{
  "swagger": "2.0",
  "info": {
    "title": "KeyVaultClient",
    "version": "2025-06-01-preview",
    "description": "The key vault client performs cryptographic key operations and vault operations against the Key Vault service.",
    "x-typespec-generated": [
      {
        "emitter": "@azure-tools/typespec-autorest"
      }
    ]
  },
  "schemes": [
    "https"
  ],
  "x-ms-parameterized-host": {
    "hostTemplate": "{vaultBaseUrl}",
    "useSchemePrefix": false,
    "parameters": [
      {
        "name": "vaultBaseUrl",
        "in": "path",
        "required": true,
        "type": "string",
        "format": "uri",
        "x-ms-skip-url-encoding": true
      }
    ]
  },
  "produces": [
    "application/json"
  ],
  "consumes": [
    "application/json"
  ],
  "security": [
    {
      "OAuth2Auth": [
        "https://vault.azure.net/.default"
      ]
    }
  ],
  "securityDefinitions": {
    "OAuth2Auth": {
      "type": "oauth2",
      "flow": "implicit",
      "authorizationUrl": "https://login.microsoftonline.com/common/oauth2/authorize",
      "scopes": {
        "https://vault.azure.net/.default": ""
      }
    }
  },
  "tags": [],
  "paths": {
    "/deletedsecrets": {
      "get": {
        "operationId": "GetDeletedSecrets",
        "summary": "Lists deleted secrets for the specified vault.",
        "description": "The Get Deleted Secrets operation returns the secrets that have been deleted for a vault enabled for soft-delete. This operation requires the secrets/list permission.",
        "parameters": [
          {
            "$ref": "#/parameters/Azure.Core.Foundations.ApiVersionParameter"
          },
          {
            "name": "maxresults",
            "in": "query",
            "description": "Maximum number of results to return in a page. If not specified the service will return up to 25 results.",
            "required": false,
            "type": "integer",
            "format": "int32",
            "minimum": 1,
            "maximum": 25
          }
        ],
        "responses": {
          "200": {
            "description": "The request has succeeded.",
            "schema": {
              "$ref": "#/definitions/DeletedSecretListResult"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "GetDeletedSecrets": {
            "$ref": "./examples/GetDeletedSecrets-example.json"
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        }
      }
    },
    "/deletedsecrets/{secret-name}": {
      "get": {
        "operationId": "GetDeletedSecret",
        "summary": "Gets the specified deleted secret.",
        "description": "The Get Deleted Secret operation returns the specified deleted secret along with its attributes. This operation requires the secrets/get permission.",
        "parameters": [
          {
            "$ref": "#/parameters/Azure.Core.Foundations.ApiVersionParameter"
          },
          {
            "name": "secret-name",
            "in": "path",
            "description": "The name of the secret.",
            "required": true,
            "type": "string",
            "x-ms-client-name": "secretName"
          }
        ],
        "responses": {
          "200": {
            "description": "The request has succeeded.",
            "schema": {
              "$ref": "#/definitions/DeletedSecretBundle"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "GetDeletedSecret": {
            "$ref": "./examples/GetDeletedSecret-example.json"
          }
        }
      },
      "delete": {
        "operationId": "PurgeDeletedSecret",
        "summary": "Permanently deletes the specified secret.",
        "description": "The purge deleted secret operation removes the secret permanently, without the possibility of recovery. This operation can only be enabled on a soft-delete enabled vault. This operation requires the secrets/purge permission.",
        "parameters": [
          {
            "$ref": "#/parameters/Azure.Core.Foundations.ApiVersionParameter"
          },
          {
            "name": "secret-name",
            "in": "path",
            "description": "The name of the secret.",
            "required": true,
            "type": "string",
            "x-ms-client-name": "secretName"
          }
        ],
        "responses": {
          "204": {
            "description": "There is no content to send for this request, but the headers may be useful. "
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "PurgeDeletedSecret": {
            "$ref": "./examples/PurgeDeletedSecret-example.json"
          }
        }
      }
    },
    "/deletedsecrets/{secret-name}/recover": {
      "post": {
        "operationId": "RecoverDeletedSecret",
        "summary": "Recovers the deleted secret to the latest version.",
        "description": "Recovers the deleted secret in the specified vault. This operation can only be performed on a soft-delete enabled vault. This operation requires the secrets/recover permission.",
        "parameters": [
          {
            "$ref": "#/parameters/Azure.Core.Foundations.ApiVersionParameter"
          },
          {
            "name": "secret-name",
            "in": "path",
            "description": "The name of the deleted secret.",
            "required": true,
            "type": "string",
            "x-ms-client-name": "secretName"
          }
        ],
        "responses": {
          "200": {
            "description": "The request has succeeded.",
            "schema": {
              "$ref": "#/definitions/SecretBundle"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "RecoverDeletedSecret": {
            "$ref": "./examples/RecoverDeletedSecret-example.json"
          }
        }
      }
    },
    "/secrets": {
      "get": {
        "operationId": "GetSecrets",
        "summary": "List secrets in a specified key vault.",
