keyvault.json

{
  "swagger": "2.0",
  "info": {
    "title": "KeyVaultClient",
    "description": "The key vault client performs cryptographic key operations and vault operations against the Key Vault service.",
    "version": "7.0-preview"
  },
  "x-ms-parameterized-host": {
    "hostTemplate": "{vaultBaseUrl}",
    "useSchemePrefix": false,
    "positionInOperation": "first",
    "parameters": [
      {
        "name": "vaultBaseUrl",
        "description": "The vault name, for example https://myvault.vault.azure.net.",
        "required": true,
        "type": "string",
        "in": "path",
        "x-ms-skip-url-encoding": true
      }
    ]
  },
  "consumes": [
    "application/json"
  ],
  "produces": [
    "application/json"
  ],
  "paths": {
    "/keys/{key-name}/create": {
      "post": {
        "tags": [
          "Keys"
        ],
        "operationId": "CreateKey",
        "summary": "Creates a new key, stores it, then returns key parameters and attributes to the client.",
        "description": "The create key operation can be used to create any key type in Azure Key Vault. If the named key already exists, Azure Key Vault creates a new version of the key. It requires the keys/create permission.",
        "parameters": [
          {
            "name": "key-name",
            "in": "path",
            "required": true,
            "type": "string",
            "pattern": "^[0-9a-zA-Z-]+$",
            "description": "The name for the new key. The system will generate the version name for the new key."
          },
          {
            "name": "parameters",
            "in": "body",
            "required": true,
            "x-ms-client-flatten": true,
            "schema": {
              "$ref": "#/definitions/KeyCreateParameters"
            },
            "description": "The parameters to create a key."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "A key bundle containing the result of the create key request.",
            "schema": {
              "$ref": "#/definitions/KeyBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "Create key": {
            "$ref": "./examples/CreateKey-example.json"
          }
        }
      }
    },
    "/keys/{key-name}": {
      "put": {
        "tags": [
          "Keys"
        ],
        "operationId": "ImportKey",
        "summary": "Imports an externally created key, stores it, and returns key parameters and attributes to the client.",
        "description": "The import key operation may be used to import any key type into an Azure Key Vault. If the named key already exists, Azure Key Vault creates a new version of the key. This operation requires the keys/import permission.",
        "parameters": [
          {
            "name": "key-name",
            "in": "path",
            "required": true,
            "type": "string",
            "pattern": "^[0-9a-zA-Z-]+$",
            "description": "Name for the imported key."
          },
          {
            "name": "parameters",
            "in": "body",
            "required": true,
            "x-ms-client-flatten": true,
            "schema": {
              "$ref": "#/definitions/KeyImportParameters"
            },
            "description": "The parameters to import a key."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "Imported key bundle to the vault.",
            "schema": {
              "$ref": "#/definitions/KeyBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "Import key": {
            "$ref": "./examples/ImportKey-example.json"
          }
        }
      },
      "delete": {
        "tags": [
          "Keys"
        ],
        "operationId": "DeleteKey",
        "summary": "Deletes a key of any type from storage in Azure Key Vault.",
        "description": "The delete key operation cannot be used to remove individual versions of a key. This operation removes the cryptographic material associated with the key, which means the key is not usable for Sign/Verify, Wrap/Unwrap or Encrypt/Decrypt operations. This operation requires the keys/delete permission.",
        "parameters": [
          {
            "name": "key-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the key to delete."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The public part of the deleted key and deletion information on when the key will be purged.",
            "schema": {
              "$ref": "#/definitions/DeletedKeyBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "Delete key": {
            "$ref": "./examples/DeleteKey-example.json"
          }
        }
      }
    },
    "/keys/{key-name}/{key-version}": {
      "patch": {
        "tags": [
          "Keys"
        ],
        "operationId": "UpdateKey",
        "summary": "The update key operation changes specified attributes of a stored key and can be applied to any key type and key version stored in Azure Key Vault.",
        "description": "In order to perform this operation, the key must already exist in the Key Vault. Note: The cryptographic material of a key itself cannot be changed. This operation requires the keys/update permission.",
        "parameters": [
          {
            "name": "key-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of key to update."
          },
          {
            "name": "key-version",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The version of the key to update."
          },
          {
            "name": "parameters",
            "in": "body",
            "required": true,
            "x-ms-client-flatten": true,
            "schema": {
              "$ref": "#/definitions/KeyUpdateParameters"
            },
            "description": "The parameters of the key to update."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The updated key.",
            "schema": {
              "$ref": "#/definitions/KeyBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "Update key": {
            "$ref": "./examples/UpdateKey-example.json"
          }
        }
      },
      "get": {
        "tags": [
          "Keys"
        ],
        "operationId": "GetKey",
        "summary": "Gets the public part of a stored key.",
        "description": "The get key operation is applicable to all key types. If the requested key is symmetric, then no key material is released in the response. This operation requires the keys/get permission.",
        "parameters": [
          {
            "name": "key-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the key to get."
          },
          {
            "name": "key-version",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "Adding the version parameter retrieves a specific version of a key."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "A key bundle containing the key and its attributes.",
            "schema": {
              "$ref": "#/definitions/KeyBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "Get key": {
            "$ref": "./examples/GetKey-example.json"
          }
        }
      }
    },
    "/keys/{key-name}/versions": {
      "get": {
        "tags": [
          "Keys"
        ],
        "operationId": "GetKeyVersions",
        "summary": "Retrieves a list of individual key versions with the same key name.",
        "description": "The full key identifier, attributes, and tags are provided in the response. This operation requires the keys/list permission.",
        "parameters": [
          {
            "name": "key-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the key."
          },
          {
            "name": "maxresults",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32",
            "minimum": 1,
            "maximum": 25,
            "description": "Specifies the maximum number of results to return in a page. Setting maxresults to a value less than 1 or greater than 25 results in error response code 400 (Bad Request). If there are additional results to return, then the service returns a nextLink containing a skip token for pagination. In certain cases, the service might return fewer results than specified by maxresults (even 0 results) and also return a nextLink. Clients should not make any assumptions on the minimum number of results per page, and should enumerate all pages until the nextLink becomes null."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "A response message containing a list of keys along with a link to the next page of keys.",
            "schema": {
              "$ref": "#/definitions/KeyListResult"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        },
        "x-ms-examples": {
          "GetKeyVersions": {
            "$ref": "./examples/GetKeyVersions-example.json"
          }
        }
      }
    },
    "/keys": {
      "get": {
        "tags": [
          "Keys"
        ],
        "operationId": "GetKeys",
        "summary": "List keys in the specified vault.",
        "description": "Retrieves a list of the keys in the Key Vault as JSON Web Key structures that contain the public part of a stored key. The LIST operation is applicable to all key types, however only the base key identifier, attributes, and tags are provided in the response. Individual versions of a key are not listed in the response. This operation requires the keys/list permission.",
        "parameters": [
          {
            "name": "maxresults",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32",
            "minimum": 1,
            "maximum": 25,
            "description": "Specifies the maximum number of results to return in a page. Setting maxresults to a value less than 1 or greater than 25 results in error response code 400 (Bad Request). If there are additional results to return, then the service returns a nextLink containing a skip token for pagination. In certain cases, the service might return fewer results than specified by maxresults (even 0 results) and also return a nextLink. Clients should not make any assumptions on the minimum number of results per page, and should enumerate all pages until the nextLink becomes null."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "A response message containing a list of keys in the vault along with a link to the next page of keys.",
            "schema": {
              "$ref": "#/definitions/KeyListResult"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        },
        "x-ms-examples": {
          "GetKeys": {
            "$ref": "./examples/GetKeys-example.json"
          }
        }
      }
    },
    "/keys/{key-name}/backup": {
      "post": {
        "tags": [
          "Keys"
        ],
        "operationId": "BackupKey",
        "summary": "Requests that a backup of the specified key be downloaded to the client.",
        "description": "The Key Backup operation exports a key from Azure Key Vault in a protected form. Note that this operation does NOT return key material in a form that can be used outside the Azure Key Vault system, the returned key material is either protected to a Azure Key Vault HSM or to Azure Key Vault itself. The intent of this operation is to allow a client to GENERATE a key in one Azure Key Vault instance, BACKUP the key, and then RESTORE it into another Azure Key Vault instance. The BACKUP operation may be used to export, in protected form, any key type from Azure Key Vault. Individual versions of a key cannot be backed up. BACKUP / RESTORE can be performed within geographical boundaries only; meaning that a BACKUP from one geographical area cannot be restored to another geographical area. For example, a backup from the US geographical area cannot be restored in an EU geographical area. This operation requires the key/backup permission.",
        "parameters": [
          {
            "name": "key-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the key."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The backup blob containing the backed up key.",
            "schema": {
              "$ref": "#/definitions/BackupKeyResult"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "BackupKey": {
            "$ref": "./examples/BackupKey-example.json"
          }
        }
      }
    },
    "/keys/restore": {
      "post": {
        "tags": [
          "Keys"
        ],
        "operationId": "RestoreKey",
        "summary": "Restores a backed up key to a vault.",
        "description": "Imports a previously backed up key into Azure Key Vault, restoring the key, its key identifier, attributes and access control policies. The RESTORE operation may be used to import a previously backed up key. Individual versions of a key cannot be restored. The key is restored in its entirety with the same key name as it had when it was backed up. If the key name is not available in the target Key Vault, the RESTORE operation will be rejected. While the key name is retained during restore, the final key identifier will change if the key is restored to a different vault. Restore will restore all versions and preserve version identifiers. The RESTORE operation is subject to security constraints: The target Key Vault must be owned by the same Microsoft Azure Subscription as the source Key Vault The user must have RESTORE permission in the target Key Vault. This operation requires the keys/restore permission.",
        "parameters": [
          {
            "name": "parameters",
            "in": "body",
            "required": true,
            "x-ms-client-flatten": true,
            "schema": {
              "$ref": "#/definitions/KeyRestoreParameters"
            },
            "description": "The parameters to restore the key."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "Restored key bundle in the vault.",
            "schema": {
              "$ref": "#/definitions/KeyBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "RestoreKey": {
            "$ref": "./examples/RestoreKey-example.json"
          }
        }
      }
    },
    "/keys/{key-name}/{key-version}/encrypt": {
      "post": {
        "tags": [
          "Keys"
        ],
        "operationId": "encrypt",
        "summary": "Encrypts an arbitrary sequence of bytes using an encryption key that is stored in a key vault.",
        "description": "The ENCRYPT operation encrypts an arbitrary sequence of bytes using an encryption key that is stored in Azure Key Vault. Note that the ENCRYPT operation only supports a single block of data, the size of which is dependent on the target key and the encryption algorithm to be used. The ENCRYPT operation is only strictly necessary for symmetric keys stored in Azure Key Vault since protection with an asymmetric key can be performed using public portion of the key. This operation is supported for asymmetric keys as a convenience for callers that have a key-reference but do not have access to the public key material. This operation requires the keys/encrypt permission.",
        "parameters": [
          {
            "name": "key-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the key."
          },
          {
            "name": "key-version",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The version of the key."
          },
          {
            "name": "parameters",
            "in": "body",
            "required": true,
            "x-ms-client-flatten": true,
            "schema": {
              "$ref": "#/definitions/KeyOperationsParameters"
            },
            "description": "The parameters for the encryption operation."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The encryption result.",
            "schema": {
              "$ref": "#/definitions/KeyOperationResult"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "Encrypt example": {
            "$ref": "./examples/encrypt-example.json"
          }
        }
      }
    },
    "/keys/{key-name}/{key-version}/decrypt": {
      "post": {
        "tags": [
          "Keys"
        ],
        "operationId": "decrypt",
        "summary": "Decrypts a single block of encrypted data.",
        "description": "The DECRYPT operation decrypts a well-formed block of ciphertext using the target encryption key and specified algorithm. This operation is the reverse of the ENCRYPT operation; only a single block of data may be decrypted, the size of this block is dependent on the target key and the algorithm to be used. The DECRYPT operation applies to asymmetric and symmetric keys stored in Azure Key Vault since it uses the private portion of the key. This operation requires the keys/decrypt permission.",
        "parameters": [
          {
            "name": "key-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the key."
          },
          {
            "name": "key-version",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The version of the key."
          },
          {
            "name": "parameters",
            "in": "body",
            "required": true,
            "x-ms-client-flatten": true,
            "schema": {
              "$ref": "#/definitions/KeyOperationsParameters"
            },
            "description": "The parameters for the decryption operation."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The decryption result.",
            "schema": {
              "$ref": "#/definitions/KeyOperationResult"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "Decrypt example": {
            "$ref": "./examples/decrypt-example.json"
          }
        }
      }
    },
    "/keys/{key-name}/{key-version}/sign": {
      "post": {
        "tags": [
          "Keys"
        ],
        "operationId": "sign",
        "summary": "Creates a signature from a digest using the specified key.",
        "description": "The SIGN operation is applicable to asymmetric and symmetric keys stored in Azure Key Vault since this operation uses the private portion of the key. This operation requires the keys/sign permission.",
        "parameters": [
          {
            "name": "key-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the key."
          },
          {
            "name": "key-version",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The version of the key."
          },
          {
            "name": "parameters",
            "in": "body",
            "required": true,
            "x-ms-client-flatten": true,
            "schema": {
              "$ref": "#/definitions/KeySignParameters"
            },
            "description": "The parameters for the signing operation."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The signature value.",
            "schema": {
              "$ref": "#/definitions/KeyOperationResult"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "Sign": {
            "$ref": "./examples/sign-example.json"
          }
        }
      }
    },
    "/keys/{key-name}/{key-version}/verify": {
      "post": {
        "tags": [
          "Keys"
        ],
        "operationId": "verify",
        "summary": "Verifies a signature using a specified key.",
        "description": "The VERIFY operation is applicable to symmetric keys stored in Azure Key Vault. VERIFY is not strictly necessary for asymmetric keys stored in Azure Key Vault since signature verification can be performed using the public portion of the key but this operation is supported as a convenience for callers that only have a key-reference and not the public portion of the key. This operation requires the keys/verify permission.",
        "parameters": [
          {
            "name": "key-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the key."
          },
          {
            "name": "key-version",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The version of the key."
          },
          {
            "name": "parameters",
            "in": "body",
            "required": true,
            "x-ms-client-flatten": true,
            "schema": {
              "$ref": "#/definitions/KeyVerifyParameters"
            },
            "description": "The parameters for verify operations."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The verification result.",
            "schema": {
              "$ref": "#/definitions/KeyVerifyResult"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "Verify": {
            "$ref": "./examples/verify-example.json"
          }
        }
      }
    },
    "/keys/{key-name}/{key-version}/wrapkey": {
      "post": {
        "tags": [
          "Keys"
        ],
        "operationId": "wrapKey",
        "summary": "Wraps a symmetric key using a specified key.",
        "description": "The WRAP operation supports encryption of a symmetric key using a key encryption key that has previously been stored in an Azure Key Vault. The WRAP operation is only strictly necessary for symmetric keys stored in Azure Key Vault since protection with an asymmetric key can be performed using the public portion of the key. This operation is supported for asymmetric keys as a convenience for callers that have a key-reference but do not have access to the public key material. This operation requires the keys/wrapKey permission.",
        "parameters": [
          {
            "name": "key-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the key."
          },
          {
            "name": "key-version",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The version of the key."
          },
          {
            "name": "parameters",
            "in": "body",
            "required": true,
            "x-ms-client-flatten": true,
            "schema": {
              "$ref": "#/definitions/KeyOperationsParameters"
            },
            "description": "The parameters for wrap operation."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The wrapped symmetric key.",
            "schema": {
              "$ref": "#/definitions/KeyOperationResult"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "Wrapkey": {
            "$ref": "./examples/wrapKey-example.json"
          }
        }
      }
    },
    "/keys/{key-name}/{key-version}/unwrapkey": {
      "post": {
        "tags": [
          "Keys"
        ],
        "operationId": "unwrapKey",
        "summary": "Unwraps a symmetric key using the specified key that was initially used for wrapping that key.",
        "description": "The UNWRAP operation supports decryption of a symmetric key using the target key encryption key. This operation is the reverse of the WRAP operation. The UNWRAP operation applies to asymmetric and symmetric keys stored in Azure Key Vault since it uses the private portion of the key. This operation requires the keys/unwrapKey permission.",
        "parameters": [
          {
            "name": "key-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the key."
          },
          {
            "name": "key-version",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The version of the key."
