddedKeyClient.rotate_keyto rotate a key on-demandAddedKeyClient.update_key_rotation_policyto update a key's automated rotation policyOther ChangesCryptographyClientno longer requires a key version when providing a key ID to its constructor
(though providing a version is still recommended)4.5.0b3 (2021-09-09)Other ChangesUpdated type hints to fix mypy errors
(#19158)4.5.0b2 (2021-08-10)Features AddedAdded support for secure key release from a Managed HSM
(#19588)Addedrelease_keymethod toKeyClientfor releasing the private component of a keyAddedexportableandrelease_policykeyword-only arguments to key creation and import
methodsAddedKeyExportEncryptionAlgorithmenum for specifying an encryption algorithm to be used
in key releaseBreaking ChangesThese changes do not impact the API of stable versions such as 4.4.0.
Only code written against a beta version such as 4.5.0b1 may be affected.KeyClient.get_random_bytesnow returns aRandomBytesmodel with bytes in avalueproperty, rather than returning the bytes directly
(#19895)4.5.0b1 (2021-07-08)Beginning with this release, this library requires Python 2.7 or 3.6+.Features AddedKey Vault API version 7.3-preview is now the defaultKeyClienthas aget_random_bytesmethod for getting a requested number of random
bytes from a managed HSM4.4.0 (2021-06-22)This is the last version to support Python 3.5. The next version will require Python 2.7 or 3.6+.ChangedKey Vault API version 7.2 is now the default(From 4.4.0b1) Updated minimummsrestversion to 0.6.21AddedKeyClienthas acreate_oct_keymethod for creating symmetric keysKeyClient'screate_keyandcreate_rsa_keymethods now accept apublic_exponentkeyword-only argument (#18016)(From 4.4.0b1) Added support for Key Vault API version 7.2
(#16566)Addedoct_hsmtoKeyTypeAdded 128-, 192-, and 256-bit AES-GCM, AES-CBC, and AES-CBCPAD encryption
algorithms toEncryptionAlgorithmAdded 128- and 192-bit AES-KW key wrapping algorithms toKeyWrapAlgorithmCryptographyClient'sencryptmethod acceptsivandadditional_authenticated_datakeyword argumentsCryptographyClient'sdecryptmethod acceptsiv,additional_authenticated_data, andauthentication_tagkeyword argumentsAddediv,aad, andtagproperties toEncryptResult(From 4.4.0b3)CryptographyClientwill perform all operations locally if initialized with
the.from_jwkfactory method
(#16565)(From 4.4.0b3) Added requirement forsix>=1.12.0(From 4.4.0b4)CryptographyClientcan perform AES-CBCPAD encryption and decryption locally
(#17762)Breaking ChangesThese changes do not impact the API of stable versions such as 4.3.1.
Only code written against a beta version such as 4.4.0b1 may be affected.parse_key_vault_key_idandKeyVaultResourceIdhave been replaced by aKeyVaultKeyIdentifierclass, which can be initialized with a key ID4.4.0b4 (2021-04-06)AddedCryptographyClientcan perform AES-CBCPAD encryption and decryption locally
(#17762)4.4.0b3 (2021-03-11)AddedCryptographyClientwill perform all operations locally if initialized with
the.from_jwkfactory method
(#16565)Added requirement for six>=1.12.04.4.0b2 (2021-02-10)FixedAPI versions older than 7.2-preview no longer raiseImportErrorwhen
performing async operations (#16680)4.4.0b1 (2021-02-10)ChangedKey Vault API version 7.2-preview is now the defaultUpdated msrest requirement to >=0.6.21AddedSupport for Key Vault API version 7.2-preview
(#16566)Addedoct_hsmtoKeyTypeAdded 128-, 192-, and 256-bit AES-GCM, AES-CBC, and AES-CBCPAD encryption
algorithms toEncryptionAlgorithmAdded 128- and 192-bit AES-KW key wrapping algorithms toKeyWrapAlgorithmCryptographyClient'sencryptmethod acceptsivandadditional_authenticated_datakeyword argumentsCryptographyClient'sdecryptmethod acceptsiv,additional_authenticated_data, andauthentication_tagkeyword argumentsAddediv,aad, andtagproperties toEncryptResultAdded methodparse_key_vault_key_idthat parses out a full ID returned by
Key Vault, so users can easily access the key'sname,vault_url, andversion.4.3.1 (2020-12-03)FixedCryptographyClientoperations no longer raiseAttributeErrorwhen
the client was constructed with a key ID
(#15608)4.3.0 (2020-10-06)ChangedCryptographyClientcan perform decrypt and sign operations locally
(#9754)FixedCorrect typing for async paging methods4.2.0 (2020-08-11)FixedValues ofx-ms-keyvault-regionandx-ms-keyvault-service-versionheaders
are no longer redacted in logging outputCryptographyClientwill no longer perform encrypt or wrap operations when
its key has expired or is not yet validChangedKey Vault API version 7.1 is now the defaultUpdated minimumazure-coreversion to 1.7.0AddedAt construction, clients accept aCustomHookPolicythrough the optional
keyword argumentcustom_hook_policyAll client requests include a unique ID in the headerx-ms-client-request-idDependency onazure-commonfor multiapi support4.2.0b1 (2020-03-10)Support for Key Vault API version 7.1-preview
(#10124)Addedimport_keytoKeyOperationAddedrecoverable_daystoCertificatePropertiesAddedApiVersionenum identifying Key Vault versions supported by this package4.1.0 (2020-03-10)KeyClientinstances have aclosemethod which closes opened sockets. Used
as a context manager, aKeyClientcloses opened sockets on exit.
