Azure Key Vault

Keys, secrets, and certificates on Azure: create, read, back up, and use keys to encrypt and sign

Signs in with: OAuth 2.0 sign-in
Runs on: Cloud or On-Prem Worker
Operations: 66
Ready-made triggers: 0

Connect Azure Key Vault

In Neblex open Connect › Connections and click New Connection.
Search for Azure Key Vault and give the connection a clear name.
Fill in the fields. Secret values are encrypted and never shown again.
Click Test, then Create Connection.

For services offered under Connect a Service you only sign in and approve access. Otherwise use Connect with OAuth2 with your own OAuth app. See Authorize with OAuth.

Field	What to enter
Vault nameRequired	The name before .vault.azure.net, for example contoso-prod.
Token endpointRequired	https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token
Application (client) IDRequired
Client secretRequiredSecret
ScopeRequired

Use it in a flow

Open a flow, open the node library and search for Azure Key Vault.
Drag it onto the canvas and choose an Operation and your connection.
Map the operation's fields from earlier steps, or click Map with Matt.
Use Test this step to see what it returns, then save.

To start a flow from Azure Key Vault without a ready-made trigger: a Poll for changes trigger can check one of its list operations on a schedule and pass on only what is new; if Azure Key Vault can send webhooks, a Webhook trigger receives them at its own URL.

Operations

66 operations in 10 groups. Each one is a step you can add to a flow.

Certificate12

Back up a certificate`backupCertificate`	POST	Download a protected backup blob of a certificate and all its versions.
Create a certificate`createCertificate`	POST	Start issuing a new certificate (self-signed or from an issuer) under a policy.
Delete a certificate`deleteCertificate`	DELETE	Delete a certificate and all its versions (soft-deleted when the vault keeps deleted items).
Get a certificate`getCertificate`	GET	Get the latest version of a certificate.
Get a certificate policy`getCertificatePolicy`	GET	Get the policy a certificate is issued and renewed under.
Get a certificate version`getCertificateVersion`	GET	Get one version of a certificate.
Import a certificate`importCertificate`	POST	Import a certificate with its private key from PFX or PEM.
List certificate versions`listCertificateVersions`	GET	List every version of a certificate.
List certificates`listCertificates`	GET	List the certificates in the vault.
Restore a certificate`restoreCertificate`	POST	Restore a certificate from a backup blob.
Update a certificate`updateCertificate`	PATCH	Change a certificate version's policy, attributes or tags.
Update a certificate policy`updateCertificatePolicy`	PATCH	Change the policy used for the certificate's next version.

Certificate contact3

Delete certificate contacts`deleteCertificateContacts`	DELETE	Remove every certificate contact.
Get certificate contacts`getCertificateContacts`	GET	Get who is notified about certificate lifecycle events.
Set certificate contacts`setCertificateContacts`	PUT	Replace the contacts notified about certificate lifecycle events.

Certificate issuer5

Delete a certificate issuer`deleteCertificateIssuer`	DELETE	Remove a certificate issuer.
Get a certificate issuer`getCertificateIssuer`	GET	Get one certificate issuer.
List certificate issuers`listCertificateIssuers`	GET	List the certificate issuers configured in the vault.
Set a certificate issuer`setCertificateIssuer`	PUT	Create or replace a certificate issuer such as DigiCert or GlobalSign.
Update a certificate issuer`updateCertificateIssuer`	PATCH	Change selected properties of a certificate issuer.

Certificate operation4

Cancel a pending operation`updateCertificateOperation`	PATCH	Request cancellation of a certificate that is being issued.
Delete a pending operation`deleteCertificateOperation`	DELETE	Delete the record of a certificate issuance in progress.
Get a pending operation`getCertificateOperation`	GET	Get the status of a certificate that is being issued.
Merge a signed certificate`mergeCertificate`	POST	Complete a pending certificate with the chain signed by an external certificate authority.