          },
          {
            "name": "parameters",
            "in": "body",
            "required": true,
            "x-ms-client-flatten": true,
            "schema": {
              "$ref": "#/definitions/KeyOperationsParameters"
            },
            "description": "The parameters for the key operation."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The unwrapped symmetric key.",
            "schema": {
              "$ref": "#/definitions/KeyOperationResult"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "Unwrapkey": {
            "$ref": "./examples/unwrapKey-example.json"
          }
        }
      }
    },
    "/deletedkeys": {
      "get": {
        "tags": [
          "DeletedKeys"
        ],
        "operationId": "GetDeletedKeys",
        "summary": "Lists the deleted keys in the specified vault.",
        "description": "Retrieves a list of the keys in the Key Vault as JSON Web Key structures that contain the public part of a deleted key. This operation includes deletion-specific information. The Get Deleted Keys operation is applicable for vaults enabled for soft-delete. While the operation can be invoked on any vault, it will return an error if invoked on a non soft-delete enabled vault. This operation requires the keys/list permission.",
        "parameters": [
          {
            "name": "maxresults",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32",
            "minimum": 1,
            "maximum": 25,
            "description": "Specifies the maximum number of results to return in a page. Setting maxresults to a value less than 1 or greater than 25 results in error response code 400 (Bad Request). If there are additional results to return, then the service returns a nextLink containing a skip token for pagination. In certain cases, the service might return fewer results than specified by maxresults (even 0 results) and also return a nextLink. Clients should not make any assumptions on the minimum number of results per page, and should enumerate all pages until the nextLink becomes null."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "A response message containing a list of deleted keys in the vault along with a link to the next page of deleted keys.",
            "schema": {
              "$ref": "#/definitions/DeletedKeyListResult"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        },
        "x-ms-examples": {
          "GetDeletedKeys": {
            "$ref": "./examples/GetDeletedKeys-example.json"
          }
        }
      }
    },
    "/deletedkeys/{key-name}": {
      "get": {
        "tags": [
          "DeletedKeys"
        ],
        "operationId": "GetDeletedKey",
        "summary": "Gets the public part of a deleted key.",
        "description": "The Get Deleted Key operation is applicable for soft-delete enabled vaults. While the operation can be invoked on any vault, it will return an error if invoked on a non soft-delete enabled vault. This operation requires the keys/get permission. ",
        "parameters": [
          {
            "name": "key-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the key."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "A DeletedKeyBundle consisting of a WebKey plus its Attributes and deletion information.",
            "schema": {
              "$ref": "#/definitions/DeletedKeyBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "GetDeletedKey": {
            "$ref": "./examples/GetDeletedKey-example.json"
          }
        }
      },
      "delete": {
        "tags": [
          "DeletedKeys"
        ],
        "operationId": "PurgeDeletedKey",
        "summary": "Permanently deletes the specified key.",
        "description": "The Purge Deleted Key operation is applicable for soft-delete enabled vaults. While the operation can be invoked on any vault, it will return an error if invoked on a non soft-delete enabled vault. This operation requires the keys/purge permission.",
        "parameters": [
          {
            "name": "key-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the key"
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "204": {
            "description": "No content, signaling that the key was permanently purged."
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "PurgeDeletedKey": {
            "$ref": "./examples/PurgeDeletedKey-example.json"
          }
        }
      }
    },
    "/deletedkeys/{key-name}/recover": {
      "post": {
        "tags": [
          "DeletedKeys"
        ],
        "operationId": "RecoverDeletedKey",
        "summary": "Recovers the deleted key to its latest version.",
        "description": "The Recover Deleted Key operation is applicable for deleted keys in soft-delete enabled vaults. It recovers the deleted key back to its latest version under /keys. An attempt to recover an non-deleted key will return an error. Consider this the inverse of the delete operation on soft-delete enabled vaults. This operation requires the keys/recover permission.",
        "parameters": [
          {
            "name": "key-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the deleted key."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "A Key bundle of the original key and its attributes",
            "schema": {
              "$ref": "#/definitions/KeyBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "RecoverDeletedKey": {
            "$ref": "./examples/RecoverDeletedKey-example.json"
          }
        }
      }
    },
    "/secrets/{secret-name}": {
      "put": {
        "tags": [
          "Secrets"
        ],
        "operationId": "SetSecret",
        "summary": "Sets a secret in a specified key vault.",
        "description": " The SET operation adds a secret to the Azure Key Vault. If the named secret already exists, Azure Key Vault creates a new version of that secret. This operation requires the secrets/set permission.",
        "parameters": [
          {
            "name": "secret-name",
            "in": "path",
            "required": true,
            "type": "string",
            "pattern": "^[0-9a-zA-Z-]+$",
            "description": "The name of the secret."
          },
          {
            "name": "parameters",
            "in": "body",
            "required": true,
            "x-ms-client-flatten": true,
            "schema": {
              "$ref": "#/definitions/SecretSetParameters"
            },
            "description": "The parameters for setting the secret."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "A secret bundle containing the result of the set secret request.",
            "schema": {
              "$ref": "#/definitions/SecretBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "SetSecret": {
            "$ref": "./examples/SetSecret-example.json"
          }
        }
      },
      "delete": {
        "tags": [
          "Secrets"
        ],
        "operationId": "DeleteSecret",
        "summary": "Deletes a secret from a specified key vault.",
        "description": "The DELETE operation applies to any secret stored in Azure Key Vault. DELETE cannot be applied to an individual version of a secret. This operation requires the secrets/delete permission.",
        "parameters": [
          {
            "name": "secret-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the secret."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The deleted secret and information on when the secret will be deleted, and how to recover the deleted secret.",
            "schema": {
              "$ref": "#/definitions/DeletedSecretBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "DeleteSecret": {
            "$ref": "./examples/DeleteSecret-example.json"
          }
        }
      }
    },
    "/secrets/{secret-name}/{secret-version}": {
      "patch": {
        "tags": [
          "Secrets"
        ],
        "operationId": "UpdateSecret",
        "summary": "Updates the attributes associated with a specified secret in a given key vault.",
        "description": "The UPDATE operation changes specified attributes of an existing stored secret. Attributes that are not specified in the request are left unchanged. The value of a secret itself cannot be changed. This operation requires the secrets/set permission.",
        "parameters": [
          {
            "name": "secret-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the secret."
          },
          {
            "name": "secret-version",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The version of the secret."
          },
          {
            "name": "parameters",
            "in": "body",
            "required": true,
            "x-ms-client-flatten": true,
            "schema": {
              "$ref": "#/definitions/SecretUpdateParameters"
            },
            "description": "The parameters for update secret operation."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The updated secret.",
            "schema": {
              "$ref": "#/definitions/SecretBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "UpdateSecret": {
            "$ref": "./examples/UpdateSecret-example.json"
          }
        }
      },
      "get": {
        "tags": [
          "Secrets"
        ],
        "operationId": "GetSecret",
        "summary": "Get a specified secret from a given key vault.",
        "description": "The GET operation is applicable to any secret stored in Azure Key Vault. This operation requires the secrets/get permission.",
        "parameters": [
          {
            "name": "secret-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the secret."
          },
          {
            "name": "secret-version",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The version of the secret."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The retrieved secret.",
            "schema": {
              "$ref": "#/definitions/SecretBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "GetSecret": {
            "$ref": "./examples/GetSecret-example.json"
          }
        }
      }
    },
    "/secrets": {
      "get": {
        "tags": [
          "Secrets"
        ],
        "operationId": "GetSecrets",
        "summary": "List secrets in a specified key vault.",
        "description": "The Get Secrets operation is applicable to the entire vault. However, only the base secret identifier and its attributes are provided in the response. Individual secret versions are not listed in the response. This operation requires the secrets/list permission.",
        "parameters": [
          {
            "name": "maxresults",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32",
            "minimum": 1,
            "maximum": 25,
            "description": "Specifies the maximum number of results to return in a page. Setting maxresults to a value less than 1 or greater than 25 results in error response code 400 (Bad Request). If there are additional results to return, then the service returns a nextLink containing a skip token for pagination. In certain cases, the service might return fewer results than specified by maxresults (even 0 results) and also return a nextLink. Clients should not make any assumptions on the minimum number of results per page, and should enumerate all pages until the nextLink becomes null."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "A response message containing a list of secrets in the vault along with a link to the next page of secrets.",
            "schema": {
              "$ref": "#/definitions/SecretListResult"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        },
        "x-ms-examples": {
          "GetSecrets": {
            "$ref": "./examples/GetSecrets-example.json"
          }
        }
      }
    },
    "/secrets/{secret-name}/versions": {
      "get": {
        "tags": [
          "Secrets"
        ],
        "operationId": "GetSecretVersions",
        "summary": "List all versions of the specified secret.",
        "description": "The full secret identifier and attributes are provided in the response. No values are returned for the secrets. This operations requires the secrets/list permission.",
        "parameters": [
          {
            "name": "secret-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the secret."
          },
          {
            "name": "maxresults",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32",
            "minimum": 1,
            "maximum": 25,
            "description": "Specifies the maximum number of results to return in a page. Setting maxresults to a value less than 1 or greater than 25 results in error response code 400 (Bad Request). If there are additional results to return, then the service returns a nextLink containing a skip token for pagination. In certain cases, the service might return fewer results than specified by maxresults (even 0 results) and also return a nextLink. Clients should not make any assumptions on the minimum number of results per page, and should enumerate all pages until the nextLink becomes null."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "A response message containing a list of secrets along with a link to the next page of secrets.",
            "schema": {
              "$ref": "#/definitions/SecretListResult"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        },
        "x-ms-examples": {
          "GetSecretVersions": {
            "$ref": "./examples/GetSecretVersions-example.json"
          }
        }
      }
    },
    "/deletedsecrets": {
      "get": {
        "tags": [
          "DeletedSecrets"
        ],
        "operationId": "GetDeletedSecrets",
        "summary": "Lists deleted secrets for the specified vault.",
        "description": "The Get Deleted Secrets operation returns the secrets that have been deleted for a vault enabled for soft-delete. This operation requires the secrets/list permission.",
        "parameters": [
          {
            "name": "maxresults",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32",
            "minimum": 1,
            "maximum": 25,
            "description": "Specifies the maximum number of results to return in a page. Setting maxresults to a value less than 1 or greater than 25 results in error response code 400 (Bad Request). If there are additional results to return, then the service returns a nextLink containing a skip token for pagination. In certain cases, the service might return fewer results than specified by maxresults (even 0 results) and also return a nextLink. Clients should not make any assumptions on the minimum number of results per page, and should enumerate all pages until the nextLink becomes null."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "A response message containing a list of deleted secrets in the vault, along with a link to the next page of deleted secrets.",
            "schema": {
              "$ref": "#/definitions/DeletedSecretListResult"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        },
        "x-ms-examples": {
          "GetDeletedSecrets": {
            "$ref": "./examples/GetDeletedSecrets-example.json"
          }
        }
      }
    },
    "/deletedsecrets/{secret-name}": {
      "get": {
        "tags": [
          "DeletedSecrets"
        ],
        "operationId": "GetDeletedSecret",
        "summary": "Gets the specified deleted secret.",
        "description": "The Get Deleted Secret operation returns the specified deleted secret along with its attributes. This operation requires the secrets/get permission.",
        "parameters": [
          {
            "name": "secret-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the secret."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "A secret bundle of the secret and its attributes.",
            "schema": {
              "$ref": "#/definitions/DeletedSecretBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "GetDeletedSecret": {
            "$ref": "./examples/GetDeletedSecret-example.json"
          }
        }
      },
      "delete": {
        "tags": [
          "DeletedSecrets"
        ],
        "operationId": "PurgeDeletedSecret",
        "summary": "Permanently deletes the specified secret.",
        "description": "The purge deleted secret operation removes the secret permanently, without the possibility of recovery. This operation can only be enabled on a soft-delete enabled vault. This operation requires the secrets/purge permission.",
        "parameters": [
          {
            "name": "secret-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the secret."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "204": {
            "description": "No content signaling that the secret was purged forever."
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "PurgeDeletedSecret": {
            "$ref": "./examples/PurgeDeletedSecret-example.json"
          }
        }
      }
    },
    "/deletedsecrets/{secret-name}/recover": {
      "post": {
        "tags": [
          "DeletedSecrets"
        ],
        "operationId": "RecoverDeletedSecret",
        "summary": "Recovers the deleted secret to the latest version.",
        "description": "Recovers the deleted secret in the specified vault. This operation can only be performed on a soft-delete enabled vault. This operation requires the secrets/recover permission.",
        "parameters": [
          {
            "name": "secret-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the deleted secret."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "A Secret bundle of the original secret and its attributes.",
            "schema": {
              "$ref": "#/definitions/SecretBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "RecoverDeletedSecret": {
            "$ref": "./examples/RecoverDeletedSecret-example.json"
          }
        }
      }
    },
    "/secrets/{secret-name}/backup": {
      "post": {
        "tags": [
          "Secrets"
        ],
        "operationId": "BackupSecret",
        "summary": "Backs up the specified secret.",
        "description": "Requests that a backup of the specified secret be downloaded to the client. All versions of the secret will be downloaded. This operation requires the secrets/backup permission.",
        "parameters": [
          {
            "name": "secret-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the secret."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The backup blob containing the backed up secret.",
            "schema": {
              "$ref": "#/definitions/BackupSecretResult"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "BackupSecret": {
            "$ref": "./examples/BackupSecret-example.json"
          }
        }
      }
    },
    "/secrets/restore": {
      "post": {
        "tags": [
          "Secrets"
        ],
        "operationId": "RestoreSecret",
        "summary": "Restores a backed up secret to a vault.",
        "description": "Restores a backed up secret, and all its versions, to a vault. This operation requires the secrets/restore permission.",
        "parameters": [
          {
            "name": "parameters",
            "in": "body",
            "required": true,
            "x-ms-client-flatten": true,
            "schema": {
              "$ref": "#/definitions/SecretRestoreParameters"
            },
            "description": "The parameters to restore the secret."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "Restored secret bundle in the vault.",
            "schema": {
              "$ref": "#/definitions/SecretBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "RestoreSecret": {
            "$ref": "./examples/RestoreSecret-example.json"
          }
        }
      }
    },
    "/certificates": {
      "get": {
        "tags": [
          "Certificates"
        ],
        "operationId": "GetCertificates",
        "summary": "List certificates in a specified key vault",
        "description": "The GetCertificates operation returns the set of certificates resources in the specified key vault. This operation requires the certificates/list permission.",
        "parameters": [
          {
            "name": "maxresults",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32",
            "minimum": 1,
            "maximum": 25,
            "description": "Specifies the maximum number of results to return in a page. Setting maxresults to a value less than 1 or greater than 25 results in error response code 400 (Bad Request). If there are additional results to return, then the service returns a nextLink containing a skip token for pagination. In certain cases, the service might return fewer results than specified by maxresults (even 0 results) and also return a nextLink. Clients should not make any assumptions on the minimum number of results per page, and should enumerate all pages until the nextLink becomes null."
