Azure Key Vault

# Key management operations
from azure.keyvault.keys import KeyClient

# Secret management operations  
from azure.keyvault.secrets import SecretClient

# Certificate management operations
from azure.keyvault.certificates import CertificateClient

# Cryptographic operations
from azure.keyvault.keys.crypto import CryptographyClient

# Administration operations (Managed HSM only)
from azure.keyvault.administration import KeyVaultAccessControlClient, KeyVaultBackupClient

# Async versions for all clients
from azure.keyvault.keys.aio import KeyClient as AsyncKeyClient
from azure.keyvault.secrets.aio import SecretClient as AsyncSecretClient  
from azure.keyvault.certificates.aio import CertificateClient as AsyncCertificateClient
from azure.keyvault.keys.crypto.aio import CryptographyClient as AsyncCryptographyClient

# Async administration clients (Managed HSM only)
from azure.keyvault.administration.aio import KeyVaultAccessControlClient as AsyncAccessControlClient
from azure.keyvault.administration.aio import KeyVaultBackupClient as AsyncBackupClient

from azure.keyvault.keys import KeyClient
from azure.keyvault.secrets import SecretClient
from azure.keyvault.certificates import CertificateClient
from azure.identity import DefaultAzureCredential

# Initialize credential
credential = DefaultAzureCredential()
vault_url = "https://your-keyvault-name.vault.azure.net/"

# Create clients
key_client = KeyClient(vault_url=vault_url, credential=credential)
secret_client = SecretClient(vault_url=vault_url, credential=credential)
certificate_client = CertificateClient(vault_url=vault_url, credential=credential)

# Basic key operations
key = key_client.create_rsa_key("my-key", size=2048)
retrieved_key = key_client.get_key("my-key")

# Basic secret operations  
secret = secret_client.set_secret("my-secret", "secret-value")
retrieved_secret = secret_client.get_secret("my-secret")

# Basic certificate operations
cert_policy = CertificatePolicy.get_default()
cert_operation = certificate_client.begin_create_certificate("my-cert", cert_policy)
certificate = cert_operation.result()

class KeyClient:
    def __init__(self, vault_url: str, credential, **kwargs): ...
    def create_key(self, name: str, key_type: KeyType, **kwargs) -> KeyVaultKey: ...
    def create_rsa_key(self, name: str, **kwargs) -> KeyVaultKey: ...
    def create_ec_key(self, name: str, **kwargs) -> KeyVaultKey: ...
    def get_key(self, name: str, version: str = None, **kwargs) -> KeyVaultKey: ...
    def begin_delete_key(self, name: str, **kwargs) -> LROPoller[DeletedKey]: ...
    def get_cryptography_client(self, key_name: str, **kwargs) -> CryptographyClient: ...

class SecretClient:
    def __init__(self, vault_url: str, credential, **kwargs): ...
    def set_secret(self, name: str, value: str, **kwargs) -> KeyVaultSecret: ...
    def get_secret(self, name: str, version: str = None, **kwargs) -> KeyVaultSecret: ...
    def begin_delete_secret(self, name: str, **kwargs) -> LROPoller[DeletedSecret]: ...
    def list_properties_of_secrets(**kwargs) -> ItemPaged[SecretProperties]: ...

class CertificateClient:
    def __init__(self, vault_url: str, credential, **kwargs): ...
    def create_certificate(self, certificate_name: str, policy: CertificatePolicy, **kwargs) -> KeyVaultCertificate: ...
    def begin_create_certificate(self, certificate_name: str, policy: CertificatePolicy, **kwargs) -> LROPoller[KeyVaultCertificate]: ...
    def get_certificate(self, certificate_name: str, **kwargs) -> KeyVaultCertificate: ...
    def import_certificate(self, certificate_name: str, certificate_bytes: bytes, **kwargs) -> KeyVaultCertificate: ...
    def begin_delete_certificate(self, certificate_name: str, **kwargs) -> LROPoller[DeletedCertificate]: ...

