Microsoft.KeyVault (preview:7.6.2)

2025/07/10 • 11 updated methods

DeleteCertificate (updated)
Description :  Deletes all versions of a certificate object along with its associated policy. Delete certificate cannot be used to remove individual versions of a certificate object. This operation requires the certificates/delete permission.
Reference :  Link ¶

⚶ Changes

{
  "#id": "DeleteCertificate",
  "$responses": {
    "200": {
      "$properties": [
        {
          "policy": [
            {
              "x509_props": [
                {
                  "sans": [
                    {
                      "#name": "dns_names",
                      "Description": {
                        "new": "Domain Names.",
                        "old": "Domain names."
                      }
                    },
                    {
                      "#name": "upns",
                      "Description": {
                        "new": "User Principal Names.",
                        "old": "User principal names."
                      }
                    }
                  ]
                }
              ]
            }
          ]
        },
        {
          "#name": "contentType",
          "Description": {
            "new": "The content type of the secret. eg. 'application/x-pem-file' or 'application/x-pkcs12'.",
            "old": "The content type of the secret. eg. 'application/x-pem-file' or 'application/x-pkcs12',"
          }
        },
        {
          "#name": "tags",
          "Description": {
            "new": "Application specific metadata in the form of key-value pairs.",
            "old": "Application specific metadata in the form of key-value pairs"
          }
        }
      ]
    }
  }
}

⚼ Request

DELETE:  /certificates/{certificate-name}
{
api-version:
{
Description: The API version to use for this operation. ,
Required: True ,
}
string ,
certificate-name:
{
Description: The name of the certificate. ,
Required: True ,
}
string ,
}

⚐ Response (200)

{
id:
{
Description: The certificate id. ,
Required: False ,
}
string ,
kid:
{
Description: The key id. ,
Required: False ,
}
string ,
sid:
{
Description: The secret id. ,
Required: False ,
}
string ,
x5t:
{
Description: Thumbprint of the certificate. ,
Format: base64url ,
Required: False ,
}
string ,
policy:
{
Description: The management policy. ,
Required: False ,
}
{
id:
{
Description: The certificate id. ,
Required: False ,
}
string ,
key_props:
{
Description: Properties of the key backing a certificate. ,
Required: False ,
}
{
exportable:
{
Description: Indicates if the private key can be exported. Release policy must be provided when creating the first version of an exportable key. ,
Required: False ,
}
boolean ,
kty:
{
Description: The type of key pair to be used for the certificate. ,
Enum:
{
EC: Elliptic Curve. ,
EC-HSM: Elliptic Curve with a private key which is not exportable from the HSM. ,
RSA: RSA (https://tools.ietf.org/html/rfc3447). ,
RSA-HSM: RSA with a private key which is not exportable from the HSM. ,
oct: Octet sequence (used to represent symmetric keys). ,
oct-HSM: Octet sequence with a private key which is not exportable from the HSM. ,
}
,
Required: False ,
}
enum ,
key_size:
{
Description: The key size in bits. For example: 2048, 3072, or 4096 for RSA. ,
Format: int32 ,
Required: False ,
}
integer ,
reuse_key:
{
Description: Indicates if the same key pair will be used on certificate renewal. ,
Required: False ,
}
boolean ,
crv:
{
Description: Elliptic curve name. For valid values, see JsonWebKeyCurveName. ,
Enum:
{
P-256: The NIST P-256 elliptic curve, AKA SECG curve SECP256R1. ,
P-384: The NIST P-384 elliptic curve, AKA SECG curve SECP384R1. ,
P-521: The NIST P-521 elliptic curve, AKA SECG curve SECP521R1. ,
P-256K: The SECG SECP256K1 elliptic curve. ,
}
,
Required: False ,
}
enum ,
}
,
secret_props:
{
Description: Properties of the secret backing a certificate. ,
Required: False ,
}
{
contentType:
{
Description: The media type (MIME type). ,
Required: False ,
}
string ,
}
,
x509_props:
{
Description: Properties of the X509 component of a certificate. ,
Required: False ,
}
{
subject:
{
Description: The subject name. Should be a valid X509 distinguished Name. ,
Required: False ,
}
string ,
ekus:
{
Description: The enhanced key usage. ,
Required: False ,
}
[
string ,
]
,
sans:
{
Description: The subject alternative names. ,
Required: False ,
}
{
emails:
{
Description: Email addresses. ,
Required: False ,
}
[
string ,
]
,
dns_names:
{
Description: Domain Names. ,
Required: False ,
}
[
string ,
]
,
upns:
{
Description: User Principal Names. ,
Required: False ,
}
[
string ,
]
,
}
,
key_usage:
{
Description: Defines how the certificate's key may be used. ,
Required: False ,
}
[
string ,
]
,
validity_months:
{
Description: The duration that the certificate is valid in months. ,
Format: int32 ,
Required: False ,
}
integer ,
}
,
lifetime_actions:
{
Description: Actions that will be performed by Key Vault over the lifetime of a certificate. ,
Required: False ,
}
[
{
trigger:
{
Description: The condition that will execute the action. ,
Required: False ,
}
{
lifetime_percentage:
{
Description: Percentage of lifetime at which to trigger. Value should be between 1 and 99. ,
Format: int32 ,
Required: False ,
}
integer ,
days_before_expiry:
{
Description: Days before expiry to attempt renewal. Value should be between 1 and validity_in_months multiplied by 27. If validity_in_months is 36, then value should be between 1 and 972 (36 * 27). ,
Format: int32 ,
Required: False ,
}
integer ,
}
,
action:
{
Description: The action that will be executed. ,
Required: False ,
}
{
action_type:
{
Description: The type of the action. ,
Enum:
{
EmailContacts: A certificate policy that will email certificate contacts. ,
AutoRenew: A certificate policy that will auto-renew a certificate. ,
}
,
Required: False ,
}
enum ,
}
,
}
,
]
,
issuer:
{
Description: Parameters for the issuer of the X509 component of a certificate. ,
Required: False ,
}
{
name:
{
Description: Name of the referenced issuer object or reserved names; for example, 'Self' or 'Unknown'. ,
Required: False ,
}
string ,
cty:
{
Description: Certificate type as supported by the provider (optional); for example 'OV-SSL', 'EV-SSL' ,
Required: False ,
}
string ,
cert_transparency:
{
Description: Indicates if the certificates generated under this policy should be published to certificate transparency logs. ,
Required: False ,
}
boolean ,
}
,
attributes:
{
Description: The certificate attributes. ,
Required: False ,
}
{
enabled:
{
Description: Determines whether the object is enabled. ,
Required: False ,
}
boolean ,
nbf:
{
Description: Not before date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
exp:
{
Description: Expiry date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
created:
{
Description: Creation time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
updated:
{
Description: Last updated time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
recoverableDays:
{
Description: softDelete data retention days. Value should be >=7 and <=90 when softDelete enabled, otherwise 0. ,
Format: int32 ,
Required: False ,
}
integer ,
recoveryLevel:
{
Description: Reflects the deletion recovery level currently in effect for certificates in the current vault. If it contains 'Purgeable', the certificate can be permanently deleted by a privileged user; otherwise, only the system can purge the certificate, at the end of the retention interval. ,
Enum:
{
Purgeable: Denotes a vault state in which deletion is an irreversible operation, without the possibility for recovery. This level corresponds to no protection being available against a Delete operation; the data is irretrievably lost upon accepting a Delete operation at the entity level or higher (vault, resource group, subscription etc.) ,
Recoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days), unless a Purge operation is requested, or the subscription is cancelled. System wil permanently delete it after 90 days, if not recovered ,
Recoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days) and while the subscription is still available. System wil permanently delete it after 90 days, if not recovered ,
Recoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable within retention interval (90 days), immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled. System wil permanently delete it after 90 days, if not recovered ,
CustomizedRecoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90). This level guarantees the recoverability of the deleted entity during the retention interval, unless a Purge operation is requested, or the subscription is cancelled. ,
CustomizedRecoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90).This level guarantees the recoverability of the deleted entity during the retention interval and while the subscription is still available. ,
CustomizedRecoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable, immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled when 7 <= SoftDeleteRetentionInDays < 90. This level guarantees the recoverability of the deleted entity during the retention interval, and also reflects the fact that the subscription itself cannot be cancelled. ,
}
,
Required: False ,
}
enum ,
}
,
}
,
cer:
{
Description: CER contents of x509 certificate. ,
Format: byte ,
Required: False ,
}
string ,
contentType:
{
Description: The content type of the secret. eg. 'application/x-pem-file' or 'application/x-pkcs12'. ,
Required: False ,
}
string ,
attributes:
{
Description: The certificate attributes. ,
Required: False ,
}
{
enabled:
{
Description: Determines whether the object is enabled. ,
Required: False ,
}
boolean ,
nbf:
{
Description: Not before date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
exp:
{
Description: Expiry date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
created:
{
Description: Creation time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
updated:
{
Description: Last updated time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
recoverableDays:
{
Description: softDelete data retention days. Value should be >=7 and <=90 when softDelete enabled, otherwise 0. ,
Format: int32 ,
Required: False ,
}
integer ,
recoveryLevel:
{
Description: Reflects the deletion recovery level currently in effect for certificates in the current vault. If it contains 'Purgeable', the certificate can be permanently deleted by a privileged user; otherwise, only the system can purge the certificate, at the end of the retention interval. ,
Enum:
{
Purgeable: Denotes a vault state in which deletion is an irreversible operation, without the possibility for recovery. This level corresponds to no protection being available against a Delete operation; the data is irretrievably lost upon accepting a Delete operation at the entity level or higher (vault, resource group, subscription etc.) ,
Recoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days), unless a Purge operation is requested, or the subscription is cancelled. System wil permanently delete it after 90 days, if not recovered ,
Recoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days) and while the subscription is still available. System wil permanently delete it after 90 days, if not recovered ,
Recoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable within retention interval (90 days), immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled. System wil permanently delete it after 90 days, if not recovered ,
CustomizedRecoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90). This level guarantees the recoverability of the deleted entity during the retention interval, unless a Purge operation is requested, or the subscription is cancelled. ,
CustomizedRecoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90).This level guarantees the recoverability of the deleted entity during the retention interval and while the subscription is still available. ,
CustomizedRecoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable, immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled when 7 <= SoftDeleteRetentionInDays < 90. This level guarantees the recoverability of the deleted entity during the retention interval, and also reflects the fact that the subscription itself cannot be cancelled. ,
}
,
Required: False ,
}
enum ,
}
,
tags:
{
Description: Application specific metadata in the form of key-value pairs. ,
Required: False ,
}
object ,
preserveCertOrder:
{
Description: Specifies whether the certificate chain preserves its original order. The default value is false, which sets the leaf certificate at index 0. ,
Required: False ,
}
boolean ,
recoveryId:
{
Description: The url of the recovery object, used to identify and recover the deleted certificate. ,
Required: False ,
}
string ,
scheduledPurgeDate:
{
Description: The time when the certificate is scheduled to be purged, in UTC ,
Format: unixtime ,
Required: False ,
}
integer ,
deletedDate:
{
Description: The time when the certificate was deleted, in UTC ,
Format: unixtime ,
Required: False ,
}
integer ,
}

⚐ Response (default)

{
error:
{
Description: The key vault server error. ,
Required: False ,
}
{
code:
{
Description: The error code. ,
Required: False ,
}
string ,
message:
{
Description: The error message. ,
Required: False ,
}
string ,
innererror:
{
Required: False ,
}
string ,
}
,
}
GetCertificate (updated)
Description :  Gets information about a specific certificate. This operation requires the certificates/get permission.
Reference :  Link ¶

⚶ Changes

{
  "#id": "GetCertificate",
  "$responses": {
    "200": {
      "$properties": [
        {
          "policy": [
            {
              "x509_props": [
                {
                  "sans": [
                    {
                      "#name": "dns_names",
                      "Description": {
                        "new": "Domain Names.",
                        "old": "Domain names."
                      }
                    },
                    {
                      "#name": "upns",
                      "Description": {
                        "new": "User Principal Names.",
                        "old": "User principal names."
                      }
                    }
                  ]
                }
              ]
            }
          ]
        },
        {
          "#name": "contentType",
          "Description": {
            "new": "The content type of the secret. eg. 'application/x-pem-file' or 'application/x-pkcs12'.",
            "old": "The content type of the secret. eg. 'application/x-pem-file' or 'application/x-pkcs12',"
          }
        },
        {
          "#name": "tags",
          "Description": {
            "new": "Application specific metadata in the form of key-value pairs.",
            "old": "Application specific metadata in the form of key-value pairs"
          }
        }
      ]
    }
  }
}

⚼ Request

GET:  /certificates/{certificate-name}/{certificate-version}
{
api-version:
{
Description: The API version to use for this operation. ,
Required: True ,
}
string ,
certificate-name:
{
Description: The name of the certificate in the given vault. ,
Required: True ,
}
string ,
certificate-version:
{
Description: The version of the certificate. This URI fragment is optional. If not specified, the latest version of the certificate is returned. ,
Required: True ,
}
string ,
}

⚐ Response (200)

{
id:
{
Description: The certificate id. ,
Required: False ,
}
string ,
kid:
{
Description: The key id. ,
Required: False ,
}
string ,
sid:
{
Description: The secret id. ,
Required: False ,
}
string ,
x5t:
{
Description: Thumbprint of the certificate. ,
Format: base64url ,
Required: False ,
}
string ,
policy:
{
Description: The management policy. ,
Required: False ,
}
{
id:
{
Description: The certificate id. ,
Required: False ,
}
string ,
key_props:
{
Description: Properties of the key backing a certificate. ,
Required: False ,
}
{
exportable:
{
Description: Indicates if the private key can be exported. Release policy must be provided when creating the first version of an exportable key. ,
Required: False ,
}
boolean ,
kty:
{
Description: The type of key pair to be used for the certificate. ,
Enum:
{
EC: Elliptic Curve. ,
EC-HSM: Elliptic Curve with a private key which is not exportable from the HSM. ,
RSA: RSA (https://tools.ietf.org/html/rfc3447). ,
RSA-HSM: RSA with a private key which is not exportable from the HSM. ,
oct: Octet sequence (used to represent symmetric keys). ,
oct-HSM: Octet sequence with a private key which is not exportable from the HSM. ,
}
,
Required: False ,
}
enum ,
key_size:
{
Description: The key size in bits. For example: 2048, 3072, or 4096 for RSA. ,
Format: int32 ,
Required: False ,
}
integer ,
reuse_key:
{
Description: Indicates if the same key pair will be used on certificate renewal. ,
Required: False ,
}
boolean ,
crv:
{
Description: Elliptic curve name. For valid values, see JsonWebKeyCurveName. ,
Enum:
{
P-256: The NIST P-256 elliptic curve, AKA SECG curve SECP256R1. ,
P-384: The NIST P-384 elliptic curve, AKA SECG curve SECP384R1. ,
P-521: The NIST P-521 elliptic curve, AKA SECG curve SECP521R1. ,
P-256K: The SECG SECP256K1 elliptic curve. ,
}
,
Required: False ,
}
enum ,
}
,
secret_props:
{
Description: Properties of the secret backing a certificate. ,
Required: False ,
}
{
contentType:
{
Description: The media type (MIME type). ,
Required: False ,
}
string ,
}
,
x509_props:
{
Description: Properties of the X509 component of a certificate. ,
Required: False ,
}
{
subject:
{
Description: The subject name. Should be a valid X509 distinguished Name. ,
Required: False ,
}
string ,
ekus:
{
Description: The enhanced key usage. ,
Required: False ,
}
[
string ,
]
,
sans:
{
Description: The subject alternative names. ,
Required: False ,
}
{
emails:
{
Description: Email addresses. ,
Required: False ,
}
[
string ,
]
,
dns_names:
{
Description: Domain Names. ,
Required: False ,
}
[
string ,
]
,
upns:
{
Description: User Principal Names. ,
Required: False ,
}
[
string ,
]
,
}
,
key_usage:
{
Description: Defines how the certificate's key may be used. ,
Required: False ,
}
[
string ,
]
,
validity_months:
{
Description: The duration that the certificate is valid in months. ,
Format: int32 ,
Required: False ,
}
integer ,
}
,
lifetime_actions:
{
Description: Actions that will be performed by Key Vault over the lifetime of a certificate. ,
Required: False ,
}
[
{
trigger:
{
Description: The condition that will execute the action. ,
Required: False ,
}
{
lifetime_percentage:
{
Description: Percentage of lifetime at which to trigger. Value should be between 1 and 99. ,
Format: int32 ,
Required: False ,
}
integer ,
days_before_expiry:
{
Description: Days before expiry to attempt renewal. Value should be between 1 and validity_in_months multiplied by 27. If validity_in_months is 36, then value should be between 1 and 972 (36 * 27). ,
Format: int32 ,
Required: False ,
}
integer ,
}
,
action:
{
Description: The action that will be executed. ,
Required: False ,
}
{
action_type:
{
Description: The type of the action. ,
Enum:
{
EmailContacts: A certificate policy that will email certificate contacts. ,
AutoRenew: A certificate policy that will auto-renew a certificate. ,
}
,
Required: False ,
}
enum ,
}
,
}
,
]
,
issuer:
{
Description: Parameters for the issuer of the X509 component of a certificate. ,
Required: False ,
}
{
name:
{
Description: Name of the referenced issuer object or reserved names; for example, 'Self' or 'Unknown'. ,
Required: False ,
}
string ,
cty:
{
Description: Certificate type as supported by the provider (optional); for example 'OV-SSL', 'EV-SSL' ,
Required: False ,
}
string ,
cert_transparency:
{
Description: Indicates if the certificates generated under this policy should be published to certificate transparency logs. ,
Required: False ,
}
boolean ,
}
,
attributes:
{
Description: The certificate attributes. ,
Required: False ,
}
{
enabled:
{
Description: Determines whether the object is enabled. ,
Required: False ,
}
boolean ,
nbf:
{
Description: Not before date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
exp:
{
Description: Expiry date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
created:
{
Description: Creation time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
updated:
{
Description: Last updated time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
recoverableDays:
{
Description: softDelete data retention days. Value should be >=7 and <=90 when softDelete enabled, otherwise 0. ,
Format: int32 ,
Required: False ,
}
integer ,
recoveryLevel:
{
Description: Reflects the deletion recovery level currently in effect for certificates in the current vault. If it contains 'Purgeable', the certificate can be permanently deleted by a privileged user; otherwise, only the system can purge the certificate, at the end of the retention interval. ,
Enum:
{
Purgeable: Denotes a vault state in which deletion is an irreversible operation, without the possibility for recovery. This level corresponds to no protection being available against a Delete operation; the data is irretrievably lost upon accepting a Delete operation at the entity level or higher (vault, resource group, subscription etc.) ,
Recoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days), unless a Purge operation is requested, or the subscription is cancelled. System wil permanently delete it after 90 days, if not recovered ,
Recoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days) and while the subscription is still available. System wil permanently delete it after 90 days, if not recovered ,
Recoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable within retention interval (90 days), immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled. System wil permanently delete it after 90 days, if not recovered ,
CustomizedRecoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90). This level guarantees the recoverability of the deleted entity during the retention interval, unless a Purge operation is requested, or the subscription is cancelled. ,
CustomizedRecoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90).This level guarantees the recoverability of the deleted entity during the retention interval and while the subscription is still available. ,
CustomizedRecoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable, immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled when 7 <= SoftDeleteRetentionInDays < 90. This level guarantees the recoverability of the deleted entity during the retention interval, and also reflects the fact that the subscription itself cannot be cancelled. ,
}
,
Required: False ,
}
enum ,
}
,
}
,
cer:
{
Description: CER contents of x509 certificate. ,
Format: byte ,
Required: False ,
}
string ,
contentType:
{
Description: The content type of the secret. eg. 'application/x-pem-file' or 'application/x-pkcs12'. ,
Required: False ,
}
string ,
attributes:
{
Description: The certificate attributes. ,
Required: False ,
}
{
enabled:
{
Description: Determines whether the object is enabled. ,
Required: False ,
}
boolean ,
nbf:
{
Description: Not before date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
exp:
{
Description: Expiry date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
created:
{
Description: Creation time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
updated:
{
Description: Last updated time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
recoverableDays:
{
Description: softDelete data retention days. Value should be >=7 and <=90 when softDelete enabled, otherwise 0. ,
Format: int32 ,
Required: False ,
}
integer ,
recoveryLevel:
{
Description: Reflects the deletion recovery level currently in effect for certificates in the current vault. If it contains 'Purgeable', the certificate can be permanently deleted by a privileged user; otherwise, only the system can purge the certificate, at the end of the retention interval. ,
Enum:
{
Purgeable: Denotes a vault state in which deletion is an irreversible operation, without the possibility for recovery. This level corresponds to no protection being available against a Delete operation; the data is irretrievably lost upon accepting a Delete operation at the entity level or higher (vault, resource group, subscription etc.) ,
Recoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days), unless a Purge operation is requested, or the subscription is cancelled. System wil permanently delete it after 90 days, if not recovered ,
Recoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days) and while the subscription is still available. System wil permanently delete it after 90 days, if not recovered ,
Recoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable within retention interval (90 days), immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled. System wil permanently delete it after 90 days, if not recovered ,
CustomizedRecoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90). This level guarantees the recoverability of the deleted entity during the retention interval, unless a Purge operation is requested, or the subscription is cancelled. ,
CustomizedRecoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90).This level guarantees the recoverability of the deleted entity during the retention interval and while the subscription is still available. ,
CustomizedRecoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable, immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled when 7 <= SoftDeleteRetentionInDays < 90. This level guarantees the recoverability of the deleted entity during the retention interval, and also reflects the fact that the subscription itself cannot be cancelled. ,
}
,
Required: False ,
}
enum ,
}
,
tags:
{
Description: Application specific metadata in the form of key-value pairs. ,
Required: False ,
}
object ,
preserveCertOrder:
{
Description: Specifies whether the certificate chain preserves its original order. The default value is false, which sets the leaf certificate at index 0. ,
Required: False ,
}
boolean ,
}