          },
          {
            "name": "includePending",
            "in": "query",
            "required": false,
            "type": "boolean",
            "description": "Specifies whether to include certificates which are not completely provisioned."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "A response message containing a list of certificates along with a link to the next page of certificates.",
            "schema": {
              "$ref": "#/definitions/CertificateListResult"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        },
        "x-ms-examples": {
          "GetCertificates": {
            "$ref": "./examples/GetCertificates-example.json"
          }
        }
      }
    },
    "/certificates/{certificate-name}": {
      "delete": {
        "tags": [
          "Certificates"
        ],
        "operationId": "DeleteCertificate",
        "summary": "Deletes a certificate from a specified key vault.",
        "description": "Deletes all versions of a certificate object along with its associated policy. Delete certificate cannot be used to remove individual versions of a certificate object. This operation requires the certificates/delete permission.",
        "parameters": [
          {
            "name": "certificate-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the certificate."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The deleted certificate.",
            "schema": {
              "$ref": "#/definitions/DeletedCertificateBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "DeleteCertificate": {
            "$ref": "./examples/DeleteCertificate-example.json"
          }
        }
      }
    },
    "/certificates/contacts": {
      "put": {
        "tags": [
          "Certificates"
        ],
        "operationId": "SetCertificateContacts",
        "description": "Sets the certificate contacts for the specified key vault. This operation requires the certificates/managecontacts permission.",
        "summary": "Sets the certificate contacts for the specified key vault.",
        "parameters": [
          {
            "name": "contacts",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/Contacts"
            },
            "description": "The contacts for the key vault certificate."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The contacts for the key vault certificate.",
            "schema": {
              "$ref": "#/definitions/Contacts"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "SetCertificateContacts": {
            "$ref": "./examples/SetCertificateContacts-example.json"
          }
        }
      },
      "get": {
        "tags": [
          "Certificates"
        ],
        "operationId": "GetCertificateContacts",
        "summary": "Lists the certificate contacts for a specified key vault.",
        "description": "The GetCertificateContacts operation returns the set of certificate contact resources in the specified key vault. This operation requires the certificates/managecontacts permission.",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The contacts for the key vault certificate.",
            "schema": {
              "$ref": "#/definitions/Contacts"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "GetCertificateContacts": {
            "$ref": "./examples/GetCertificateContacts-example.json"
          }
        }
      },
      "delete": {
        "tags": [
          "Certificates"
        ],
        "operationId": "DeleteCertificateContacts",
        "description": "Deletes the certificate contacts for a specified key vault certificate. This operation requires the certificates/managecontacts permission.",
        "summary": "Deletes the certificate contacts for a specified key vault.",
        "parameters": [
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The contacts for the key vault certificate.",
            "schema": {
              "$ref": "#/definitions/Contacts"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "DeleteCertificateContacts": {
            "$ref": "./examples/DeleteCertificateContacts-example.json"
          }
        }
      }
    },
    "/certificates/issuers": {
      "get": {
        "tags": [
          "Certificates"
        ],
        "operationId": "GetCertificateIssuers",
        "summary": "List certificate issuers for a specified key vault.",
        "description": "The GetCertificateIssuers operation returns the set of certificate issuer resources in the specified key vault. This operation requires the certificates/manageissuers/getissuers permission.",
        "parameters": [
          {
            "name": "maxresults",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32",
            "minimum": 1,
            "maximum": 25,
            "description": "Specifies the maximum number of results to return in a page. Setting maxresults to a value less than 1 or greater than 25 results in error response code 400 (Bad Request). If there are additional results to return, then the service returns a nextLink containing a skip token for pagination. In certain cases, the service might return fewer results than specified by maxresults (even 0 results) and also return a nextLink. Clients should not make any assumptions on the minimum number of results per page, and should enumerate all pages until the nextLink becomes null."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "A response message containing a list of certificate issuers in a key vault along with a link to the next page of certificate issuers.",
            "schema": {
              "$ref": "#/definitions/CertificateIssuerListResult"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        },
        "x-ms-examples": {
          "GetCertificateIssuers": {
            "$ref": "./examples/GetCertificateIssuers-example.json"
          }
        }
      }
    },
    "/certificates/issuers/{issuer-name}": {
      "put": {
        "tags": [
          "Certificates"
        ],
        "operationId": "SetCertificateIssuer",
        "summary": "Sets the specified certificate issuer.",
        "description": "The SetCertificateIssuer operation adds or updates the specified certificate issuer. This operation requires the certificates/setissuers permission.",
        "parameters": [
          {
            "name": "issuer-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the issuer."
          },
          {
            "name": "parameter",
            "in": "body",
            "required": true,
            "x-ms-client-flatten": true,
            "schema": {
              "$ref": "#/definitions/CertificateIssuerSetParameters"
            },
            "description": "Certificate issuer set parameter."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The issuer for the key vault certificate.",
            "schema": {
              "$ref": "#/definitions/IssuerBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "SetCertificateIssuer": {
            "$ref": "./examples/SetCertificateIssuer-example.json"
          }
        }
      },
      "patch": {
        "tags": [
          "Certificates"
        ],
        "operationId": "UpdateCertificateIssuer",
        "summary": "Updates the specified certificate issuer.",
        "description": "The UpdateCertificateIssuer operation performs an update on the specified certificate issuer entity. This operation requires the certificates/setissuers permission.",
        "parameters": [
          {
            "name": "issuer-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the issuer."
          },
          {
            "name": "parameter",
            "in": "body",
            "required": true,
            "x-ms-client-flatten": true,
            "schema": {
              "$ref": "#/definitions/CertificateIssuerUpdateParameters"
            },
            "description": "Certificate issuer update parameter."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The issuer for the key vault certificate.",
            "schema": {
              "$ref": "#/definitions/IssuerBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "UpdateCertificateIssuer": {
            "$ref": "./examples/UpdateCertificateIssuer-example.json"
          }
        }
      },
      "get": {
        "tags": [
          "Certificates"
        ],
        "operationId": "GetCertificateIssuer",
        "summary": "Lists the specified certificate issuer.",
        "description": "The GetCertificateIssuer operation returns the specified certificate issuer resources in the specified key vault. This operation requires the certificates/manageissuers/getissuers permission.",
        "parameters": [
          {
            "name": "issuer-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the issuer."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The issuer for the key vault certificate.",
            "schema": {
              "$ref": "#/definitions/IssuerBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "GetCertificateIssuer": {
            "$ref": "./examples/GetCertificateIssuer-example.json"
          }
        }
      },
      "delete": {
        "tags": [
          "Certificates"
        ],
        "operationId": "DeleteCertificateIssuer",
        "summary": "Deletes the specified certificate issuer.",
        "description": "The DeleteCertificateIssuer operation permanently removes the specified certificate issuer from the vault. This operation requires the certificates/manageissuers/deleteissuers permission.",
        "parameters": [
          {
            "name": "issuer-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the issuer."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The issuer for the key vault certificate.",
            "schema": {
              "$ref": "#/definitions/IssuerBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "DeleteCertificateIssuer": {
            "$ref": "./examples/DeleteCertificateIssuer-example.json"
          }
        }
      }
    },
    "/certificates/{certificate-name}/create": {
      "post": {
        "tags": [
          "Certificates"
        ],
        "operationId": "CreateCertificate",
        "summary": "Creates a new certificate.",
        "description": "If this is the first version, the certificate resource is created. This operation requires the certificates/create permission.",
        "parameters": [
          {
            "name": "certificate-name",
            "in": "path",
            "required": true,
            "type": "string",
            "pattern": "^[0-9a-zA-Z-]+$",
            "description": "The name of the certificate."
          },
          {
            "name": "parameters",
            "in": "body",
            "required": true,
            "x-ms-client-flatten": true,
            "schema": {
              "$ref": "#/definitions/CertificateCreateParameters"
            },
            "description": "The parameters to create a certificate."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "202": {
            "description": "Created certificate bundle.",
            "schema": {
              "$ref": "#/definitions/CertificateOperation"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "CreateCertificate": {
            "$ref": "./examples/CreateCertificate-example.json"
          }
        }
      }
    },
    "/certificates/{certificate-name}/import": {
      "post": {
        "tags": [
          "Certificates"
        ],
        "operationId": "ImportCertificate",
        "summary": "Imports a certificate into a specified key vault.",
        "description": "Imports an existing valid certificate, containing a private key, into Azure Key Vault. The certificate to be imported can be in either PFX or PEM format. If the certificate is in PEM format the PEM file must contain the key as well as x509 certificates. This operation requires the certificates/import permission.",
        "parameters": [
          {
            "name": "certificate-name",
            "in": "path",
            "required": true,
            "type": "string",
            "pattern": "^[0-9a-zA-Z-]+$",
            "description": "The name of the certificate."
          },
          {
            "name": "parameters",
            "in": "body",
            "required": true,
            "x-ms-client-flatten": true,
            "schema": {
              "$ref": "#/definitions/CertificateImportParameters"
            },
            "description": "The parameters to import the certificate."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "Imported certificate bundle to the vault.",
            "schema": {
              "$ref": "#/definitions/CertificateBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "ImportCertificate": {
            "$ref": "./examples/ImportCertificate-example.json"
          }
        }
      }
    },
    "/certificates/{certificate-name}/versions": {
      "get": {
        "tags": [
          "Certificates"
        ],
        "operationId": "GetCertificateVersions",
        "summary": "List the versions of a certificate.",
        "description": "The GetCertificateVersions operation returns the versions of a certificate in the specified key vault. This operation requires the certificates/list permission.",
        "parameters": [
          {
            "name": "certificate-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the certificate."
          },
          {
            "name": "maxresults",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32",
            "minimum": 1,
            "maximum": 25,
            "description": "Specifies the maximum number of results to return in a page. Setting maxresults to a value less than 1 or greater than 25 results in error response code 400 (Bad Request). If there are additional results to return, then the service returns a nextLink containing a skip token for pagination. In certain cases, the service might return fewer results than specified by maxresults (even 0 results) and also return a nextLink. Clients should not make any assumptions on the minimum number of results per page, and should enumerate all pages until the nextLink becomes null."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "A response message containing a list of certificates in the key vault along with a link to the next page of keys.",
            "schema": {
              "$ref": "#/definitions/CertificateListResult"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        },
        "x-ms-examples": {
          "GetCertificateVersions": {
            "$ref": "./examples/GetCertificateVersions-example.json"
          }
        }
      }
    },
    "/certificates/{certificate-name}/policy": {
      "get": {
        "tags": [
          "Certificates"
        ],
        "operationId": "GetCertificatePolicy",
        "summary": "Lists the policy for a certificate.",
        "description": "The GetCertificatePolicy operation returns the specified certificate policy resources in the specified key vault. This operation requires the certificates/get permission.",
        "parameters": [
          {
            "name": "certificate-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the certificate in a given key vault."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The certificate policy.",
            "schema": {
              "$ref": "#/definitions/CertificatePolicy"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "GetCertificatePolicy": {
            "$ref": "./examples/GetCertificatePolicy-example.json"
          }
        }
      },
      "patch": {
        "tags": [
          "Certificates"
        ],
        "operationId": "UpdateCertificatePolicy",
        "summary": "Updates the policy for a certificate.",
        "description": "Set specified members in the certificate policy. Leave others as null. This operation requires the certificates/update permission.",
        "parameters": [
          {
            "name": "certificate-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the certificate in the given vault."
          },
          {
            "name": "certificatePolicy",
            "in": "body",
            "required": true,
            "schema": {
              "$ref": "#/definitions/CertificatePolicy"
            },
            "description": "The policy for the certificate."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The certificate policy",
            "schema": {
              "$ref": "#/definitions/CertificatePolicy"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "UpdateCertificatePolicy": {
            "$ref": "./examples/UpdateCertificatePolicy-example.json"
          }
        }
      }
    },
    "/certificates/{certificate-name}/{certificate-version}": {
      "patch": {
        "tags": [
          "Certificates"
        ],
        "operationId": "UpdateCertificate",
        "summary": "Updates the specified attributes associated with the given certificate.",
        "description": "The UpdateCertificate operation applies the specified update on the given certificate; the only elements updated are the certificate's attributes. This operation requires the certificates/update permission.",
        "parameters": [
          {
            "name": "certificate-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the certificate in the given key vault."
          },
          {
            "name": "certificate-version",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The version of the certificate."
          },
          {
            "name": "parameters",
            "in": "body",
            "required": true,
            "x-ms-client-flatten": true,
            "schema": {
              "$ref": "#/definitions/CertificateUpdateParameters"
            },
            "description": "The parameters for certificate update."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The updated certificate.",
            "schema": {
              "$ref": "#/definitions/CertificateBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "UpdateCertificate": {
            "$ref": "./examples/UpdateCertificate-example.json"
          }
        }
      },
      "get": {
        "tags": [
          "Certificates"
        ],
        "operationId": "GetCertificate",
        "summary": "Gets information about a certificate.",
        "description": "Gets information about a specific certificate. This operation requires the certificates/get permission.",
        "parameters": [
          {
            "name": "certificate-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the certificate in the given vault."
          },
          {
            "name": "certificate-version",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The version of the certificate."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The retrieved certificate.",
            "schema": {
              "$ref": "#/definitions/CertificateBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "GetCertificate": {
            "$ref": "./examples/GetCertificate-example.json"
          }
        }
      }
    },
    "/certificates/{certificate-name}/pending": {
      "patch": {
        "tags": [
          "Certificates"
        ],
        "operationId": "UpdateCertificateOperation",
        "summary": "Updates a certificate operation.",
        "description": "Updates a certificate creation operation that is already in progress. This operation requires the certificates/update permission.",
        "parameters": [
          {
            "name": "certificate-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the certificate."
          },
          {
            "name": "certificateOperation",
            "in": "body",
            "required": true,
            "x-ms-client-flatten": true,
            "schema": {
              "$ref": "#/definitions/CertificateOperationUpdateParameter"
            },
            "description": "The certificate operation response."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "A message containing the certificate operation response.",
            "schema": {
              "$ref": "#/definitions/CertificateOperation"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "UpdateCertificateOperation": {
            "$ref": "./examples/UpdateCertificateOperation-example.json"
          }
        }
      },
      "get": {
        "tags": [
          "Certificates"
        ],
        "operationId": "GetCertificateOperation",
        "summary": "Gets the creation operation of a certificate.",
        "description": "Gets the creation operation associated with a specified certificate. This operation requires the certificates/get permission.",
        "parameters": [
          {
            "name": "certificate-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the certificate."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The certificate operation response.",
            "schema": {
              "$ref": "#/definitions/CertificateOperation"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "GetCertificateOperation": {
            "$ref": "./examples/GetCertificateOperation-example.json"
          }
        }
      },
      "delete": {
        "tags": [
          "Certificates"
        ],
        "operationId": "DeleteCertificateOperation",
        "summary": "Deletes the creation operation for a specific certificate.",
        "description": "Deletes the creation operation for a specified certificate that is in the process of being created. The certificate is no longer created. This operation requires the certificates/update permission.",
        "parameters": [
          {
            "name": "certificate-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the certificate."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "A message containing the certificate operation response.",
            "schema": {
              "$ref": "#/definitions/CertificateOperation"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "DeleteCertificateOperation": {
            "$ref": "./examples/DeleteCertificateOperation-example.json"
          }
        }
      }
    },
    "/certificates/{certificate-name}/pending/merge": {
      "post": {
        "tags": [
          "Certificates"
        ],
        "operationId": "MergeCertificate",
        "summary": "Merges a certificate or a certificate chain with a key pair existing on the server.",
        "description": "The MergeCertificate operation performs the merging of a certificate or certificate chain with a key pair currently available in the service. This operation requires the certificates/create permission.",
        "parameters": [
          {
            "name": "certificate-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the certificate."
          },
          {
            "name": "parameters",
            "in": "body",
            "required": true,
            "x-ms-client-flatten": true,
            "schema": {
              "$ref": "#/definitions/CertificateMergeParameters"
            },
            "description": "The parameters to merge certificate."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "201": {
            "description": "Merged certificate bundle to the vault.",
            "schema": {
              "$ref": "#/definitions/CertificateBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "MergeCertificate": {
            "$ref": "./examples/MergeCertificate-example.json"
          }
        }
      }
    },
    "/certificates/{certificate-name}/backup": {
      "post": {
        "tags": [
          "Certificates"
        ],
        "operationId": "BackupCertificate",
        "summary": "Backs up the specified certificate.",
        "description": "Requests that a backup of the specified certificate be downloaded to the client. All versions of the certificate will be downloaded. This operation requires the certificates/backup permission.",
        "parameters": [
          {
            "name": "certificate-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the certificate."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The backup blob containing the backed up certificate.",
            "schema": {
              "$ref": "#/definitions/BackupCertificateResult"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "BackupCertificate": {
            "$ref": "./examples/BackupCertificate-example.json"
          }
        }
      }
    },
    "/certificates/restore": {
      "post": {
        "tags": [
          "Certificates"
        ],
        "operationId": "RestoreCertificate",
        "summary": "Restores a backed up certificate to a vault.",
        "description": "Restores a backed up certificate, and all its versions, to a vault. This operation requires the certificates/restore permission.",
        "parameters": [
          {
            "name": "parameters",
            "in": "body",
            "required": true,
            "x-ms-client-flatten": true,
            "schema": {
              "$ref": "#/definitions/CertificateRestoreParameters"
            },
            "description": "The parameters to restore the certificate."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "Restored certificate bundle in the vault.",
            "schema": {
              "$ref": "#/definitions/CertificateBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "RestoreCertificate": {
            "$ref": "./examples/RestoreCertificate-example.json"
          }
        }
      }
    },
    "/deletedcertificates": {
      "get": {
        "tags": [
          "DeletedCertificates"
        ],
        "operationId": "GetDeletedCertificates",
        "summary": "Lists the deleted certificates in the specified vault currently available for recovery.",
        "description": "The GetDeletedCertificates operation retrieves the certificates in the current vault which are in a deleted state and ready for recovery or purging. This operation includes deletion-specific information. This operation requires the certificates/get/list permission. This operation can only be enabled on soft-delete enabled vaults.",
        "parameters": [
          {
            "name": "maxresults",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32",
            "minimum": 1,
            "maximum": 25,
            "description": "Specifies the maximum number of results to return in a page. Setting maxresults to a value less than 1 or greater than 25 results in error response code 400 (Bad Request). If there are additional results to return, then the service returns a nextLink containing a skip token for pagination. In certain cases, the service might return fewer results than specified by maxresults (even 0 results) and also return a nextLink. Clients should not make any assumptions on the minimum number of results per page, and should enumerate all pages until the nextLink becomes null."