        "description": "The Get Secrets operation is applicable to the entire vault. However, only the base secret identifier and its attributes are provided in the response. Individual secret versions are not listed in the response. This operation requires the secrets/list permission.",
        "parameters": [
          {
            "$ref": "#/parameters/Azure.Core.Foundations.ApiVersionParameter"
          },
          {
            "name": "maxresults",
            "in": "query",
            "description": "Maximum number of results to return in a page. If not specified the service will return up to 25 results.",
            "required": false,
            "type": "integer",
            "format": "int32",
            "minimum": 1,
            "maximum": 25
          }
        ],
        "responses": {
          "200": {
            "description": "The request has succeeded.",
            "schema": {
              "$ref": "#/definitions/SecretListResult"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "GetSecrets": {
            "$ref": "./examples/GetSecrets-example.json"
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        }
      }
    },
    "/secrets/{secret-name}": {
      "put": {
        "operationId": "SetSecret",
        "summary": "Sets a secret in a specified key vault.",
        "description": "The SET operation adds a secret to the Azure Key Vault. If the named secret already exists, Azure Key Vault creates a new version of that secret. This operation requires the secrets/set permission.",
        "parameters": [
          {
            "$ref": "#/parameters/Azure.Core.Foundations.ApiVersionParameter"
          },
          {
            "name": "secret-name",
            "in": "path",
            "description": "The name of the secret. The value you provide may be copied globally for the purpose of running the service. The value provided should not include personally identifiable or sensitive information.",
            "required": true,
            "type": "string",
            "pattern": "^[0-9a-zA-Z-]+$",
            "x-ms-client-name": "secretName"
          },
          {
            "name": "parameters",
            "in": "body",
            "description": "The parameters for setting the secret.",
            "required": true,
            "schema": {
              "$ref": "#/definitions/SecretSetParameters"
            },
            "x-ms-client-flatten": true
          }
        ],
        "responses": {
          "200": {
            "description": "The request has succeeded.",
            "schema": {
              "$ref": "#/definitions/SecretBundle"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "SetSecret": {
            "$ref": "./examples/SetSecret-example.json"
          }
        }
      },
      "delete": {
        "operationId": "DeleteSecret",
        "summary": "Deletes a secret from a specified key vault.",
        "description": "The DELETE operation applies to any secret stored in Azure Key Vault. DELETE cannot be applied to an individual version of a secret. This operation requires the secrets/delete permission.",
        "parameters": [
          {
            "$ref": "#/parameters/Azure.Core.Foundations.ApiVersionParameter"
          },
          {
            "name": "secret-name",
            "in": "path",
            "description": "The name of the secret.",
            "required": true,
            "type": "string",
            "x-ms-client-name": "secretName"
          }
        ],
        "responses": {
          "200": {
            "description": "The request has succeeded.",
            "schema": {
              "$ref": "#/definitions/DeletedSecretBundle"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "DeleteSecret": {
            "$ref": "./examples/DeleteSecret-example.json"
          }
        }
      }
    },
    "/secrets/{secret-name}/{secret-version}": {
      "get": {
        "operationId": "GetSecret",
        "summary": "Get a specified secret from a given key vault.",
        "description": "The GET operation is applicable to any secret stored in Azure Key Vault. This operation requires the secrets/get permission.",
        "parameters": [
          {
            "$ref": "#/parameters/Azure.Core.Foundations.ApiVersionParameter"
          },
          {
            "name": "secret-name",
            "in": "path",
            "description": "The name of the secret.",
            "required": true,
            "type": "string",
            "x-ms-client-name": "secretName"
          },
          {
            "name": "secret-version",
            "in": "path",
            "description": "The version of the secret. This URI fragment is optional. If not specified, the latest version of the secret is returned.",
            "required": true,
            "type": "string",
            "x-ms-client-name": "secretVersion"
          },
          {
            "name": "outContentType",
            "in": "query",
            "description": "The media type (MIME type) of the certificate. If a supported format is specified, the certificate content is converted to the requested format. Currently, only PFX to PEM conversion is supported. If an unsupported format is specified, the request is rejected. If not specified, the certificate is returned in its original format without conversion.",
            "required": false,
            "type": "string",
            "enum": [
              "application/x-pkcs12",
              "application/x-pem-file"
            ],
            "x-ms-enum": {
              "name": "ContentType",
              "modelAsString": true,
              "values": [
                {
                  "name": "PFX",
                  "value": "application/x-pkcs12",
                  "description": "The PKCS#12 file format."