⚐ Response (default)

{
error:
{
Description: The key vault server error. ,
Required: False ,
}
{
code:
{
Description: The error code. ,
Required: False ,
}
string ,
message:
{
Description: The error message. ,
Required: False ,
}
string ,
innererror:
{
Required: False ,
}
string ,
}
,
}
UpdateCertificate (updated)
Description :  The UpdateCertificate operation applies the specified update on the given certificate; the only elements updated are the certificate's attributes. This operation requires the certificates/update permission.
Reference :  Link ¶

⚶ Changes

{
  "#id": "UpdateCertificate",
  "$parameters": {
    "parameters": {
      "$properties": {
        "policy": [
          {
            "x509_props": [
              {
                "sans": [
                  {
                    "#name": "dns_names",
                    "Description": {
                      "new": "Domain Names.",
                      "old": "Domain names."
                    }
                  },
                  {
                    "#name": "upns",
                    "Description": {
                      "new": "User Principal Names.",
                      "old": "User principal names."
                    }
                  }
                ]
              }
            ]
          }
        ]
      }
    }
  },
  "$responses": {
    "200": {
      "$properties": [
        {
          "policy": [
            {
              "x509_props": [
                {
                  "sans": [
                    {
                      "#name": "dns_names",
                      "Description": {
                        "new": "Domain Names.",
                        "old": "Domain names."
                      }
                    },
                    {
                      "#name": "upns",
                      "Description": {
                        "new": "User Principal Names.",
                        "old": "User principal names."
                      }
                    }
                  ]
                }
              ]
            }
          ]
        },
        {
          "#name": "contentType",
          "Description": {
            "new": "The content type of the secret. eg. 'application/x-pem-file' or 'application/x-pkcs12'.",
            "old": "The content type of the secret. eg. 'application/x-pem-file' or 'application/x-pkcs12',"
          }
        },
        {
          "#name": "tags",
          "Description": {
            "new": "Application specific metadata in the form of key-value pairs.",
            "old": "Application specific metadata in the form of key-value pairs"
          }
        }
      ]
    }
  }
}

⚼ Request

PATCH:  /certificates/{certificate-name}/{certificate-version}
{
api-version:
{
Description: The API version to use for this operation. ,
Required: True ,
}
string ,
certificate-name:
{
Description: The name of the certificate in the given key vault. ,
Required: True ,
}
string ,
certificate-version:
{
Description: The version of the certificate. ,
Required: True ,
}
string ,
parameters:
{
Description: The parameters for certificate update. ,
Required: True ,
}
{
policy:
{
Description: The management policy for the certificate. ,
Required: False ,
}
{
id:
{
Description: The certificate id. ,
Required: False ,
}
string ,
key_props:
{
Description: Properties of the key backing a certificate. ,
Required: False ,
}
{
exportable:
{
Description: Indicates if the private key can be exported. Release policy must be provided when creating the first version of an exportable key. ,
Required: False ,
}
boolean ,
kty:
{
Description: The type of key pair to be used for the certificate. ,
Enum:
{
EC: Elliptic Curve. ,
EC-HSM: Elliptic Curve with a private key which is not exportable from the HSM. ,
RSA: RSA (https://tools.ietf.org/html/rfc3447). ,
RSA-HSM: RSA with a private key which is not exportable from the HSM. ,
oct: Octet sequence (used to represent symmetric keys). ,
oct-HSM: Octet sequence with a private key which is not exportable from the HSM. ,
}
,
Required: False ,
}
enum ,
key_size:
{
Description: The key size in bits. For example: 2048, 3072, or 4096 for RSA. ,
Format: int32 ,
Required: False ,
}
integer ,
reuse_key:
{
Description: Indicates if the same key pair will be used on certificate renewal. ,
Required: False ,
}
boolean ,
crv:
{
Description: Elliptic curve name. For valid values, see JsonWebKeyCurveName. ,
Enum:
{
P-256: The NIST P-256 elliptic curve, AKA SECG curve SECP256R1. ,
P-384: The NIST P-384 elliptic curve, AKA SECG curve SECP384R1. ,
P-521: The NIST P-521 elliptic curve, AKA SECG curve SECP521R1. ,
P-256K: The SECG SECP256K1 elliptic curve. ,
}
,
Required: False ,
}
enum ,
}
,
secret_props:
{
Description: Properties of the secret backing a certificate. ,
Required: False ,
}
{
contentType:
{
Description: The media type (MIME type). ,
Required: False ,
}
string ,
}
,
x509_props:
{
Description: Properties of the X509 component of a certificate. ,
Required: False ,
}
{
subject:
{
Description: The subject name. Should be a valid X509 distinguished Name. ,
Required: False ,
}
string ,
ekus:
{
Description: The enhanced key usage. ,
Required: False ,
}
[
string ,
]
,
sans:
{
Description: The subject alternative names. ,
Required: False ,
}
{
emails:
{
Description: Email addresses. ,
Required: False ,
}
[
string ,
]
,
dns_names:
{
Description: Domain Names. ,
Required: False ,
}
[
string ,
]
,
upns:
{
Description: User Principal Names. ,
Required: False ,
}
[
string ,
]
,
}
,
key_usage:
{
Description: Defines how the certificate's key may be used. ,
Required: False ,
}
[
string ,
]
,
validity_months:
{
Description: The duration that the certificate is valid in months. ,
Format: int32 ,
Required: False ,
}
integer ,
}
,
lifetime_actions:
{
Description: Actions that will be performed by Key Vault over the lifetime of a certificate. ,
Required: False ,
}
[
{
trigger:
{
Description: The condition that will execute the action. ,
Required: False ,
}
{
lifetime_percentage:
{
Description: Percentage of lifetime at which to trigger. Value should be between 1 and 99. ,
Format: int32 ,
Required: False ,
}
integer ,
days_before_expiry:
{
Description: Days before expiry to attempt renewal. Value should be between 1 and validity_in_months multiplied by 27. If validity_in_months is 36, then value should be between 1 and 972 (36 * 27). ,
Format: int32 ,
Required: False ,
}
integer ,
}
,
action:
{
Description: The action that will be executed. ,
Required: False ,
}
{
action_type:
{
Description: The type of the action. ,
Enum:
{
EmailContacts: A certificate policy that will email certificate contacts. ,
AutoRenew: A certificate policy that will auto-renew a certificate. ,
}
,
Required: False ,
}
enum ,
}
,
}
,
]
,
issuer:
{
Description: Parameters for the issuer of the X509 component of a certificate. ,
Required: False ,
}
{
name:
{
Description: Name of the referenced issuer object or reserved names; for example, 'Self' or 'Unknown'. ,
Required: False ,
}
string ,
cty:
{
Description: Certificate type as supported by the provider (optional); for example 'OV-SSL', 'EV-SSL' ,
Required: False ,
}
string ,
cert_transparency:
{
Description: Indicates if the certificates generated under this policy should be published to certificate transparency logs. ,
Required: False ,
}
boolean ,
}
,
attributes:
{
Description: The certificate attributes. ,
Required: False ,
}
{
enabled:
{
Description: Determines whether the object is enabled. ,
Required: False ,
}
boolean ,
nbf:
{
Description: Not before date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
exp:
{
Description: Expiry date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
created:
{
Description: Creation time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
updated:
{
Description: Last updated time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
recoverableDays:
{
Description: softDelete data retention days. Value should be >=7 and <=90 when softDelete enabled, otherwise 0. ,
Format: int32 ,
Required: False ,
}
integer ,
recoveryLevel:
{
Description: Reflects the deletion recovery level currently in effect for certificates in the current vault. If it contains 'Purgeable', the certificate can be permanently deleted by a privileged user; otherwise, only the system can purge the certificate, at the end of the retention interval. ,
Enum:
{
Purgeable: Denotes a vault state in which deletion is an irreversible operation, without the possibility for recovery. This level corresponds to no protection being available against a Delete operation; the data is irretrievably lost upon accepting a Delete operation at the entity level or higher (vault, resource group, subscription etc.) ,
Recoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days), unless a Purge operation is requested, or the subscription is cancelled. System wil permanently delete it after 90 days, if not recovered ,
Recoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days) and while the subscription is still available. System wil permanently delete it after 90 days, if not recovered ,
Recoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable within retention interval (90 days), immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled. System wil permanently delete it after 90 days, if not recovered ,
CustomizedRecoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90). This level guarantees the recoverability of the deleted entity during the retention interval, unless a Purge operation is requested, or the subscription is cancelled. ,
CustomizedRecoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90).This level guarantees the recoverability of the deleted entity during the retention interval and while the subscription is still available. ,
CustomizedRecoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable, immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled when 7 <= SoftDeleteRetentionInDays < 90. This level guarantees the recoverability of the deleted entity during the retention interval, and also reflects the fact that the subscription itself cannot be cancelled. ,
}
,
Required: False ,
}
enum ,
}
,
}
,
attributes:
{
Description: The attributes of the certificate (optional). ,
Required: False ,
}
{
enabled:
{
Description: Determines whether the object is enabled. ,
Required: False ,
}
boolean ,
nbf:
{
Description: Not before date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
exp:
{
Description: Expiry date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
created:
{
Description: Creation time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
updated:
{
Description: Last updated time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
recoverableDays:
{
Description: softDelete data retention days. Value should be >=7 and <=90 when softDelete enabled, otherwise 0. ,
Format: int32 ,
Required: False ,
}
integer ,
recoveryLevel:
{
Description: Reflects the deletion recovery level currently in effect for certificates in the current vault. If it contains 'Purgeable', the certificate can be permanently deleted by a privileged user; otherwise, only the system can purge the certificate, at the end of the retention interval. ,
Enum:
{
Purgeable: Denotes a vault state in which deletion is an irreversible operation, without the possibility for recovery. This level corresponds to no protection being available against a Delete operation; the data is irretrievably lost upon accepting a Delete operation at the entity level or higher (vault, resource group, subscription etc.) ,
Recoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days), unless a Purge operation is requested, or the subscription is cancelled. System wil permanently delete it after 90 days, if not recovered ,
Recoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days) and while the subscription is still available. System wil permanently delete it after 90 days, if not recovered ,
Recoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable within retention interval (90 days), immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled. System wil permanently delete it after 90 days, if not recovered ,
CustomizedRecoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90). This level guarantees the recoverability of the deleted entity during the retention interval, unless a Purge operation is requested, or the subscription is cancelled. ,
CustomizedRecoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90).This level guarantees the recoverability of the deleted entity during the retention interval and while the subscription is still available. ,
CustomizedRecoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable, immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled when 7 <= SoftDeleteRetentionInDays < 90. This level guarantees the recoverability of the deleted entity during the retention interval, and also reflects the fact that the subscription itself cannot be cancelled. ,
}
,
Required: False ,
}
enum ,
}
,
tags:
{
Description: Application specific metadata in the form of key-value pairs. ,
Required: False ,
}
object ,
}
,
}

⚐ Response (200)