          },
          {
            "name": "includePending",
            "in": "query",
            "required": false,
            "type": "boolean",
            "description": "Specifies whether to include certificates which are not completely provisioned."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "A response message containing a list of deleted certificates in the vault along with a link to the next page of deleted certificates",
            "schema": {
              "$ref": "#/definitions/DeletedCertificateListResult"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        },
        "x-ms-examples": {
          "GetDeletedCertificates": {
            "$ref": "./examples/GetDeletedCertificates-example.json"
          }
        }
      }
    },
    "/deletedcertificates/{certificate-name}": {
      "get": {
        "tags": [
          "DeletedCertificates"
        ],
        "operationId": "GetDeletedCertificate",
        "summary": "Retrieves information about the specified deleted certificate.",
        "description": "The GetDeletedCertificate operation retrieves the deleted certificate information plus its attributes, such as retention interval, scheduled permanent deletion and the current deletion recovery level. This operation requires the certificates/get permission.",
        "parameters": [
          {
            "name": "certificate-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the certificate"
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "A Certificate bundle of the certificate and its attributes",
            "schema": {
              "$ref": "#/definitions/DeletedCertificateBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "GetDeletedCertificate": {
            "$ref": "./examples/GetDeletedCertificate-example.json"
          }
        }
      },
      "delete": {
        "tags": [
          "DeletedCertificates"
        ],
        "operationId": "PurgeDeletedCertificate",
        "summary": "Permanently deletes the specified deleted certificate.",
        "description": "The PurgeDeletedCertificate operation performs an irreversible deletion of the specified certificate, without possibility for recovery. The operation is not available if the recovery level does not specify 'Purgeable'. This operation requires the certificate/purge permission.",
        "parameters": [
          {
            "name": "certificate-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the certificate"
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "204": {
            "description": "No content signaling that the certificate was purged forever."
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "PurgeDeletedCertificate": {
            "$ref": "./examples/PurgeDeletedCertificate-example.json"
          }
        }
      }
    },
    "/deletedcertificates/{certificate-name}/recover": {
      "post": {
        "tags": [
          "DeletedCertificates"
        ],
        "operationId": "RecoverDeletedCertificate",
        "summary": "Recovers the deleted certificate back to its current version under /certificates.",
        "description": "The RecoverDeletedCertificate operation performs the reversal of the Delete operation. The operation is applicable in vaults enabled for soft-delete, and must be issued during the retention interval (available in the deleted certificate's attributes). This operation requires the certificates/recover permission.",
        "parameters": [
          {
            "name": "certificate-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the deleted certificate"
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "A Certificate bundle of the original certificate and its attributes",
            "schema": {
              "$ref": "#/definitions/CertificateBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "RecoverDeletedCertificate": {
            "$ref": "./examples/RecoverDeletedCertificate-example.json"
          }
        }
      }
    },
    "/storage": {
      "get": {
        "tags": [
          "Storage"
        ],
        "operationId": "GetStorageAccounts",
        "description": "List storage accounts managed by the specified key vault. This operation requires the storage/list permission.",
        "parameters": [
          {
            "name": "maxresults",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32",
            "minimum": 1,
            "maximum": 25,
            "description": "Specifies the maximum number of results to return in a page. Setting maxresults to a value less than 1 or greater than 25 results in error response code 400 (Bad Request). If there are additional results to return, then the service returns a nextLink containing a skip token for pagination. In certain cases, the service might return fewer results than specified by maxresults (even 0 results) and also return a nextLink. Clients should not make any assumptions on the minimum number of results per page, and should enumerate all pages until the nextLink becomes null."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "A response message containing a list of storage accounts along with a link to the next page of storage accounts.",
            "schema": {
              "$ref": "#/definitions/StorageListResult"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        },
        "x-ms-examples": {
          "List Storage account": {
            "$ref": "./examples/listStorageAccount.json"
          }
        }
      }
    },
    "/deletedstorage": {
      "get": {
        "tags": [
          "DeletedStorage"
        ],
        "operationId": "GetDeletedStorageAccounts",
        "summary": "Lists deleted storage accounts for the specified vault.",
        "description": "The Get Deleted Storage Accounts operation returns the storage accounts that have been deleted for a vault enabled for soft-delete. This operation requires the storage/list permission.",
        "parameters": [
          {
            "name": "maxresults",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32",
            "minimum": 1,
            "maximum": 25,
            "description": "Specifies the maximum number of results to return in a page. Setting maxresults to a value less than 1 or greater than 25 results in error response code 400 (Bad Request). If there are additional results to return, then the service returns a nextLink containing a skip token for pagination. In certain cases, the service might return fewer results than specified by maxresults (even 0 results) and also return a nextLink. Clients should not make any assumptions on the minimum number of results per page, and should enumerate all pages until the nextLink becomes null."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "A response message containing a list of deleted storage accounts in the vault, along with a link to the next page of deleted storage accounts.",
            "schema": {
              "$ref": "#/definitions/DeletedStorageListResult"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        },
        "x-ms-examples": {
          "List Deleted Storage Accounts": {
            "$ref": "./examples/listDeletedStorageAccount.json"
          }
        }
      }
    },
    "/deletedstorage/{storage-account-name}": {
      "get": {
        "tags": [
          "DeletedStorage"
        ],
        "operationId": "GetDeletedStorageAccount",
        "summary": "Gets the specified deleted storage account.",
        "description": "The Get Deleted Storage Account operation returns the specified deleted storage account along with its attributes. This operation requires the storage/get permission.",
        "parameters": [
          {
            "name": "storage-account-name",
            "in": "path",
            "required": true,
            "type": "string",
            "pattern": "^[0-9a-zA-Z]+$",
            "description": "The name of the storage account."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The deleted storage account and information on when it will be purged, and how to recover the deleted storage account.",
            "schema": {
              "$ref": "#/definitions/DeletedStorageBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "Get Deleted Storage": {
            "$ref": "./examples/getDeletedStorageAccount.json"
          }
        }
      },
      "delete": {
        "tags": [
          "DeletedStorage"
        ],
        "operationId": "PurgeDeletedStorageAccount",
        "summary": "Permanently deletes the specified storage account.",
        "description": "The purge deleted storage account operation removes the secret permanently, without the possibility of recovery. This operation can only be performed on a soft-delete enabled vault. This operation requires the storage/purge permission.",
        "parameters": [
          {
            "name": "storage-account-name",
            "in": "path",
            "required": true,
            "type": "string",
            "pattern": "^[0-9a-zA-Z]+$",
            "description": "The name of the storage account."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "204": {
            "description": "No content signaling that the storage account was purged forever."
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "Purge Deleted Storage Account": {
            "$ref": "./examples/purgeStorageAccount.json"
          }
        }
      }
    },
    "/deletedstorage/{storage-account-name}/recover": {
      "post": {
        "tags": [
          "DeletedStorage"
        ],
        "operationId": "RecoverDeletedStorageAccount",
        "summary": "Recovers the deleted storage account.",
        "description": "Recovers the deleted storage account in the specified vault. This operation can only be performed on a soft-delete enabled vault. This operation requires the storage/recover permission.",
        "parameters": [
          {
            "name": "storage-account-name",
            "in": "path",
            "required": true,
            "type": "string",
            "pattern": "^[0-9a-zA-Z]+$",
            "description": "The name of the storage account."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "A storage bundle of the original storage account and its attributes.",
            "schema": {
              "$ref": "#/definitions/StorageBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "Recover Deleted Storage Account": {
            "$ref": "./examples/recoverStorageAccount.json"
          }
        }
      }
    },
    "/storage/{storage-account-name}/backup": {
      "post": {
        "tags": [
          "Storage"
        ],
        "operationId": "BackupStorageAccount",
        "summary": "Backs up the specified storage account.",
        "description": "Requests that a backup of the specified storage account be downloaded to the client. This operation requires the storage/backup permission.",
        "parameters": [
          {
            "name": "storage-account-name",
            "in": "path",
            "required": true,
            "type": "string",
            "description": "The name of the storage account."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The backup blob containing the backed up storage account.",
            "schema": {
              "$ref": "#/definitions/BackupStorageResult"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "Backup Storage Account": {
            "$ref": "./examples/backupStorageAccount.json"
          }
        }
      }
    },
    "/storage/restore": {
      "post": {
        "tags": [
          "Storage"
        ],
        "operationId": "RestoreStorageAccount",
        "summary": "Restores a backed up storage account to a vault.",
        "description": "Restores a backed up storage account to a vault. This operation requires the storage/restore permission.",
        "parameters": [
          {
            "name": "parameters",
            "in": "body",
            "required": true,
            "x-ms-client-flatten": true,
            "schema": {
              "$ref": "#/definitions/StorageRestoreParameters"
            },
            "description": "The parameters to restore the storage account."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "Restored storage account bundle in the vault.",
            "schema": {
              "$ref": "#/definitions/StorageBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "Restore Storage Account": {
            "$ref": "./examples/restoreStorageAccount.json"
          }
        }
      }
    },
    "/storage/{storage-account-name}": {
      "delete": {
        "tags": [
          "Storage"
        ],
        "operationId": "DeleteStorageAccount",
        "description": "Deletes a storage account. This operation requires the storage/delete permission.",
        "parameters": [
          {
            "name": "storage-account-name",
            "in": "path",
            "required": true,
            "type": "string",
            "pattern": "^[0-9a-zA-Z]+$",
            "description": "The name of the storage account."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The deleted storage account and information on when the storage account will be deleted, and how to recover the deleted storage account.",
            "schema": {
              "$ref": "#/definitions/DeletedStorageBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "Delete Storage account": {
            "$ref": "./examples/deleteStorageAccount.json"
          }
        }
      },
      "get": {
        "tags": [
          "Storage"
        ],
        "operationId": "GetStorageAccount",
        "description": "Gets information about a specified storage account. This operation requires the storage/get permission.",
        "parameters": [
          {
            "name": "storage-account-name",
            "in": "path",
            "required": true,
            "type": "string",
            "pattern": "^[0-9a-zA-Z]+$",
            "description": "The name of the storage account."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The retrieved storage account.",
            "schema": {
              "$ref": "#/definitions/StorageBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "Get Storage account": {
            "$ref": "./examples/getStorageAccount.json"
          }
        }
      },
      "put": {
        "tags": [
          "Storage"
        ],
        "operationId": "SetStorageAccount",
        "description": "Creates or updates a new storage account. This operation requires the storage/set permission.",
        "parameters": [
          {
            "name": "storage-account-name",
            "in": "path",
            "required": true,
            "type": "string",
            "pattern": "^[0-9a-zA-Z]+$",
            "description": "The name of the storage account."
          },
          {
            "name": "parameters",
            "in": "body",
            "required": true,
            "x-ms-client-flatten": true,
            "schema": {
              "$ref": "#/definitions/StorageAccountCreateParameters"
            },
            "description": "The parameters to create a storage account."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The created storage account.",
            "schema": {
              "$ref": "#/definitions/StorageBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "Set Storage account": {
            "$ref": "./examples/setStorageAccount.json"
          }
        }
      },
      "patch": {
        "tags": [
          "Storage"
        ],
        "operationId": "UpdateStorageAccount",
        "description": "Updates the specified attributes associated with the given storage account. This operation requires the storage/set/update permission.",
        "parameters": [
          {
            "name": "storage-account-name",
            "in": "path",
            "required": true,
            "type": "string",
            "pattern": "^[0-9a-zA-Z]+$",
            "description": "The name of the storage account."
          },
          {
            "name": "parameters",
            "in": "body",
            "required": true,
            "x-ms-client-flatten": true,
            "schema": {
              "$ref": "#/definitions/StorageAccountUpdateParameters"
            },
            "description": "The parameters to update a storage account."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The updated storage account.",
            "schema": {
              "$ref": "#/definitions/StorageBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "Update Storage account": {
            "$ref": "./examples/updateStorageAccount.json"
          }
        }
      }
    },
    "/storage/{storage-account-name}/regeneratekey": {
      "post": {
        "tags": [
          "Storage"
        ],
        "operationId": "RegenerateStorageAccountKey",
        "description": "Regenerates the specified key value for the given storage account. This operation requires the storage/regeneratekey permission.",
        "parameters": [
          {
            "name": "storage-account-name",
            "in": "path",
            "required": true,
            "type": "string",
            "pattern": "^[0-9a-zA-Z]+$",
            "description": "The name of the storage account."
          },
          {
            "name": "parameters",
            "in": "body",
            "required": true,
            "x-ms-client-flatten": true,
            "schema": {
              "$ref": "#/definitions/StorageAccountRegenerteKeyParameters"
            },
            "description": "The parameters to regenerate storage account key."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The updated storage account.",
            "schema": {
              "$ref": "#/definitions/StorageBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "Regenerate Storage account key": {
            "$ref": "./examples/regenerateStorageAccountKey.json"
          }
        }
      }
    },
    "/storage/{storage-account-name}/sas": {
      "get": {
        "tags": [
          "Storage"
        ],
        "operationId": "GetSasDefinitions",
        "description": "List storage SAS definitions for the given storage account. This operation requires the storage/listsas permission.",
        "parameters": [
          {
            "name": "storage-account-name",
            "in": "path",
            "required": true,
            "type": "string",
            "pattern": "^[0-9a-zA-Z]+$",
            "description": "The name of the storage account."
          },
          {
            "name": "maxresults",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32",
            "minimum": 1,
            "maximum": 25,
            "description": "Specifies the maximum number of results to return in a page. Setting maxresults to a value less than 1 or greater than 25 results in error response code 400 (Bad Request). If there are additional results to return, then the service returns a nextLink containing a skip token for pagination. In certain cases, the service might return fewer results than specified by maxresults (even 0 results) and also return a nextLink. Clients should not make any assumptions on the minimum number of results per page, and should enumerate all pages until the nextLink becomes null."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "A response message containing a list of SAS definitions along with a link to the next page of SAS definitions.",
            "schema": {
              "$ref": "#/definitions/SasDefinitionListResult"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        },
        "x-ms-examples": {
          "List Storage Sas Definition": {
            "$ref": "./examples/listStorageSasDefinition.json"
          }
        }
      }
    },
    "/deletedstorage/{storage-account-name}/sas": {
      "get": {
        "tags": [
          "DeletedStorage"
        ],
        "operationId": "GetDeletedSasDefinitions",
        "summary": "Lists deleted SAS definitions for the specified vault and storage account.",
        "description": "The Get Deleted Sas Definitions operation returns the SAS definitions that have been deleted for a vault enabled for soft-delete. This operation requires the storage/listsas permission.",
        "parameters": [
          {
            "name": "storage-account-name",
            "in": "path",
            "required": true,
            "type": "string",
            "pattern": "^[0-9a-zA-Z]+$",
            "description": "The name of the storage account."
          },
          {
            "name": "maxresults",
            "in": "query",
            "required": false,
            "type": "integer",
            "format": "int32",
            "minimum": 1,
            "maximum": 25,
            "description": "Specifies the maximum number of results to return in a page. Setting maxresults to a value less than 1 or greater than 25 results in error response code 400 (Bad Request). If there are additional results to return, then the service returns a nextLink containing a skip token for pagination. In certain cases, the service might return fewer results than specified by maxresults (even 0 results) and also return a nextLink. Clients should not make any assumptions on the minimum number of results per page, and should enumerate all pages until the nextLink becomes null."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "A response message containing a list of deleted SAS definitions for the storage account, along with a link to the next page of deleted SAS definitions.",
            "schema": {
              "$ref": "#/definitions/DeletedSasDefinitionListResult"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        },
        "x-ms-examples": {
          "List Deleted Storage Sas Definitions": {
            "$ref": "./examples/listDeletedStorageSasDefinition.json"
          }
        }
      }
    },
    "/deletedstorage/{storage-account-name}/sas/{sas-definition-name}": {
      "get": {
        "tags": [
          "DeletedStorage"
        ],
        "operationId": "GetDeletedSasDefinition",
        "summary": "Gets the specified deleted sas definition.",
        "description": "The Get Deleted SAS Definition operation returns the specified deleted SAS definition along with its attributes. This operation requires the storage/getsas permission.",
        "parameters": [
          {
            "name": "storage-account-name",
            "in": "path",
            "required": true,
            "type": "string",
            "pattern": "^[0-9a-zA-Z]+$",
            "description": "The name of the storage account."
