Azure Key Vault

Create a local vault, store, delete and recover secrets, and encrypt and decrypt with an RSA key; Pro adds self-signed certificates and managed storage accounts.

Plan: Free132 of 132 operations implemented across 5 APIs2Known differences

Free: Key Vault management, Key Vault secrets and Key Vault keys.Pro: Key Vault certificates and Key Vault storage accounts.

Keys are local software keys, not an HSM, and only RSA-OAEP-256 encryption was checked. The vault's empty access policy didn't stop any request, so access control isn't shown to be enforced.

Example checked on Vera 1.2.2, 8 November 2026. Each coverage note names its own evidence and date.

Connect

Start Vera as in Get started, with your license key activated and the emulator started by the Vera launcher (Activate Pro). Then open Bash in a terminal of its own (on macOS, whose terminal starts zsh, type bash first), go to an empty scratch directory and run this; it needs curl and Python 3, and jq. It fetches the emulator's own certificate, so every request checks TLS, and defines data_request and data_arm, which this page's commands use. The bearer token vera-local is a dummy local credential, not your license key.

export VERA_CA_CERT="$PWD/vera-ca.pem"
curl --fail --silent --show-error --noproxy '*' --insecure \
  https://localhost:8543/_vera/ca.pem --output "$VERA_CA_CERT"
curl --fail --silent --show-error --noproxy '*' \
  --cacert "$VERA_CA_CERT" https://localhost:8543/_vera/health; echo

export VERA_CA="$VERA_CA_CERT"
export ARM='https://localhost:8543'
export SUB='00000000-0000-0000-0000-000000000001'
export TENANT='00000000-0000-0000-0000-0000000000a1'
export RG='azdata-rg'
export ROOT="/subscriptions/$SUB/resourceGroups/$RG"
export AUDIT_TMP="$(mktemp -d)"

56 more lines: show the full setup
# Every .localhost host name is connected to loopback, and TLS is verified.
# DATA_RESPONSE is replaced after each call: copy any IDs before the next one.
data_request() {
  local method="$1" url="$2" host status
  shift 2
  case "$url" in
    https://localhost:8543/*|https://*.localhost:8543/*) ;;
    *) printf 'Refusing non-local URL: %s\n' "$url" >&2; return 1 ;;
  esac
  host="${url#https://}"
  host="${host%%/*}"
  host="${host%:8543}"
  status=$(curl --noproxy '*' --silent --show-error \
    --cacert "$VERA_CA" --resolve "$host:8543:127.0.0.1" \
    -H 'Authorization: Bearer vera-local' \
    -X "$method" "$url" "$@" \
    -D "$AUDIT_TMP/headers" -o "$AUDIT_TMP/body" -w '%{http_code}') || return
  DATA_RESPONSE=$(cat "$AUDIT_TMP/body")
  printf 'HTTP %s\n%s\n' "$status" "$DATA_RESPONSE"
  case "$status" in 2??) ;; *) return 1 ;; esac
}

# Polls the operation URL from the last successful management change, even
# after HTTP 200 or 201. Don't replace it with a fixed sleep.
data_wait_arm() {
  local operation attempt status state delay
  operation=$(awk 'BEGIN {IGNORECASE=1} tolower($1)=="azure-asyncoperation:" {gsub("\r", "", $2); print $2; exit}' "$AUDIT_TMP/headers")
  if [ -z "$operation" ]; then
    operation=$(awk 'tolower($1)=="location:" {gsub("\r", "", $2); print $2; exit}' "$AUDIT_TMP/headers")
  fi
  [ -z "$operation" ] && return 0
  case "$operation" in "$ARM"/_vera/operations/*) ;; *) printf 'Inspect unexpected operation URL: %s\n' "$operation" >&2; return 1 ;; esac
  for attempt in $(seq 1 60); do
    data_request GET "$operation" || return
    status=$(awk '/^HTTP\// {code=$2} END {print code}' "$AUDIT_TMP/headers")
    state=$(printf '%s' "$DATA_RESPONSE" | jq -r '.status // empty' 2>/dev/null) || state=''
    case "$state" in
      Failed|Canceled|Cancelled) return 1 ;;
      Succeeded) return 0 ;;
      InProgress|Running|Accepted) ;;
      *) [ "$status" != '202' ] && return 0 ;;
    esac
    delay=$(awk 'tolower($1)=="retry-after:" {gsub("\r", "", $2); print $2; exit}' "$AUDIT_TMP/headers")
    case "$delay" in ''|*[!0-9]*) delay=1 ;; esac
    sleep "$delay"
  done
  printf 'Operation did not finish within the polling limit\n' >&2
  return 1
}