{
id:
{
Description: The certificate id. ,
Required: False ,
}
string ,
kid:
{
Description: The key id. ,
Required: False ,
}
string ,
sid:
{
Description: The secret id. ,
Required: False ,
}
string ,
x5t:
{
Description: Thumbprint of the certificate. ,
Format: base64url ,
Required: False ,
}
string ,
policy:
{
Description: The management policy. ,
Required: False ,
}
{
id:
{
Description: The certificate id. ,
Required: False ,
}
string ,
key_props:
{
Description: Properties of the key backing a certificate. ,
Required: False ,
}
{
exportable:
{
Description: Indicates if the private key can be exported. Release policy must be provided when creating the first version of an exportable key. ,
Required: False ,
}
boolean ,
kty:
{
Description: The type of key pair to be used for the certificate. ,
Enum:
{
EC: Elliptic Curve. ,
EC-HSM: Elliptic Curve with a private key which is not exportable from the HSM. ,
RSA: RSA (https://tools.ietf.org/html/rfc3447). ,
RSA-HSM: RSA with a private key which is not exportable from the HSM. ,
oct: Octet sequence (used to represent symmetric keys). ,
oct-HSM: Octet sequence with a private key which is not exportable from the HSM. ,
}
,
Required: False ,
}
enum ,
key_size:
{
Description: The key size in bits. For example: 2048, 3072, or 4096 for RSA. ,
Format: int32 ,
Required: False ,
}
integer ,
reuse_key:
{
Description: Indicates if the same key pair will be used on certificate renewal. ,
Required: False ,
}
boolean ,
crv:
{
Description: Elliptic curve name. For valid values, see JsonWebKeyCurveName. ,
Enum:
{
P-256: The NIST P-256 elliptic curve, AKA SECG curve SECP256R1. ,
P-384: The NIST P-384 elliptic curve, AKA SECG curve SECP384R1. ,
P-521: The NIST P-521 elliptic curve, AKA SECG curve SECP521R1. ,
P-256K: The SECG SECP256K1 elliptic curve. ,
}
,
Required: False ,
}
enum ,
}
,
secret_props:
{
Description: Properties of the secret backing a certificate. ,
Required: False ,
}
{
contentType:
{
Description: The media type (MIME type). ,
Required: False ,
}
string ,
}
,
x509_props:
{
Description: Properties of the X509 component of a certificate. ,
Required: False ,
}
{
subject:
{
Description: The subject name. Should be a valid X509 distinguished Name. ,
Required: False ,
}
string ,
ekus:
{
Description: The enhanced key usage. ,
Required: False ,
}
[
string ,
]
,
sans:
{
Description: The subject alternative names. ,
Required: False ,
}
{
emails:
{
Description: Email addresses. ,
Required: False ,
}
[
string ,
]
,
dns_names:
{
Description: Domain Names. ,
Required: False ,
}
[
string ,
]
,
upns:
{
Description: User Principal Names. ,
Required: False ,
}
[
string ,
]
,
}
,
key_usage:
{
Description: Defines how the certificate's key may be used. ,
Required: False ,
}
[
string ,
]
,
validity_months:
{
Description: The duration that the certificate is valid in months. ,
Format: int32 ,
Required: False ,
}
integer ,
}
,
lifetime_actions:
{
Description: Actions that will be performed by Key Vault over the lifetime of a certificate. ,
Required: False ,
}
[
{
trigger:
{
Description: The condition that will execute the action. ,
Required: False ,
}
{
lifetime_percentage:
{
Description: Percentage of lifetime at which to trigger. Value should be between 1 and 99. ,
Format: int32 ,
Required: False ,
}
integer ,
days_before_expiry:
{
Description: Days before expiry to attempt renewal. Value should be between 1 and validity_in_months multiplied by 27. If validity_in_months is 36, then value should be between 1 and 972 (36 * 27). ,
Format: int32 ,
Required: False ,
}
integer ,
}
,
action:
{
Description: The action that will be executed. ,
Required: False ,
}
{
action_type:
{
Description: The type of the action. ,
Enum:
{
EmailContacts: A certificate policy that will email certificate contacts. ,
AutoRenew: A certificate policy that will auto-renew a certificate. ,
}
,
Required: False ,
}
enum ,
}
,
}
,
]
,
issuer:
{
Description: Parameters for the issuer of the X509 component of a certificate. ,
Required: False ,
}
{
name:
{
Description: Name of the referenced issuer object or reserved names; for example, 'Self' or 'Unknown'. ,
Required: False ,
}
string ,
cty:
{
Description: Certificate type as supported by the provider (optional); for example 'OV-SSL', 'EV-SSL' ,
Required: False ,
}
string ,
cert_transparency:
{
Description: Indicates if the certificates generated under this policy should be published to certificate transparency logs. ,
Required: False ,
}
boolean ,
}
,
attributes:
{
Description: The certificate attributes. ,
Required: False ,
}
{
enabled:
{
Description: Determines whether the object is enabled. ,
Required: False ,
}
boolean ,
nbf:
{
Description: Not before date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
exp:
{
Description: Expiry date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
created:
{
Description: Creation time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
updated:
{
Description: Last updated time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
recoverableDays:
{
Description: softDelete data retention days. Value should be >=7 and <=90 when softDelete enabled, otherwise 0. ,
Format: int32 ,
Required: False ,
}
integer ,
recoveryLevel:
{
Description: Reflects the deletion recovery level currently in effect for certificates in the current vault. If it contains 'Purgeable', the certificate can be permanently deleted by a privileged user; otherwise, only the system can purge the certificate, at the end of the retention interval. ,
Enum:
{
Purgeable: Denotes a vault state in which deletion is an irreversible operation, without the possibility for recovery. This level corresponds to no protection being available against a Delete operation; the data is irretrievably lost upon accepting a Delete operation at the entity level or higher (vault, resource group, subscription etc.) ,
Recoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days), unless a Purge operation is requested, or the subscription is cancelled. System wil permanently delete it after 90 days, if not recovered ,
Recoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days) and while the subscription is still available. System wil permanently delete it after 90 days, if not recovered ,
Recoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable within retention interval (90 days), immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled. System wil permanently delete it after 90 days, if not recovered ,
CustomizedRecoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90). This level guarantees the recoverability of the deleted entity during the retention interval, unless a Purge operation is requested, or the subscription is cancelled. ,
CustomizedRecoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90).This level guarantees the recoverability of the deleted entity during the retention interval and while the subscription is still available. ,
CustomizedRecoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable, immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled when 7 <= SoftDeleteRetentionInDays < 90. This level guarantees the recoverability of the deleted entity during the retention interval, and also reflects the fact that the subscription itself cannot be cancelled. ,
}
,
Required: False ,
}
enum ,
}
,
}
,
cer:
{
Description: CER contents of x509 certificate. ,
Format: byte ,
Required: False ,
}
string ,
contentType:
{
Description: The content type of the secret. eg. 'application/x-pem-file' or 'application/x-pkcs12'. ,
Required: False ,
}
string ,
attributes:
{
Description: The certificate attributes. ,
Required: False ,
}
{
enabled:
{
Description: Determines whether the object is enabled. ,
Required: False ,
}
boolean ,
nbf:
{
Description: Not before date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
exp:
{
Description: Expiry date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
created:
{
Description: Creation time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
updated:
{
Description: Last updated time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
recoverableDays:
{
Description: softDelete data retention days. Value should be >=7 and <=90 when softDelete enabled, otherwise 0. ,
Format: int32 ,
Required: False ,
}
integer ,
recoveryLevel:
{
Description: Reflects the deletion recovery level currently in effect for certificates in the current vault. If it contains 'Purgeable', the certificate can be permanently deleted by a privileged user; otherwise, only the system can purge the certificate, at the end of the retention interval. ,
Enum:
{
Purgeable: Denotes a vault state in which deletion is an irreversible operation, without the possibility for recovery. This level corresponds to no protection being available against a Delete operation; the data is irretrievably lost upon accepting a Delete operation at the entity level or higher (vault, resource group, subscription etc.) ,
Recoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days), unless a Purge operation is requested, or the subscription is cancelled. System wil permanently delete it after 90 days, if not recovered ,
Recoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days) and while the subscription is still available. System wil permanently delete it after 90 days, if not recovered ,
Recoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable within retention interval (90 days), immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled. System wil permanently delete it after 90 days, if not recovered ,
CustomizedRecoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90). This level guarantees the recoverability of the deleted entity during the retention interval, unless a Purge operation is requested, or the subscription is cancelled. ,
CustomizedRecoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90).This level guarantees the recoverability of the deleted entity during the retention interval and while the subscription is still available. ,
CustomizedRecoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable, immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled when 7 <= SoftDeleteRetentionInDays < 90. This level guarantees the recoverability of the deleted entity during the retention interval, and also reflects the fact that the subscription itself cannot be cancelled. ,
}
,
Required: False ,
}
enum ,
}
,
tags:
{
Description: Application specific metadata in the form of key-value pairs. ,
Required: False ,
}
object ,
preserveCertOrder:
{
Description: Specifies whether the certificate chain preserves its original order. The default value is false, which sets the leaf certificate at index 0. ,
Required: False ,
}
boolean ,
}

⚐ Response (default)

{
error:
{
Description: The key vault server error. ,
Required: False ,
}
{
code:
{
Description: The error code. ,
Required: False ,
}
string ,
message:
{
Description: The error message. ,
Required: False ,
}
string ,
innererror:
{
Required: False ,
}
string ,
}
,
}
CreateCertificate (updated)
Description :  If this is the first version, the certificate resource is created. This operation requires the certificates/create permission.
Reference :  Link ¶

⚶ Changes

{
  "#id": "CreateCertificate",
  "$parameters": {
    "parameters": {
      "$properties": {
        "policy": [
          {
            "x509_props": [
              {
                "sans": [
                  {
                    "#name": "dns_names",
                    "Description": {
                      "new": "Domain Names.",
                      "old": "Domain names."
                    }
                  },
                  {
                    "#name": "upns",
                    "Description": {
                      "new": "User Principal Names.",
                      "old": "User principal names."
                    }
                  }
                ]
              }
            ]
          }
        ]
      }
    }
  }
}

⚼ Request

POST:  /certificates/{certificate-name}/create
{
api-version:
{
Description: The API version to use for this operation. ,
Required: True ,
}
string ,
certificate-name:
{
Description: The name of the certificate. The value you provide may be copied globally for the purpose of running the service. The value provided should not include personally identifiable or sensitive information. ,
Required: True ,
}
string ,
parameters:
{
Description: The parameters to create a certificate. ,
Required: True ,
}
{
policy:
{
Description: The management policy for the certificate. ,
Required: False ,
}
{
id:
{
Description: The certificate id. ,
Required: False ,
}
string ,
key_props:
{
Description: Properties of the key backing a certificate. ,
Required: False ,
}
{
exportable:
{
Description: Indicates if the private key can be exported. Release policy must be provided when creating the first version of an exportable key. ,
Required: False ,
}
boolean ,
kty:
{
Description: The type of key pair to be used for the certificate. ,
Enum:
{
EC: Elliptic Curve. ,
EC-HSM: Elliptic Curve with a private key which is not exportable from the HSM. ,
RSA: RSA (https://tools.ietf.org/html/rfc3447). ,
RSA-HSM: RSA with a private key which is not exportable from the HSM. ,
oct: Octet sequence (used to represent symmetric keys). ,
oct-HSM: Octet sequence with a private key which is not exportable from the HSM. ,
}
,
Required: False ,
}
enum ,
key_size:
{
Description: The key size in bits. For example: 2048, 3072, or 4096 for RSA. ,
Format: int32 ,
Required: False ,
}
integer ,
reuse_key:
{
Description: Indicates if the same key pair will be used on certificate renewal. ,
Required: False ,
}
boolean ,
crv:
{
Description: Elliptic curve name. For valid values, see JsonWebKeyCurveName. ,
Enum:
{
P-256: The NIST P-256 elliptic curve, AKA SECG curve SECP256R1. ,
P-384: The NIST P-384 elliptic curve, AKA SECG curve SECP384R1. ,
P-521: The NIST P-521 elliptic curve, AKA SECG curve SECP521R1. ,
P-256K: The SECG SECP256K1 elliptic curve. ,
}
,
Required: False ,
}
enum ,
}
,
secret_props:
{
Description: Properties of the secret backing a certificate. ,
Required: False ,
}
{
contentType:
{
Description: The media type (MIME type). ,
Required: False ,
}
string ,
}
,
x509_props:
{
Description: Properties of the X509 component of a certificate. ,
Required: False ,
}
{
subject:
{
Description: The subject name. Should be a valid X509 distinguished Name. ,
Required: False ,
}
string ,
ekus:
{
Description: The enhanced key usage. ,
Required: False ,
}
[
string ,
]
,
sans:
{
Description: The subject alternative names. ,
Required: False ,
}
{
emails:
{
Description: Email addresses. ,
Required: False ,
}
[
string ,
]
,
dns_names:
{
Description: Domain Names. ,
Required: False ,
}
[
string ,
]
,
upns:
{
Description: User Principal Names. ,
Required: False ,
}
[
string ,
]
,
}
,
key_usage:
{
Description: Defines how the certificate's key may be used. ,
Required: False ,
}
[
string ,
]
,
validity_months:
{
Description: The duration that the certificate is valid in months. ,
Format: int32 ,
Required: False ,
}
integer ,
}
,
lifetime_actions:
{
Description: Actions that will be performed by Key Vault over the lifetime of a certificate. ,
Required: False ,
}
[
{
trigger:
{
Description: The condition that will execute the action. ,
Required: False ,
}
{
lifetime_percentage:
{
Description: Percentage of lifetime at which to trigger. Value should be between 1 and 99. ,
Format: int32 ,
Required: False ,
}
integer ,
days_before_expiry:
{
Description: Days before expiry to attempt renewal. Value should be between 1 and validity_in_months multiplied by 27. If validity_in_months is 36, then value should be between 1 and 972 (36 * 27). ,
Format: int32 ,
Required: False ,
}
integer ,
}
,
action:
{
Description: The action that will be executed. ,
Required: False ,
}
{
action_type:
{
Description: The type of the action. ,
Enum:
{
EmailContacts: A certificate policy that will email certificate contacts. ,
AutoRenew: A certificate policy that will auto-renew a certificate. ,
}
,
Required: False ,
}
enum ,
}
,
}
,
]
,
issuer:
{
Description: Parameters for the issuer of the X509 component of a certificate. ,
Required: False ,
}
{
name:
{
Description: Name of the referenced issuer object or reserved names; for example, 'Self' or 'Unknown'. ,
Required: False ,
}
string ,
cty:
{
Description: Certificate type as supported by the provider (optional); for example 'OV-SSL', 'EV-SSL' ,
Required: False ,
}
string ,
cert_transparency:
{
Description: Indicates if the certificates generated under this policy should be published to certificate transparency logs. ,
Required: False ,
}
boolean ,
}
,
attributes:
{
Description: The certificate attributes. ,
Required: False ,
}
{
enabled:
{
Description: Determines whether the object is enabled. ,
Required: False ,
}
boolean ,
nbf:
{
Description: Not before date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
exp:
{
Description: Expiry date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
created:
{
Description: Creation time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
updated:
{
Description: Last updated time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
recoverableDays:
{
Description: softDelete data retention days. Value should be >=7 and <=90 when softDelete enabled, otherwise 0. ,
Format: int32 ,
Required: False ,
}
integer ,
recoveryLevel:
{
Description: Reflects the deletion recovery level currently in effect for certificates in the current vault. If it contains 'Purgeable', the certificate can be permanently deleted by a privileged user; otherwise, only the system can purge the certificate, at the end of the retention interval. ,
Enum:
{
Purgeable: Denotes a vault state in which deletion is an irreversible operation, without the possibility for recovery. This level corresponds to no protection being available against a Delete operation; the data is irretrievably lost upon accepting a Delete operation at the entity level or higher (vault, resource group, subscription etc.) ,
Recoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days), unless a Purge operation is requested, or the subscription is cancelled. System wil permanently delete it after 90 days, if not recovered ,
Recoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days) and while the subscription is still available. System wil permanently delete it after 90 days, if not recovered ,
Recoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable within retention interval (90 days), immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled. System wil permanently delete it after 90 days, if not recovered ,
CustomizedRecoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90). This level guarantees the recoverability of the deleted entity during the retention interval, unless a Purge operation is requested, or the subscription is cancelled. ,
CustomizedRecoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90).This level guarantees the recoverability of the deleted entity during the retention interval and while the subscription is still available. ,
CustomizedRecoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable, immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled when 7 <= SoftDeleteRetentionInDays < 90. This level guarantees the recoverability of the deleted entity during the retention interval, and also reflects the fact that the subscription itself cannot be cancelled. ,
}
,
Required: False ,
}
enum ,
}
,
}
,
attributes:
{
Description: The attributes of the certificate (optional). ,
Required: False ,
}
{
enabled:
{
Description: Determines whether the object is enabled. ,
Required: False ,
}
boolean ,
nbf:
{
Description: Not before date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
exp:
{
Description: Expiry date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
created:
{
Description: Creation time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
updated:
{
Description: Last updated time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
recoverableDays:
{
Description: softDelete data retention days. Value should be >=7 and <=90 when softDelete enabled, otherwise 0. ,
Format: int32 ,
Required: False ,
}
integer ,
recoveryLevel:
{
Description: Reflects the deletion recovery level currently in effect for certificates in the current vault. If it contains 'Purgeable', the certificate can be permanently deleted by a privileged user; otherwise, only the system can purge the certificate, at the end of the retention interval. ,
Enum:
{
Purgeable: Denotes a vault state in which deletion is an irreversible operation, without the possibility for recovery. This level corresponds to no protection being available against a Delete operation; the data is irretrievably lost upon accepting a Delete operation at the entity level or higher (vault, resource group, subscription etc.) ,
Recoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days), unless a Purge operation is requested, or the subscription is cancelled. System wil permanently delete it after 90 days, if not recovered ,
Recoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days) and while the subscription is still available. System wil permanently delete it after 90 days, if not recovered ,
Recoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable within retention interval (90 days), immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled. System wil permanently delete it after 90 days, if not recovered ,
CustomizedRecoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90). This level guarantees the recoverability of the deleted entity during the retention interval, unless a Purge operation is requested, or the subscription is cancelled. ,
CustomizedRecoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90).This level guarantees the recoverability of the deleted entity during the retention interval and while the subscription is still available. ,
CustomizedRecoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable, immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled when 7 <= SoftDeleteRetentionInDays < 90. This level guarantees the recoverability of the deleted entity during the retention interval, and also reflects the fact that the subscription itself cannot be cancelled. ,
}
,
Required: False ,
}
enum ,
}
,
tags:
{
Description: Application specific metadata in the form of key-value pairs. ,
Required: False ,
}
object ,
preserveCertOrder:
{
Description: Specifies whether the certificate chain preserves its original order. The default value is false, which sets the leaf certificate at index 0. ,
Required: False ,
}
boolean ,
}
,
}

⚐ Response (202)

{
id:
{
Description: The certificate id. ,
Required: False ,
}
string ,
issuer:
{
Description: Parameters for the issuer of the X509 component of a certificate. ,
Required: False ,
}
{
name:
{
Description: Name of the referenced issuer object or reserved names; for example, 'Self' or 'Unknown'. ,
Required: False ,
}
string ,
cty:
{
Description: Certificate type as supported by the provider (optional); for example 'OV-SSL', 'EV-SSL' ,
Required: False ,
}
string ,
cert_transparency:
{
Description: Indicates if the certificates generated under this policy should be published to certificate transparency logs. ,
Required: False ,
}
boolean ,
}
,
csr:
{
Description: The certificate signing request (CSR) that is being used in the certificate operation. ,
Format: byte ,
Required: False ,
}
string ,
cancellation_requested:
{
Description: Indicates if cancellation was requested on the certificate operation. ,
Required: False ,
}
boolean ,
status:
{
Description: Status of the certificate operation. ,
Required: False ,
}
string ,
status_details:
{
Description: The status details of the certificate operation. ,
Required: False ,
}
string ,
error:
{
Description: Error encountered, if any, during the certificate operation. ,
Required: False ,
}
{
code:
{
Description: The error code. ,
Required: False ,
}
string ,
message:
{
Description: The error message. ,
Required: False ,
}
string ,
innererror:
{
Required: False ,
}
string ,
}
,
target:
{
Description: Location which contains the result of the certificate operation. ,
Required: False ,
}
string ,
preserveCertOrder:
{
Description: Specifies whether the certificate chain preserves its original order. The default value is false, which sets the leaf certificate at index 0. ,
Required: False ,
}
boolean ,
request_id:
{
Description: Identifier for the certificate operation. ,
Required: False ,
}
string ,
}