          },
          {
            "name": "sas-definition-name",
            "in": "path",
            "required": true,
            "type": "string",
            "pattern": "^[0-9a-zA-Z]+$",
            "description": "The name of the SAS definition."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The deleted SAS definition and information on when the it will be purged, and how to recover the deleted SAS definition.",
            "schema": {
              "$ref": "#/definitions/DeletedSasDefinitionBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "Get Deleted Storage Sas Definition": {
            "$ref": "./examples/getDeletedStorageSasDefinition.json"
          }
        }
      }
    },
    "/deletedstorage/{storage-account-name}/sas/{sas-definition-name}/recover": {
      "post": {
        "tags": [
          "DeletedStorage"
        ],
        "operationId": "RecoverDeletedSasDefinition",
        "summary": "Recovers the deleted SAS definition.",
        "description": "Recovers the deleted SAS definition for the specified storage account. This operation can only be performed on a soft-delete enabled vault. This operation requires the storage/recover permission.",
        "parameters": [
          {
            "name": "storage-account-name",
            "in": "path",
            "required": true,
            "type": "string",
            "pattern": "^[0-9a-zA-Z]+$",
            "description": "The name of the storage account."
          },
          {
            "name": "sas-definition-name",
            "in": "path",
            "required": true,
            "type": "string",
            "pattern": "^[0-9a-zA-Z]+$",
            "description": "The name of the SAS definition."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "A SAS definition bundle of the original SAS definition and its attributes.",
            "schema": {
              "$ref": "#/definitions/SasDefinitionBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "Recover Deleted Storage Sas Definition": {
            "$ref": "./examples/recoverStorageSasDefinition.json"
          }
        }
      }
    },
    "/storage/{storage-account-name}/sas/{sas-definition-name}": {
      "delete": {
        "tags": [
          "Storage"
        ],
        "operationId": "DeleteSasDefinition",
        "description": "Deletes a SAS definition from a specified storage account. This operation requires the storage/deletesas permission.",
        "parameters": [
          {
            "name": "storage-account-name",
            "in": "path",
            "required": true,
            "type": "string",
            "pattern": "^[0-9a-zA-Z]+$",
            "description": "The name of the storage account."
          },
          {
            "name": "sas-definition-name",
            "in": "path",
            "required": true,
            "type": "string",
            "pattern": "^[0-9a-zA-Z]+$",
            "description": "The name of the SAS definition."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The deleted SAS definition and information on when the SAS definition will be deleted, and how to recover the deleted SAS definition.",
            "schema": {
              "$ref": "#/definitions/DeletedSasDefinitionBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "Delete Storage Sas Definition": {
            "$ref": "./examples/deleteStorageSasDefinition.json"
          }
        }
      },
      "get": {
        "tags": [
          "Storage"
        ],
        "operationId": "GetSasDefinition",
        "description": "Gets information about a SAS definition for the specified storage account. This operation requires the storage/getsas permission.",
        "parameters": [
          {
            "name": "storage-account-name",
            "in": "path",
            "required": true,
            "type": "string",
            "pattern": "^[0-9a-zA-Z]+$",
            "description": "The name of the storage account."
          },
          {
            "name": "sas-definition-name",
            "in": "path",
            "required": true,
            "type": "string",
            "pattern": "^[0-9a-zA-Z]+$",
            "description": "The name of the SAS definition."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The retrieved SAS definition.",
            "schema": {
              "$ref": "#/definitions/SasDefinitionBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "Get Storage Sas Definition": {
            "$ref": "./examples/getStorageSasDefinition.json"
          }
        }
      },
      "put": {
        "tags": [
          "Storage"
        ],
        "operationId": "SetSasDefinition",
        "description": "Creates or updates a new SAS definition for the specified storage account. This operation requires the storage/setsas permission.",
        "parameters": [
          {
            "name": "storage-account-name",
            "in": "path",
            "required": true,
            "type": "string",
            "pattern": "^[0-9a-zA-Z]+$",
            "description": "The name of the storage account."
          },
          {
            "name": "sas-definition-name",
            "in": "path",
            "required": true,
            "type": "string",
            "pattern": "^[0-9a-zA-Z]+$",
            "description": "The name of the SAS definition."
          },
          {
            "name": "parameters",
            "in": "body",
            "required": true,
            "x-ms-client-flatten": true,
            "schema": {
              "$ref": "#/definitions/SasDefinitionCreateParameters"
            },
            "description": "The parameters to create a SAS definition."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The created SAS definition.",
            "schema": {
              "$ref": "#/definitions/SasDefinitionBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "Set Storage Sas definition": {
            "$ref": "./examples/setStorageSasDefinition.json"
          }
        }
      },
      "patch": {
        "tags": [
          "Storage"
        ],
        "operationId": "UpdateSasDefinition",
        "description": "Updates the specified attributes associated with the given SAS definition. This operation requires the storage/setsas permission.",
        "parameters": [
          {
            "name": "storage-account-name",
            "in": "path",
            "required": true,
            "type": "string",
            "pattern": "^[0-9a-zA-Z]+$",
            "description": "The name of the storage account."
          },
          {
            "name": "sas-definition-name",
            "in": "path",
            "required": true,
            "type": "string",
            "pattern": "^[0-9a-zA-Z]+$",
            "description": "The name of the SAS definition."
          },
          {
            "name": "parameters",
            "in": "body",
            "required": true,
            "x-ms-client-flatten": true,
            "schema": {
              "$ref": "#/definitions/SasDefinitionUpdateParameters"
            },
            "description": "The parameters to update a SAS definition."
          },
          {
            "$ref": "#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "The updated SAS definition.",
            "schema": {
              "$ref": "#/definitions/SasDefinitionBundle"
            }
          },
          "default": {
            "description": "Key Vault error response describing why the operation failed.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "Update Storage Sas definition": {
            "$ref": "./examples/updateStorageSasDefinition.json"
          }
        }
      }
    }
  },
  "definitions": {
    "Attributes": {
      "properties": {
        "enabled": {
          "type": "boolean",
          "description": "Determines whether the object is enabled."
        },
        "nbf": {
          "x-ms-client-name": "NotBefore",
          "type": "integer",
          "format": "unixtime",
          "description": "Not before date in UTC."
        },
        "exp": {
          "x-ms-client-name": "Expires",
          "type": "integer",
          "format": "unixtime",
          "description": "Expiry date in UTC."
        },
        "created": {
          "type": "integer",
          "format": "unixtime",
          "readOnly": true,
          "description": "Creation time in UTC."
        },
        "updated": {
          "type": "integer",
          "format": "unixtime",
          "readOnly": true,
          "description": "Last updated time in UTC."
        }
      },
      "description": "The object attributes managed by the KeyVault service."
    },
    "JsonWebKey": {
      "properties": {
        "kid": {
          "type": "string",
          "description": "Key identifier."
        },
        "kty": {
          "type": "string",
          "description": "JsonWebKey Key Type (kty), as defined in https://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-40.",
          "enum": [
            "EC",
            "EC-HSM",
            "RSA",
            "RSA-HSM",
            "oct"
          ],
          "x-ms-enum": {
            "name": "JsonWebKeyType",
            "modelAsString": true,
            "values": [
              {
                "value": "EC",
                "description": "Elliptic Curve."
              },
              {
                "value": "EC-HSM",
                "description": "Elliptic Curve with a private key which is not exportable from the HSM."
              },
              {
                "value": "RSA",
                "description": "RSA (https://tools.ietf.org/html/rfc3447)"
              },
              {
                "value": "RSA-HSM",
                "description": "RSA with a private key which is not exportable from the HSM."
              },
              {
                "value": "oct",
                "description": "Octet sequence (used to represent symmetric keys)"
              }
            ]
          }
        },
        "key_ops": {
          "type": "array",
          "items": {
            "type": "string",
            "description": "Supported key operations."
          }
        },
        "n": {
          "type": "string",
          "format": "base64url",
          "description": "RSA modulus."
        },
        "e": {
          "type": "string",
          "format": "base64url",
          "description": "RSA public exponent."
        },
        "d": {
          "type": "string",
          "format": "base64url",
          "description": "RSA private exponent, or the D component of an EC private key."
        },
        "dp": {
          "x-ms-client-name": "DP",
          "type": "string",
          "format": "base64url",
          "description": "RSA private key parameter."
        },
        "dq": {
          "x-ms-client-name": "DQ",
          "type": "string",
          "format": "base64url",
          "description": "RSA private key parameter."
        },
        "qi": {
          "x-ms-client-name": "QI",
          "type": "string",
          "format": "base64url",
          "description": "RSA private key parameter."
        },
        "p": {
          "type": "string",
          "format": "base64url",
          "description": "RSA secret prime."
        },
        "q": {
          "type": "string",
          "format": "base64url",
          "description": "RSA secret prime, with p < q."
        },
        "k": {
          "type": "string",
          "format": "base64url",
          "description": "Symmetric key."
        },
        "key_hsm": {
          "x-ms-client-name": "t",
          "type": "string",
          "format": "base64url",
          "description": "HSM Token, used with 'Bring Your Own Key'."
        },
        "crv": {
          "type": "string",
          "description": "Elliptic curve name. For valid values, see JsonWebKeyCurveName.",
          "enum": [
            "P-256",
            "P-384",
            "P-521",
            "P-256K"
          ],
          "x-ms-enum": {
            "name": "JsonWebKeyCurveName",
            "modelAsString": true,
            "values": [
              {
                "value": "P-256",
                "description": "The NIST P-256 elliptic curve, AKA SECG curve SECP256R1."
              },
              {
                "value": "P-384",
                "description": "The NIST P-384 elliptic curve, AKA SECG curve SECP384R1."
              },
              {
                "value": "P-521",
                "description": "The NIST P-521 elliptic curve, AKA SECG curve SECP521R1."
              },
              {
                "value": "P-256K",
                "description": "The SECG SECP256K1 elliptic curve."
              }
            ]
          }
        },
        "x": {
          "type": "string",
          "format": "base64url",
          "description": "X component of an EC public key."
        },
        "y": {
          "type": "string",
          "format": "base64url",
          "description": "Y component of an EC public key."
        }
      },
      "description": "As of http://tools.ietf.org/html/draft-ietf-jose-json-web-key-18"
    },
    "KeyAttributes": {
      "allOf": [
        {
          "$ref": "#/definitions/Attributes"
        }
      ],
      "properties": {
        "recoveryLevel": {
          "type": "string",
          "description": "Reflects the deletion recovery level currently in effect for keys in the current vault. If it contains 'Purgeable' the key can be permanently deleted by a privileged user; otherwise, only the system can purge the key, at the end of the retention interval.",
          "enum": [
            "Purgeable",
            "Recoverable+Purgeable",
            "Recoverable",
            "Recoverable+ProtectedSubscription"
          ],
          "x-ms-enum": {
            "name": "DeletionRecoveryLevel",
            "modelAsString": true
          },
          "readOnly": true,
          "x-nullable": false
        }
      },
      "description": "The attributes of a key managed by the key vault service."
    },
    "KeyBundle": {
      "properties": {
        "key": {
          "$ref": "#/definitions/JsonWebKey",
          "description": "The Json web key."
        },
        "attributes": {
          "$ref": "#/definitions/KeyAttributes",
          "description": "The key management attributes."
        },
        "tags": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          },
          "description": "Application specific metadata in the form of key-value pairs."
        },
        "managed": {
          "type": "boolean",
          "readOnly": true,
          "description": "True if the key's lifetime is managed by key vault. If this is a key backing a certificate, then managed will be true."
        }
      },
      "description": "A KeyBundle consisting of a WebKey plus its attributes."
    },
    "KeyItem": {
      "properties": {
        "kid": {
          "type": "string",
          "description": "Key identifier."
        },
        "attributes": {
          "$ref": "#/definitions/KeyAttributes",
          "description": "The key management attributes."
        },
        "tags": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          },
          "description": "Application specific metadata in the form of key-value pairs."
        },
        "managed": {
          "type": "boolean",
          "readOnly": true,
          "description": "True if the key's lifetime is managed by key vault. If this is a key backing a certificate, then managed will be true."
        }
      },
      "description": "The key item containing key metadata."
    },
    "DeletedKeyBundle": {
      "allOf": [
        {
          "$ref": "#/definitions/KeyBundle"
        }
      ],
      "properties": {
        "recoveryId": {
          "type": "string",
          "description": "The url of the recovery object, used to identify and recover the deleted key."
        },
        "scheduledPurgeDate": {
          "type": "integer",
          "format": "unixtime",
          "readOnly": true,
          "description": "The time when the key is scheduled to be purged, in UTC"
        },
        "deletedDate": {
          "type": "integer",
          "format": "unixtime",
          "readOnly": true,
          "description": "The time when the key was deleted, in UTC"
        }
      },
      "description": "A DeletedKeyBundle consisting of a WebKey plus its Attributes and deletion info"
    },
    "DeletedKeyItem": {
      "allOf": [
        {
          "$ref": "#/definitions/KeyItem"
        }
      ],
      "properties": {
        "recoveryId": {
          "type": "string",
          "description": "The url of the recovery object, used to identify and recover the deleted key."
        },
        "scheduledPurgeDate": {
          "type": "integer",
          "format": "unixtime",
          "readOnly": true,
          "description": "The time when the key is scheduled to be purged, in UTC"
        },
        "deletedDate": {
          "type": "integer",
          "format": "unixtime",
          "readOnly": true,
          "description": "The time when the key was deleted, in UTC"
        }
      },
      "description": "The deleted key item containing the deleted key metadata and information about deletion."
    },
    "SecretBundle": {
      "properties": {
        "value": {
          "type": "string",
          "description": "The secret value."
        },
        "id": {
          "type": "string",
          "description": "The secret id."
        },
        "contentType": {
          "type": "string",
          "description": "The content type of the secret."
        },
        "attributes": {
          "$ref": "#/definitions/SecretAttributes",
          "description": "The secret management attributes."
        },
        "tags": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          },
          "description": "Application specific metadata in the form of key-value pairs."
        },
        "kid": {
          "type": "string",
          "readOnly": true,
          "description": "If this is a secret backing a KV certificate, then this field specifies the corresponding key backing the KV certificate."
        },
        "managed": {
          "type": "boolean",
          "readOnly": true,
          "description": "True if the secret's lifetime is managed by key vault. If this is a secret backing a certificate, then managed will be true."
        }
      },
      "description": "A secret consisting of a value, id and its attributes."
    },
    "SecretItem": {
      "properties": {
        "id": {
          "type": "string",
          "description": "Secret identifier."
        },
        "attributes": {
          "$ref": "#/definitions/SecretAttributes",
          "description": "The secret management attributes."
        },
        "tags": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          },
          "description": "Application specific metadata in the form of key-value pairs."
        },
        "contentType": {
          "type": "string",
          "description": "Type of the secret value such as a password."
        },
        "managed": {
          "type": "boolean",
          "readOnly": true,
          "description": "True if the secret's lifetime is managed by key vault. If this is a key backing a certificate, then managed will be true."
        }
      },
      "description": "The secret item containing secret metadata."
    },
    "DeletedSecretBundle": {
      "allOf": [
        {
          "$ref": "#/definitions/SecretBundle"
        }
      ],
      "properties": {
        "recoveryId": {
          "type": "string",
          "description": "The url of the recovery object, used to identify and recover the deleted secret."
        },
        "scheduledPurgeDate": {
          "type": "integer",
          "format": "unixtime",
          "readOnly": true,
          "description": "The time when the secret is scheduled to be purged, in UTC"
        },
        "deletedDate": {
          "type": "integer",
          "format": "unixtime",
          "readOnly": true,
          "description": "The time when the secret was deleted, in UTC"
        }
      },
      "description": "A Deleted Secret consisting of its previous id, attributes and its tags, as well as information on when it will be purged."
