Azure Key Vault Keys

from azure.keyvault.keys import KeyClient

from azure.keyvault.keys.aio import KeyClient

from azure.keyvault.keys.crypto import CryptographyClient
from azure.keyvault.keys.crypto.aio import CryptographyClient  # async version

from azure.keyvault.keys import (
    KeyVaultKey, KeyProperties, DeletedKey, JsonWebKey,
    KeyType, KeyCurveName, KeyOperation
)

from azure.identity import DefaultAzureCredential
from azure.keyvault.keys import KeyClient, KeyType

# Create a client
credential = DefaultAzureCredential()
vault_url = "https://my-key-vault.vault.azure.net/"
client = KeyClient(vault_url=vault_url, credential=credential)

# Create a key
key_name = "my-rsa-key"
key = client.create_rsa_key(key_name, size=2048)
print(f"Created key: {key.name}")

# Get a key
retrieved_key = client.get_key(key_name)
print(f"Retrieved key: {retrieved_key.name}")

# Create a cryptography client for operations
crypto_client = client.get_cryptography_client(key_name)

# Encrypt data
from azure.keyvault.keys.crypto import EncryptionAlgorithm
plaintext = b"Hello, World!"
encrypt_result = crypto_client.encrypt(EncryptionAlgorithm.rsa_oaep, plaintext)
print(f"Encrypted data length: {len(encrypt_result.ciphertext)}")

# Decrypt data
decrypt_result = crypto_client.decrypt(EncryptionAlgorithm.rsa_oaep, encrypt_result.ciphertext)
print(f"Decrypted text: {decrypt_result.plaintext}")

def create_key(name: str, key_type: KeyType, **kwargs) -> KeyVaultKey: ...
def create_rsa_key(name: str, *, size: int = None, **kwargs) -> KeyVaultKey: ...
def create_ec_key(name: str, *, curve: KeyCurveName = None, **kwargs) -> KeyVaultKey: ...
def get_key(name: str, version: str = None, **kwargs) -> KeyVaultKey: ...
def update_key_properties(name: str, version: str = None, **kwargs) -> KeyVaultKey: ...
def begin_delete_key(name: str, **kwargs) -> LROPoller[DeletedKey]: ...

def encrypt(algorithm: EncryptionAlgorithm, plaintext: bytes, **kwargs) -> EncryptResult: ...
def decrypt(algorithm: EncryptionAlgorithm, ciphertext: bytes, **kwargs) -> DecryptResult: ...
def sign(algorithm: SignatureAlgorithm, digest: bytes, **kwargs) -> SignResult: ...
def verify(algorithm: SignatureAlgorithm, digest: bytes, signature: bytes, **kwargs) -> VerifyResult: ...
def wrap_key(algorithm: KeyWrapAlgorithm, key: bytes, **kwargs) -> WrapResult: ...
def unwrap_key(algorithm: KeyWrapAlgorithm, encrypted_key: bytes, **kwargs) -> UnwrapResult: ...

def backup_key(name: str, **kwargs) -> bytes: ...
def restore_key_backup(backup: bytes, **kwargs) -> KeyVaultKey: ...
def list_deleted_keys(**kwargs) -> ItemPaged[DeletedKey]: ...
def get_deleted_key(name: str, **kwargs) -> DeletedKey: ...
def begin_recover_deleted_key(name: str, **kwargs) -> LROPoller[KeyVaultKey]: ...
def purge_deleted_key(name: str, **kwargs) -> None: ...

def import_key(name: str, key: JsonWebKey, **kwargs) -> KeyVaultKey: ...
def release_key(name: str, target_attestation_token: str, **kwargs) -> ReleaseKeyResult: ...

def get_key_rotation_policy(key_name: str, **kwargs) -> KeyRotationPolicy: ...
def update_key_rotation_policy(key_name: str, policy: KeyRotationPolicy, **kwargs) -> KeyRotationPolicy: ...
def rotate_key(name: str, **kwargs) -> KeyVaultKey: ...

async def create_key(name: str, key_type: KeyType, **kwargs) -> KeyVaultKey: ...
async def encrypt(algorithm: EncryptionAlgorithm, plaintext: bytes, **kwargs) -> EncryptResult: ...
async def decrypt(algorithm: EncryptionAlgorithm, ciphertext: bytes, **kwargs) -> DecryptResult: ...