(#9906)Pollers no longer sleep after operation completion
(#9991)4.0.1 (2020-02-11)azure.keyvault.keysdefines__version__Challenge authentication policy preserves request options
(#8999)Updatedmsrestrequirement to >=0.6.0Challenge authentication policy requires TLS
(#9457)Methods no longer raise the internal errorKeyVaultErrorException(#9690)FixAttributeErrorin async CryptographyClient when verifying signatures remotely
(#9734)4.0.0 (2019-10-31)Breaking changes:RemovedKeyClient.get_cryptography_client()andCryptographyClient.get_key()Moved the optional parameters of several methods into kwargs (docsdetail the new keyword arguments):create_keynow has positional parametersnameandkey_typecreate_ec_keyandcreate_rsa_keynow have one positional parameter,nameupdate_key_propertiesnow has two positional parameters,nameand
(optional)versionimport_keynow has positional parametersnameandkeyCryptographyClientoperations return class instances instead of tuples and renamed the following
propertiesRenamed thedecrypted_bytesproperty ofDecryptResulttoplaintextRenamed theunwrapped_bytesproperty ofUnwrapResulttokeyRenamed theresultproperty ofVerifyResulttois_validRenamed theUnwrapKeyResultandWrapKeyResultclasses toUnwrapResultandWrapResultRenamedlist_keystolist_properties_of_keysRenamedlist_key_versionstolist_properties_of_key_versionsRenamed sync methoddelete_keytobegin_delete_keyThe sync methodbegin_delete_keyand asyncdelete_keynow return pollers that return aDeletedKeyRenamedKeytoKeyVaultKeyKeyVaultKeypropertiescreated,expires, andupdatedrenamed tocreated_on,expires_on, andupdated_onThevault_endpointparameter ofKeyClienthas been renamed tovault_urlThe propertyvault_endpointhas been renamed tovault_urlin all modelsNew features:Now allCryptographyClientreturns includekey_idandalgorithmproperties4.0.0b4 (2019-10-08)EnumsJsonWebKeyCurveName,JsonWebKeyOperation, andJsonWebKeyTypehave
been renamed toKeyCurveName,KeyOperation, andKeyType, respectively.Keynow has attributeproperties, which holds certain properties of the
key, such asversion. This changes the shape of the returnedKeytype,
as certain properties ofKey(such asversion) have to be accessed
through thepropertiesproperty.update_keyhas been renamed toupdate_key_propertiesThevault_urlparameter ofKeyClienthas been renamed tovault_endpointThe propertyvault_urlhas been renamed tovault_endpointin all modelsFixes and improvements:Thekeyargument toimport_keyshould be an instance ofazure.keyvault.keys.JsonWebKey(#7590)4.0.0b3 (2019-09-11)Breaking changes:CryptographyClientmethodswrapandunwrapare renamedwrap_keyandunwrap_key, respectively.New features:CryptographyClientperforms encrypt, verify and wrap operations locally
when its key's public material is available (i.e., when it has keys/get
permission).4.0.0b2 (2019-08-06)Breaking changes:Removedazure.core.Configurationfrom the public API in preparation for a
revamped configuration API. Staticcreate_configmethods have been renamed_create_config, and will be removed in a future release.Removedwrap_keyandunwrap_keyfromKeyClient. These are now available
throughCryptographyClient.This version of the library requiresazure-core1.0.0b2If you later want to revert to a version requiring azure-core 1.0.0b1,
of this or another Azure SDK library, you must explicitly install azure-core
1.0.0b1 as well. For example:pip install azure-core==1.0.0b1 azure-keyvault-keys==4.0.0b1New features:AddedCryptographyClient, a client for performing cryptographic operations
(encrypt/decrypt, wrap/unwrap, sign/verify) with a key.Distributed tracing framework OpenCensus is now supportedAdded support for HTTP challenge based authentication, allowing clients to
interact with vaults in sovereign clouds.Other changes:Async clients useaiohttpfor transport
by default. Seeazure-core documentationfor more information about using other transports.4.0.0b1 (2019-06-28)Version 4.0.0b1 is the first preview of our efforts to create a user-friendly
and Pythonic client library for Azure Key Vault. For more information about
preview releases of other Azure SDK libraries, please visithttps://aka.ms/azure-sdk-preview1-python.This library is not a direct replacement forazure-keyvault. Applications
using that library would require code changes to useazure-keyvault-keys.
This package'sdocumentationandsamplesdemonstrate the new API.Major changes fromazure-keyvaultPackages scoped by functionalityazure-keyvault-keyscontains a client for key operations,azure-keyvault-secretscontains a client for secret operationsClient instances are scoped to vaults (an instance interacts with one vault
only)Asynchronous API supported on Python 3.5.3+theazure.keyvault.keys.aionamespace contains an async equivalent of
the synchronous client inazure.keyvault.keysAuthentication usingazure-identitycredentialssee this package'sdocumentation, and theAzure Identity documentationfor more informationazure-keyvaultfeatures not implemented in this releaseCertificate management APIsCryptographic operations, e.g. sign, un/wrap_key, verify, en- and
decryptNational cloud support. This release supports public global cloud vaults,
e.g. https://{vault-name}.vault.azure.net