    },
    "DeletedSecretItem": {
      "allOf": [
        {
          "$ref": "#/definitions/SecretItem"
        }
      ],
      "properties": {
        "recoveryId": {
          "type": "string",
          "description": "The url of the recovery object, used to identify and recover the deleted secret."
        },
        "scheduledPurgeDate": {
          "type": "integer",
          "format": "unixtime",
          "readOnly": true,
          "description": "The time when the secret is scheduled to be purged, in UTC"
        },
        "deletedDate": {
          "type": "integer",
          "format": "unixtime",
          "readOnly": true,
          "description": "The time when the secret was deleted, in UTC"
        }
      },
      "description": "The deleted secret item containing metadata about the deleted secret."
    },
    "SecretAttributes": {
      "allOf": [
        {
          "$ref": "#/definitions/Attributes"
        }
      ],
      "properties": {
        "recoveryLevel": {
          "type": "string",
          "description": "Reflects the deletion recovery level currently in effect for secrets in the current vault. If it contains 'Purgeable', the secret can be permanently deleted by a privileged user; otherwise, only the system can purge the secret, at the end of the retention interval.",
          "enum": [
            "Purgeable",
            "Recoverable+Purgeable",
            "Recoverable",
            "Recoverable+ProtectedSubscription"
          ],
          "x-ms-enum": {
            "name": "DeletionRecoveryLevel",
            "modelAsString": true
          },
          "readOnly": true,
          "x-nullable": false
        }
      },
      "description": "The secret management attributes."
    },
    "SecretRestoreParameters": {
      "properties": {
        "value": {
          "type": "string",
          "x-ms-client-name": "secretBundleBackup",
          "format": "base64url",
          "description": "The backup blob associated with a secret bundle."
        }
      },
      "description": "The secret restore parameters.",
      "required": [
        "value"
      ]
    },
    "StorageRestoreParameters": {
      "properties": {
        "value": {
          "type": "string",
          "x-ms-client-name": "storageBundleBackup",
          "format": "base64url",
          "description": "The backup blob associated with a storage account."
        }
      },
      "description": "The secret restore parameters.",
      "required": [
        "value"
      ]
    },
    "CertificateAttributes": {
      "allOf": [
        {
          "$ref": "#/definitions/Attributes"
        }
      ],
      "properties": {
        "recoveryLevel": {
          "type": "string",
          "description": "Reflects the deletion recovery level currently in effect for certificates in the current vault. If it contains 'Purgeable', the certificate can be permanently deleted by a privileged user; otherwise, only the system can purge the certificate, at the end of the retention interval.",
          "enum": [
            "Purgeable",
            "Recoverable+Purgeable",
            "Recoverable",
            "Recoverable+ProtectedSubscription"
          ],
          "x-ms-enum": {
            "name": "DeletionRecoveryLevel",
            "modelAsString": true
          },
          "readOnly": true,
          "x-nullable": false
        }
      },
      "description": "The certificate management attributes."
    },
    "CertificateItem": {
      "properties": {
        "id": {
          "type": "string",
          "description": "Certificate identifier."
        },
        "attributes": {
          "$ref": "#/definitions/CertificateAttributes",
          "description": "The certificate management attributes."
        },
        "tags": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          },
          "description": "Application specific metadata in the form of key-value pairs."
        },
        "x5t": {
          "x-ms-client-name": "X509Thumbprint",
          "type": "string",
          "format": "base64url",
          "description": "Thumbprint of the certificate."
        }
      },
      "description": "The certificate item containing certificate metadata."
    },
    "CertificateIssuerItem": {
      "properties": {
        "id": {
          "type": "string",
          "description": "Certificate Identifier."
        },
        "provider": {
          "type": "string",
          "description": "The issuer provider."
        }
      },
      "description": "The certificate issuer item containing certificate issuer metadata."
    },
    "CertificateBundle": {
      "properties": {
        "id": {
          "type": "string",
          "description": "The certificate id.",
          "readOnly": true
        },
        "kid": {
          "type": "string",
          "description": "The key id.",
          "readOnly": true
        },
        "sid": {
          "type": "string",
          "description": "The secret id.",
          "readOnly": true
        },
        "x5t": {
          "x-ms-client-name": "X509Thumbprint",
          "type": "string",
          "format": "base64url",
          "description": "Thumbprint of the certificate.",
          "readOnly": true
        },
        "policy": {
          "$ref": "#/definitions/CertificatePolicy",
          "description": "The management policy.",
          "readOnly": true
        },
        "cer": {
          "type": "string",
          "format": "byte",
          "description": "CER contents of x509 certificate."
        },
        "contentType": {
          "type": "string",
          "description": "The content type of the secret."
        },
        "attributes": {
          "$ref": "#/definitions/CertificateAttributes",
          "description": "The certificate attributes."
        },
        "tags": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          },
          "description": "Application specific metadata in the form of key-value pairs"
        }
      },
      "description": "A certificate bundle consists of a certificate (X509) plus its attributes."
    },
    "DeletedCertificateBundle": {
      "allOf": [
        {
          "$ref": "#/definitions/CertificateBundle"
        }
      ],
      "properties": {
        "recoveryId": {
          "type": "string",
          "description": "The url of the recovery object, used to identify and recover the deleted certificate."
        },
        "scheduledPurgeDate": {
          "type": "integer",
          "format": "unixtime",
          "readOnly": true,
          "description": "The time when the certificate is scheduled to be purged, in UTC"
        },
        "deletedDate": {
          "type": "integer",
          "format": "unixtime",
          "readOnly": true,
          "description": "The time when the certificate was deleted, in UTC"
        }
      },
      "description": "A Deleted Certificate consisting of its previous id, attributes and its tags, as well as information on when it will be purged."
    },
    "DeletedCertificateItem": {
      "allOf": [
        {
          "$ref": "#/definitions/CertificateItem"
        }
      ],
      "properties": {
        "recoveryId": {
          "type": "string",
          "description": "The url of the recovery object, used to identify and recover the deleted certificate."
        },
        "scheduledPurgeDate": {
          "type": "integer",
          "format": "unixtime",
          "readOnly": true,
          "description": "The time when the certificate is scheduled to be purged, in UTC"
        },
        "deletedDate": {
          "type": "integer",
          "format": "unixtime",
          "readOnly": true,
          "description": "The time when the certificate was deleted, in UTC"
        }
      },
      "description": "The deleted certificate item containing metadata about the deleted certificate."
    },
    "CertificateOperation": {
      "properties": {
        "id": {
          "type": "string",
          "description": "The certificate id.",
          "readOnly": true
        },
        "issuer": {
          "x-ms-client-name": "IssuerParameters",
          "$ref": "#/definitions/IssuerParameters",
          "description": "Parameters for the issuer of the X509 component of a certificate."
        },
        "csr": {
          "type": "string",
          "format": "byte",
          "description": "The certificate signing request (CSR) that is being used in the certificate operation."
        },
        "cancellation_requested": {
          "type": "boolean",
          "description": "Indicates if cancellation was requested on the certificate operation."
        },
        "status": {
          "type": "string",
          "description": "Status of the certificate operation."
        },
        "status_details": {
          "type": "string",
          "description": "The status details of the certificate operation."
        },
        "error": {
          "$ref": "#/definitions/Error",
          "description": "Error encountered, if any, during the certificate operation."
        },
        "target": {
          "type": "string",
          "description": "Location which contains the result of the certificate operation."
        },
        "request_id": {
          "type": "string",
          "description": "Identifier for the certificate operation."
        }
      },
      "description": "A certificate operation is returned in case of asynchronous requests."
    },
    "CertificatePolicy": {
      "properties": {
        "id": {
          "type": "string",
          "description": "The certificate id.",
          "readOnly": true
        },
        "key_props": {
          "x-ms-client-name": "KeyProperties",
          "$ref": "#/definitions/KeyProperties",
          "description": "Properties of the key backing a certificate."
        },
        "secret_props": {
          "x-ms-client-name": "SecretProperties",
          "$ref": "#/definitions/SecretProperties",
          "description": "Properties of the secret backing a certificate."
        },
        "x509_props": {
          "x-ms-client-name": "X509CertificateProperties",
          "$ref": "#/definitions/X509CertificateProperties",
          "description": "Properties of the X509 component of a certificate."
        },
        "lifetime_actions": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/LifetimeAction"
          },
          "description": "Actions that will be performed by Key Vault over the lifetime of a certificate."
        },
        "issuer": {
          "x-ms-client-name": "IssuerParameters",
          "$ref": "#/definitions/IssuerParameters",
          "description": "Parameters for the issuer of the X509 component of a certificate."
        },
        "attributes": {
          "$ref": "#/definitions/CertificateAttributes",
          "description": "The certificate attributes."
        }
      },
      "description": "Management policy for a certificate."
    },
    "KeyProperties": {
      "properties": {
        "exportable": {
          "type": "boolean",
          "description": "Indicates if the private key can be exported."
        },
        "kty": {
          "x-ms-client-name": "keyType",
          "type": "string",
          "description": "The type of key pair to be used for the certificate.",
          "enum": [
            "EC",
            "EC-HSM",
            "RSA",
            "RSA-HSM",
            "oct"
          ],
          "x-ms-enum": {
            "name": "JsonWebKeyType",
            "modelAsString": true
          }
        },
        "key_size": {
          "type": "integer",
          "format": "int32",
          "description": "The key size in bits. For example: 2048, 3072, or 4096 for RSA."
        },
        "reuse_key": {
          "type": "boolean",
          "description": "Indicates if the same key pair will be used on certificate renewal."
        },
        "crv": {
          "x-ms-client-name": "curve",
          "type": "string",
          "description": "Elliptic curve name. For valid values, see JsonWebKeyCurveName.",
          "enum": [
            "P-256",
            "P-384",
            "P-521",
            "P-256K"
          ],
          "x-ms-enum": {
            "name": "JsonWebKeyCurveName",
            "modelAsString": true
          }
        }
      },
      "description": "Properties of the key pair backing a certificate."
    },
    "SecretProperties": {
      "properties": {
        "contentType": {
          "type": "string",
          "description": "The media type (MIME type)."
        }
      },
      "description": "Properties of the key backing a certificate."
    },
    "X509CertificateProperties": {
      "properties": {
        "subject": {
          "type": "string",
          "description": "The subject name. Should be a valid X509 distinguished Name."
        },
        "ekus": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "The enhanced key usage."
        },
        "sans": {
          "x-ms-client-name": "SubjectAlternativeNames",
          "$ref": "#/definitions/SubjectAlternativeNames",
          "description": "The subject alternative names."
        },
        "key_usage": {
          "type": "array",
          "items": {
            "type": "string",
            "enum": [
              "digitalSignature",
              "nonRepudiation",
              "keyEncipherment",
              "dataEncipherment",
              "keyAgreement",
              "keyCertSign",
              "cRLSign",
              "encipherOnly",
              "decipherOnly"
            ],
            "x-ms-enum": {
              "name": "KeyUsageType",
              "modelAsString": true
            }
          },
          "description": "List of key usages."
        },
        "validity_months": {
          "x-ms-client-name": "ValidityInMonths",
          "type": "integer",
          "format": "int32",
          "minimum": 0,
          "description": "The duration that the certificate is valid in months."
        }
      },
      "description": "Properties of the X509 component of a certificate."
    },
    "IssuerParameters": {
      "properties": {
        "name": {
          "type": "string",
          "description": "Name of the referenced issuer object or reserved names; for example, 'Self' or 'Unknown'."
        },
        "cty": {
          "x-ms-client-name": "CertificateType",
          "type": "string",
          "description": "Certificate type as supported by the provider (optional); for example 'OV-SSL', 'EV-SSL'"
        },
        "cert_transparency": {
          "x-ms-client-name": "CertificateTransparency",
          "type": "boolean",
          "description": "Indicates if the certificates generated under this policy should be published to certificate transparency logs."
        }
      },
      "description": "Parameters for the issuer of the X509 component of a certificate."
    },
    "LifetimeAction": {
      "properties": {
        "trigger": {
          "$ref": "#/definitions/Trigger",
          "description": "The condition that will execute the action."
        },
        "action": {
          "$ref": "#/definitions/Action",
          "description": "The action that will be executed."
        }
      },
      "description": "Action and its trigger that will be performed by Key Vault over the lifetime of a certificate."
    },
    "Action": {
      "properties": {
        "action_type": {
          "type": "string",
          "description": "The type of the action.",
          "enum": [
            "EmailContacts",
            "AutoRenew"
          ],
          "x-ms-enum": {
            "name": "ActionType",
            "modelAsString": false
          }
        }
      },
      "description": "The action that will be executed."
    },
    "Trigger": {
      "properties": {
        "lifetime_percentage": {
          "type": "integer",
          "format": "int32",
          "minimum": 1,
          "maximum": 99,
          "description": "Percentage of lifetime at which to trigger. Value should be between 1 and 99."
        },
        "days_before_expiry": {
          "type": "integer",
          "format": "int32",
          "description": "Days before expiry to attempt renewal. Value should be between 1 and validity_in_months multiplied by 27. If validity_in_months is 36, then value should be between 1 and 972 (36 * 27)."
        }
      },
      "description": "A condition to be satisfied for an action to be executed."
    },
    "SubjectAlternativeNames": {
      "properties": {
        "emails": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Email addresses."
        },
        "dns_names": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Domain names."
        },
        "upns": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "User principal names."
        }
      },
      "description": "The subject alternate names of a X509 object."
    },
    "IssuerBundle": {
      "properties": {
        "id": {
          "type": "string",
          "description": "Identifier for the issuer object.",
          "readOnly": true
        },
        "provider": {
          "type": "string",
          "description": "The issuer provider."
        },
        "credentials": {
          "$ref": "#/definitions/IssuerCredentials",
          "description": "The credentials to be used for the issuer."
        },
        "org_details": {
          "x-ms-client-name": "OrganizationDetails",
          "$ref": "#/definitions/OrganizationDetails",
          "description": "Details of the organization as provided to the issuer."
        },
        "attributes": {
          "$ref": "#/definitions/IssuerAttributes",
          "description": "Attributes of the issuer object."
        }
      },
      "description": "The issuer for Key Vault certificate."
    },
    "IssuerAttributes": {
      "properties": {
        "enabled": {
          "type": "boolean",
          "description": "Determines whether the issuer is enabled."
        },
        "created": {
          "type": "integer",
          "format": "unixtime",
          "readOnly": true,
          "description": "Creation time in UTC."
        },
        "updated": {
          "type": "integer",
          "format": "unixtime",
          "readOnly": true,
          "description": "Last updated time in UTC."
        }
      },
      "description": "The attributes of an issuer managed by the Key Vault service."
    },
    "IssuerCredentials": {
      "properties": {
        "account_id": {
          "type": "string",
          "description": "The user name/account name/account id."
        },
        "pwd": {
          "x-ms-client-name": "Password",
          "type": "string",
          "description": "The password/secret/account key."
        }
      },
      "description": "The credentials to be used for the certificate issuer."
    },
    "OrganizationDetails": {
      "properties": {
        "id": {
          "type": "string",
          "description": "Id of the organization."
        },
        "admin_details": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/AdministratorDetails"
          },
          "description": "Details of the organization administrator."
        }
      },
      "description": "Details of the organization of the certificate issuer."
    },
    "AdministratorDetails": {
      "properties": {
        "first_name": {
          "type": "string",
          "description": "First name."
        },
        "last_name": {
          "type": "string",
          "description": "Last name."
        },
        "email": {
          "x-ms-client-name": "EmailAddress",
          "type": "string",
          "description": "Email address."
        },
        "phone": {
          "type": "string",
          "description": "Phone number."
        }
      },
      "description": "Details of the organization administrator of the certificate issuer."
    },
    "Contacts": {
      "properties": {
        "id": {
          "type": "string",
          "description": "Identifier for the contacts collection.",
          "readOnly": true
        },
        "contacts": {
          "x-ms-client-name": "ContactList",
          "type": "array",
          "items": {
            "$ref": "#/definitions/Contact"
          },
          "description": "The contact list for the vault certificates."
        }
      },
      "description": "The contacts for the vault certificates."
    },
    "Contact": {
      "properties": {
        "email": {
          "x-ms-client-name": "EmailAddress",
          "type": "string",
          "description": "Email address."
        },
        "name": {
          "type": "string",
          "description": "Name."