Cryptography7

Decrypt`decrypt`	POST	Decrypt bytes with a key version.
Encrypt`encrypt`	POST	Encrypt bytes with a key version.
Get random bytes`getRandomBytes`	POST	Get cryptographically secure random bytes from the vault's HSM.
Sign a digest`sign`	POST	Sign a digest with a key version.
Unwrap a key`unwrapKey`	POST	Decrypt a wrapped symmetric key with a key version.
Verify a signature`verify`	POST	Verify a signature over a digest with a key version.
Wrap a key`wrapKey`	POST	Encrypt a symmetric key with a key version.

Deleted certificate4

Get a deleted certificate`getDeletedCertificate`	GET	Get a soft-deleted certificate and its scheduled purge date.
List deleted certificates`listDeletedCertificates`	GET	List soft-deleted certificates.
Purge a deleted certificate`purgeDeletedCertificate`	DELETE	Permanently delete a soft-deleted certificate.
Recover a deleted certificate`recoverDeletedCertificate`	POST	Restore a soft-deleted certificate to active use.

Deleted key4

Get a deleted key`getDeletedKey`	GET	Get a soft-deleted key and its scheduled purge date.
List deleted keys`listDeletedKeys`	GET	List soft-deleted keys.
Purge a deleted key`purgeDeletedKey`	DELETE	Permanently delete a soft-deleted key.
Recover a deleted key`recoverDeletedKey`	POST	Restore a soft-deleted key to active use.

Deleted secret4

Get a deleted secret`getDeletedSecret`	GET	Get a soft-deleted secret and its scheduled purge date.
List deleted secrets`listDeletedSecrets`	GET	List soft-deleted secrets.
Purge a deleted secret`purgeDeletedSecret`	DELETE	Permanently delete a soft-deleted secret.
Recover a deleted secret`recoverDeletedSecret`	POST	Restore a soft-deleted secret to active use.

Key14

Back up a key`backupKey`	POST	Download a protected backup blob of a key and all its versions.
Create a key`createKey`	POST	Create a new key, or a new version of an existing key.
Delete a key`deleteKey`	DELETE	Delete a key and all its versions (soft-deleted when the vault keeps deleted items).
Get a key`getKey`	GET	Get the latest version of a key's public part and attributes.
Get a key version`getKeyVersion`	GET	Get one version of a key.
Get a rotation policy`getKeyRotationPolicy`	GET	Get a key's automatic rotation policy.
Import a key`importKey`	PUT	Import an existing key as a JSON Web Key.
List key versions`listKeyVersions`	GET	List every version of a key.
List keys`listKeys`	GET	List the keys in the vault.
Release a key`releaseKey`	POST	Release an exportable key to an attested environment under its release policy.
Restore a key`restoreKey`	POST	Restore a key from a backup blob.
Rotate a key`rotateKey`	POST	Create a new key version now, following the key's rotation policy.
Set a rotation policy`updateKeyRotationPolicy`	PUT	Set when a key rotates automatically and when to notify before it expires.
Update a key`updateKey`	PATCH	Change a key version's permitted operations, attributes, tags or release policy.

Secret9

Back up a secret`backupSecret`	POST	Download a protected backup blob of a secret and all its versions.
Delete a secret`deleteSecret`	DELETE	Delete a secret and all its versions (soft-deleted when the vault keeps deleted items).
Get a secret`getSecret`	GET	Get the latest version of a secret, including its value.
Get a secret version`getSecretVersion`	GET	Get one version of a secret, including its value.
List secret versions`listSecretVersions`	GET	List every version of a secret.
List secrets`listSecrets`	GET	List the secrets in the vault (values are not included).
Restore a secret`restoreSecret`	POST	Restore a secret from a backup blob.
Set a secret`setSecret`	PUT	Create a secret, or a new version of an existing secret.
Update a secret`updateSecret`	PATCH	Change a secret version's content type, attributes or tags.