                },
                {
                  "name": "PEM",
                  "value": "application/x-pem-file",
                  "description": "The PEM file format."
                }
              ]
            }
          }
        ],
        "responses": {
          "200": {
            "description": "The request has succeeded.",
            "schema": {
              "$ref": "#/definitions/SecretBundle"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "GetSecret": {
            "$ref": "./examples/GetSecret-example.json"
          }
        }
      },
      "patch": {
        "operationId": "UpdateSecret",
        "summary": "Updates the attributes associated with a specified secret in a given key vault.",
        "description": "The UPDATE operation changes specified attributes of an existing stored secret. Attributes that are not specified in the request are left unchanged. The value of a secret itself cannot be changed. This operation requires the secrets/set permission.",
        "parameters": [
          {
            "$ref": "#/parameters/Azure.Core.Foundations.ApiVersionParameter"
          },
          {
            "name": "secret-name",
            "in": "path",
            "description": "The name of the secret.",
            "required": true,
            "type": "string",
            "x-ms-client-name": "secretName"
          },
          {
            "name": "secret-version",
            "in": "path",
            "description": "The version of the secret.",
            "required": true,
            "type": "string",
            "x-ms-client-name": "secretVersion"
          },
          {
            "name": "parameters",
            "in": "body",
            "description": "The parameters for update secret operation.",
            "required": true,
            "schema": {
              "$ref": "#/definitions/SecretUpdateParameters"
            },
            "x-ms-client-flatten": true
          }
        ],
        "responses": {
          "200": {
            "description": "The request has succeeded.",
            "schema": {
              "$ref": "#/definitions/SecretBundle"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "UpdateSecret": {
            "$ref": "./examples/UpdateSecret-example.json"
          }
        }
      }
    },
    "/secrets/{secret-name}/backup": {
      "post": {
        "operationId": "BackupSecret",
        "summary": "Backs up the specified secret.",
        "description": "Requests that a backup of the specified secret be downloaded to the client. All versions of the secret will be downloaded. This operation requires the secrets/backup permission.",
        "parameters": [
          {
            "$ref": "#/parameters/Azure.Core.Foundations.ApiVersionParameter"
          },
          {
            "name": "secret-name",
            "in": "path",
            "description": "The name of the secret.",
            "required": true,
            "type": "string",
            "x-ms-client-name": "secretName"
          }
        ],
        "responses": {
          "200": {
            "description": "The request has succeeded.",
            "schema": {
              "$ref": "#/definitions/BackupSecretResult"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "BackupSecret": {
            "$ref": "./examples/BackupSecret-example.json"
          }
        }
      }
    },
    "/secrets/{secret-name}/versions": {
      "get": {
        "operationId": "GetSecretVersions",
        "summary": "List all versions of the specified secret.",
        "description": "The full secret identifier and attributes are provided in the response. No values are returned for the secrets. This operations requires the secrets/list permission.",
        "parameters": [
          {
            "$ref": "#/parameters/Azure.Core.Foundations.ApiVersionParameter"
          },
          {
            "name": "secret-name",
            "in": "path",
            "description": "The name of the secret.",
            "required": true,
            "type": "string",
            "x-ms-client-name": "secretName"
          },
          {
            "name": "maxresults",
            "in": "query",
            "description": "Maximum number of results to return in a page. If not specified the service will return up to 25 results.",
            "required": false,
            "type": "integer",
            "format": "int32",