        },
        "phone": {
          "type": "string",
          "description": "Phone number."
        }
      },
      "description": "The contact information for the vault certificates."
    },
    "KeyCreateParameters": {
      "properties": {
        "kty": {
          "type": "string",
          "minLength": 1,
          "description": "The type of key to create. For valid values, see JsonWebKeyType.",
          "enum": [
            "EC",
            "EC-HSM",
            "RSA",
            "RSA-HSM",
            "oct"
          ],
          "x-ms-enum": {
            "name": "JsonWebKeyType",
            "modelAsString": true
          }
        },
        "key_size": {
          "type": "integer",
          "format": "int32",
          "description": "The key size in bits. For example: 2048, 3072, or 4096 for RSA."
        },
        "key_ops": {
          "type": "array",
          "items": {
            "type": "string",
            "description": "JSON web key operations. For more information, see JsonWebKeyOperation.",
            "enum": [
              "encrypt",
              "decrypt",
              "sign",
              "verify",
              "wrapKey",
              "unwrapKey"
            ],
            "x-ms-enum": {
              "name": "JsonWebKeyOperation",
              "modelAsString": true
            }
          }
        },
        "attributes": {
          "x-ms-client-name": "keyAttributes",
          "$ref": "#/definitions/KeyAttributes"
        },
        "tags": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          },
          "description": "Application specific metadata in the form of key-value pairs."
        },
        "crv": {
          "x-ms-client-name": "curve",
          "type": "string",
          "description": "Elliptic curve name. For valid values, see JsonWebKeyCurveName.",
          "enum": [
            "P-256",
            "P-384",
            "P-521",
            "P-256K"
          ],
          "x-ms-enum": {
            "name": "JsonWebKeyCurveName",
            "modelAsString": true
          }
        }
      },
      "description": "The key create parameters.",
      "required": [
        "kty"
      ]
    },
    "KeyImportParameters": {
      "properties": {
        "Hsm": {
          "type": "boolean",
          "description": "Whether to import as a hardware key (HSM) or software key."
        },
        "key": {
          "$ref": "#/definitions/JsonWebKey",
          "description": "The Json web key"
        },
        "attributes": {
          "x-ms-client-name": "keyAttributes",
          "$ref": "#/definitions/KeyAttributes",
          "description": "The key management attributes."
        },
        "tags": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          },
          "description": "Application specific metadata in the form of key-value pairs."
        }
      },
      "description": "The key import parameters.",
      "required": [
        "key"
      ]
    },
    "KeyOperationsParameters": {
      "properties": {
        "alg": {
          "x-ms-client-name": "algorithm",
          "type": "string",
          "minLength": 1,
          "description": "algorithm identifier",
          "enum": [
            "RSA-OAEP",
            "RSA-OAEP-256",
            "RSA1_5"
          ],
          "x-ms-enum": {
            "name": "JsonWebKeyEncryptionAlgorithm",
            "modelAsString": true
          }
        },
        "value": {
          "type": "string",
          "format": "base64url"
        }
      },
      "description": "The key operations parameters.",
      "required": [
        "alg",
        "value"
      ]
    },
    "KeySignParameters": {
      "properties": {
        "alg": {
          "x-ms-client-name": "algorithm",
          "type": "string",
          "minLength": 1,
          "description": "The signing/verification algorithm identifier. For more information on possible algorithm types, see JsonWebKeySignatureAlgorithm.",
          "enum": [
            "PS256",
            "PS384",
            "PS512",
            "RS256",
            "RS384",
            "RS512",
            "RSNULL",
            "ES256",
            "ES384",
            "ES512",
            "ES256K"
          ],
          "x-ms-enum": {
            "name": "JsonWebKeySignatureAlgorithm",
            "modelAsString": true,
            "values": [
              {
                "value": "PS256",
                "description": "RSASSA-PSS using SHA-256 and MGF1 with SHA-256, as described in https://tools.ietf.org/html/rfc7518"
              },
              {
                "value": "PS384",
                "description": "RSASSA-PSS using SHA-384 and MGF1 with SHA-384, as described in https://tools.ietf.org/html/rfc7518"
              },
              {
                "value": "PS512",
                "description": "RSASSA-PSS using SHA-512 and MGF1 with SHA-512, as described in https://tools.ietf.org/html/rfc7518"
              },
              {
                "value": "RS256",
                "description": "RSASSA-PKCS1-v1_5 using SHA-256, as described in https://tools.ietf.org/html/rfc7518"
              },
              {
                "value": "RS384",
                "description": "RSASSA-PKCS1-v1_5 using SHA-384, as described in https://tools.ietf.org/html/rfc7518"
              },
              {
                "value": "RS512",
                "description": "RSASSA-PKCS1-v1_5 using SHA-512, as described in https://tools.ietf.org/html/rfc7518"
              },
              {
                "value": "RSNULL",
                "description": "Reserved"
              },
              {
                "value": "ES256",
                "description": "ECDSA using P-256 and SHA-256, as described in https://tools.ietf.org/html/rfc7518."
              },
              {
                "value": "ES384",
                "description": "ECDSA using P-384 and SHA-384, as described in https://tools.ietf.org/html/rfc7518"
              },
              {
                "value": "ES512",
                "description": "ECDSA using P-521 and SHA-512, as described in https://tools.ietf.org/html/rfc7518"
              },
              {
                "value": "ES256K",
                "description": "ECDSA using P-256K and SHA-256, as described in https://tools.ietf.org/html/rfc7518"
              }
            ]
          }
        },
        "value": {
          "type": "string",
          "format": "base64url"
        }
      },
      "description": "The key operations parameters.",
      "required": [
        "alg",
        "value"
      ]
    },
    "KeyVerifyParameters": {
      "properties": {
        "alg": {
          "x-ms-client-name": "algorithm",
          "type": "string",
          "minLength": 1,
          "description": "The signing/verification algorithm. For more information on possible algorithm types, see JsonWebKeySignatureAlgorithm.",
          "enum": [
            "PS256",
            "PS384",
            "PS512",
            "RS256",
            "RS384",
            "RS512",
            "RSNULL",
            "ES256",
            "ES384",
            "ES512",
            "ES256K"
          ],
          "x-ms-enum": {
            "name": "JsonWebKeySignatureAlgorithm",
            "modelAsString": true
          }
        },
        "digest": {
          "type": "string",
          "format": "base64url",
          "description": "The digest used for signing."
        },
        "value": {
          "x-ms-client-name": "signature",
          "type": "string",
          "format": "base64url",
          "description": "The signature to be verified."
        }
      },
      "description": "The key verify parameters.",
      "required": [
        "alg",
        "digest",
        "value"
      ]
    },
    "KeyUpdateParameters": {
      "properties": {
        "key_ops": {
          "type": "array",
          "items": {
            "type": "string",
            "enum": [
              "encrypt",
              "decrypt",
              "sign",
              "verify",
              "wrapKey",
              "unwrapKey"
            ],
            "x-ms-enum": {
              "name": "JsonWebKeyOperation",
              "modelAsString": true
            }
          },
          "description": "Json web key operations. For more information on possible key operations, see JsonWebKeyOperation."
        },
        "attributes": {
          "x-ms-client-name": "keyAttributes",
          "$ref": "#/definitions/KeyAttributes"
        },
        "tags": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          },
          "description": "Application specific metadata in the form of key-value pairs."
        }
      },
      "description": "The key update parameters."
    },
    "KeyRestoreParameters": {
      "properties": {
        "value": {
          "type": "string",
          "x-ms-client-name": "keyBundleBackup",
          "format": "base64url",
          "description": "The backup blob associated with a key bundle."
        }
      },
      "description": "The key restore parameters.",
      "required": [
        "value"
      ]
    },
    "SecretSetParameters": {
      "properties": {
        "value": {
          "type": "string",
          "description": "The value of the secret."
        },
        "tags": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          },
          "description": "Application specific metadata in the form of key-value pairs."
        },
        "contentType": {
          "type": "string",
          "description": "Type of the secret value such as a password."
        },
        "attributes": {
          "x-ms-client-name": "secretAttributes",
          "$ref": "#/definitions/SecretAttributes",
          "description": "The secret management attributes."
        }
      },
      "description": "The secret set parameters.",
      "required": [
        "value"
      ]
    },
    "SecretUpdateParameters": {
      "properties": {
        "contentType": {
          "type": "string",
          "description": "Type of the secret value such as a password."
        },
        "attributes": {
          "x-ms-client-name": "secretAttributes",
          "$ref": "#/definitions/SecretAttributes",
          "description": "The secret management attributes."
        },
        "tags": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          },
          "description": "Application specific metadata in the form of key-value pairs."
        }
      },
      "description": "The secret update parameters."
    },
    "CertificateCreateParameters": {
      "properties": {
        "policy": {
          "x-ms-client-name": "CertificatePolicy",
          "$ref": "#/definitions/CertificatePolicy",
          "description": "The management policy for the certificate."
        },
        "attributes": {
          "x-ms-client-name": "CertificateAttributes",
          "$ref": "#/definitions/CertificateAttributes",
          "description": "The attributes of the certificate (optional)."
        },
        "tags": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          },
          "description": "Application specific metadata in the form of key-value pairs."
        }
      },
      "description": "The certificate create parameters."
    },
    "CertificateImportParameters": {
      "properties": {
        "value": {
          "x-ms-client-name": "base64EncodedCertificate",
          "type": "string",
          "description": "Base64 encoded representation of the certificate object to import. This certificate needs to contain the private key."
        },
        "pwd": {
          "x-ms-client-name": "password",
          "type": "string",
          "description": "If the private key in base64EncodedCertificate is encrypted, the password used for encryption."
        },
        "policy": {
          "x-ms-client-name": "CertificatePolicy",
          "$ref": "#/definitions/CertificatePolicy",
          "description": "The management policy for the certificate."
        },
        "attributes": {
          "x-ms-client-name": "CertificateAttributes",
          "$ref": "#/definitions/CertificateAttributes",
          "description": "The attributes of the certificate (optional)."
        },
        "tags": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          },
          "description": "Application specific metadata in the form of key-value pairs."
        }
      },
      "description": "The certificate import parameters.",
      "required": [
        "value"
      ]
    },
    "CertificateUpdateParameters": {
      "properties": {
        "policy": {
          "x-ms-client-name": "CertificatePolicy",
          "$ref": "#/definitions/CertificatePolicy",
          "description": "The management policy for the certificate."
        },
        "attributes": {
          "x-ms-client-name": "CertificateAttributes",
          "$ref": "#/definitions/CertificateAttributes",
          "description": "The attributes of the certificate (optional)."
        },
        "tags": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          },
          "description": "Application specific metadata in the form of key-value pairs."
        }
      },
      "description": "The certificate update parameters."
    },
    "CertificateMergeParameters": {
      "properties": {
        "x5c": {
          "x-ms-client-name": "x509Certificates",
          "type": "array",
          "items": {
            "type": "string",
            "format": "byte"
          },
          "description": "The certificate or the certificate chain to merge."
        },
        "attributes": {
          "x-ms-client-name": "CertificateAttributes",
          "$ref": "#/definitions/CertificateAttributes",
          "description": "The attributes of the certificate (optional)."
        },
        "tags": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          },
          "description": "Application specific metadata in the form of key-value pairs."
        }
      },
      "description": "The certificate merge parameters",
      "required": [
        "x5c"
      ]
    },
    "CertificateIssuerSetParameters": {
      "properties": {
        "provider": {
          "type": "string",
          "description": "The issuer provider."
        },
        "credentials": {
          "$ref": "#/definitions/IssuerCredentials",
          "description": "The credentials to be used for the issuer."
        },
        "org_details": {
          "x-ms-client-name": "OrganizationDetails",
          "$ref": "#/definitions/OrganizationDetails",
          "description": "Details of the organization as provided to the issuer."
        },
        "attributes": {
          "$ref": "#/definitions/IssuerAttributes",
          "description": "Attributes of the issuer object."
        }
      },
      "description": "The certificate issuer set parameters.",
      "required": [
        "provider"
      ]
    },
    "CertificateIssuerUpdateParameters": {
      "properties": {
        "provider": {
          "type": "string",
          "description": "The issuer provider."
        },
        "credentials": {
          "$ref": "#/definitions/IssuerCredentials",
          "description": "The credentials to be used for the issuer."
        },
        "org_details": {
          "x-ms-client-name": "OrganizationDetails",
          "$ref": "#/definitions/OrganizationDetails",
          "description": "Details of the organization as provided to the issuer."
        },
        "attributes": {
          "$ref": "#/definitions/IssuerAttributes",
          "description": "Attributes of the issuer object."
        }
      },
      "description": "The certificate issuer update parameters."
    },
    "CertificateOperationUpdateParameter": {
      "properties": {
        "cancellation_requested": {
          "type": "boolean",
          "description": "Indicates if cancellation was requested on the certificate operation."
        }
      },
      "description": "The certificate operation update parameters.",
      "required": [
        "cancellation_requested"
      ]
    },
    "KeyOperationResult": {
      "properties": {
        "kid": {
          "type": "string",
          "description": "Key identifier",
          "readOnly": true
        },
        "value": {
          "x-ms-client-name": "result",
          "type": "string",
          "format": "base64url",
          "readOnly": true
        }
      },
      "description": "The key operation result."
    },
    "KeyVerifyResult": {
      "properties": {
        "value": {
          "type": "boolean",
          "readOnly": true,
          "description": "True if the signature is verified, otherwise false."
        }
      },
      "description": "The key verify result."
    },
    "KeyListResult": {
      "properties": {
        "value": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/KeyItem"
          },
          "readOnly": true,
          "description": "A response message containing a list of keys in the key vault along with a link to the next page of keys."
        },
        "nextLink": {
          "type": "string",
          "readOnly": true,
          "description": "The URL to get the next set of keys."
        }
      },
      "description": "The key list result."
    },
    "DeletedKeyListResult": {
      "properties": {
        "value": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/DeletedKeyItem"
          },
          "readOnly": true,
          "description": "A response message containing a list of deleted keys in the vault along with a link to the next page of deleted keys"
        },
        "nextLink": {
          "type": "string",
          "readOnly": true,
          "description": "The URL to get the next set of deleted keys."
        }
      },
      "description": "A list of keys that have been deleted in this vault."
    },
    "SecretListResult": {
      "properties": {
        "value": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/SecretItem"
          },
          "readOnly": true,
          "description": "A response message containing a list of secrets in the key vault along with a link to the next page of secrets."
        },
        "nextLink": {
          "type": "string",
          "readOnly": true,
          "description": "The URL to get the next set of secrets."
        }
      },
      "description": "The secret list result."
    },
    "DeletedSecretListResult": {
      "properties": {
        "value": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/DeletedSecretItem"
          },
          "readOnly": true,
          "description": "A response message containing a list of the deleted secrets in the vault along with a link to the next page of deleted secrets"
        },
        "nextLink": {
          "type": "string",
          "readOnly": true,
          "description": "The URL to get the next set of deleted secrets."
        }
      },
      "description": "The deleted secret list result"
    },
    "CertificateListResult": {
      "properties": {
        "value": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/CertificateItem"
          },
          "readOnly": true,
          "description": "A response message containing a list of certificates in the key vault along with a link to the next page of certificates."
        },
        "nextLink": {
          "type": "string",
          "readOnly": true,
          "description": "The URL to get the next set of certificates."
        }
      },
      "description": "The certificate list result."
    },
    "DeletedCertificateListResult": {
      "properties": {
        "value": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/DeletedCertificateItem"
          },
          "readOnly": true,
          "description": "A response message containing a list of deleted certificates in the vault along with a link to the next page of deleted certificates"
        },
        "nextLink": {
          "type": "string",
          "readOnly": true,
          "description": "The URL to get the next set of deleted certificates."
        }
      },
      "description": "A list of certificates that have been deleted in this vault."
    },
    "CertificateIssuerListResult": {
      "properties": {
        "value": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/CertificateIssuerItem"
          },
          "readOnly": true,
          "description": "A response message containing a list of certificate issuers in the key vault along with a link to the next page of certificate issuers."
        },
        "nextLink": {
          "type": "string",
          "readOnly": true,
          "description": "The URL to get the next set of certificate issuers."
        }
      },
      "description": "The certificate issuer list result."
    },
    "BackupKeyResult": {
      "properties": {
        "value": {
          "type": "string",
          "format": "base64url",
          "readOnly": true,
          "description": "The backup blob containing the backed up key."