⚐ Response (default)

{
error:
{
Description: The key vault server error. ,
Required: False ,
}
{
code:
{
Description: The error code. ,
Required: False ,
}
string ,
message:
{
Description: The error message. ,
Required: False ,
}
string ,
innererror:
{
Required: False ,
}
string ,
}
,
}
ImportCertificate (updated)
Description :  Imports an existing valid certificate, containing a private key, into Azure Key Vault. This operation requires the certificates/import permission. The certificate to be imported can be in either PFX or PEM format. If the certificate is in PEM format the PEM file must contain the key as well as x509 certificates. Key Vault will only accept a key in PKCS#8 format.
Reference :  Link ¶

⚶ Changes

{
  "#id": "ImportCertificate",
  "$parameters": {
    "parameters": {
      "$properties": {
        "policy": [
          {
            "x509_props": [
              {
                "sans": [
                  {
                    "#name": "dns_names",
                    "Description": {
                      "new": "Domain Names.",
                      "old": "Domain names."
                    }
                  },
                  {
                    "#name": "upns",
                    "Description": {
                      "new": "User Principal Names.",
                      "old": "User principal names."
                    }
                  }
                ]
              }
            ]
          }
        ]
      }
    }
  },
  "$responses": {
    "200": {
      "$properties": [
        {
          "policy": [
            {
              "x509_props": [
                {
                  "sans": [
                    {
                      "#name": "dns_names",
                      "Description": {
                        "new": "Domain Names.",
                        "old": "Domain names."
                      }
                    },
                    {
                      "#name": "upns",
                      "Description": {
                        "new": "User Principal Names.",
                        "old": "User principal names."
                      }
                    }
                  ]
                }
              ]
            }
          ]
        },
        {
          "#name": "contentType",
          "Description": {
            "new": "The content type of the secret. eg. 'application/x-pem-file' or 'application/x-pkcs12'.",
            "old": "The content type of the secret. eg. 'application/x-pem-file' or 'application/x-pkcs12',"
          }
        },
        {
          "#name": "tags",
          "Description": {
            "new": "Application specific metadata in the form of key-value pairs.",
            "old": "Application specific metadata in the form of key-value pairs"
          }
        }
      ]
    }
  }
}

⚼ Request

POST:  /certificates/{certificate-name}/import
{
api-version:
{
Description: The API version to use for this operation. ,
Required: True ,
}
string ,
certificate-name:
{
Description: The name of the certificate. The value you provide may be copied globally for the purpose of running the service. The value provided should not include personally identifiable or sensitive information. ,
Required: True ,
}
string ,
parameters:
{
Description: The parameters to import the certificate. ,
Required: True ,
}
{
value:
{
Description: Base64 encoded representation of the certificate object to import. This certificate needs to contain the private key. ,
Required: True ,
}
string ,
pwd:
{
Description: If the private key in base64EncodedCertificate is encrypted, the password used for encryption. ,
Required: False ,
}
string ,
policy:
{
Description: The management policy for the certificate. ,
Required: False ,
}
{
id:
{
Description: The certificate id. ,
Required: False ,
}
string ,
key_props:
{
Description: Properties of the key backing a certificate. ,
Required: False ,
}
{
exportable:
{
Description: Indicates if the private key can be exported. Release policy must be provided when creating the first version of an exportable key. ,
Required: False ,
}
boolean ,
kty:
{
Description: The type of key pair to be used for the certificate. ,
Enum:
{
EC: Elliptic Curve. ,
EC-HSM: Elliptic Curve with a private key which is not exportable from the HSM. ,
RSA: RSA (https://tools.ietf.org/html/rfc3447). ,
RSA-HSM: RSA with a private key which is not exportable from the HSM. ,
oct: Octet sequence (used to represent symmetric keys). ,
oct-HSM: Octet sequence with a private key which is not exportable from the HSM. ,
}
,
Required: False ,
}
enum ,
key_size:
{
Description: The key size in bits. For example: 2048, 3072, or 4096 for RSA. ,
Format: int32 ,
Required: False ,
}
integer ,
reuse_key:
{
Description: Indicates if the same key pair will be used on certificate renewal. ,
Required: False ,
}
boolean ,
crv:
{
Description: Elliptic curve name. For valid values, see JsonWebKeyCurveName. ,
Enum:
{
P-256: The NIST P-256 elliptic curve, AKA SECG curve SECP256R1. ,
P-384: The NIST P-384 elliptic curve, AKA SECG curve SECP384R1. ,
P-521: The NIST P-521 elliptic curve, AKA SECG curve SECP521R1. ,
P-256K: The SECG SECP256K1 elliptic curve. ,
}
,
Required: False ,
}
enum ,
}
,
secret_props:
{
Description: Properties of the secret backing a certificate. ,
Required: False ,
}
{
contentType:
{
Description: The media type (MIME type). ,
Required: False ,
}
string ,
}
,
x509_props:
{
Description: Properties of the X509 component of a certificate. ,
Required: False ,
}
{
subject:
{
Description: The subject name. Should be a valid X509 distinguished Name. ,
Required: False ,
}
string ,
ekus:
{
Description: The enhanced key usage. ,
Required: False ,
}
[
string ,
]
,
sans:
{
Description: The subject alternative names. ,
Required: False ,
}
{
emails:
{
Description: Email addresses. ,
Required: False ,
}
[
string ,
]
,
dns_names:
{
Description: Domain Names. ,
Required: False ,
}
[
string ,
]
,
upns:
{
Description: User Principal Names. ,
Required: False ,
}
[
string ,
]
,
}
,
key_usage:
{
Description: Defines how the certificate's key may be used. ,
Required: False ,
}
[
string ,
]
,
validity_months:
{
Description: The duration that the certificate is valid in months. ,
Format: int32 ,
Required: False ,
}
integer ,
}
,
lifetime_actions:
{
Description: Actions that will be performed by Key Vault over the lifetime of a certificate. ,
Required: False ,
}
[
{
trigger:
{
Description: The condition that will execute the action. ,
Required: False ,
}
{
lifetime_percentage:
{
Description: Percentage of lifetime at which to trigger. Value should be between 1 and 99. ,
Format: int32 ,
Required: False ,
}
integer ,
days_before_expiry:
{
Description: Days before expiry to attempt renewal. Value should be between 1 and validity_in_months multiplied by 27. If validity_in_months is 36, then value should be between 1 and 972 (36 * 27). ,
Format: int32 ,
Required: False ,
}
integer ,
}
,
action:
{
Description: The action that will be executed. ,
Required: False ,
}
{
action_type:
{
Description: The type of the action. ,
Enum:
{
EmailContacts: A certificate policy that will email certificate contacts. ,
AutoRenew: A certificate policy that will auto-renew a certificate. ,
}
,
Required: False ,
}
enum ,
}
,
}
,
]
,
issuer:
{
Description: Parameters for the issuer of the X509 component of a certificate. ,
Required: False ,
}
{
name:
{
Description: Name of the referenced issuer object or reserved names; for example, 'Self' or 'Unknown'. ,
Required: False ,
}
string ,
cty:
{
Description: Certificate type as supported by the provider (optional); for example 'OV-SSL', 'EV-SSL' ,
Required: False ,
}
string ,
cert_transparency:
{
Description: Indicates if the certificates generated under this policy should be published to certificate transparency logs. ,
Required: False ,
}
boolean ,
}
,
attributes:
{
Description: The certificate attributes. ,
Required: False ,
}
{
enabled:
{
Description: Determines whether the object is enabled. ,
Required: False ,
}
boolean ,
nbf:
{
Description: Not before date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
exp:
{
Description: Expiry date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
created:
{
Description: Creation time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
updated:
{
Description: Last updated time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
recoverableDays:
{
Description: softDelete data retention days. Value should be >=7 and <=90 when softDelete enabled, otherwise 0. ,
Format: int32 ,
Required: False ,
}
integer ,
recoveryLevel:
{
Description: Reflects the deletion recovery level currently in effect for certificates in the current vault. If it contains 'Purgeable', the certificate can be permanently deleted by a privileged user; otherwise, only the system can purge the certificate, at the end of the retention interval. ,
Enum:
{
Purgeable: Denotes a vault state in which deletion is an irreversible operation, without the possibility for recovery. This level corresponds to no protection being available against a Delete operation; the data is irretrievably lost upon accepting a Delete operation at the entity level or higher (vault, resource group, subscription etc.) ,
Recoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days), unless a Purge operation is requested, or the subscription is cancelled. System wil permanently delete it after 90 days, if not recovered ,
Recoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days) and while the subscription is still available. System wil permanently delete it after 90 days, if not recovered ,
Recoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable within retention interval (90 days), immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled. System wil permanently delete it after 90 days, if not recovered ,
CustomizedRecoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90). This level guarantees the recoverability of the deleted entity during the retention interval, unless a Purge operation is requested, or the subscription is cancelled. ,
CustomizedRecoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90).This level guarantees the recoverability of the deleted entity during the retention interval and while the subscription is still available. ,
CustomizedRecoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable, immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled when 7 <= SoftDeleteRetentionInDays < 90. This level guarantees the recoverability of the deleted entity during the retention interval, and also reflects the fact that the subscription itself cannot be cancelled. ,
}
,
Required: False ,
}
enum ,
}
,
}
,
attributes:
{
Description: The attributes of the certificate (optional). ,
Required: False ,
}
{
enabled:
{
Description: Determines whether the object is enabled. ,
Required: False ,
}
boolean ,
nbf:
{
Description: Not before date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
exp:
{
Description: Expiry date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
created:
{
Description: Creation time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
updated:
{
Description: Last updated time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
recoverableDays:
{
Description: softDelete data retention days. Value should be >=7 and <=90 when softDelete enabled, otherwise 0. ,
Format: int32 ,
Required: False ,
}
integer ,
recoveryLevel:
{
Description: Reflects the deletion recovery level currently in effect for certificates in the current vault. If it contains 'Purgeable', the certificate can be permanently deleted by a privileged user; otherwise, only the system can purge the certificate, at the end of the retention interval. ,
Enum:
{
Purgeable: Denotes a vault state in which deletion is an irreversible operation, without the possibility for recovery. This level corresponds to no protection being available against a Delete operation; the data is irretrievably lost upon accepting a Delete operation at the entity level or higher (vault, resource group, subscription etc.) ,
Recoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days), unless a Purge operation is requested, or the subscription is cancelled. System wil permanently delete it after 90 days, if not recovered ,
Recoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days) and while the subscription is still available. System wil permanently delete it after 90 days, if not recovered ,
Recoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable within retention interval (90 days), immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled. System wil permanently delete it after 90 days, if not recovered ,
CustomizedRecoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90). This level guarantees the recoverability of the deleted entity during the retention interval, unless a Purge operation is requested, or the subscription is cancelled. ,
CustomizedRecoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90).This level guarantees the recoverability of the deleted entity during the retention interval and while the subscription is still available. ,
CustomizedRecoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable, immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled when 7 <= SoftDeleteRetentionInDays < 90. This level guarantees the recoverability of the deleted entity during the retention interval, and also reflects the fact that the subscription itself cannot be cancelled. ,
}
,
Required: False ,
}
enum ,
}
,
tags:
{
Description: Application specific metadata in the form of key-value pairs. ,
Required: False ,
}
object ,
preserveCertOrder:
{
Description: Specifies whether the certificate chain preserves its original order. The default value is false, which sets the leaf certificate at index 0. ,
Required: False ,
}
boolean ,
}
,
}

⚐ Response (200)

{
id:
{
Description: The certificate id. ,
Required: False ,
}
string ,
kid:
{
Description: The key id. ,
Required: False ,
}
string ,
sid:
{
Description: The secret id. ,
Required: False ,
}
string ,
x5t:
{
Description: Thumbprint of the certificate. ,
Format: base64url ,
Required: False ,
}
string ,
policy:
{
Description: The management policy. ,
Required: False ,
}
{
id:
{
Description: The certificate id. ,
Required: False ,
}
string ,
key_props:
{
Description: Properties of the key backing a certificate. ,
Required: False ,
}
{
exportable:
{
Description: Indicates if the private key can be exported. Release policy must be provided when creating the first version of an exportable key. ,
Required: False ,
}
boolean ,
kty:
{
Description: The type of key pair to be used for the certificate. ,
Enum:
{
EC: Elliptic Curve. ,
EC-HSM: Elliptic Curve with a private key which is not exportable from the HSM. ,
RSA: RSA (https://tools.ietf.org/html/rfc3447). ,
RSA-HSM: RSA with a private key which is not exportable from the HSM. ,
oct: Octet sequence (used to represent symmetric keys). ,
oct-HSM: Octet sequence with a private key which is not exportable from the HSM. ,
}
,
Required: False ,
}
enum ,
key_size:
{
Description: The key size in bits. For example: 2048, 3072, or 4096 for RSA. ,
Format: int32 ,
Required: False ,
}
integer ,
reuse_key:
{
Description: Indicates if the same key pair will be used on certificate renewal. ,
Required: False ,
}
boolean ,
crv:
{
Description: Elliptic curve name. For valid values, see JsonWebKeyCurveName. ,
Enum:
{
P-256: The NIST P-256 elliptic curve, AKA SECG curve SECP256R1. ,
P-384: The NIST P-384 elliptic curve, AKA SECG curve SECP384R1. ,
P-521: The NIST P-521 elliptic curve, AKA SECG curve SECP521R1. ,
P-256K: The SECG SECP256K1 elliptic curve. ,
}
,
Required: False ,
}
enum ,
}
,
secret_props:
{
Description: Properties of the secret backing a certificate. ,
Required: False ,
}
{
contentType:
{
Description: The media type (MIME type). ,
Required: False ,
}
string ,
}
,
x509_props:
{
Description: Properties of the X509 component of a certificate. ,
Required: False ,
}
{
subject:
{
Description: The subject name. Should be a valid X509 distinguished Name. ,
Required: False ,
}
string ,
ekus:
{
Description: The enhanced key usage. ,
Required: False ,
}
[
string ,
]
,
sans:
{
Description: The subject alternative names. ,
Required: False ,
}
{
emails:
{
Description: Email addresses. ,
Required: False ,
}
[
string ,
]
,
dns_names:
{
Description: Domain Names. ,
Required: False ,
}
[
string ,
]
,
upns:
{
Description: User Principal Names. ,
Required: False ,
}
[
string ,
]
,
}
,
key_usage:
{
Description: Defines how the certificate's key may be used. ,
Required: False ,
}
[
string ,
]
,
validity_months:
{
Description: The duration that the certificate is valid in months. ,
Format: int32 ,
Required: False ,
}
integer ,
}
,
lifetime_actions:
{
Description: Actions that will be performed by Key Vault over the lifetime of a certificate. ,
Required: False ,
}
[
{
trigger:
{
Description: The condition that will execute the action. ,
Required: False ,
}
{
lifetime_percentage:
{
Description: Percentage of lifetime at which to trigger. Value should be between 1 and 99. ,
Format: int32 ,
Required: False ,
}
integer ,
days_before_expiry:
{
Description: Days before expiry to attempt renewal. Value should be between 1 and validity_in_months multiplied by 27. If validity_in_months is 36, then value should be between 1 and 972 (36 * 27). ,
Format: int32 ,
Required: False ,
}
integer ,
}
,
action:
{
Description: The action that will be executed. ,
Required: False ,
}
{
action_type:
{
Description: The type of the action. ,
Enum:
{
EmailContacts: A certificate policy that will email certificate contacts. ,
AutoRenew: A certificate policy that will auto-renew a certificate. ,
}
,
Required: False ,
}
enum ,
}
,
}
,
]
,
issuer:
{
Description: Parameters for the issuer of the X509 component of a certificate. ,
Required: False ,
}
{
name:
{
Description: Name of the referenced issuer object or reserved names; for example, 'Self' or 'Unknown'. ,
Required: False ,
}
string ,
cty:
{
Description: Certificate type as supported by the provider (optional); for example 'OV-SSL', 'EV-SSL' ,
Required: False ,
}
string ,
cert_transparency:
{
Description: Indicates if the certificates generated under this policy should be published to certificate transparency logs. ,
Required: False ,
}
boolean ,
}
,
attributes:
{
Description: The certificate attributes. ,
Required: False ,
}
{
enabled:
{
Description: Determines whether the object is enabled. ,
Required: False ,
}
boolean ,
nbf:
{
Description: Not before date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
exp:
{
Description: Expiry date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
created:
{
Description: Creation time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
updated:
{
Description: Last updated time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
recoverableDays:
{
Description: softDelete data retention days. Value should be >=7 and <=90 when softDelete enabled, otherwise 0. ,
Format: int32 ,
Required: False ,
}
integer ,
recoveryLevel:
{
Description: Reflects the deletion recovery level currently in effect for certificates in the current vault. If it contains 'Purgeable', the certificate can be permanently deleted by a privileged user; otherwise, only the system can purge the certificate, at the end of the retention interval. ,
Enum:
{
Purgeable: Denotes a vault state in which deletion is an irreversible operation, without the possibility for recovery. This level corresponds to no protection being available against a Delete operation; the data is irretrievably lost upon accepting a Delete operation at the entity level or higher (vault, resource group, subscription etc.) ,
Recoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days), unless a Purge operation is requested, or the subscription is cancelled. System wil permanently delete it after 90 days, if not recovered ,
Recoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days) and while the subscription is still available. System wil permanently delete it after 90 days, if not recovered ,
Recoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable within retention interval (90 days), immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled. System wil permanently delete it after 90 days, if not recovered ,
CustomizedRecoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90). This level guarantees the recoverability of the deleted entity during the retention interval, unless a Purge operation is requested, or the subscription is cancelled. ,
CustomizedRecoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90).This level guarantees the recoverability of the deleted entity during the retention interval and while the subscription is still available. ,
CustomizedRecoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable, immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled when 7 <= SoftDeleteRetentionInDays < 90. This level guarantees the recoverability of the deleted entity during the retention interval, and also reflects the fact that the subscription itself cannot be cancelled. ,
}
,
Required: False ,
}
enum ,
}
,
}
,
cer:
{
Description: CER contents of x509 certificate. ,
Format: byte ,
Required: False ,
}
string ,
contentType:
{
Description: The content type of the secret. eg. 'application/x-pem-file' or 'application/x-pkcs12'. ,
Required: False ,
}
string ,
attributes:
{
Description: The certificate attributes. ,
Required: False ,
}
{
enabled:
{
Description: Determines whether the object is enabled. ,
Required: False ,
}
boolean ,
nbf:
{
Description: Not before date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
exp:
{
Description: Expiry date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
created:
{
Description: Creation time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
updated:
{
Description: Last updated time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
recoverableDays:
{
Description: softDelete data retention days. Value should be >=7 and <=90 when softDelete enabled, otherwise 0. ,
Format: int32 ,
Required: False ,
}
integer ,
recoveryLevel:
{
Description: Reflects the deletion recovery level currently in effect for certificates in the current vault. If it contains 'Purgeable', the certificate can be permanently deleted by a privileged user; otherwise, only the system can purge the certificate, at the end of the retention interval. ,
Enum:
{
Purgeable: Denotes a vault state in which deletion is an irreversible operation, without the possibility for recovery. This level corresponds to no protection being available against a Delete operation; the data is irretrievably lost upon accepting a Delete operation at the entity level or higher (vault, resource group, subscription etc.) ,
Recoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days), unless a Purge operation is requested, or the subscription is cancelled. System wil permanently delete it after 90 days, if not recovered ,
Recoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days) and while the subscription is still available. System wil permanently delete it after 90 days, if not recovered ,
Recoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable within retention interval (90 days), immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled. System wil permanently delete it after 90 days, if not recovered ,
CustomizedRecoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90). This level guarantees the recoverability of the deleted entity during the retention interval, unless a Purge operation is requested, or the subscription is cancelled. ,
CustomizedRecoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90).This level guarantees the recoverability of the deleted entity during the retention interval and while the subscription is still available. ,
CustomizedRecoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable, immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled when 7 <= SoftDeleteRetentionInDays < 90. This level guarantees the recoverability of the deleted entity during the retention interval, and also reflects the fact that the subscription itself cannot be cancelled. ,
}
,
Required: False ,
}
enum ,
}
,
tags:
{
Description: Application specific metadata in the form of key-value pairs. ,
Required: False ,
}
object ,
preserveCertOrder:
{
Description: Specifies whether the certificate chain preserves its original order. The default value is false, which sets the leaf certificate at index 0. ,
Required: False ,
}
boolean ,
}