data_arm() {
  local method="$1" path="$2"
  shift 2
  data_request "$method" "$ARM$path" "$@" || return
  case "$method" in PUT|PATCH|POST|DELETE) data_wait_arm ;; esac
}

The health check answers {"cloud": "azure", "generation_status": "generated", "status": "ok"}. Requests go only to the emulator at https://localhost:8543: the helper refuses any other address, including the Azure-looking URLs some responses hold. When you've finished, close the terminal and delete the scratch directory; that removes only these local files, not what you created in the emulator.

The examples use these API versions, tested with this build; keep them as shown. Each goes in an api-version parameter.

API	Version	Plan
Resource groups	`2025-04-01`	Free
Key Vault management	`2026-05-15`	Free
Key Vault secrets and keys	`7.6`	Free
Key Vault certificates and storage accounts	`7.6`	Pro
Storage account management	`2026-09-01`	Free

Vault and storage account management go to https://localhost:8543. The vault’s secrets, keys, certificates and storage accounts go to its own host name, azdatavault.vault.localhost, on the same port. The emulator finds the vault by that name, so keep it in the URL. data_request gives curl a --resolve for it, which connects to 127.0.0.1 while keeping the name for routing and TLS, so the name doesn’t need to resolve on your machine. See data host names.

Example

Create a vault, store a secret, read it, delete it and recover it. The sections after this one use the same vault for keys, certificates and storage accounts, and Clean up deletes it at the end.

Create the resource group the examples share, then the vault, and read the vault. data_arm prints each response, then polls any operation until it has finished (long-running operations):

data_arm PUT "$ROOT?api-version=2025-04-01" \
  -H 'Content-Type: application/json' --data '{"location":"eastus"}'
VAULT="$ROOT/providers/Microsoft.KeyVault/vaults/azdatavault"
KV='https://azdatavault.vault.localhost:8543'
data_arm PUT "$VAULT?api-version=2026-05-15" -H 'Content-Type: application/json' \
  --data "{\"location\":\"eastus\",\"properties\":{\"tenantId\":\"$TENANT\",\"sku\":{\"family\":\"A\",\"name\":\"standard\"},\"accessPolicies\":[]}}"
data_arm GET "$VAULT?api-version=2026-05-15"

The vault’s create and GET both answer HTTP 200. Its vaultUri is on its local host name and port 8543, and soft delete is enabled. Now store a secret, read it, delete it, read the deleted secret, recover it and read it again:

data_request PUT "$KV/secrets/azdatasecret?api-version=7.6" \
  -H 'Content-Type: application/json' --data '{"value":"hello vera"}'
data_request GET "$KV/secrets/azdatasecret/?api-version=7.6"
data_request DELETE "$KV/secrets/azdatasecret?api-version=7.6"
data_request GET "$KV/deletedsecrets/azdatasecret?api-version=7.6"
data_request POST "$KV/deletedsecrets/azdatasecret/recover?api-version=7.6"
data_request GET "$KV/secrets/azdatasecret/?api-version=7.6"

Every request answers HTTP 200. The slash before ?api-version in the reads asks for the latest version. The last read returns the recovered secret, with the same versioned id it had before the delete; this is its value:

{
  "value": "hello vera"
}

Encrypt and decrypt

Create an RSA key, keep its versioned ID, encrypt hello vera with RSA-OAEP-256, then decrypt the result. Key Vault takes values in unpadded base64url, so hello vera is aGVsbG8gdmVyYQ.

data_request POST "$KV/keys/azdatakey/create?api-version=7.6" \
  -H 'Content-Type: application/json' \
  --data '{"kty":"RSA","key_size":2048,"key_ops":["encrypt","decrypt","sign","verify"]}'
KEY_ID=$(printf '%s' "$DATA_RESPONSE" | jq -r '.key.kid')
data_request POST "$KEY_ID/encrypt?api-version=7.6" -H 'Content-Type: application/json' \
  --data '{"alg":"RSA-OAEP-256","value":"aGVsbG8gdmVyYQ"}'
CIPHERTEXT=$(printf '%s' "$DATA_RESPONSE" | jq -r '.value')
DECRYPT_BODY=$(jq -nc --arg value "$CIPHERTEXT" '{alg:"RSA-OAEP-256",value:$value}')
data_request POST "$KEY_ID/decrypt?api-version=7.6" -H 'Content-Type: application/json' \
  --data "$DECRYPT_BODY"

All three answer HTTP 200, and the decrypt returns the original value:

{
  "value": "aGVsbG8gdmVyYQ"
}

Delete the key, which answers HTTP 200:

data_request DELETE "$KV/keys/azdatakey?api-version=7.6"

Create a certificate

Certificates need Pro. Create a self-signed certificate for CN=azdata.local, which answers HTTP 202: the certificate is created in the background.

data_request POST "$KV/certificates/azdatacert/create?api-version=7.6" \
  -H 'Content-Type: application/json' \
  --data '{"policy":{"issuer":{"name":"Self"},"key_props":{"exportable":true,"kty":"RSA","key_size":2048,"reuse_key":false},"secret_props":{"contentType":"application/x-pkcs12"},"x509_props":{"subject":"CN=azdata.local","validity_months":12}}}'

Poll the certificate’s pending operation, for up to 30 seconds, until its status is completed, stopping if it fails. Then read the certificate:

CERT_STATUS=''
for attempt in $(seq 1 30); do
  data_request GET "$KV/certificates/azdatacert/pending?api-version=7.6" || break
  CERT_STATUS=$(printf '%s' "$DATA_RESPONSE" | jq -r '.status')
  case "$CERT_STATUS" in completed|failed|canceled|cancelled) break ;; esac
  sleep 1
done
echo "Certificate status: $CERT_STATUS"
data_request GET "$KV/certificates/azdatacert/?api-version=7.6"

The pending operation answers HTTP 200, and the status line should read Certificate status: completed. The certificate answers HTTP 200. Its cer field holds the certificate as base64 DER, not PEM; in testing it parsed as an X.509 certificate for CN=azdata.local with a valid RSA self-signature.

Delete the certificate, which answers HTTP 200:

data_request DELETE "$KV/certificates/azdatacert?api-version=7.6"

Manage a storage account’s keys

Key Vault’s storage account API needs Pro. It records a storage account for Key Vault to manage, so create the account first: Key Vault doesn’t create one. The account’s name, azdatastore, is the one the Storage page’s example uses.