            "minimum": 1,
            "maximum": 25
          }
        ],
        "responses": {
          "200": {
            "description": "The request has succeeded.",
            "schema": {
              "$ref": "#/definitions/SecretListResult"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "GetSecretVersions": {
            "$ref": "./examples/GetSecretVersions-example.json"
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        }
      }
    },
    "/secrets/restore": {
      "post": {
        "operationId": "RestoreSecret",
        "summary": "Restores a backed up secret to a vault.",
        "description": "Restores a backed up secret, and all its versions, to a vault. This operation requires the secrets/restore permission.",
        "parameters": [
          {
            "$ref": "#/parameters/Azure.Core.Foundations.ApiVersionParameter"
          },
          {
            "name": "parameters",
            "in": "body",
            "description": "The parameters to restore the secret.",
            "required": true,
            "schema": {
              "$ref": "#/definitions/SecretRestoreParameters"
            },
            "x-ms-client-flatten": true
          }
        ],
        "responses": {
          "200": {
            "description": "The request has succeeded.",
            "schema": {
              "$ref": "#/definitions/SecretBundle"
            }
          },
          "default": {
            "description": "An unexpected error response.",
            "schema": {
              "$ref": "#/definitions/KeyVaultError"
            }
          }
        },
        "x-ms-examples": {
          "RestoreSecret": {
            "$ref": "./examples/RestoreSecret-example.json"
          }
        }
      }
    }
  },
  "definitions": {
    "Attributes": {
      "type": "object",
      "description": "The object attributes managed by the KeyVault service.",
      "properties": {
        "enabled": {
          "type": "boolean",
          "description": "Determines whether the object is enabled."
        },
        "nbf": {
          "type": "integer",
          "format": "unixtime",
          "description": "Not before date in UTC.",
          "x-ms-client-name": "NotBefore"
        },
        "exp": {
          "type": "integer",
          "format": "unixtime",
          "description": "Expiry date in UTC.",
          "x-ms-client-name": "Expires"
        },
        "created": {
          "type": "integer",
          "format": "unixtime",
          "description": "Creation time in UTC.",
          "readOnly": true
        },
        "updated": {
          "type": "integer",
          "format": "unixtime",
          "description": "Last updated time in UTC.",
          "readOnly": true
        }
      }
    },
    "BackupSecretResult": {
      "type": "object",
      "description": "The backup secret result, containing the backup blob.",
      "properties": {
        "value": {
          "type": "string",
          "format": "base64url",
          "description": "The backup blob containing the backed up secret.",
          "readOnly": true
        }
      }
    },
    "ContentType": {
      "type": "string",
      "description": "The media type (MIME type).",
      "enum": [
        "application/x-pkcs12",
        "application/x-pem-file"
      ],
      "x-ms-enum": {
        "name": "ContentType",
        "modelAsString": true,
        "values": [
          {
            "name": "PFX",
            "value": "application/x-pkcs12",
            "description": "The PKCS#12 file format."
          },
          {
            "name": "PEM",
            "value": "application/x-pem-file",
            "description": "The PEM file format."
          }
        ]
      }
    },
    "DeletedSecretBundle": {
      "type": "object",
      "description": "A Deleted Secret consisting of its previous id, attributes and its tags, as well as information on when it will be purged.",
      "properties": {
        "value": {
          "type": "string",
          "description": "The secret value."
        },
        "id": {
          "type": "string",
          "description": "The secret id."
        },
        "contentType": {
          "type": "string",
          "description": "The content type of the secret."
        },
        "attributes": {
          "$ref": "#/definitions/SecretAttributes",
          "description": "The secret management attributes."