⚐ Response (default)

{
error:
{
Description: The key vault server error. ,
Required: False ,
}
{
code:
{
Description: The error code. ,
Required: False ,
}
string ,
message:
{
Description: The error message. ,
Required: False ,
}
string ,
innererror:
{
Required: False ,
}
string ,
}
,
}
MergeCertificate (updated)
Description :  The MergeCertificate operation performs the merging of a certificate or certificate chain with a key pair currently available in the service. This operation requires the certificates/create permission.
Reference :  Link ¶

⚶ Changes

{
  "#id": "MergeCertificate",
  "$responses": {
    "201": {
      "$properties": [
        {
          "policy": [
            {
              "x509_props": [
                {
                  "sans": [
                    {
                      "#name": "dns_names",
                      "Description": {
                        "new": "Domain Names.",
                        "old": "Domain names."
                      }
                    },
                    {
                      "#name": "upns",
                      "Description": {
                        "new": "User Principal Names.",
                        "old": "User principal names."
                      }
                    }
                  ]
                }
              ]
            }
          ]
        },
        {
          "#name": "contentType",
          "Description": {
            "new": "The content type of the secret. eg. 'application/x-pem-file' or 'application/x-pkcs12'.",
            "old": "The content type of the secret. eg. 'application/x-pem-file' or 'application/x-pkcs12',"
          }
        },
        {
          "#name": "tags",
          "Description": {
            "new": "Application specific metadata in the form of key-value pairs.",
            "old": "Application specific metadata in the form of key-value pairs"
          }
        }
      ]
    }
  }
}

⚼ Request

POST:  /certificates/{certificate-name}/pending/merge
{
api-version:
{
Description: The API version to use for this operation. ,
Required: True ,
}
string ,
certificate-name:
{
Description: The name of the certificate. ,
Required: True ,
}
string ,
parameters:
{
Description: The parameters to merge certificate. ,
Required: True ,
}
{
x5c:
{
Description: The certificate or the certificate chain to merge. ,
Required: True ,
}
[
string ,
]
,
attributes:
{
Description: The attributes of the certificate (optional). ,
Required: False ,
}
{
enabled:
{
Description: Determines whether the object is enabled. ,
Required: False ,
}
boolean ,
nbf:
{
Description: Not before date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
exp:
{
Description: Expiry date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
created:
{
Description: Creation time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
updated:
{
Description: Last updated time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
recoverableDays:
{
Description: softDelete data retention days. Value should be >=7 and <=90 when softDelete enabled, otherwise 0. ,
Format: int32 ,
Required: False ,
}
integer ,
recoveryLevel:
{
Description: Reflects the deletion recovery level currently in effect for certificates in the current vault. If it contains 'Purgeable', the certificate can be permanently deleted by a privileged user; otherwise, only the system can purge the certificate, at the end of the retention interval. ,
Enum:
{
Purgeable: Denotes a vault state in which deletion is an irreversible operation, without the possibility for recovery. This level corresponds to no protection being available against a Delete operation; the data is irretrievably lost upon accepting a Delete operation at the entity level or higher (vault, resource group, subscription etc.) ,
Recoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days), unless a Purge operation is requested, or the subscription is cancelled. System wil permanently delete it after 90 days, if not recovered ,
Recoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days) and while the subscription is still available. System wil permanently delete it after 90 days, if not recovered ,
Recoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable within retention interval (90 days), immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled. System wil permanently delete it after 90 days, if not recovered ,
CustomizedRecoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90). This level guarantees the recoverability of the deleted entity during the retention interval, unless a Purge operation is requested, or the subscription is cancelled. ,
CustomizedRecoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90).This level guarantees the recoverability of the deleted entity during the retention interval and while the subscription is still available. ,
CustomizedRecoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable, immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled when 7 <= SoftDeleteRetentionInDays < 90. This level guarantees the recoverability of the deleted entity during the retention interval, and also reflects the fact that the subscription itself cannot be cancelled. ,
}
,
Required: False ,
}
enum ,
}
,
tags:
{
Description: Application specific metadata in the form of key-value pairs. ,
Required: False ,
}
object ,
}
,
}

⚐ Response (201)

{
id:
{
Description: The certificate id. ,
Required: False ,
}
string ,
kid:
{
Description: The key id. ,
Required: False ,
}
string ,
sid:
{
Description: The secret id. ,
Required: False ,
}
string ,
x5t:
{
Description: Thumbprint of the certificate. ,
Format: base64url ,
Required: False ,
}
string ,
policy:
{
Description: The management policy. ,
Required: False ,
}
{
id:
{
Description: The certificate id. ,
Required: False ,
}
string ,
key_props:
{
Description: Properties of the key backing a certificate. ,
Required: False ,
}
{
exportable:
{
Description: Indicates if the private key can be exported. Release policy must be provided when creating the first version of an exportable key. ,
Required: False ,
}
boolean ,
kty:
{
Description: The type of key pair to be used for the certificate. ,
Enum:
{
EC: Elliptic Curve. ,
EC-HSM: Elliptic Curve with a private key which is not exportable from the HSM. ,
RSA: RSA (https://tools.ietf.org/html/rfc3447). ,
RSA-HSM: RSA with a private key which is not exportable from the HSM. ,
oct: Octet sequence (used to represent symmetric keys). ,
oct-HSM: Octet sequence with a private key which is not exportable from the HSM. ,
}
,
Required: False ,
}
enum ,
key_size:
{
Description: The key size in bits. For example: 2048, 3072, or 4096 for RSA. ,
Format: int32 ,
Required: False ,
}
integer ,
reuse_key:
{
Description: Indicates if the same key pair will be used on certificate renewal. ,
Required: False ,
}
boolean ,
crv:
{
Description: Elliptic curve name. For valid values, see JsonWebKeyCurveName. ,
Enum:
{
P-256: The NIST P-256 elliptic curve, AKA SECG curve SECP256R1. ,
P-384: The NIST P-384 elliptic curve, AKA SECG curve SECP384R1. ,
P-521: The NIST P-521 elliptic curve, AKA SECG curve SECP521R1. ,
P-256K: The SECG SECP256K1 elliptic curve. ,
}
,
Required: False ,
}
enum ,
}
,
secret_props:
{
Description: Properties of the secret backing a certificate. ,
Required: False ,
}
{
contentType:
{
Description: The media type (MIME type). ,
Required: False ,
}
string ,
}
,
x509_props:
{
Description: Properties of the X509 component of a certificate. ,
Required: False ,
}
{
subject:
{
Description: The subject name. Should be a valid X509 distinguished Name. ,
Required: False ,
}
string ,
ekus:
{
Description: The enhanced key usage. ,
Required: False ,
}
[
string ,
]
,
sans:
{
Description: The subject alternative names. ,
Required: False ,
}
{
emails:
{
Description: Email addresses. ,
Required: False ,
}
[
string ,
]
,
dns_names:
{
Description: Domain Names. ,
Required: False ,
}
[
string ,
]
,
upns:
{
Description: User Principal Names. ,
Required: False ,
}
[
string ,
]
,
}
,
key_usage:
{
Description: Defines how the certificate's key may be used. ,
Required: False ,
}
[
string ,
]
,
validity_months:
{
Description: The duration that the certificate is valid in months. ,
Format: int32 ,
Required: False ,
}
integer ,
}
,
lifetime_actions:
{
Description: Actions that will be performed by Key Vault over the lifetime of a certificate. ,
Required: False ,
}
[
{
trigger:
{
Description: The condition that will execute the action. ,
Required: False ,
}
{
lifetime_percentage:
{
Description: Percentage of lifetime at which to trigger. Value should be between 1 and 99. ,
Format: int32 ,
Required: False ,
}
integer ,
days_before_expiry:
{
Description: Days before expiry to attempt renewal. Value should be between 1 and validity_in_months multiplied by 27. If validity_in_months is 36, then value should be between 1 and 972 (36 * 27). ,
Format: int32 ,
Required: False ,
}
integer ,
}
,
action:
{
Description: The action that will be executed. ,
Required: False ,
}
{
action_type:
{
Description: The type of the action. ,
Enum:
{
EmailContacts: A certificate policy that will email certificate contacts. ,
AutoRenew: A certificate policy that will auto-renew a certificate. ,
}
,
Required: False ,
}
enum ,
}
,
}
,
]
,
issuer:
{
Description: Parameters for the issuer of the X509 component of a certificate. ,
Required: False ,
}
{
name:
{
Description: Name of the referenced issuer object or reserved names; for example, 'Self' or 'Unknown'. ,
Required: False ,
}
string ,
cty:
{
Description: Certificate type as supported by the provider (optional); for example 'OV-SSL', 'EV-SSL' ,
Required: False ,
}
string ,
cert_transparency:
{
Description: Indicates if the certificates generated under this policy should be published to certificate transparency logs. ,
Required: False ,
}
boolean ,
}
,
attributes:
{
Description: The certificate attributes. ,
Required: False ,
}
{
enabled:
{
Description: Determines whether the object is enabled. ,
Required: False ,
}
boolean ,
nbf:
{
Description: Not before date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
exp:
{
Description: Expiry date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
created:
{
Description: Creation time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
updated:
{
Description: Last updated time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
recoverableDays:
{
Description: softDelete data retention days. Value should be >=7 and <=90 when softDelete enabled, otherwise 0. ,
Format: int32 ,
Required: False ,
}
integer ,
recoveryLevel:
{
Description: Reflects the deletion recovery level currently in effect for certificates in the current vault. If it contains 'Purgeable', the certificate can be permanently deleted by a privileged user; otherwise, only the system can purge the certificate, at the end of the retention interval. ,
Enum:
{
Purgeable: Denotes a vault state in which deletion is an irreversible operation, without the possibility for recovery. This level corresponds to no protection being available against a Delete operation; the data is irretrievably lost upon accepting a Delete operation at the entity level or higher (vault, resource group, subscription etc.) ,
Recoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days), unless a Purge operation is requested, or the subscription is cancelled. System wil permanently delete it after 90 days, if not recovered ,
Recoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days) and while the subscription is still available. System wil permanently delete it after 90 days, if not recovered ,
Recoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable within retention interval (90 days), immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled. System wil permanently delete it after 90 days, if not recovered ,
CustomizedRecoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90). This level guarantees the recoverability of the deleted entity during the retention interval, unless a Purge operation is requested, or the subscription is cancelled. ,
CustomizedRecoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90).This level guarantees the recoverability of the deleted entity during the retention interval and while the subscription is still available. ,
CustomizedRecoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable, immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled when 7 <= SoftDeleteRetentionInDays < 90. This level guarantees the recoverability of the deleted entity during the retention interval, and also reflects the fact that the subscription itself cannot be cancelled. ,
}
,
Required: False ,
}
enum ,
}
,
}
,
cer:
{
Description: CER contents of x509 certificate. ,
Format: byte ,
Required: False ,
}
string ,
contentType:
{
Description: The content type of the secret. eg. 'application/x-pem-file' or 'application/x-pkcs12'. ,
Required: False ,
}
string ,
attributes:
{
Description: The certificate attributes. ,
Required: False ,
}
{
enabled:
{
Description: Determines whether the object is enabled. ,
Required: False ,
}
boolean ,
nbf:
{
Description: Not before date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
exp:
{
Description: Expiry date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
created:
{
Description: Creation time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
updated:
{
Description: Last updated time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
recoverableDays:
{
Description: softDelete data retention days. Value should be >=7 and <=90 when softDelete enabled, otherwise 0. ,
Format: int32 ,
Required: False ,
}
integer ,
recoveryLevel:
{
Description: Reflects the deletion recovery level currently in effect for certificates in the current vault. If it contains 'Purgeable', the certificate can be permanently deleted by a privileged user; otherwise, only the system can purge the certificate, at the end of the retention interval. ,
Enum:
{
Purgeable: Denotes a vault state in which deletion is an irreversible operation, without the possibility for recovery. This level corresponds to no protection being available against a Delete operation; the data is irretrievably lost upon accepting a Delete operation at the entity level or higher (vault, resource group, subscription etc.) ,
Recoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days), unless a Purge operation is requested, or the subscription is cancelled. System wil permanently delete it after 90 days, if not recovered ,
Recoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days) and while the subscription is still available. System wil permanently delete it after 90 days, if not recovered ,
Recoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable within retention interval (90 days), immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled. System wil permanently delete it after 90 days, if not recovered ,
CustomizedRecoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90). This level guarantees the recoverability of the deleted entity during the retention interval, unless a Purge operation is requested, or the subscription is cancelled. ,
CustomizedRecoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90).This level guarantees the recoverability of the deleted entity during the retention interval and while the subscription is still available. ,
CustomizedRecoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable, immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled when 7 <= SoftDeleteRetentionInDays < 90. This level guarantees the recoverability of the deleted entity during the retention interval, and also reflects the fact that the subscription itself cannot be cancelled. ,
}
,
Required: False ,
}
enum ,
}
,
tags:
{
Description: Application specific metadata in the form of key-value pairs. ,
Required: False ,
}
object ,
preserveCertOrder:
{
Description: Specifies whether the certificate chain preserves its original order. The default value is false, which sets the leaf certificate at index 0. ,
Required: False ,
}
boolean ,
}

⚐ Response (default)

{
error:
{
Description: The key vault server error. ,
Required: False ,
}
{
code:
{
Description: The error code. ,
Required: False ,
}
string ,
message:
{
Description: The error message. ,
Required: False ,
}
string ,
innererror:
{
Required: False ,
}
string ,
}
,
}
GetCertificatePolicy (updated)
Description :  The GetCertificatePolicy operation returns the specified certificate policy resources in the specified key vault. This operation requires the certificates/get permission.
Reference :  Link ¶

⚶ Changes

{
  "#id": "GetCertificatePolicy",
  "$responses": {
    "200": {
      "$properties": {
        "x509_props": [
          {
            "sans": [
              {
                "#name": "dns_names",
                "Description": {
                  "new": "Domain Names.",
                  "old": "Domain names."
                }
              },
              {
                "#name": "upns",
                "Description": {
                  "new": "User Principal Names.",
                  "old": "User principal names."
                }
              }
            ]
          }
        ]
      }
    }
  }
}

⚼ Request

GET:  /certificates/{certificate-name}/policy
{
api-version:
{
Description: The API version to use for this operation. ,
Required: True ,
}
string ,
certificate-name:
{
Description: The name of the certificate in a given key vault. ,
Required: True ,
}
string ,
}

⚐ Response (200)