STORAGE="$ROOT/providers/Microsoft.Storage/storageAccounts/azdatastore"
data_arm PUT "$STORAGE?api-version=2026-09-01" -H 'Content-Type: application/json' \
  --data '{"location":"eastus","sku":{"name":"Standard_LRS"},"kind":"StorageV2"}'
STORAGE_BODY=$(jq -nc --arg id "$STORAGE" \
  '{resourceId:$id,activeKeyName:"key1",autoRegenerateKey:false}')
data_request PUT "$KV/storage/azdatastore?api-version=7.6" \
  -H 'Content-Type: application/json' --data "$STORAGE_BODY"
data_request GET "$KV/storage/azdatastore?api-version=7.6"

Both Key Vault requests answer HTTP 200, and the GET returns the settings you sent. These are selected fields:

{
  "resourceId": "/subscriptions/00000000-0000-0000-0000-000000000001/resourceGroups/azdata-rg/providers/Microsoft.Storage/storageAccounts/azdatastore",
  "activeKeyName": "key1",
  "autoRegenerateKey": false
}

Delete the Key Vault record, then the storage account:

data_request DELETE "$KV/storage/azdatastore?api-version=7.6"
data_arm DELETE "$STORAGE?api-version=2026-09-01"

Clean up

Delete the secret, then the vault:

data_request DELETE "$KV/secrets/azdatasecret?api-version=7.6"
data_arm DELETE "$VAULT?api-version=2026-05-15"

Both answer HTTP 200, and a GET of the vault then answers HTTP 404. Key Vault’s deletes are soft deletes: each returns the details for recovering the object, and purging wasn’t tested. If you run the examples again and a name conflicts with a recoverable object, use new names or a fresh emulator.

The resource group azdata-rg stays, since deleting a group fails in Vera 1.2.2: see deleting resource groups. Other pages’ examples reuse it. To remove it and anything else left over, start a fresh emulator: see Stop and start again.

Supported features

Vaults (Free): a standard vault created with an empty access policy list, read back with its local vaultUri and soft delete enabled, listed in its resource group and deleted. A missing vault answers HTTP 404.
Secrets (Free): a secret stored, read at its latest version, deleted, read while deleted, recovered with the same versioned ID and deleted again. A missing secret answers HTTP 404 with SecretNotFound.
Keys (Free): an RSA 2048 key created and deleted, and values encrypted and decrypted with RSA-OAEP-256. The cryptography is real: in testing, a value encrypted outside the emulator with the key’s public n and e decrypted correctly.
Certificates (Pro): a self-signed RSA certificate created, its pending operation read until completed, the certificate read with its cer and deleted.
Storage accounts (Pro): Key Vault’s record of a storage account set with its resource ID, active key and autoRegenerateKey, read back and deleted.
Not run as examples: secret versions, updates, backups and purges, signing, wrapping and other key algorithms, key rotation and import, certificate issuers, contacts, imports and renewals, SAS definitions and key regeneration, and managed HSMs. The API coverage marks these from a review of Vera 1.2.0’s source, with their limits in the notes.

Limitations

The main limits are below. A few more apply to every service, and the API coverage notes cover smaller differences.

Local software keys, not an HSM. The keys are generated and used by the emulator on your machine. HSM protection, attestation and cryptographic compliance aren’t claimed, and only RSA-OAEP-256 encryption was checked. Don’t use it as a store for production secrets.
Access control isn’t shown to be enforced. The examples use an empty access policy list and the dummy token, and every request succeeded. Access policies and role-based access weren’t tested.
Only self-signed certificates were tested. Issuing through an external certificate authority, renewals and policy compatibility weren’t. A certificate from an external issuer waits for a merge (MergeCertificate), and no certificate authority is contacted.
Managed storage accounts are records. Setting one doesn’t show that keys are regenerated: automatic rotation, regenerationPeriod and SAS definitions weren’t exercised.
Deletes are soft deletes. Each delete returns recovery details, and purging wasn’t tested.
Backups are local. Key, secret, certificate and storage account backups are local snapshot handles in the emulator’s own format. They aren’t interchangeable with Azure’s encrypted backups.
Attestation and key release are local. GetKeyAttestation and release return payloads signed locally with HMAC, not hardware-backed attestation or Azure secure key release.