        },
        "tags": {
          "type": "object",
          "description": "Application specific metadata in the form of key-value pairs.",
          "additionalProperties": {
            "type": "string"
          }
        },
        "kid": {
          "type": "string",
          "description": "If this is a secret backing a KV certificate, then this field specifies the corresponding key backing the KV certificate.",
          "readOnly": true
        },
        "managed": {
          "type": "boolean",
          "description": "True if the secret's lifetime is managed by key vault. If this is a secret backing a certificate, then managed will be true.",
          "readOnly": true
        },
        "previousVersion": {
          "type": "string",
          "description": "The version of the previous certificate, if applicable. Applies only to certificates created after June 1, 2025. Certificates created before this date are not retroactively updated."
        },
        "recoveryId": {
          "type": "string",
          "description": "The url of the recovery object, used to identify and recover the deleted secret."
        },
        "scheduledPurgeDate": {
          "type": "integer",
          "format": "unixtime",
          "description": "The time when the secret is scheduled to be purged, in UTC",
          "readOnly": true
        },
        "deletedDate": {
          "type": "integer",
          "format": "unixtime",
          "description": "The time when the secret was deleted, in UTC",
          "readOnly": true
        }
      }
    },
    "DeletedSecretItem": {
      "type": "object",
      "description": "The deleted secret item containing metadata about the deleted secret.",
      "properties": {
        "id": {
          "type": "string",
          "description": "Secret identifier."
        },
        "attributes": {
          "$ref": "#/definitions/SecretAttributes",
          "description": "The secret management attributes."
        },
        "tags": {
          "type": "object",
          "description": "Application specific metadata in the form of key-value pairs.",
          "additionalProperties": {
            "type": "string"
          }
        },
        "contentType": {
          "type": "string",
          "description": "Type of the secret value such as a password."
        },
        "managed": {
          "type": "boolean",
          "description": "True if the secret's lifetime is managed by key vault. If this is a key backing a certificate, then managed will be true.",
          "readOnly": true
        },
        "recoveryId": {
          "type": "string",
          "description": "The url of the recovery object, used to identify and recover the deleted secret."
        },
        "scheduledPurgeDate": {
          "type": "integer",
          "format": "unixtime",
          "description": "The time when the secret is scheduled to be purged, in UTC",
          "readOnly": true
        },
        "deletedDate": {
          "type": "integer",
          "format": "unixtime",
          "description": "The time when the secret was deleted, in UTC",
          "readOnly": true
        }
      }
    },
    "DeletedSecretListResult": {
      "type": "object",
      "description": "The deleted secret list result",
      "properties": {
        "value": {
          "type": "array",
          "description": "A response message containing a list of deleted secrets in the key vault along with a link to the next page of deleted secrets.",
          "items": {
            "$ref": "#/definitions/DeletedSecretItem"
          },
          "readOnly": true
        },
        "nextLink": {
          "type": "string",
          "description": "The URL to get the next set of deleted secrets.",
          "readOnly": true
        }
      }
    },
    "DeletionRecoveryLevel": {
      "type": "string",
      "description": "Reflects the deletion recovery level currently in effect for secrets in the current vault. If it contains 'Purgeable', the secret can be permanently deleted by a privileged user; otherwise, only the system can purge the secret, at the end of the retention interval.",
      "enum": [
        "Purgeable",
        "Recoverable+Purgeable",
        "Recoverable",
        "Recoverable+ProtectedSubscription",
        "CustomizedRecoverable+Purgeable",
        "CustomizedRecoverable",
        "CustomizedRecoverable+ProtectedSubscription"
      ],
      "x-ms-enum": {
        "name": "DeletionRecoveryLevel",
        "modelAsString": true,
        "values": [
          {
            "name": "Purgeable",
            "value": "Purgeable",
            "description": "Denotes a vault state in which deletion is an irreversible operation, without the possibility for recovery. This level corresponds to no protection being available against a Delete operation; the data is irretrievably lost upon accepting a Delete operation at the entity level or higher (vault, resource group, subscription etc.)"