        }
      },
      "description": "The backup key result, containing the backup blob."
    },
    "BackupSecretResult": {
      "properties": {
        "value": {
          "type": "string",
          "format": "base64url",
          "readOnly": true,
          "description": "The backup blob containing the backed up secret."
        }
      },
      "description": "The backup secret result, containing the backup blob."
    },
    "BackupStorageResult": {
      "properties": {
        "value": {
          "type": "string",
          "format": "base64url",
          "readOnly": true,
          "description": "The backup blob containing the backed up storage account."
        }
      },
      "description": "The backup storage result, containing the backup blob."
    },
    "PendingCertificateSigningRequestResult": {
      "properties": {
        "value": {
          "type": "string",
          "readOnly": true,
          "description": "The pending certificate signing request as Base64 encoded string."
        }
      },
      "description": "The pending certificate signing request result."
    },
    "StorageAccountAttributes": {
      "properties": {
        "enabled": {
          "type": "boolean",
          "description": "the enabled state of the object."
        },
        "created": {
          "type": "integer",
          "format": "unixtime",
          "readOnly": true,
          "description": "Creation time in UTC."
        },
        "updated": {
          "type": "integer",
          "format": "unixtime",
          "readOnly": true,
          "description": "Last updated time in UTC."
        },
        "recoveryLevel": {
          "type": "string",
          "description": "Reflects the deletion recovery level currently in effect for storage accounts in the current vault. If it contains 'Purgeable' the storage account can be permanently deleted by a privileged user; otherwise, only the system can purge the storage account, at the end of the retention interval.",
          "enum": [
            "Purgeable",
            "Recoverable+Purgeable",
            "Recoverable",
            "Recoverable+ProtectedSubscription"
          ],
          "x-ms-enum": {
            "name": "DeletionRecoveryLevel",
            "modelAsString": true
          },
          "readOnly": true,
          "x-nullable": false
        }
      },
      "description": "The storage account management attributes."
    },
    "StorageBundle": {
      "properties": {
        "id": {
          "type": "string",
          "description": "The storage account id.",
          "readOnly": true
        },
        "resourceId": {
          "type": "string",
          "description": "The storage account resource id.",
          "readOnly": true
        },
        "activeKeyName": {
          "type": "string",
          "description": "The current active storage account key name.",
          "readOnly": true
        },
        "autoRegenerateKey": {
          "type": "boolean",
          "description": "whether keyvault should manage the storage account for the user.",
          "readOnly": true
        },
        "regenerationPeriod": {
          "type": "string",
          "description": "The key regeneration time duration specified in ISO-8601 format.",
          "readOnly": true
        },
        "attributes": {
          "$ref": "#/definitions/StorageAccountAttributes",
          "description": "The storage account attributes.",
          "readOnly": true
        },
        "tags": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          },
          "description": "Application specific metadata in the form of key-value pairs",
          "readOnly": true
        }
      },
      "description": "A Storage account bundle consists of key vault storage account details plus its attributes."
    },
    "DeletedStorageBundle": {
      "allOf": [
        {
          "$ref": "#/definitions/StorageBundle"
        }
      ],
      "properties": {
        "recoveryId": {
          "type": "string",
          "description": "The url of the recovery object, used to identify and recover the deleted storage account."
        },
        "scheduledPurgeDate": {
          "type": "integer",
          "format": "unixtime",
          "readOnly": true,
          "description": "The time when the storage account is scheduled to be purged, in UTC"
        },
        "deletedDate": {
          "type": "integer",
          "format": "unixtime",
          "readOnly": true,
          "description": "The time when the storage account was deleted, in UTC"
        }
      },
      "description": "A deleted storage account bundle consisting of its previous id, attributes and its tags, as well as information on when it will be purged."
    },
    "StorageAccountCreateParameters": {
      "properties": {
        "resourceId": {
          "type": "string",
          "description": "Storage account resource id."
        },
        "activeKeyName": {
          "type": "string",
          "description": "Current active storage account key name."
        },
        "autoRegenerateKey": {
          "type": "boolean",
          "description": "whether keyvault should manage the storage account for the user."
        },
        "regenerationPeriod": {
          "type": "string",
          "description": "The key regeneration time duration specified in ISO-8601 format."
        },
        "attributes": {
          "x-ms-client-name": "StorageAccountAttributes",
          "$ref": "#/definitions/StorageAccountAttributes",
          "description": "The attributes of the storage account."
        },
        "tags": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          },
          "description": "Application specific metadata in the form of key-value pairs."
        }
      },
      "description": "The storage account create parameters.",
      "required": [
        "resourceId",
        "activeKeyName",
        "autoRegenerateKey"
      ]
    },
    "StorageAccountUpdateParameters": {
      "properties": {
        "activeKeyName": {
          "type": "string",
          "description": "The current active storage account key name."
        },
        "autoRegenerateKey": {
          "type": "boolean",
          "description": "whether keyvault should manage the storage account for the user."
        },
        "regenerationPeriod": {
          "type": "string",
          "description": "The key regeneration time duration specified in ISO-8601 format."
        },
        "attributes": {
          "x-ms-client-name": "StorageAccountAttributes",
          "$ref": "#/definitions/StorageAccountAttributes",
          "description": "The attributes of the storage account."
        },
        "tags": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          },
          "description": "Application specific metadata in the form of key-value pairs."
        }
      },
      "description": "The storage account update parameters."
    },
    "StorageAccountRegenerteKeyParameters": {
      "properties": {
        "keyName": {
          "type": "string",
          "description": "The storage account key name."
        }
      },
      "description": "The storage account key regenerate parameters.",
      "required": [
        "keyName"
      ]
    },
    "StorageAccountItem": {
      "properties": {
        "id": {
          "type": "string",
          "description": "Storage identifier.",
          "readOnly": true
        },
        "resourceId": {
          "type": "string",
          "description": "Storage account resource Id.",
          "readOnly": true
        },
        "attributes": {
          "$ref": "#/definitions/StorageAccountAttributes",
          "description": "The storage account management attributes.",
          "readOnly": true
        },
        "tags": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          },
          "description": "Application specific metadata in the form of key-value pairs.",
          "readOnly": true
        }
      },
      "description": "The storage account item containing storage account metadata."
    },
    "DeletedStorageAccountItem": {
      "allOf": [
        {
          "$ref": "#/definitions/StorageAccountItem"
        }
      ],
      "properties": {
        "recoveryId": {
          "type": "string",
          "description": "The url of the recovery object, used to identify and recover the deleted storage account."
        },
        "scheduledPurgeDate": {
          "type": "integer",
          "format": "unixtime",
          "readOnly": true,
          "description": "The time when the storage account is scheduled to be purged, in UTC"
        },
        "deletedDate": {
          "type": "integer",
          "format": "unixtime",
          "readOnly": true,
          "description": "The time when the storage account was deleted, in UTC"
        }
      },
      "description": "The deleted storage account item containing metadata about the deleted storage account."
    },
    "StorageListResult": {
      "properties": {
        "value": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/StorageAccountItem"
          },
          "readOnly": true,
          "description": "A response message containing a list of storage accounts in the key vault along with a link to the next page of storage accounts."
        },
        "nextLink": {
          "type": "string",
          "readOnly": true,
          "description": "The URL to get the next set of storage accounts."
        }
      },
      "description": "The storage accounts list result."
    },
    "DeletedStorageListResult": {
      "properties": {
        "value": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/DeletedStorageAccountItem"
          },
          "readOnly": true,
          "description": "A response message containing a list of the deleted storage accounts in the vault along with a link to the next page of deleted storage accounts"
        },
        "nextLink": {
          "type": "string",
          "readOnly": true,
          "description": "The URL to get the next set of deleted storage accounts."
        }
      },
      "description": "The deleted storage account list result"
    },
    "SasDefinitionAttributes": {
      "properties": {
        "enabled": {
          "type": "boolean",
          "description": "the enabled state of the object."
        },
        "created": {
          "type": "integer",
          "format": "unixtime",
          "readOnly": true,
          "description": "Creation time in UTC."
        },
        "updated": {
          "type": "integer",
          "format": "unixtime",
          "readOnly": true,
          "description": "Last updated time in UTC."
        },
        "recoveryLevel": {
          "type": "string",
          "description": "Reflects the deletion recovery level currently in effect for SAS definitions in the current vault. If it contains 'Purgeable' the SAS definition can be permanently deleted by a privileged user; otherwise, only the system can purge the SAS definition, at the end of the retention interval.",
          "enum": [
            "Purgeable",
            "Recoverable+Purgeable",
            "Recoverable",
            "Recoverable+ProtectedSubscription"
          ],
          "x-ms-enum": {
            "name": "DeletionRecoveryLevel",
            "modelAsString": true
          },
          "readOnly": true,
          "x-nullable": false
        }
      },
      "description": "The SAS definition management attributes."
    },
    "SasDefinitionBundle": {
      "properties": {
        "id": {
          "type": "string",
          "description": "The SAS definition id.",
          "readOnly": true
        },
        "sid": {
          "x-ms-client-name": "SecretId",
          "type": "string",
          "description": "Storage account SAS definition secret id.",
          "readOnly": true
        },
        "templateUri": {
          "type": "string",
          "description": "The SAS definition token template signed with an arbitrary key.  Tokens created according to the SAS definition will have the same properties as the template.",
          "readOnly": true
        },
        "sasType": {
          "type": "string",
          "description": "The type of SAS token the SAS definition will create.",
          "enum": [
            "account",
            "service"
          ],
          "x-ms-enum": {
            "name": "SasTokenType",
            "modelAsString": true
          },
          "readOnly": true
        },
        "validityPeriod": {
          "type": "string",
          "description": "The validity period of SAS tokens created according to the SAS definition.",
          "readOnly": true
        },
        "attributes": {
          "$ref": "#/definitions/SasDefinitionAttributes",
          "description": "The SAS definition attributes.",
          "readOnly": true
        },
        "tags": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          },
          "description": "Application specific metadata in the form of key-value pairs",
          "readOnly": true
        }
      },
      "description": "A SAS definition bundle consists of key vault SAS definition details plus its attributes."
    },
    "DeletedSasDefinitionBundle": {
      "allOf": [
        {
          "$ref": "#/definitions/SasDefinitionBundle"
        }
      ],
      "properties": {
        "recoveryId": {
          "type": "string",
          "description": "The url of the recovery object, used to identify and recover the deleted SAS definition."
        },
        "scheduledPurgeDate": {
          "type": "integer",
          "format": "unixtime",
          "readOnly": true,
          "description": "The time when the SAS definition is scheduled to be purged, in UTC"
        },
        "deletedDate": {
          "type": "integer",
          "format": "unixtime",
          "readOnly": true,
          "description": "The time when the SAS definition was deleted, in UTC"
        }
      },
      "description": "A deleted SAS definition bundle consisting of its previous id, attributes and its tags, as well as information on when it will be purged."
    },
    "SasDefinitionItem": {
      "properties": {
        "id": {
          "type": "string",
          "description": "The storage SAS identifier.",
          "readOnly": true
        },
        "sid": {
          "x-ms-client-name": "SecretId",
          "type": "string",
          "description": "The storage account SAS definition secret id.",
          "readOnly": true
        },
        "attributes": {
          "$ref": "#/definitions/SasDefinitionAttributes",
          "description": "The SAS definition management attributes.",
          "readOnly": true
        },
        "tags": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          },
          "description": "Application specific metadata in the form of key-value pairs.",
          "readOnly": true
        }
      },
      "description": "The SAS definition item containing storage SAS definition metadata."
    },
    "DeletedSasDefinitionItem": {
      "allOf": [
        {
          "$ref": "#/definitions/SasDefinitionItem"
        }
      ],
      "properties": {
        "recoveryId": {
          "type": "string",
          "description": "The url of the recovery object, used to identify and recover the deleted SAS definition."
        },
        "scheduledPurgeDate": {
          "type": "integer",
          "format": "unixtime",
          "readOnly": true,
          "description": "The time when the SAS definition is scheduled to be purged, in UTC"
        },
        "deletedDate": {
          "type": "integer",
          "format": "unixtime",
          "readOnly": true,
          "description": "The time when the SAS definition was deleted, in UTC"
        }
      },
      "description": "The deleted SAS definition item containing metadata about the deleted SAS definition."
    },
    "SasDefinitionListResult": {
      "properties": {
        "value": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/SasDefinitionItem"
          },
          "readOnly": true,
          "description": "A response message containing a list of SAS definitions along with a link to the next page of SAS definitions."
        },
        "nextLink": {
          "type": "string",
          "readOnly": true,
          "description": "The URL to get the next set of SAS definitions."
        }
      },
      "description": "The storage account SAS definition list result."
    },
    "DeletedSasDefinitionListResult": {
      "properties": {
        "value": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/DeletedSasDefinitionItem"
          },
          "readOnly": true,
          "description": "A response message containing a list of the deleted SAS definitions in the vault along with a link to the next page of deleted sas definitions"
        },
        "nextLink": {
          "type": "string",
          "readOnly": true,
          "description": "The URL to get the next set of deleted SAS definitions."
        }
      },
      "description": "The deleted SAS definition list result"
    },
    "SasDefinitionCreateParameters": {
      "properties": {
        "templateUri": {
          "type": "string",
          "description": "The SAS definition token template signed with an arbitrary key.  Tokens created according to the SAS definition will have the same properties as the template."
        },
        "sasType": {
          "type": "string",
          "description": "The type of SAS token the SAS definition will create.",
          "enum": [
            "account",
            "service"
          ],
          "x-ms-enum": {
            "name": "SasTokenType",
            "modelAsString": true
          }
        },
        "validityPeriod": {
          "type": "string",
          "description": "The validity period of SAS tokens created according to the SAS definition."
        },
        "attributes": {
          "x-ms-client-name": "SasDefinitionAttributes",
          "$ref": "#/definitions/SasDefinitionAttributes",
          "description": "The attributes of the SAS definition."
        },
        "tags": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          },
          "description": "Application specific metadata in the form of key-value pairs."
        }
      },
      "description": "The SAS definition create parameters.",
      "required": [
        "templateUri",
        "sasType",
        "validityPeriod"
      ]
    },
    "SasDefinitionUpdateParameters": {
      "properties": {
        "templateUri": {
          "type": "string",
          "description": "The SAS definition token template signed with an arbitrary key.  Tokens created according to the SAS definition will have the same properties as the template."
        },
        "sasType": {
          "type": "string",
          "description": "The type of SAS token the SAS definition will create.",
          "enum": [
            "account",
            "service"
          ],
          "x-ms-enum": {
            "name": "SasTokenType",
            "modelAsString": true
          }
        },
        "validityPeriod": {
          "type": "string",
          "description": "The validity period of SAS tokens created according to the SAS definition."
        },
        "attributes": {
          "x-ms-client-name": "SasDefinitionAttributes",
          "$ref": "#/definitions/SasDefinitionAttributes",
          "description": "The attributes of the SAS definition."
        },
        "tags": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          },
          "description": "Application specific metadata in the form of key-value pairs."
        }
      },
      "description": "The SAS definition update parameters."
    },
    "KeyVaultError": {
      "properties": {
        "error": {
          "readOnly": true,
          "$ref": "#/definitions/Error"
        }
      },
      "description": "The key vault error exception."
    },
    "Error": {
      "properties": {
        "code": {
          "type": "string",
          "readOnly": true,
          "description": "The error code."
        },
        "message": {
          "type": "string",
          "readOnly": true,
          "description": "The error message."
        },
        "innererror": {
          "x-ms-client-name": "innerError",
          "readOnly": true,
          "$ref": "#/definitions/Error"
        }
      },
      "description": "The key vault server error."
    },
    "CertificateRestoreParameters": {
      "properties": {
        "value": {
          "type": "string",
          "x-ms-client-name": "certificateBundleBackup",
          "format": "base64url",
          "description": "The backup blob associated with a certificate bundle."
        }
      },
      "description": "The certificate restore parameters.",
      "required": [
        "value"
      ]
    },
    "BackupCertificateResult": {
      "properties": {
        "value": {
          "type": "string",
          "format": "base64url",
          "readOnly": true,
          "description": "The backup blob containing the backed up certificate."
        }
      },
      "description": "The backup certificate result, containing the backup blob."
    }
  },
  "parameters": {
    "ApiVersionParameter": {
      "name": "api-version",
      "in": "query",
      "required": true,
      "type": "string",
      "description": "Client API version."
    }
  }
}