API coverage

Every operation of the APIs on this page, from their pinned public definitions, and whether Vera 1.2.0 implements it. Only the API surfaces in this release are listed, and each operation once. Implementation availability was reviewed against the Vera 1.2.0 source on 6 November 2026. Source inspection identifies a local implementation and its known limits; it doesn't mean every operation or API version was tested with a request. Each note names its evidence: a Local observation without a build or date is from Vera 1.2.0 preview, on 5 November 2026, and one from a later build, such as Vera 1.2.0-rc.3 or Vera 1.2.2, names that build and its date. No response was compared with Azure's. What the statuses mean

Key Vault management 2026-05-15Plan: Free

48 of 48 implemented

Version 2026-05-15, from the Azure REST API specifications at commit 21bbf1b.

Keys

5 of 5 implemented

Operation	Status	Notes
Keys_CreateIfNotExist	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
Keys_Get	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
Keys_GetVersion	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
Keys_List	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
Keys_ListVersions	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.

MHSMPrivateEndpointConnections

4 of 4 implemented

Operation	Status	Notes
MHSMPrivateEndpointConnections_Delete	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
MHSMPrivateEndpointConnections_Get	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
MHSMPrivateEndpointConnections_ListByResource	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
MHSMPrivateEndpointConnections_Put	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.

MHSMPrivateLinkResources

1 of 1 implemented

Operation	Status	Notes
MHSMPrivateLinkResources_ListByMHSMResource	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.

MHSMRegions

1 of 1 implemented

Operation	Status	Notes
MHSMRegions_ListByResource	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.

ManagedHsmKeys

5 of 5 implemented

Operation	Status	Notes
ManagedHsmKeys_CreateIfNotExist	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
ManagedHsmKeys_Get	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
ManagedHsmKeys_GetVersion	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
ManagedHsmKeys_List	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
ManagedHsmKeys_ListVersions	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.

ManagedHsms

10 of 10 implemented

Operation	Status	Notes
ManagedHsms_CheckMhsmNameAvailability	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
ManagedHsms_CreateOrUpdate	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
ManagedHsms_Delete	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
ManagedHsms_Get	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
ManagedHsms_GetDeleted	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
ManagedHsms_ListByResourceGroup	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
ManagedHsms_ListBySubscription	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
ManagedHsms_ListDeleted	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
ManagedHsms_PurgeDeleted	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
ManagedHsms_Update	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.

Operations

1 of 1 implemented

Operation	Status	Notes
Operations_List	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.

PrivateEndpointConnections

4 of 4 implemented

Operation	Status	Notes
PrivateEndpointConnections_Delete	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
PrivateEndpointConnections_Get	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
PrivateEndpointConnections_ListByResource	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
PrivateEndpointConnections_Put	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.

PrivateLinkResources

1 of 1 implemented

Operation	Status	Notes
PrivateLinkResources_ListByVault	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.

Secrets

4 of 4 implemented

Operation	Status	Notes
Secrets_CreateOrUpdate	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
Secrets_Get	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
Secrets_List	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
Secrets_Update	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.

Vaults

12 of 12 implemented

Operation	Status	Notes
Vaults_CheckNameAvailability	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
Vaults_CreateOrUpdate	Implemented	Local observation: Created a standard vault with an empty access policy list (HTTP 200).
Vaults_Delete	Implemented	Local observation: Deleted the vault (HTTP 200); a GET then answered HTTP 404.
Vaults_Get	Implemented	Local observation: Returned the vault with a `vaultUri` on its local host name and port 8543, and soft delete enabled (HTTP 200). A missing vault, and the vault after deletion, answered HTTP 404.
Vaults_GetDeleted	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
Vaults_List	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
Vaults_ListByResourceGroup	Implemented	Local observation: Listed the resource group's vaults (HTTP 200).
Vaults_ListBySubscription	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
Vaults_ListDeleted	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
Vaults_PurgeDeleted	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
Vaults_Update	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
Vaults_UpdateAccessPolicy	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.