          },
          {
            "name": "RecoverablePurgeable",
            "value": "Recoverable+Purgeable",
            "description": "Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days), unless a Purge operation is requested, or the subscription is cancelled. System wil permanently delete it after 90 days, if not recovered"
          },
          {
            "name": "Recoverable",
            "value": "Recoverable",
            "description": "Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge). This level guarantees the recoverability of the deleted entity during the retention interval (90 days) and while the subscription is still available. System wil permanently delete it after 90 days, if not recovered"
          },
          {
            "name": "RecoverableProtectedSubscription",
            "value": "Recoverable+ProtectedSubscription",
            "description": "Denotes a vault and subscription state in which deletion is recoverable within retention interval (90 days), immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself  cannot be permanently canceled. System wil permanently delete it after 90 days, if not recovered"
          },
          {
            "name": "CustomizedRecoverablePurgeable",
            "value": "CustomizedRecoverable+Purgeable",
            "description": "Denotes a vault state in which deletion is recoverable, and which also permits immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90). This level guarantees the recoverability of the deleted entity during the retention interval, unless a Purge operation is requested, or the subscription is cancelled."
          },
          {
            "name": "CustomizedRecoverable",
            "value": "CustomizedRecoverable",
            "description": "Denotes a vault state in which deletion is recoverable without the possibility for immediate and permanent deletion (i.e. purge when 7 <= SoftDeleteRetentionInDays < 90).This level guarantees the recoverability of the deleted entity during the retention interval and while the subscription is still available."
          },
          {
            "name": "CustomizedRecoverableProtectedSubscription",
            "value": "CustomizedRecoverable+ProtectedSubscription",
            "description": "Denotes a vault and subscription state in which deletion is recoverable, immediate and permanent deletion (i.e. purge) is not permitted, and in which the subscription itself cannot be permanently canceled when 7 <= SoftDeleteRetentionInDays < 90. This level guarantees the recoverability of the deleted entity during the retention interval, and also reflects the fact that the subscription itself cannot be cancelled."
          }
        ]
      }
    },
    "Error": {
      "type": "object",
      "properties": {
        "code": {
          "type": "string",
          "description": "The error code.",
          "readOnly": true
        },
        "message": {
          "type": "string",
          "description": "The error message.",
          "readOnly": true
        },
        "innererror": {
          "$ref": "#/definitions/Error",
          "description": "The key vault server error.",
          "readOnly": true,
          "x-ms-client-name": "innerError"
        }
      },
      "x-nullable": true
    },
    "KeyVaultError": {
      "type": "object",
      "description": "The key vault error exception.",
      "properties": {
        "error": {
          "$ref": "#/definitions/Error",
          "description": "The key vault server error.",
          "readOnly": true
        }
      }
    },
    "SecretAttributes": {
      "type": "object",
      "description": "The secret management attributes.",
      "properties": {
        "enabled": {
          "type": "boolean",
          "description": "Determines whether the object is enabled."
        },
        "nbf": {
          "type": "integer",
          "format": "unixtime",
          "description": "Not before date in UTC.",
          "x-ms-client-name": "NotBefore"
        },
        "exp": {
          "type": "integer",
          "format": "unixtime",
          "description": "Expiry date in UTC.",
          "x-ms-client-name": "Expires"
        },
        "created": {
          "type": "integer",
          "format": "unixtime",
          "description": "Creation time in UTC.",
          "readOnly": true
        },
        "updated": {
          "type": "integer",
          "format": "unixtime",
          "description": "Last updated time in UTC.",
          "readOnly": true
        },
        "recoverableDays": {
          "type": "integer",
          "format": "int32",
          "description": "softDelete data retention days. Value should be >=7 and <=90 when softDelete enabled, otherwise 0.",
          "readOnly": true
        },
        "recoveryLevel": {
          "$ref": "#/definitions/DeletionRecoveryLevel",
          "description": "Reflects the deletion recovery level currently in effect for secrets in the current vault. If it contains 'Purgeable', the secret can be permanently deleted by a privileged user; otherwise, only the system can purge the secret, at the end of the retention interval.",
          "readOnly": true
        }
      }
    },
    "SecretBundle": {
      "type": "object",
      "description": "A secret consisting of a value, id and its attributes.",
      "properties": {
        "value": {
          "type": "string",
          "description": "The secret value."
        },
        "id": {
          "type": "string",
          "description": "The secret id."
        },
        "contentType": {
          "type": "string",
          "description": "The content type of the secret."