class CryptographyClient:
    def encrypt(self, algorithm: EncryptionAlgorithm, plaintext: bytes, **kwargs) -> EncryptResult: ...
    def decrypt(self, algorithm: EncryptionAlgorithm, ciphertext: bytes, **kwargs) -> DecryptResult: ...
    def sign(self, algorithm: SignatureAlgorithm, digest: bytes, **kwargs) -> SignResult: ...
    def verify(self, algorithm: SignatureAlgorithm, digest: bytes, signature: bytes, **kwargs) -> VerifyResult: ...

class KeyVaultAccessControlClient:
    def __init__(self, vault_url: str, credential, **kwargs): ...
    def create_role_assignment(self, role_scope: KeyVaultRoleScope, role_definition_id: str, principal_id: str, **kwargs) -> KeyVaultRoleAssignment: ...
    def get_role_assignment(self, role_scope: KeyVaultRoleScope, role_assignment_name: str, **kwargs) -> KeyVaultRoleAssignment: ...
    def set_role_definition(self, role_scope: KeyVaultRoleScope, **kwargs) -> KeyVaultRoleDefinition: ...
    def list_role_definitions(self, role_scope: KeyVaultRoleScope, **kwargs) -> ItemPaged[KeyVaultRoleDefinition]: ...

class KeyVaultBackupClient:
    def __init__(self, vault_url: str, credential, **kwargs): ...
    def begin_backup(self, blob_storage_url: str, sas_token: str, **kwargs) -> LROPoller[KeyVaultBackupResult]: ...
    def begin_restore(self, blob_storage_url: str, sas_token: str, folder_name: str, **kwargs) -> LROPoller[None]: ...

# Long-running operation support
from azure.core.polling import LROPoller

# Authentication and configuration
class ApiVersion(str, Enum):
    V7_0 = "7.0"
    V7_1 = "7.1"
    V7_2 = "7.2"
    V7_3 = "7.3"
    V7_4 = "7.4"
    V7_5 = "7.5"

# Key types and properties
class KeyVaultKey:
    id: str
    name: str
    properties: KeyProperties
    key: JsonWebKey
    key_type: KeyType

class KeyProperties:
    id: str
    name: str
    version: str
    enabled: bool
    expires_on: datetime
    created_on: datetime
    updated_on: datetime
    tags: Dict[str, str]

# Secret types
class KeyVaultSecret:
    id: str
    name: str
    properties: SecretProperties
    value: str

class SecretProperties:
    id: str
    name: str
    version: str
    enabled: bool
    expires_on: datetime
    content_type: str
    tags: Dict[str, str]

# Certificate types  
class KeyVaultCertificate:
    id: str
    name: str
    properties: CertificateProperties
    cer: bytes
    policy: CertificatePolicy

class CertificateProperties:
    id: str
    name: str
    version: str
    enabled: bool
    expires_on: datetime
    x509_thumbprint: bytes
    tags: Dict[str, str]

# Key enums and additional types
class KeyType(str, Enum):
    EC = "EC"
    EC_HSM = "EC-HSM"
    RSA = "RSA"
    RSA_HSM = "RSA-HSM"
    oct = "oct"
    oct_HSM = "oct-HSM"

class KeyCurveName(str, Enum):
    P_256 = "P-256"
    P_384 = "P-384"
    P_521 = "P-521"
    P_256K = "P-256K"

class KeyOperation(str, Enum):
    encrypt = "encrypt"
    decrypt = "decrypt"
    sign = "sign"
    verify = "verify"
    wrap_key = "wrapKey"
    unwrap_key = "unwrapKey"
    import_key = "import"
    export = "export"

class DeletedKey:
    id: str
    name: str
    properties: KeyProperties
    key: JsonWebKey
    deleted_on: datetime
    recovery_id: str
    scheduled_purge_date: datetime

class JsonWebKey:
    kid: str
    kty: KeyType
    key_ops: List[KeyOperation]
    n: bytes  # RSA modulus
    e: bytes  # RSA public exponent
    d: bytes  # RSA private exponent
    x: bytes  # EC x coordinate
    y: bytes  # EC y coordinate
    crv: KeyCurveName  # EC curve name
    k: bytes  # Symmetric key value