Key Vault certificates 7.6Plan: Pro

27 of 27 implemented

Version 7.6, from the Azure REST API specifications at commit 21bbf1b.

keyvault_certificates_data

27 of 27 implemented

Operation	Status	Notes
BackupCertificate	Implemented	Source inspection: Keeps certificates, policies, issuers, contacts and pending operations in the local vault. Self-signed certificates are issued locally; an external issuer's certificate waits for a merge, and no certificate authority, directory or network is contacted. Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
CreateCertificate	Implemented	Local observation: Started creating a self-signed RSA 2048 certificate for `CN=azdata.local` (HTTP 202).
DeleteCertificate	Implemented	Local observation: Deleted the certificate (HTTP 200), returning soft-delete recovery details.
DeleteCertificateContacts	Implemented	Source inspection: Keeps certificates, policies, issuers, contacts and pending operations in the local vault. Self-signed certificates are issued locally; an external issuer's certificate waits for a merge, and no certificate authority, directory or network is contacted. Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
DeleteCertificateIssuer	Implemented	Source inspection: Keeps certificates, policies, issuers, contacts and pending operations in the local vault. Self-signed certificates are issued locally; an external issuer's certificate waits for a merge, and no certificate authority, directory or network is contacted. Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
DeleteCertificateOperation	Implemented	Source inspection: Keeps certificates, policies, issuers, contacts and pending operations in the local vault. Self-signed certificates are issued locally; an external issuer's certificate waits for a merge, and no certificate authority, directory or network is contacted. Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
GetCertificate	Implemented	Local observation: Returned the certificate with its `cer` (HTTP 200): base64 DER that parsed as an X.509 certificate for `CN=azdata.local` with a valid RSA self-signature. Read first, the certificate's `/pending` operation answered HTTP 200 with `status` `completed`.
GetCertificateContacts	Implemented	Source inspection: Keeps certificates, policies, issuers, contacts and pending operations in the local vault. Self-signed certificates are issued locally; an external issuer's certificate waits for a merge, and no certificate authority, directory or network is contacted. Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
GetCertificateIssuer	Implemented	Source inspection: Keeps certificates, policies, issuers, contacts and pending operations in the local vault. Self-signed certificates are issued locally; an external issuer's certificate waits for a merge, and no certificate authority, directory or network is contacted. Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
GetCertificateIssuers	Implemented	Source inspection: Keeps certificates, policies, issuers, contacts and pending operations in the local vault. Self-signed certificates are issued locally; an external issuer's certificate waits for a merge, and no certificate authority, directory or network is contacted. Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
GetCertificateOperation	Implemented	Source inspection: Keeps certificates, policies, issuers, contacts and pending operations in the local vault. Self-signed certificates are issued locally; an external issuer's certificate waits for a merge, and no certificate authority, directory or network is contacted. Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
GetCertificatePolicy	Implemented	Source inspection: Keeps certificates, policies, issuers, contacts and pending operations in the local vault. Self-signed certificates are issued locally; an external issuer's certificate waits for a merge, and no certificate authority, directory or network is contacted. Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
GetCertificateVersions	Implemented	Source inspection: Keeps certificates, policies, issuers, contacts and pending operations in the local vault. Self-signed certificates are issued locally; an external issuer's certificate waits for a merge, and no certificate authority, directory or network is contacted. Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
GetCertificates	Implemented	Source inspection: Keeps certificates, policies, issuers, contacts and pending operations in the local vault. Self-signed certificates are issued locally; an external issuer's certificate waits for a merge, and no certificate authority, directory or network is contacted. Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