        },
        "attributes": {
          "$ref": "#/definitions/SecretAttributes",
          "description": "The secret management attributes."
        },
        "tags": {
          "type": "object",
          "description": "Application specific metadata in the form of key-value pairs.",
          "additionalProperties": {
            "type": "string"
          }
        },
        "kid": {
          "type": "string",
          "description": "If this is a secret backing a KV certificate, then this field specifies the corresponding key backing the KV certificate.",
          "readOnly": true
        },
        "managed": {
          "type": "boolean",
          "description": "True if the secret's lifetime is managed by key vault. If this is a secret backing a certificate, then managed will be true.",
          "readOnly": true
        },
        "previousVersion": {
          "type": "string",
          "description": "The version of the previous certificate, if applicable. Applies only to certificates created after June 1, 2025. Certificates created before this date are not retroactively updated."
        }
      }
    },
    "SecretItem": {
      "type": "object",
      "description": "The secret item containing secret metadata.",
      "properties": {
        "id": {
          "type": "string",
          "description": "Secret identifier."
        },
        "attributes": {
          "$ref": "#/definitions/SecretAttributes",
          "description": "The secret management attributes."
        },
        "tags": {
          "type": "object",
          "description": "Application specific metadata in the form of key-value pairs.",
          "additionalProperties": {
            "type": "string"
          }
        },
        "contentType": {
          "type": "string",
          "description": "Type of the secret value such as a password."
        },
        "managed": {
          "type": "boolean",
          "description": "True if the secret's lifetime is managed by key vault. If this is a key backing a certificate, then managed will be true.",
          "readOnly": true
        }
      }
    },
    "SecretListResult": {
      "type": "object",
      "description": "The secret list result.",
      "properties": {
        "value": {
          "type": "array",
          "description": "A response message containing a list of secrets in the key vault along with a link to the next page of secrets.",
          "items": {
            "$ref": "#/definitions/SecretItem"
          },
          "readOnly": true
        },
        "nextLink": {
          "type": "string",
          "description": "The URL to get the next set of secrets.",
          "readOnly": true
        }
      }
    },
    "SecretProperties": {
      "type": "object",
      "description": "Properties of the key backing a certificate.",
      "properties": {
        "contentType": {
          "type": "string",
          "description": "The media type (MIME type)."
        }
      }
    },
    "SecretRestoreParameters": {
      "type": "object",
      "description": "The secret restore parameters.",
      "properties": {
        "value": {
          "type": "string",
          "format": "base64url",
          "description": "The backup blob associated with a secret bundle.",
          "x-ms-client-name": "secretBundleBackup"
        }
      },
      "required": [
        "value"
      ]
    },
    "SecretSetParameters": {
      "type": "object",
      "description": "The secret set parameters.",
      "properties": {
        "value": {
          "type": "string",
          "description": "The value of the secret."
        },
        "tags": {
          "type": "object",
          "description": "Application specific metadata in the form of key-value pairs.",
          "additionalProperties": {
            "type": "string"
          }
        },
        "contentType": {
          "type": "string",
          "description": "Type of the secret value such as a password."
        },
        "attributes": {
          "$ref": "#/definitions/SecretAttributes",
          "description": "The secret management attributes.",
          "x-ms-client-name": "secretAttributes"
        }
      },
      "required": [
        "value"
      ]
    },
    "SecretUpdateParameters": {
      "type": "object",
      "description": "The secret update parameters.",
      "properties": {
        "contentType": {
          "type": "string",
          "description": "Type of the secret value such as a password."
        },
        "attributes": {
          "$ref": "#/definitions/SecretAttributes",
          "description": "The secret management attributes.",
          "x-ms-client-name": "secretAttributes"
        },
        "tags": {
          "type": "object",
          "description": "Application specific metadata in the form of key-value pairs.",
          "additionalProperties": {
            "type": "string"
          }
        }
      }
    }
  },
  "parameters": {
    "Azure.Core.Foundations.ApiVersionParameter": {
      "name": "api-version",
      "in": "query",
      "description": "The API version to use for this operation.",
      "required": true,
      "type": "string",
      "minLength": 1,
      "x-ms-parameter-location": "method",
      "x-ms-client-name": "apiVersion"
    }
  }
}