class KeyVaultKey:
    """A key's attributes and cryptographic material."""
    id: str
    name: str
    properties: KeyProperties
    key: JsonWebKey
    key_type: KeyType
    key_operations: List[KeyOperation]

class KeyProperties:
    """A key's ID and attributes without cryptographic material."""
    id: str
    name: str
    version: str
    enabled: bool
    not_before: datetime
    expires_on: datetime
    created_on: datetime
    updated_on: datetime
    vault_url: str
    recoverable_days: int
    recovery_level: str
    tags: Dict[str, str]
    managed: bool
    exportable: bool

class JsonWebKey:
    """JSON Web Key representation as defined in RFC 7517."""
    kid: str
    kty: KeyType
    key_ops: List[KeyOperation]
    # RSA parameters
    n: bytes  # RSA modulus
    e: bytes  # RSA public exponent
    d: bytes  # RSA private exponent
    dp: bytes  # RSA private key parameter
    dq: bytes  # RSA private key parameter
    qi: bytes  # RSA private key parameter
    p: bytes  # RSA secret prime
    q: bytes  # RSA secret prime
    # EC parameters
    crv: KeyCurveName  # Elliptic curve name
    x: bytes  # X component of EC public key
    y: bytes  # Y component of EC public key
    # Symmetric key parameters
    k: bytes  # Symmetric key
    # HSM token
    t: bytes  # HSM Token for Bring Your Own Key

class DeletedKey(KeyVaultKey):
    """A deleted key's properties and deletion information."""
    deleted_on: datetime        # When the key was deleted
    recovery_id: str           # Recovery identifier for deleted key
    scheduled_purge_date: datetime  # When key will be permanently deleted

class KeyVaultKeyIdentifier:
    """Information about a KeyVaultKey parsed from a key ID."""
    source_id: str   # The complete key identifier URL
    vault_url: str   # The Key Vault URL
    name: str        # The key name
    version: str     # The key version (optional)

class KeyReleasePolicy:
    """The policy rules under which a key can be exported."""
    encoded_policy: bytes     # The policy rules encoded based on content_type
    content_type: str         # Content type and version of the release policy
    immutable: bool           # Whether the policy is immutable

class KeyRotationLifetimeAction:
    """Action and trigger performed over a key's lifetime."""
    action: KeyRotationPolicyAction  # The action to execute
    time_after_create: str           # Time after creation as ISO 8601 duration
    time_before_expiry: str          # Time before expiry as ISO 8601 duration

class KeyRotationPolicy:
    """Key rotation policy configuration."""
    id: str                              # Policy identifier
    lifetime_actions: List[KeyRotationLifetimeAction]  # Lifetime actions
    expires_in: str                      # Expiration time as ISO 8601 duration
    created_on: datetime                 # When policy was created
    updated_on: datetime                 # When policy was last updated

class ReleaseKeyResult:
    """Result of a key release operation."""
    value: str  # The released key value

class KeyType(str, Enum):
    """Supported key types."""
    ec = "EC"
    ec_hsm = "EC-HSM"
    rsa = "RSA"
    rsa_hsm = "RSA-HSM"
    oct = "oct"
    oct_hsm = "oct-HSM"

class KeyCurveName(str, Enum):
    """Supported elliptic curves."""
    p_256 = "P-256"    # NIST P-256 elliptic curve
    p_384 = "P-384"    # NIST P-384 elliptic curve
    p_521 = "P-521"    # NIST P-521 elliptic curve
    p_256_k = "P-256K"  # SECG SECP256K1 elliptic curve

class KeyOperation(str, Enum):
    """Supported key operations."""
    encrypt = "encrypt"
    decrypt = "decrypt"
    sign = "sign"
    verify = "verify"
    wrap_key = "wrapKey"
    unwrap_key = "unwrapKey"
    import_key = "import"
    export = "export"

class KeyExportEncryptionAlgorithm(str, Enum):
    """Supported algorithms for protecting exported key material."""
    ckm_rsa_aes_key_wrap = "CKM_RSA_AES_KEY_WRAP"
    rsa_aes_key_wrap_256 = "RSA_AES_KEY_WRAP_256"
    rsa_aes_key_wrap_384 = "RSA_AES_KEY_WRAP_384"

class KeyRotationPolicyAction(str, Enum):
    """The action that will be executed in a key rotation policy."""
    rotate = "Rotate"  # Rotate the key based on the key policy
    notify = "Notify"  # Trigger Event Grid events

class ApiVersion(str, Enum):
    """Key Vault API versions supported by the client."""
    V7_6 = "7.6"           # Latest version (default)
    V7_5 = "7.5"
    V7_4 = "7.4"
    V7_3 = "7.3"
    V7_2 = "7.2"
    V7_1 = "7.1"
    V7_0 = "7.0"
    V2016_10_01 = "2016-10-01"

# Package version constant
__version__: str  # Current package version (e.g., "4.11.0")