GetDeletedCertificate	Implemented	Source inspection: Keeps certificates, policies, issuers, contacts and pending operations in the local vault. Self-signed certificates are issued locally; an external issuer's certificate waits for a merge, and no certificate authority, directory or network is contacted. Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
GetDeletedCertificates	Implemented	Source inspection: Keeps certificates, policies, issuers, contacts and pending operations in the local vault. Self-signed certificates are issued locally; an external issuer's certificate waits for a merge, and no certificate authority, directory or network is contacted. Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
ImportCertificate	Implemented	Source inspection: Keeps certificates, policies, issuers, contacts and pending operations in the local vault. Self-signed certificates are issued locally; an external issuer's certificate waits for a merge, and no certificate authority, directory or network is contacted. Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
MergeCertificate	Implemented	Source inspection: Keeps certificates, policies, issuers, contacts and pending operations in the local vault. Self-signed certificates are issued locally; an external issuer's certificate waits for a merge, and no certificate authority, directory or network is contacted. Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
PurgeDeletedCertificate	Implemented	Source inspection: Keeps certificates, policies, issuers, contacts and pending operations in the local vault. Self-signed certificates are issued locally; an external issuer's certificate waits for a merge, and no certificate authority, directory or network is contacted. Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
RecoverDeletedCertificate	Implemented	Source inspection: Keeps certificates, policies, issuers, contacts and pending operations in the local vault. Self-signed certificates are issued locally; an external issuer's certificate waits for a merge, and no certificate authority, directory or network is contacted. Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
RestoreCertificate	Implemented	Source inspection: Keeps certificates, policies, issuers, contacts and pending operations in the local vault. Self-signed certificates are issued locally; an external issuer's certificate waits for a merge, and no certificate authority, directory or network is contacted. Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
SetCertificateContacts	Implemented	Source inspection: Keeps certificates, policies, issuers, contacts and pending operations in the local vault. Self-signed certificates are issued locally; an external issuer's certificate waits for a merge, and no certificate authority, directory or network is contacted. Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
SetCertificateIssuer	Implemented	Source inspection: Keeps certificates, policies, issuers, contacts and pending operations in the local vault. Self-signed certificates are issued locally; an external issuer's certificate waits for a merge, and no certificate authority, directory or network is contacted. Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
UpdateCertificate	Implemented	Source inspection: Keeps certificates, policies, issuers, contacts and pending operations in the local vault. Self-signed certificates are issued locally; an external issuer's certificate waits for a merge, and no certificate authority, directory or network is contacted. Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
UpdateCertificateIssuer	Implemented	Source inspection: Keeps certificates, policies, issuers, contacts and pending operations in the local vault. Self-signed certificates are issued locally; an external issuer's certificate waits for a merge, and no certificate authority, directory or network is contacted. Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
UpdateCertificateOperation	Implemented	Source inspection: Keeps certificates, policies, issuers, contacts and pending operations in the local vault. Self-signed certificates are issued locally; an external issuer's certificate waits for a merge, and no certificate authority, directory or network is contacted. Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
UpdateCertificatePolicy	Implemented	Source inspection: Keeps certificates, policies, issuers, contacts and pending operations in the local vault. Self-signed certificates are issued locally; an external issuer's certificate waits for a merge, and no certificate authority, directory or network is contacted. Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.