# Deleted secret type
class DeletedSecret:
    id: str
    name: str
    properties: SecretProperties
    value: str
    deleted_on: datetime
    recovery_id: str
    scheduled_purge_date: datetime

# Deleted certificate type
class DeletedCertificate:
    id: str
    name: str
    properties: CertificateProperties
    cer: bytes
    policy: CertificatePolicy
    deleted_on: datetime
    recovery_id: str
    scheduled_purge_date: datetime

# Certificate policy and related types
class CertificatePolicy:
    id: str
    issuer_name: str
    subject: str
    san_dns_names: List[str]
    san_emails: List[str]
    san_user_principal_names: List[str]
    exportable: bool
    key_type: KeyType
    key_size: int
    reuse_key: bool
    curve: KeyCurveName
    enhanced_key_usage: List[str]
    key_usage: List[KeyUsageType]
    x509_props: X509CertificateProperties
    lifetime_actions: List[LifetimeAction]
    attributes: CertificateAttributes
    
    @classmethod
    def get_default(cls) -> "CertificatePolicy": ...

class KeyUsageType(str, Enum):
    digital_signature = "digitalSignature"
    non_repudiation = "nonRepudiation"
    key_encipherment = "keyEncipherment"
    data_encipherment = "dataEncipherment"
    key_agreement = "keyAgreement"
    key_cert_sign = "keyCertSign"
    crl_sign = "crlSign"
    encipher_only = "encipherOnly"
    decipher_only = "decipherOnly"

# Cryptographic operation result types
class EncryptResult:
    key_id: str
    algorithm: EncryptionAlgorithm
    ciphertext: bytes
    iv: bytes
    authentication_tag: bytes
    additional_authenticated_data: bytes

class DecryptResult:
    key_id: str
    algorithm: EncryptionAlgorithm
    plaintext: bytes

class SignResult:
    key_id: str
    algorithm: SignatureAlgorithm
    signature: bytes

class VerifyResult:
    key_id: str
    algorithm: SignatureAlgorithm
    is_valid: bool

class WrapResult:
    key_id: str
    algorithm: KeyWrapAlgorithm
    encrypted_key: bytes

class UnwrapResult:
    key_id: str
    algorithm: KeyWrapAlgorithm
    key: bytes

# Cryptographic algorithm enums
class EncryptionAlgorithm(str, Enum):
    RSA_OAEP = "RSA-OAEP"
    RSA_OAEP_256 = "RSA-OAEP-256"
    RSA1_5 = "RSA1_5"
    A128GCM = "A128GCM"
    A192GCM = "A192GCM"
    A256GCM = "A256GCM"
    A128CBC = "A128CBC"
    A192CBC = "A192CBC"
    A256CBC = "A256CBC"
    A128CBCPAD = "A128CBCPAD"
    A192CBCPAD = "A192CBCPAD"
    A256CBCPAD = "A256CBCPAD"

class SignatureAlgorithm(str, Enum):
    PS256 = "PS256"
    PS384 = "PS384"
    PS512 = "PS512"
    RS256 = "RS256"
    RS384 = "RS384"
    RS512 = "RS512"
    ES256 = "ES256"
    ES384 = "ES384"
    ES512 = "ES512"
    ES256K = "ES256K"

class KeyWrapAlgorithm(str, Enum):
    A128KW = "A128KW"
    A192KW = "A192KW"
    A256KW = "A256KW"
    RSA_OAEP = "RSA-OAEP"
    RSA_OAEP_256 = "RSA-OAEP-256"
    RSA1_5 = "RSA1_5"

# Paging support
from azure.core.paging import ItemPaged