{
id:
{
Description: The certificate id. ,
Required: False ,
}
string ,
key_props:
{
Description: Properties of the key backing a certificate. ,
Required: False ,
}
{
exportable:
{
Description: Indicates if the private key can be exported. Release policy must be provided when creating the first version of an exportable key. ,
Required: False ,
}
boolean ,
kty:
{
Description: The type of key pair to be used for the certificate. ,
Enum:
{
EC: Elliptic Curve. ,
EC-HSM: Elliptic Curve with a private key which is not exportable from the HSM. ,
RSA: RSA (https://tools.ietf.org/html/rfc3447). ,
RSA-HSM: RSA with a private key which is not exportable from the HSM. ,
oct: Octet sequence (used to represent symmetric keys). ,
oct-HSM: Octet sequence with a private key which is not exportable from the HSM. ,
}
,
Required: False ,
}
enum ,
key_size:
{
Description: The key size in bits. For example: 2048, 3072, or 4096 for RSA. ,
Format: int32 ,
Required: False ,
}
integer ,
reuse_key:
{
Description: Indicates if the same key pair will be used on certificate renewal. ,
Required: False ,
}
boolean ,
crv:
{
Description: Elliptic curve name. For valid values, see JsonWebKeyCurveName. ,
Enum:
{
P-256: The NIST P-256 elliptic curve, AKA SECG curve SECP256R1. ,
P-384: The NIST P-384 elliptic curve, AKA SECG curve SECP384R1. ,
P-521: The NIST P-521 elliptic curve, AKA SECG curve SECP521R1. ,
P-256K: The SECG SECP256K1 elliptic curve. ,
}
,
Required: False ,
}
enum ,
}
,
secret_props:
{
Description: Properties of the secret backing a certificate. ,
Required: False ,
}
{
contentType:
{
Description: The media type (MIME type). ,
Required: False ,
}
string ,
}
,
x509_props:
{
Description: Properties of the X509 component of a certificate. ,
Required: False ,
}
{
subject:
{
Description: The subject name. Should be a valid X509 distinguished Name. ,
Required: False ,
}
string ,
ekus:
{
Description: The enhanced key usage. ,
Required: False ,
}
[
string ,
]
,
sans:
{
Description: The subject alternative names. ,
Required: False ,
}
{
emails:
{
Description: Email addresses. ,
Required: False ,
}
[
string ,
]
,
dns_names:
{
Description: Domain Names. ,
Required: False ,
}
[
string ,
]
,
upns:
{
Description: User Principal Names. ,
Required: False ,
}
[
string ,
]
,
}
,
key_usage:
{
Description: Defines how the certificate's key may be used. ,
Required: False ,
}
[
string ,
]
,
validity_months:
{
Description: The duration that the certificate is valid in months. ,
Format: int32 ,
Required: False ,
}
integer ,
}
,
lifetime_actions:
{
Description: Actions that will be performed by Key Vault over the lifetime of a certificate. ,
Required: False ,
}
[
{
trigger:
{
Description: The condition that will execute the action. ,
Required: False ,
}
{
lifetime_percentage:
{
Description: Percentage of lifetime at which to trigger. Value should be between 1 and 99. ,
Format: int32 ,
Required: False ,
}
integer ,
days_before_expiry:
{
Description: Days before expiry to attempt renewal. Value should be between 1 and validity_in_months multiplied by 27. If validity_in_months is 36, then value should be between 1 and 972 (36 * 27). ,
Format: int32 ,
Required: False ,
}
integer ,
}
,
action:
{
Description: The action that will be executed. ,
Required: False ,
}
{
action_type:
{
Description: The type of the action. ,
Enum:
{
EmailContacts: A certificate policy that will email certificate contacts. ,
AutoRenew: A certificate policy that will auto-renew a certificate. ,
}
,
Required: False ,
}
enum ,
}
,
}
,
]
,
issuer:
{
Description: Parameters for the issuer of the X509 component of a certificate. ,
Required: False ,
}
{
name:
{
Description: Name of the referenced issuer object or reserved names; for example, 'Self' or 'Unknown'. ,
Required: False ,
}
string ,
cty:
{
Description: Certificate type as supported by the provider (optional); for example 'OV-SSL', 'EV-SSL' ,
Required: False ,
}
string ,
cert_transparency:
{
Description: Indicates if the certificates generated under this policy should be published to certificate transparency logs. ,
Required: False ,
}
boolean ,
}
,
attributes:
{
Description: The certificate attributes. ,
Required: False ,
}
{
enabled:
{
Description: Determines whether the object is enabled. ,
Required: False ,
}
boolean ,
nbf:
{
Description: Not before date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
exp:
{
Description: Expiry date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
created:
{
Description: Creation time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
updated:
{
Description: Last updated time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
recoverableDays:
{
Description: softDelete data retention days. Value should be >=7 and <=90 when softDelete enabled, otherwise 0. ,
Format: int32 ,
Required: False ,
}
integer ,
recoveryLevel:
{
Description: Reflects the deletion recovery level currently in effect for certificates in the current vault. If it contains 'Purgeable', the certificate can be permanently deleted by a privileged user; otherwise, only the system can purge the certificate, at the end of the retention interval. ,
Enum:
{
Purgeable: Denotes a vault state in which deletion is an irreversible operation, without the possibility for recovery. This level corresponds to no protection being available against a Delete operation; the data is irretrievably lost upon accepting a Delete operation at the entity level or higher (vault, resource group, subscription etc.) ,
Recoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days), unless a Purge operation is requested, or the subscription is cancelled. System wil permanently delete it after 90 days, if not recovered ,
Recoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days) and while the subscription is still available. System wil permanently delete it after 90 days, if not recovered ,
Recoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable within retention interval (90 days), immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled. System wil permanently delete it after 90 days, if not recovered ,
CustomizedRecoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90). This level guarantees the recoverability of the deleted entity during the retention interval, unless a Purge operation is requested, or the subscription is cancelled. ,
CustomizedRecoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90).This level guarantees the recoverability of the deleted entity during the retention interval and while the subscription is still available. ,
CustomizedRecoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable, immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled when 7 <= SoftDeleteRetentionInDays < 90. This level guarantees the recoverability of the deleted entity during the retention interval, and also reflects the fact that the subscription itself cannot be cancelled. ,
}
,
Required: False ,
}
enum ,
}
,
}

⚐ Response (default)

{
error:
{
Description: The key vault server error. ,
Required: False ,
}
{
code:
{
Description: The error code. ,
Required: False ,
}
string ,
message:
{
Description: The error message. ,
Required: False ,
}
string ,
innererror:
{
Required: False ,
}
string ,
}
,
}
UpdateCertificatePolicy (updated)
Description :  Set specified members in the certificate policy. Leave others as null. This operation requires the certificates/update permission.
Reference :  Link ¶

⚶ Changes

{
  "#id": "UpdateCertificatePolicy",
  "$parameters": {
    "certificatePolicy": {
      "$properties": {
        "x509_props": [
          {
            "sans": [
              {
                "#name": "dns_names",
                "Description": {
                  "new": "Domain Names.",
                  "old": "Domain names."
                }
              },
              {
                "#name": "upns",
                "Description": {
                  "new": "User Principal Names.",
                  "old": "User principal names."
                }
              }
            ]
          }
        ]
      }
    }
  },
  "$responses": {
    "200": {
      "$properties": {
        "x509_props": [
          {
            "sans": [
              {
                "#name": "dns_names",
                "Description": {
                  "new": "Domain Names.",
                  "old": "Domain names."
                }
              },
              {
                "#name": "upns",
                "Description": {
                  "new": "User Principal Names.",
                  "old": "User principal names."
                }
              }
            ]
          }
        ]
      }
    }
  }
}

⚼ Request

PATCH:  /certificates/{certificate-name}/policy
{
api-version:
{
Description: The API version to use for this operation. ,
Required: True ,
}
string ,
certificate-name:
{
Description: The name of the certificate in the given vault. ,
Required: True ,
}
string ,
certificatePolicy:
{
Description: The policy for the certificate. ,
Required: True ,
}
{
id:
{
Description: The certificate id. ,
Required: False ,
}
string ,
key_props:
{
Description: Properties of the key backing a certificate. ,
Required: False ,
}
{
exportable:
{
Description: Indicates if the private key can be exported. Release policy must be provided when creating the first version of an exportable key. ,
Required: False ,
}
boolean ,
kty:
{
Description: The type of key pair to be used for the certificate. ,
Enum:
{
EC: Elliptic Curve. ,
EC-HSM: Elliptic Curve with a private key which is not exportable from the HSM. ,
RSA: RSA (https://tools.ietf.org/html/rfc3447). ,
RSA-HSM: RSA with a private key which is not exportable from the HSM. ,
oct: Octet sequence (used to represent symmetric keys). ,
oct-HSM: Octet sequence with a private key which is not exportable from the HSM. ,
}
,
Required: False ,
}
enum ,
key_size:
{
Description: The key size in bits. For example: 2048, 3072, or 4096 for RSA. ,
Format: int32 ,
Required: False ,
}
integer ,
reuse_key:
{
Description: Indicates if the same key pair will be used on certificate renewal. ,
Required: False ,
}
boolean ,
crv:
{
Description: Elliptic curve name. For valid values, see JsonWebKeyCurveName. ,
Enum:
{
P-256: The NIST P-256 elliptic curve, AKA SECG curve SECP256R1. ,
P-384: The NIST P-384 elliptic curve, AKA SECG curve SECP384R1. ,
P-521: The NIST P-521 elliptic curve, AKA SECG curve SECP521R1. ,
P-256K: The SECG SECP256K1 elliptic curve. ,
}
,
Required: False ,
}
enum ,
}
,
secret_props:
{
Description: Properties of the secret backing a certificate. ,
Required: False ,
}
{
contentType:
{
Description: The media type (MIME type). ,
Required: False ,
}
string ,
}
,
x509_props:
{
Description: Properties of the X509 component of a certificate. ,
Required: False ,
}
{
subject:
{
Description: The subject name. Should be a valid X509 distinguished Name. ,
Required: False ,
}
string ,
ekus:
{
Description: The enhanced key usage. ,
Required: False ,
}
[
string ,
]
,
sans:
{
Description: The subject alternative names. ,
Required: False ,
}
{
emails:
{
Description: Email addresses. ,
Required: False ,
}
[
string ,
]
,
dns_names:
{
Description: Domain Names. ,
Required: False ,
}
[
string ,
]
,
upns:
{
Description: User Principal Names. ,
Required: False ,
}
[
string ,
]
,
}
,
key_usage:
{
Description: Defines how the certificate's key may be used. ,
Required: False ,
}
[
string ,
]
,
validity_months:
{
Description: The duration that the certificate is valid in months. ,
Format: int32 ,
Required: False ,
}
integer ,
}
,
lifetime_actions:
{
Description: Actions that will be performed by Key Vault over the lifetime of a certificate. ,
Required: False ,
}
[
{
trigger:
{
Description: The condition that will execute the action. ,
Required: False ,
}
{
lifetime_percentage:
{
Description: Percentage of lifetime at which to trigger. Value should be between 1 and 99. ,
Format: int32 ,
Required: False ,
}
integer ,
days_before_expiry:
{
Description: Days before expiry to attempt renewal. Value should be between 1 and validity_in_months multiplied by 27. If validity_in_months is 36, then value should be between 1 and 972 (36 * 27). ,
Format: int32 ,
Required: False ,
}
integer ,
}
,
action:
{
Description: The action that will be executed. ,
Required: False ,
}
{
action_type:
{
Description: The type of the action. ,
Enum:
{
EmailContacts: A certificate policy that will email certificate contacts. ,
AutoRenew: A certificate policy that will auto-renew a certificate. ,
}
,
Required: False ,
}
enum ,
}
,
}
,
]
,
issuer:
{
Description: Parameters for the issuer of the X509 component of a certificate. ,
Required: False ,
}
{
name:
{
Description: Name of the referenced issuer object or reserved names; for example, 'Self' or 'Unknown'. ,
Required: False ,
}
string ,
cty:
{
Description: Certificate type as supported by the provider (optional); for example 'OV-SSL', 'EV-SSL' ,
Required: False ,
}
string ,
cert_transparency:
{
Description: Indicates if the certificates generated under this policy should be published to certificate transparency logs. ,
Required: False ,
}
boolean ,
}
,
attributes:
{
Description: The certificate attributes. ,
Required: False ,
}
{
enabled:
{
Description: Determines whether the object is enabled. ,
Required: False ,
}
boolean ,
nbf:
{
Description: Not before date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
exp:
{
Description: Expiry date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
created:
{
Description: Creation time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
updated:
{
Description: Last updated time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
recoverableDays:
{
Description: softDelete data retention days. Value should be >=7 and <=90 when softDelete enabled, otherwise 0. ,
Format: int32 ,
Required: False ,
}
integer ,
recoveryLevel:
{
Description: Reflects the deletion recovery level currently in effect for certificates in the current vault. If it contains 'Purgeable', the certificate can be permanently deleted by a privileged user; otherwise, only the system can purge the certificate, at the end of the retention interval. ,
Enum:
{
Purgeable: Denotes a vault state in which deletion is an irreversible operation, without the possibility for recovery. This level corresponds to no protection being available against a Delete operation; the data is irretrievably lost upon accepting a Delete operation at the entity level or higher (vault, resource group, subscription etc.) ,
Recoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days), unless a Purge operation is requested, or the subscription is cancelled. System wil permanently delete it after 90 days, if not recovered ,
Recoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days) and while the subscription is still available. System wil permanently delete it after 90 days, if not recovered ,
Recoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable within retention interval (90 days), immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled. System wil permanently delete it after 90 days, if not recovered ,
CustomizedRecoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90). This level guarantees the recoverability of the deleted entity during the retention interval, unless a Purge operation is requested, or the subscription is cancelled. ,
CustomizedRecoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90).This level guarantees the recoverability of the deleted entity during the retention interval and while the subscription is still available. ,
CustomizedRecoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable, immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled when 7 <= SoftDeleteRetentionInDays < 90. This level guarantees the recoverability of the deleted entity during the retention interval, and also reflects the fact that the subscription itself cannot be cancelled. ,
}
,
Required: False ,
}
enum ,
}
,
}
,
}

⚐ Response (200)

{
id:
{
Description: The certificate id. ,
Required: False ,
}
string ,
key_props:
{
Description: Properties of the key backing a certificate. ,
Required: False ,
}
{
exportable:
{
Description: Indicates if the private key can be exported. Release policy must be provided when creating the first version of an exportable key. ,
Required: False ,
}
boolean ,
kty:
{
Description: The type of key pair to be used for the certificate. ,
Enum:
{
EC: Elliptic Curve. ,
EC-HSM: Elliptic Curve with a private key which is not exportable from the HSM. ,
RSA: RSA (https://tools.ietf.org/html/rfc3447). ,
RSA-HSM: RSA with a private key which is not exportable from the HSM. ,
oct: Octet sequence (used to represent symmetric keys). ,
oct-HSM: Octet sequence with a private key which is not exportable from the HSM. ,
}
,
Required: False ,
}
enum ,
key_size:
{
Description: The key size in bits. For example: 2048, 3072, or 4096 for RSA. ,
Format: int32 ,
Required: False ,
}
integer ,
reuse_key:
{
Description: Indicates if the same key pair will be used on certificate renewal. ,
Required: False ,
}
boolean ,
crv:
{
Description: Elliptic curve name. For valid values, see JsonWebKeyCurveName. ,
Enum:
{
P-256: The NIST P-256 elliptic curve, AKA SECG curve SECP256R1. ,
P-384: The NIST P-384 elliptic curve, AKA SECG curve SECP384R1. ,
P-521: The NIST P-521 elliptic curve, AKA SECG curve SECP521R1. ,
P-256K: The SECG SECP256K1 elliptic curve. ,
}
,
Required: False ,
}
enum ,
}
,
secret_props:
{
Description: Properties of the secret backing a certificate. ,
Required: False ,
}
{
contentType:
{
Description: The media type (MIME type). ,
Required: False ,
}
string ,
}
,
x509_props:
{
Description: Properties of the X509 component of a certificate. ,
Required: False ,
}
{
subject:
{
Description: The subject name. Should be a valid X509 distinguished Name. ,
Required: False ,
}
string ,
ekus:
{
Description: The enhanced key usage. ,
Required: False ,
}
[
string ,
]
,
sans:
{
Description: The subject alternative names. ,
Required: False ,
}
{
emails:
{
Description: Email addresses. ,
Required: False ,
}
[
string ,
]
,
dns_names:
{
Description: Domain Names. ,
Required: False ,
}
[
string ,
]
,
upns:
{
Description: User Principal Names. ,
Required: False ,
}
[
string ,
]
,
}
,
key_usage:
{
Description: Defines how the certificate's key may be used. ,
Required: False ,
}
[
string ,
]
,
validity_months:
{
Description: The duration that the certificate is valid in months. ,
Format: int32 ,
Required: False ,
}
integer ,
}
,
lifetime_actions:
{
Description: Actions that will be performed by Key Vault over the lifetime of a certificate. ,
Required: False ,
}
[
{
trigger:
{
Description: The condition that will execute the action. ,
Required: False ,
}
{
lifetime_percentage:
{
Description: Percentage of lifetime at which to trigger. Value should be between 1 and 99. ,
Format: int32 ,
Required: False ,
}
integer ,
days_before_expiry:
{
Description: Days before expiry to attempt renewal. Value should be between 1 and validity_in_months multiplied by 27. If validity_in_months is 36, then value should be between 1 and 972 (36 * 27). ,
Format: int32 ,
Required: False ,
}
integer ,
}
,
action:
{
Description: The action that will be executed. ,
Required: False ,
}
{
action_type:
{
Description: The type of the action. ,
Enum:
{
EmailContacts: A certificate policy that will email certificate contacts. ,
AutoRenew: A certificate policy that will auto-renew a certificate. ,
}
,
Required: False ,
}
enum ,
}
,
}
,
]
,
issuer:
{
Description: Parameters for the issuer of the X509 component of a certificate. ,
Required: False ,
}
{
name:
{
Description: Name of the referenced issuer object or reserved names; for example, 'Self' or 'Unknown'. ,
Required: False ,
}
string ,
cty:
{
Description: Certificate type as supported by the provider (optional); for example 'OV-SSL', 'EV-SSL' ,
Required: False ,
}
string ,
cert_transparency:
{
Description: Indicates if the certificates generated under this policy should be published to certificate transparency logs. ,
Required: False ,
}
boolean ,
}
,
attributes:
{
Description: The certificate attributes. ,
Required: False ,
}
{
enabled:
{
Description: Determines whether the object is enabled. ,
Required: False ,
}
boolean ,
nbf:
{
Description: Not before date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
exp:
{
Description: Expiry date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
created:
{
Description: Creation time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
updated:
{
Description: Last updated time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
recoverableDays:
{
Description: softDelete data retention days. Value should be >=7 and <=90 when softDelete enabled, otherwise 0. ,
Format: int32 ,
Required: False ,
}
integer ,
recoveryLevel:
{
Description: Reflects the deletion recovery level currently in effect for certificates in the current vault. If it contains 'Purgeable', the certificate can be permanently deleted by a privileged user; otherwise, only the system can purge the certificate, at the end of the retention interval. ,
Enum:
{
Purgeable: Denotes a vault state in which deletion is an irreversible operation, without the possibility for recovery. This level corresponds to no protection being available against a Delete operation; the data is irretrievably lost upon accepting a Delete operation at the entity level or higher (vault, resource group, subscription etc.) ,
Recoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days), unless a Purge operation is requested, or the subscription is cancelled. System wil permanently delete it after 90 days, if not recovered ,
Recoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days) and while the subscription is still available. System wil permanently delete it after 90 days, if not recovered ,
Recoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable within retention interval (90 days), immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled. System wil permanently delete it after 90 days, if not recovered ,
CustomizedRecoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90). This level guarantees the recoverability of the deleted entity during the retention interval, unless a Purge operation is requested, or the subscription is cancelled. ,
CustomizedRecoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90).This level guarantees the recoverability of the deleted entity during the retention interval and while the subscription is still available. ,
CustomizedRecoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable, immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled when 7 <= SoftDeleteRetentionInDays < 90. This level guarantees the recoverability of the deleted entity during the retention interval, and also reflects the fact that the subscription itself cannot be cancelled. ,
}
,
Required: False ,
}
enum ,
}
,
}