Key Vault keys 7.6Plan: Free

25 of 25 implemented · 2 known differences

Version 7.6, from the Azure REST API specifications at commit 21bbf1b.

keyvault_keys_data

25 of 25 implemented · 2 known differences

Operation	Status	Notes
BackupKey	Implemented	Source inspection: Backs up and restores a key with a local snapshot token tied to the emulator's state, not a portable Azure-encrypted backup. Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
CreateKey	Implemented	Local observation: Created an RSA 2048 key for encrypt, decrypt, sign and verify (HTTP 200).
DeleteKey	Implemented	Local observation: Deleted the key (HTTP 200), returning soft-delete recovery details.
GetDeletedKey	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
GetDeletedKeys	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
GetKey	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
GetKeyAttestation	Known difference	Source inspection: Returns an attestation or release payload signed locally with HMAC, not hardware-backed Azure attestation or Azure secure key release. Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
GetKeyRotationPolicy	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
GetKeyVersions	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
GetKeys	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
GetRandomBytes	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
ImportKey	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
PurgeDeletedKey	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
RecoverDeletedKey	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
RestoreKey	Implemented	Source inspection: Backs up and restores a key with a local snapshot token tied to the emulator's state, not a portable Azure-encrypted backup. Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
RotateKey	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
UpdateKey	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
UpdateKeyRotationPolicy	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
decrypt	Implemented	Local observation: Decrypted RSA-OAEP-256 ciphertext back to the original value (HTTP 200), both ciphertext from `encrypt` and ciphertext made outside the emulator with the key's public `n` and `e`.
encrypt	Implemented	Local observation: Encrypted a value with RSA-OAEP-256 (HTTP 200). Other algorithms weren't tested.
release	Known difference	Source inspection: Returns an attestation or release payload signed locally with HMAC, not hardware-backed Azure attestation or Azure secure key release. Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
sign	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
unwrapKey	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
verify	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
wrapKey	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.

Key Vault secrets 7.6Plan: Free

12 of 12 implemented

Version 7.6, from the Azure REST API specifications at commit 21bbf1b.

keyvault_secrets_data

12 of 12 implemented

Operation	Status	Notes
BackupSecret	Implemented	Source inspection: Backs up and restores a secret through an opaque local state handle, not an interchangeable Azure encrypted backup. Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
DeleteSecret	Implemented	Local observation: Deleted the secret (HTTP 200), returning soft-delete recovery details, both before recovering it and in cleanup.
GetDeletedSecret	Implemented	Local observation: Returned the deleted secret (HTTP 200).
GetDeletedSecrets	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
GetSecret	Implemented	Local observation: Returned the latest version, `hello vera`, when read with a slash and no version (HTTP 200), and after recovery the same value with the same versioned ID. A missing secret answered HTTP 404 `SecretNotFound`.
GetSecretVersions	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
GetSecrets	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
PurgeDeletedSecret	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
RecoverDeletedSecret	Implemented	Local observation: Recovered the deleted secret (HTTP 200).
RestoreSecret	Implemented	Source inspection: Backs up and restores a secret through an opaque local state handle, not an interchangeable Azure encrypted backup. Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
SetSecret	Implemented	Local observation: Stored a secret (HTTP 200).
UpdateSecret	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.

Key Vault storage accounts 7.6Plan: Pro

20 of 20 implemented

Version 7.6, from the Azure REST API specifications at commit 21bbf1b.

keyvault_storage_data

20 of 20 implemented

Operation	Status	Notes
BackupStorageAccount	Implemented	Source inspection: Backs up and restores a managed storage account through authenticated local snapshots, which aren't interchangeable with Azure backups. Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
DeleteSasDefinition	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
DeleteStorageAccount	Implemented	Local observation: Deleted the managed storage account (HTTP 200), returning soft-delete recovery details.
GetDeletedSasDefinition	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
GetDeletedSasDefinitions	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
GetDeletedStorageAccount	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
GetDeletedStorageAccounts	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
GetSasDefinition	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
GetSasDefinitions	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
GetStorageAccount	Implemented	Local observation: Returned the `resourceId`, `activeKeyName` `key1` and `autoRegenerateKey` `false` it was set with (HTTP 200).
GetStorageAccounts	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
PurgeDeletedStorageAccount	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
RecoverDeletedSasDefinition	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
RecoverDeletedStorageAccount	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
RegenerateStorageAccountKey	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
RestoreStorageAccount	Implemented	Source inspection: Backs up and restores a managed storage account through authenticated local snapshots, which aren't interchangeable with Azure backups. Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
SetSasDefinition	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
SetStorageAccount	Implemented	Local observation: Set a managed storage account for an existing storage account's resource ID (HTTP 200). Key regeneration and rotation weren't tested.
UpdateSasDefinition	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.
UpdateStorageAccount	Implemented	Source inspection: Local vault state and software cryptography; Azure RBAC, network rules and hardware HSMs aren't established, and backups use the emulator's own format.