⚐ Response (default)

{
error:
{
Description: The key vault server error. ,
Required: False ,
}
{
code:
{
Description: The error code. ,
Required: False ,
}
string ,
message:
{
Description: The error message. ,
Required: False ,
}
string ,
innererror:
{
Required: False ,
}
string ,
}
,
}
RestoreCertificate (updated)
Description :  Restores a backed up certificate, and all its versions, to a vault. This operation requires the certificates/restore permission.
Reference :  Link ¶

⚶ Changes

{
  "#id": "RestoreCertificate",
  "$responses": {
    "200": {
      "$properties": [
        {
          "policy": [
            {
              "x509_props": [
                {
                  "sans": [
                    {
                      "#name": "dns_names",
                      "Description": {
                        "new": "Domain Names.",
                        "old": "Domain names."
                      }
                    },
                    {
                      "#name": "upns",
                      "Description": {
                        "new": "User Principal Names.",
                        "old": "User principal names."
                      }
                    }
                  ]
                }
              ]
            }
          ]
        },
        {
          "#name": "contentType",
          "Description": {
            "new": "The content type of the secret. eg. 'application/x-pem-file' or 'application/x-pkcs12'.",
            "old": "The content type of the secret. eg. 'application/x-pem-file' or 'application/x-pkcs12',"
          }
        },
        {
          "#name": "tags",
          "Description": {
            "new": "Application specific metadata in the form of key-value pairs.",
            "old": "Application specific metadata in the form of key-value pairs"
          }
        }
      ]
    }
  }
}

⚼ Request

POST:  /certificates/restore
{
api-version:
{
Description: The API version to use for this operation. ,
Required: True ,
}
string ,
parameters:
{
Description: The parameters to restore the certificate. ,
Required: True ,
}
{
value:
{
Description: The backup blob associated with a certificate bundle. ,
Format: base64url ,
Required: True ,
}
string ,
}
,
}

⚐ Response (200)

{
id:
{
Description: The certificate id. ,
Required: False ,
}
string ,
kid:
{
Description: The key id. ,
Required: False ,
}
string ,
sid:
{
Description: The secret id. ,
Required: False ,
}
string ,
x5t:
{
Description: Thumbprint of the certificate. ,
Format: base64url ,
Required: False ,
}
string ,
policy:
{
Description: The management policy. ,
Required: False ,
}
{
id:
{
Description: The certificate id. ,
Required: False ,
}
string ,
key_props:
{
Description: Properties of the key backing a certificate. ,
Required: False ,
}
{
exportable:
{
Description: Indicates if the private key can be exported. Release policy must be provided when creating the first version of an exportable key. ,
Required: False ,
}
boolean ,
kty:
{
Description: The type of key pair to be used for the certificate. ,
Enum:
{
EC: Elliptic Curve. ,
EC-HSM: Elliptic Curve with a private key which is not exportable from the HSM. ,
RSA: RSA (https://tools.ietf.org/html/rfc3447). ,
RSA-HSM: RSA with a private key which is not exportable from the HSM. ,
oct: Octet sequence (used to represent symmetric keys). ,
oct-HSM: Octet sequence with a private key which is not exportable from the HSM. ,
}
,
Required: False ,
}
enum ,
key_size:
{
Description: The key size in bits. For example: 2048, 3072, or 4096 for RSA. ,
Format: int32 ,
Required: False ,
}
integer ,
reuse_key:
{
Description: Indicates if the same key pair will be used on certificate renewal. ,
Required: False ,
}
boolean ,
crv:
{
Description: Elliptic curve name. For valid values, see JsonWebKeyCurveName. ,
Enum:
{
P-256: The NIST P-256 elliptic curve, AKA SECG curve SECP256R1. ,
P-384: The NIST P-384 elliptic curve, AKA SECG curve SECP384R1. ,
P-521: The NIST P-521 elliptic curve, AKA SECG curve SECP521R1. ,
P-256K: The SECG SECP256K1 elliptic curve. ,
}
,
Required: False ,
}
enum ,
}
,
secret_props:
{
Description: Properties of the secret backing a certificate. ,
Required: False ,
}
{
contentType:
{
Description: The media type (MIME type). ,
Required: False ,
}
string ,
}
,
x509_props:
{
Description: Properties of the X509 component of a certificate. ,
Required: False ,
}
{
subject:
{
Description: The subject name. Should be a valid X509 distinguished Name. ,
Required: False ,
}
string ,
ekus:
{
Description: The enhanced key usage. ,
Required: False ,
}
[
string ,
]
,
sans:
{
Description: The subject alternative names. ,
Required: False ,
}
{
emails:
{
Description: Email addresses. ,
Required: False ,
}
[
string ,
]
,
dns_names:
{
Description: Domain Names. ,
Required: False ,
}
[
string ,
]
,
upns:
{
Description: User Principal Names. ,
Required: False ,
}
[
string ,
]
,
}
,
key_usage:
{
Description: Defines how the certificate's key may be used. ,
Required: False ,
}
[
string ,
]
,
validity_months:
{
Description: The duration that the certificate is valid in months. ,
Format: int32 ,
Required: False ,
}
integer ,
}
,
lifetime_actions:
{
Description: Actions that will be performed by Key Vault over the lifetime of a certificate. ,
Required: False ,
}
[
{
trigger:
{
Description: The condition that will execute the action. ,
Required: False ,
}
{
lifetime_percentage:
{
Description: Percentage of lifetime at which to trigger. Value should be between 1 and 99. ,
Format: int32 ,
Required: False ,
}
integer ,
days_before_expiry:
{
Description: Days before expiry to attempt renewal. Value should be between 1 and validity_in_months multiplied by 27. If validity_in_months is 36, then value should be between 1 and 972 (36 * 27). ,
Format: int32 ,
Required: False ,
}
integer ,
}
,
action:
{
Description: The action that will be executed. ,
Required: False ,
}
{
action_type:
{
Description: The type of the action. ,
Enum:
{
EmailContacts: A certificate policy that will email certificate contacts. ,
AutoRenew: A certificate policy that will auto-renew a certificate. ,
}
,
Required: False ,
}
enum ,
}
,
}
,
]
,
issuer:
{
Description: Parameters for the issuer of the X509 component of a certificate. ,
Required: False ,
}
{
name:
{
Description: Name of the referenced issuer object or reserved names; for example, 'Self' or 'Unknown'. ,
Required: False ,
}
string ,
cty:
{
Description: Certificate type as supported by the provider (optional); for example 'OV-SSL', 'EV-SSL' ,
Required: False ,
}
string ,
cert_transparency:
{
Description: Indicates if the certificates generated under this policy should be published to certificate transparency logs. ,
Required: False ,
}
boolean ,
}
,
attributes:
{
Description: The certificate attributes. ,
Required: False ,
}
{
enabled:
{
Description: Determines whether the object is enabled. ,
Required: False ,
}
boolean ,
nbf:
{
Description: Not before date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
exp:
{
Description: Expiry date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
created:
{
Description: Creation time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
updated:
{
Description: Last updated time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
recoverableDays:
{
Description: softDelete data retention days. Value should be >=7 and <=90 when softDelete enabled, otherwise 0. ,
Format: int32 ,
Required: False ,
}
integer ,
recoveryLevel:
{
Description: Reflects the deletion recovery level currently in effect for certificates in the current vault. If it contains 'Purgeable', the certificate can be permanently deleted by a privileged user; otherwise, only the system can purge the certificate, at the end of the retention interval. ,
Enum:
{
Purgeable: Denotes a vault state in which deletion is an irreversible operation, without the possibility for recovery. This level corresponds to no protection being available against a Delete operation; the data is irretrievably lost upon accepting a Delete operation at the entity level or higher (vault, resource group, subscription etc.) ,
Recoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days), unless a Purge operation is requested, or the subscription is cancelled. System wil permanently delete it after 90 days, if not recovered ,
Recoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days) and while the subscription is still available. System wil permanently delete it after 90 days, if not recovered ,
Recoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable within retention interval (90 days), immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled. System wil permanently delete it after 90 days, if not recovered ,
CustomizedRecoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90). This level guarantees the recoverability of the deleted entity during the retention interval, unless a Purge operation is requested, or the subscription is cancelled. ,
CustomizedRecoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90).This level guarantees the recoverability of the deleted entity during the retention interval and while the subscription is still available. ,
CustomizedRecoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable, immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled when 7 <= SoftDeleteRetentionInDays < 90. This level guarantees the recoverability of the deleted entity during the retention interval, and also reflects the fact that the subscription itself cannot be cancelled. ,
}
,
Required: False ,
}
enum ,
}
,
}
,
cer:
{
Description: CER contents of x509 certificate. ,
Format: byte ,
Required: False ,
}
string ,
contentType:
{
Description: The content type of the secret. eg. 'application/x-pem-file' or 'application/x-pkcs12'. ,
Required: False ,
}
string ,
attributes:
{
Description: The certificate attributes. ,
Required: False ,
}
{
enabled:
{
Description: Determines whether the object is enabled. ,
Required: False ,
}
boolean ,
nbf:
{
Description: Not before date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
exp:
{
Description: Expiry date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
created:
{
Description: Creation time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
updated:
{
Description: Last updated time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
recoverableDays:
{
Description: softDelete data retention days. Value should be >=7 and <=90 when softDelete enabled, otherwise 0. ,
Format: int32 ,
Required: False ,
}
integer ,
recoveryLevel:
{
Description: Reflects the deletion recovery level currently in effect for certificates in the current vault. If it contains 'Purgeable', the certificate can be permanently deleted by a privileged user; otherwise, only the system can purge the certificate, at the end of the retention interval. ,
Enum:
{
Purgeable: Denotes a vault state in which deletion is an irreversible operation, without the possibility for recovery. This level corresponds to no protection being available against a Delete operation; the data is irretrievably lost upon accepting a Delete operation at the entity level or higher (vault, resource group, subscription etc.) ,
Recoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days), unless a Purge operation is requested, or the subscription is cancelled. System wil permanently delete it after 90 days, if not recovered ,
Recoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days) and while the subscription is still available. System wil permanently delete it after 90 days, if not recovered ,
Recoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable within retention interval (90 days), immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled. System wil permanently delete it after 90 days, if not recovered ,
CustomizedRecoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90). This level guarantees the recoverability of the deleted entity during the retention interval, unless a Purge operation is requested, or the subscription is cancelled. ,
CustomizedRecoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90).This level guarantees the recoverability of the deleted entity during the retention interval and while the subscription is still available. ,
CustomizedRecoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable, immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled when 7 <= SoftDeleteRetentionInDays < 90. This level guarantees the recoverability of the deleted entity during the retention interval, and also reflects the fact that the subscription itself cannot be cancelled. ,
}
,
Required: False ,
}
enum ,
}
,
tags:
{
Description: Application specific metadata in the form of key-value pairs. ,
Required: False ,
}
object ,
preserveCertOrder:
{
Description: Specifies whether the certificate chain preserves its original order. The default value is false, which sets the leaf certificate at index 0. ,
Required: False ,
}
boolean ,
}

⚐ Response (default)

{
error:
{
Description: The key vault server error. ,
Required: False ,
}
{
code:
{
Description: The error code. ,
Required: False ,
}
string ,
message:
{
Description: The error message. ,
Required: False ,
}
string ,
innererror:
{
Required: False ,
}
string ,
}
,
}
GetDeletedCertificate (updated)
Description :  The GetDeletedCertificate operation retrieves the deleted certificate information plus its attributes, such as retention interval, scheduled permanent deletion and the current deletion recovery level. This operation requires the certificates/get permission.
Reference :  Link ¶

⚶ Changes

{
  "#id": "GetDeletedCertificate",
  "$responses": {
    "200": {
      "$properties": [
        {
          "policy": [
            {
              "x509_props": [
                {
                  "sans": [
                    {
                      "#name": "dns_names",
                      "Description": {
                        "new": "Domain Names.",
                        "old": "Domain names."
                      }
                    },
                    {
                      "#name": "upns",
                      "Description": {
                        "new": "User Principal Names.",
                        "old": "User principal names."
                      }
                    }
                  ]
                }
              ]
            }
          ]
        },
        {
          "#name": "contentType",
          "Description": {
            "new": "The content type of the secret. eg. 'application/x-pem-file' or 'application/x-pkcs12'.",
            "old": "The content type of the secret. eg. 'application/x-pem-file' or 'application/x-pkcs12',"
          }
        },
        {
          "#name": "tags",
          "Description": {
            "new": "Application specific metadata in the form of key-value pairs.",
            "old": "Application specific metadata in the form of key-value pairs"
          }
        }
      ]
    }
  }
}

⚼ Request

GET:  /deletedcertificates/{certificate-name}
{
api-version:
{
Description: The API version to use for this operation. ,
Required: True ,
}
string ,
certificate-name:
{
Description: The name of the certificate ,
Required: True ,
}
string ,
}

⚐ Response (200)

{
id:
{
Description: The certificate id. ,
Required: False ,
}
string ,
kid:
{
Description: The key id. ,
Required: False ,
}
string ,
sid:
{
Description: The secret id. ,
Required: False ,
}
string ,
x5t:
{
Description: Thumbprint of the certificate. ,
Format: base64url ,
Required: False ,
}
string ,
policy:
{
Description: The management policy. ,
Required: False ,
}
{
id:
{
Description: The certificate id. ,
Required: False ,
}
string ,
key_props:
{
Description: Properties of the key backing a certificate. ,
Required: False ,
}
{
exportable:
{
Description: Indicates if the private key can be exported. Release policy must be provided when creating the first version of an exportable key. ,
Required: False ,
}
boolean ,
kty:
{
Description: The type of key pair to be used for the certificate. ,
Enum:
{
EC: Elliptic Curve. ,
EC-HSM: Elliptic Curve with a private key which is not exportable from the HSM. ,
RSA: RSA (https://tools.ietf.org/html/rfc3447). ,
RSA-HSM: RSA with a private key which is not exportable from the HSM. ,
oct: Octet sequence (used to represent symmetric keys). ,
oct-HSM: Octet sequence with a private key which is not exportable from the HSM. ,
}
,
Required: False ,
}
enum ,
key_size:
{
Description: The key size in bits. For example: 2048, 3072, or 4096 for RSA. ,
Format: int32 ,
Required: False ,
}
integer ,
reuse_key:
{
Description: Indicates if the same key pair will be used on certificate renewal. ,
Required: False ,
}
boolean ,
crv:
{
Description: Elliptic curve name. For valid values, see JsonWebKeyCurveName. ,
Enum:
{
P-256: The NIST P-256 elliptic curve, AKA SECG curve SECP256R1. ,
P-384: The NIST P-384 elliptic curve, AKA SECG curve SECP384R1. ,
P-521: The NIST P-521 elliptic curve, AKA SECG curve SECP521R1. ,
P-256K: The SECG SECP256K1 elliptic curve. ,
}
,
Required: False ,
}
enum ,
}
,
secret_props:
{
Description: Properties of the secret backing a certificate. ,
Required: False ,
}
{
contentType:
{
Description: The media type (MIME type). ,
Required: False ,
}
string ,
}
,
x509_props:
{
Description: Properties of the X509 component of a certificate. ,
Required: False ,
}
{
subject:
{
Description: The subject name. Should be a valid X509 distinguished Name. ,
Required: False ,
}
string ,
ekus:
{
Description: The enhanced key usage. ,
Required: False ,
}
[
string ,
]
,
sans:
{
Description: The subject alternative names. ,
Required: False ,
}
{
emails:
{
Description: Email addresses. ,
Required: False ,
}
[
string ,
]
,
dns_names:
{
Description: Domain Names. ,
Required: False ,
}
[
string ,
]
,
upns:
{
Description: User Principal Names. ,
Required: False ,
}
[
string ,
]
,
}
,
key_usage:
{
Description: Defines how the certificate's key may be used. ,
Required: False ,
}
[
string ,
]
,
validity_months:
{
Description: The duration that the certificate is valid in months. ,
Format: int32 ,
Required: False ,
}
integer ,
}
,
lifetime_actions:
{
Description: Actions that will be performed by Key Vault over the lifetime of a certificate. ,
Required: False ,
}
[
{
trigger:
{
Description: The condition that will execute the action. ,
Required: False ,
}
{
lifetime_percentage:
{
Description: Percentage of lifetime at which to trigger. Value should be between 1 and 99. ,
Format: int32 ,
Required: False ,
}
integer ,
days_before_expiry:
{
Description: Days before expiry to attempt renewal. Value should be between 1 and validity_in_months multiplied by 27. If validity_in_months is 36, then value should be between 1 and 972 (36 * 27). ,
Format: int32 ,
Required: False ,
}
integer ,
}
,
action:
{
Description: The action that will be executed. ,
Required: False ,
}
{
action_type:
{
Description: The type of the action. ,
Enum:
{
EmailContacts: A certificate policy that will email certificate contacts. ,
AutoRenew: A certificate policy that will auto-renew a certificate. ,
}
,
Required: False ,
}
enum ,
}
,
}
,
]
,
issuer:
{
Description: Parameters for the issuer of the X509 component of a certificate. ,
Required: False ,
}
{
name:
{
Description: Name of the referenced issuer object or reserved names; for example, 'Self' or 'Unknown'. ,
Required: False ,
}
string ,
cty:
{
Description: Certificate type as supported by the provider (optional); for example 'OV-SSL', 'EV-SSL' ,
Required: False ,
}
string ,
cert_transparency:
{
Description: Indicates if the certificates generated under this policy should be published to certificate transparency logs. ,
Required: False ,
}
boolean ,
}
,
attributes:
{
Description: The certificate attributes. ,
Required: False ,
}
{
enabled:
{
Description: Determines whether the object is enabled. ,
Required: False ,
}
boolean ,
nbf:
{
Description: Not before date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
exp:
{
Description: Expiry date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
created:
{
Description: Creation time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
updated:
{
Description: Last updated time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
recoverableDays:
{
Description: softDelete data retention days. Value should be >=7 and <=90 when softDelete enabled, otherwise 0. ,
Format: int32 ,
Required: False ,
}
integer ,
recoveryLevel:
{
Description: Reflects the deletion recovery level currently in effect for certificates in the current vault. If it contains 'Purgeable', the certificate can be permanently deleted by a privileged user; otherwise, only the system can purge the certificate, at the end of the retention interval. ,
Enum:
{
Purgeable: Denotes a vault state in which deletion is an irreversible operation, without the possibility for recovery. This level corresponds to no protection being available against a Delete operation; the data is irretrievably lost upon accepting a Delete operation at the entity level or higher (vault, resource group, subscription etc.) ,
Recoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days), unless a Purge operation is requested, or the subscription is cancelled. System wil permanently delete it after 90 days, if not recovered ,
Recoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days) and while the subscription is still available. System wil permanently delete it after 90 days, if not recovered ,
Recoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable within retention interval (90 days), immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled. System wil permanently delete it after 90 days, if not recovered ,
CustomizedRecoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90). This level guarantees the recoverability of the deleted entity during the retention interval, unless a Purge operation is requested, or the subscription is cancelled. ,
CustomizedRecoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90).This level guarantees the recoverability of the deleted entity during the retention interval and while the subscription is still available. ,
CustomizedRecoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable, immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled when 7 <= SoftDeleteRetentionInDays < 90. This level guarantees the recoverability of the deleted entity during the retention interval, and also reflects the fact that the subscription itself cannot be cancelled. ,
}
,
Required: False ,
}
enum ,
}
,
}
,
cer:
{
Description: CER contents of x509 certificate. ,
Format: byte ,
Required: False ,
}
string ,
contentType:
{
Description: The content type of the secret. eg. 'application/x-pem-file' or 'application/x-pkcs12'. ,
Required: False ,
}
string ,
attributes:
{
Description: The certificate attributes. ,
Required: False ,
}
{
enabled:
{
Description: Determines whether the object is enabled. ,
Required: False ,
}
boolean ,
nbf:
{
Description: Not before date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
exp:
{
Description: Expiry date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
created:
{
Description: Creation time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
updated:
{
Description: Last updated time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
recoverableDays:
{
Description: softDelete data retention days. Value should be >=7 and <=90 when softDelete enabled, otherwise 0. ,
Format: int32 ,
Required: False ,
}
integer ,
recoveryLevel:
{
Description: Reflects the deletion recovery level currently in effect for certificates in the current vault. If it contains 'Purgeable', the certificate can be permanently deleted by a privileged user; otherwise, only the system can purge the certificate, at the end of the retention interval. ,
Enum:
{
Purgeable: Denotes a vault state in which deletion is an irreversible operation, without the possibility for recovery. This level corresponds to no protection being available against a Delete operation; the data is irretrievably lost upon accepting a Delete operation at the entity level or higher (vault, resource group, subscription etc.) ,
Recoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days), unless a Purge operation is requested, or the subscription is cancelled. System wil permanently delete it after 90 days, if not recovered ,
Recoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days) and while the subscription is still available. System wil permanently delete it after 90 days, if not recovered ,
Recoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable within retention interval (90 days), immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled. System wil permanently delete it after 90 days, if not recovered ,
CustomizedRecoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90). This level guarantees the recoverability of the deleted entity during the retention interval, unless a Purge operation is requested, or the subscription is cancelled. ,
CustomizedRecoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90).This level guarantees the recoverability of the deleted entity during the retention interval and while the subscription is still available. ,
CustomizedRecoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable, immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled when 7 <= SoftDeleteRetentionInDays < 90. This level guarantees the recoverability of the deleted entity during the retention interval, and also reflects the fact that the subscription itself cannot be cancelled. ,
}
,
Required: False ,
}
enum ,
}
,
tags:
{
Description: Application specific metadata in the form of key-value pairs. ,
Required: False ,
}
object ,
preserveCertOrder:
{
Description: Specifies whether the certificate chain preserves its original order. The default value is false, which sets the leaf certificate at index 0. ,
Required: False ,
}
boolean ,
recoveryId:
{
Description: The url of the recovery object, used to identify and recover the deleted certificate. ,
Required: False ,
}
string ,
scheduledPurgeDate:
{
Description: The time when the certificate is scheduled to be purged, in UTC ,
Format: unixtime ,
Required: False ,
}
integer ,
deletedDate:
{
Description: The time when the certificate was deleted, in UTC ,
Format: unixtime ,
Required: False ,
}
integer ,
}

⚐ Response (default)

{
error:
{
Description: The key vault server error. ,
Required: False ,
}
{
code:
{
Description: The error code. ,
Required: False ,
}
string ,
message:
{
Description: The error message. ,
Required: False ,
}
string ,
innererror:
{
Required: False ,
}
string ,
}
,
}
RecoverDeletedCertificate (updated)
Description :  The RecoverDeletedCertificate operation performs the reversal of the Delete operation. The operation is applicable in vaults enabled for soft-delete, and must be issued during the retention interval (available in the deleted certificate's attributes). This operation requires the certificates/recover permission.
Reference :  Link ¶

⚶ Changes

{
  "#id": "RecoverDeletedCertificate",
  "$responses": {
    "200": {
      "$properties": [
        {
          "policy": [
            {
              "x509_props": [
                {
                  "sans": [
                    {
                      "#name": "dns_names",
                      "Description": {
                        "new": "Domain Names.",
                        "old": "Domain names."
                      }
                    },
                    {
                      "#name": "upns",
                      "Description": {
                        "new": "User Principal Names.",
                        "old": "User principal names."
                      }
                    }
                  ]
                }
              ]
            }
          ]
        },
        {
          "#name": "contentType",
          "Description": {
            "new": "The content type of the secret. eg. 'application/x-pem-file' or 'application/x-pkcs12'.",
            "old": "The content type of the secret. eg. 'application/x-pem-file' or 'application/x-pkcs12',"
          }
        },
        {
          "#name": "tags",
          "Description": {
            "new": "Application specific metadata in the form of key-value pairs.",
            "old": "Application specific metadata in the form of key-value pairs"
          }
        }
      ]
    }
  }
}

⚼ Request

POST:  /deletedcertificates/{certificate-name}/recover
{
api-version:
{
Description: The API version to use for this operation. ,
Required: True ,
}
string ,
certificate-name:
{
Description: The name of the deleted certificate ,
Required: True ,
}
string ,
}

⚐ Response (200)

{
id:
{
Description: The certificate id. ,
Required: False ,
}
string ,
kid:
{
Description: The key id. ,
Required: False ,
}
string ,
sid:
{
Description: The secret id. ,
Required: False ,
}
string ,
x5t:
{
Description: Thumbprint of the certificate. ,
Format: base64url ,
Required: False ,
}
string ,
policy:
{
Description: The management policy. ,
Required: False ,
}
{
id:
{
Description: The certificate id. ,
Required: False ,
}
string ,
key_props:
{
Description: Properties of the key backing a certificate. ,
Required: False ,
}
{
exportable:
{
Description: Indicates if the private key can be exported. Release policy must be provided when creating the first version of an exportable key. ,
Required: False ,
}
boolean ,
kty:
{
Description: The type of key pair to be used for the certificate. ,
Enum:
{
EC: Elliptic Curve. ,
EC-HSM: Elliptic Curve with a private key which is not exportable from the HSM. ,
RSA: RSA (https://tools.ietf.org/html/rfc3447). ,
RSA-HSM: RSA with a private key which is not exportable from the HSM. ,
oct: Octet sequence (used to represent symmetric keys). ,
oct-HSM: Octet sequence with a private key which is not exportable from the HSM. ,
}
,
Required: False ,
}
enum ,
key_size:
{
Description: The key size in bits. For example: 2048, 3072, or 4096 for RSA. ,
Format: int32 ,
Required: False ,
}
integer ,
reuse_key:
{
Description: Indicates if the same key pair will be used on certificate renewal. ,
Required: False ,
}
boolean ,
crv:
{
Description: Elliptic curve name. For valid values, see JsonWebKeyCurveName. ,
Enum:
{
P-256: The NIST P-256 elliptic curve, AKA SECG curve SECP256R1. ,
P-384: The NIST P-384 elliptic curve, AKA SECG curve SECP384R1. ,
P-521: The NIST P-521 elliptic curve, AKA SECG curve SECP521R1. ,
P-256K: The SECG SECP256K1 elliptic curve. ,
}
,
Required: False ,
}
enum ,
}
,
secret_props:
{
Description: Properties of the secret backing a certificate. ,
Required: False ,
}
{
contentType:
{
Description: The media type (MIME type). ,
Required: False ,
}
string ,
}
,
x509_props:
{
Description: Properties of the X509 component of a certificate. ,
Required: False ,
}
{
subject:
{
Description: The subject name. Should be a valid X509 distinguished Name. ,
Required: False ,
}
string ,
ekus:
{
Description: The enhanced key usage. ,
Required: False ,
}
[
string ,
]
,
sans:
{
Description: The subject alternative names. ,
Required: False ,
}
{
emails:
{
Description: Email addresses. ,
Required: False ,
}
[
string ,
]
,
dns_names:
{
Description: Domain Names. ,
Required: False ,
}
[
string ,
]
,
upns:
{
Description: User Principal Names. ,
Required: False ,
}
[
string ,
]
,
}
,
key_usage:
{
Description: Defines how the certificate's key may be used. ,
Required: False ,
}
[
string ,
]
,
validity_months:
{
Description: The duration that the certificate is valid in months. ,
Format: int32 ,
Required: False ,
}
integer ,
}
,
lifetime_actions:
{
Description: Actions that will be performed by Key Vault over the lifetime of a certificate. ,
Required: False ,
}
[
{
trigger:
{
Description: The condition that will execute the action. ,
Required: False ,
}
{
lifetime_percentage:
{
Description: Percentage of lifetime at which to trigger. Value should be between 1 and 99. ,
Format: int32 ,
Required: False ,
}
integer ,
days_before_expiry:
{
Description: Days before expiry to attempt renewal. Value should be between 1 and validity_in_months multiplied by 27. If validity_in_months is 36, then value should be between 1 and 972 (36 * 27). ,
Format: int32 ,
Required: False ,
}
integer ,
}
,
action:
{
Description: The action that will be executed. ,
Required: False ,
}
{
action_type:
{
Description: The type of the action. ,
Enum:
{
EmailContacts: A certificate policy that will email certificate contacts. ,
AutoRenew: A certificate policy that will auto-renew a certificate. ,
}
,
Required: False ,
}
enum ,
}
,
}
,
]
,
issuer:
{
Description: Parameters for the issuer of the X509 component of a certificate. ,
Required: False ,
}
{
name:
{
Description: Name of the referenced issuer object or reserved names; for example, 'Self' or 'Unknown'. ,
Required: False ,
}
string ,
cty:
{
Description: Certificate type as supported by the provider (optional); for example 'OV-SSL', 'EV-SSL' ,
Required: False ,
}
string ,
cert_transparency:
{
Description: Indicates if the certificates generated under this policy should be published to certificate transparency logs. ,
Required: False ,
}
boolean ,
}
,
attributes:
{
Description: The certificate attributes. ,
Required: False ,
}
{
enabled:
{
Description: Determines whether the object is enabled. ,
Required: False ,
}
boolean ,
nbf:
{
Description: Not before date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
exp:
{
Description: Expiry date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
created:
{
Description: Creation time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
updated:
{
Description: Last updated time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
recoverableDays:
{
Description: softDelete data retention days. Value should be >=7 and <=90 when softDelete enabled, otherwise 0. ,
Format: int32 ,
Required: False ,
}
integer ,
recoveryLevel:
{
Description: Reflects the deletion recovery level currently in effect for certificates in the current vault. If it contains 'Purgeable', the certificate can be permanently deleted by a privileged user; otherwise, only the system can purge the certificate, at the end of the retention interval. ,
Enum:
{
Purgeable: Denotes a vault state in which deletion is an irreversible operation, without the possibility for recovery. This level corresponds to no protection being available against a Delete operation; the data is irretrievably lost upon accepting a Delete operation at the entity level or higher (vault, resource group, subscription etc.) ,
Recoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days), unless a Purge operation is requested, or the subscription is cancelled. System wil permanently delete it after 90 days, if not recovered ,
Recoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days) and while the subscription is still available. System wil permanently delete it after 90 days, if not recovered ,
Recoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable within retention interval (90 days), immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled. System wil permanently delete it after 90 days, if not recovered ,
CustomizedRecoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90). This level guarantees the recoverability of the deleted entity during the retention interval, unless a Purge operation is requested, or the subscription is cancelled. ,
CustomizedRecoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90).This level guarantees the recoverability of the deleted entity during the retention interval and while the subscription is still available. ,
CustomizedRecoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable, immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled when 7 <= SoftDeleteRetentionInDays < 90. This level guarantees the recoverability of the deleted entity during the retention interval, and also reflects the fact that the subscription itself cannot be cancelled. ,
}
,
Required: False ,
}
enum ,
}
,
}
,
cer:
{
Description: CER contents of x509 certificate. ,
Format: byte ,
Required: False ,
}
string ,
contentType:
{
Description: The content type of the secret. eg. 'application/x-pem-file' or 'application/x-pkcs12'. ,
Required: False ,
}
string ,
attributes:
{
Description: The certificate attributes. ,
Required: False ,
}
{
enabled:
{
Description: Determines whether the object is enabled. ,
Required: False ,
}
boolean ,
nbf:
{
Description: Not before date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
exp:
{
Description: Expiry date in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
created:
{
Description: Creation time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
updated:
{
Description: Last updated time in UTC. ,
Format: unixtime ,
Required: False ,
}
integer ,
recoverableDays:
{
Description: softDelete data retention days. Value should be >=7 and <=90 when softDelete enabled, otherwise 0. ,
Format: int32 ,
Required: False ,
}
integer ,
recoveryLevel:
{
Description: Reflects the deletion recovery level currently in effect for certificates in the current vault. If it contains 'Purgeable', the certificate can be permanently deleted by a privileged user; otherwise, only the system can purge the certificate, at the end of the retention interval. ,
Enum:
{
Purgeable: Denotes a vault state in which deletion is an irreversible operation, without the possibility for recovery. This level corresponds to no protection being available against a Delete operation; the data is irretrievably lost upon accepting a Delete operation at the entity level or higher (vault, resource group, subscription etc.) ,
Recoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days), unless a Purge operation is requested, or the subscription is cancelled. System wil permanently delete it after 90 days, if not recovered ,
Recoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days) and while the subscription is still available. System wil permanently delete it after 90 days, if not recovered ,
Recoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable within retention interval (90 days), immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled. System wil permanently delete it after 90 days, if not recovered ,
CustomizedRecoverable+Purgeable: Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90). This level guarantees the recoverability of the deleted entity during the retention interval, unless a Purge operation is requested, or the subscription is cancelled. ,
CustomizedRecoverable: Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90).This level guarantees the recoverability of the deleted entity during the retention interval and while the subscription is still available. ,
CustomizedRecoverable+ProtectedSubscription: Denotes a vault and subscription state in which deletion is recoverable, immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled when 7 <= SoftDeleteRetentionInDays < 90. This level guarantees the recoverability of the deleted entity during the retention interval, and also reflects the fact that the subscription itself cannot be cancelled. ,
}
,
Required: False ,
}
enum ,
}
,
tags:
{
Description: Application specific metadata in the form of key-value pairs. ,
Required: False ,
}
object ,
preserveCertOrder:
{
Description: Specifies whether the certificate chain preserves its original order. The default value is false, which sets the leaf certificate at index 0. ,
Required: False ,
}
boolean ,
}

⚐ Response (default)

{
error:
{
Description: The key vault server error. ,
Required: False ,
}
{
code:
{
Description: The error code. ,
Required: False ,
}
string ,
message:
{
Description: The error message. ,
Required: False ,
}
string ,
innererror:
{
Required: False ,
}
string ,
}
,
}