specification: API Commons Plans
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/Plans
provider: Azure Key Vault
providerId: azure-key-vault
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: true
tags:
  - Security
  - Secrets Management
  - Key Management
  - HSM
  - Cryptography
description: Azure Key Vault is metered as per-operation transactions for secrets, certificates, and
  software-protected keys (Standard tier), HSM-protected keys (Premium tier), and managed HSM (single-tenant
  pool with hourly partition pricing). Renewals and certificates have separate per-operation charges.
  Pricing is per 10,000 transactions; managed HSM is billed per partition-hour. See Azure Key Vault pricing
  page for the exact per-region rates.
sources:
  - https://azure.microsoft.com/en-us/pricing/details/key-vault/
  - https://learn.microsoft.com/en-us/azure/key-vault/general/service-limits
plans:
  - id: azure-key-vault-standard
    name: Key Vault Standard
    type: usage-based
    description: Secrets, software-protected keys, certificate operations. Metered per 10,000 operations.
    entries:
      - label: Secret operations
        name: secret_ops
        type: metered
        metric: operation
        limit: -1
        timeFrame: usage
        geo: global
        unit: 10000
        price: see Azure Key Vault pricing page
        userMultiplied: false
      - label: Software-protected key operations
        name: software_key_ops
        type: metered
        metric: operation
        limit: -1
        timeFrame: usage
        geo: global
        unit: 10000
        price: see Azure Key Vault pricing page
        userMultiplied: false
      - label: Certificate operations
        name: cert_ops
        type: metered
        metric: operation
        limit: -1
        timeFrame: usage
        geo: global
        unit: 10000
        price: see Azure Key Vault pricing page
        userMultiplied: false
      - label: Certificate renewals
        name: cert_renewal
        type: metered
        metric: renewal
        limit: -1
        timeFrame: usage
        geo: global
        unit: 1
        price: see Azure Key Vault pricing page
        userMultiplied: false
    elements:
      - name: Secrets storage
      - name: Software-protected RSA, EC keys
      - name: Certificate lifecycle
      - name: Per-operation metering
  - id: azure-key-vault-premium
    name: Key Vault Premium
    type: usage-based
    description: Adds HSM-protected keys (FIPS 140-2 Level 2). HSM key operations and HSM-protected key
      storage carry uplifted per-operation rates.
    entries:
      - label: HSM-protected key operations
        name: hsm_key_ops
        type: metered
        metric: operation
        limit: -1
        timeFrame: usage
        geo: global
        unit: 10000
        price: see Azure Key Vault pricing page
        userMultiplied: false
      - label: HSM-protected key storage (per key/month)
        name: hsm_key_storage
        type: metered
        metric: key
        limit: -1
        timeFrame: month
        geo: global
        unit: 1
        price: see Azure Key Vault pricing page
        userMultiplied: false
      - label: All Standard meters
        name: standard_inherited
        type: metered
        metric: operation
        limit: -1
        timeFrame: usage
        geo: global
        unit: 10000
        price: see Azure Key Vault pricing page
        userMultiplied: false
    elements:
      - name: HSM-protected RSA, EC keys (FIPS 140-2 Level 2)
      - name: All Standard features
  - id: azure-key-vault-managed-hsm
    name: Managed HSM
    type: usage-based
    description: Single-tenant FIPS 140-2 Level 3 HSM pool. Billed per partition-hour rather than per-operation.
      Supports up to 5 instances per subscription per region, 5,000 keys per HSM.
    entries:
      - label: Managed HSM partition
        name: managed_hsm
        type: metered
        metric: partition-hour
        limit: -1
        timeFrame: usage
        geo: global
        unit: 1
        price: see Azure Key Vault pricing page (hourly per active HSM pool)
        userMultiplied: false
    elements:
      - name: FIPS 140-2 Level 3 HSM
      - name: Single-tenant
      - name: Up to 5,000 keys per HSM
      - name: BYOK / HYOK support
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com
x-canonical:
  generated: '2026-10-08'
  vocabulary: all/0-working/economics/plans-canonical.yml
  models:
  - metered
  units:
  - compute
  - object
  - request
  plans:
  - name: Key Vault Standard
    access: other
    model: metered
    model_how: stated
    units:
    - other
    - request
    periods:
    - per-use
  - name: Key Vault Premium
    access: other
    model: metered
    model_how: stated
    units:
    - object
    - request
    periods:
    - month
    - per-use
  - name: Managed HSM
    access: other
    model: metered
    model_how: stated
    units:
    - compute
    periods:
    - per-use
  - name: Standard
    access: other
    model: metered
    model_how: stated
    units:
    - other
    - request
    periods:
    - per-use
  - name: Premium
    access: other
    model: metered
    model_how: stated
    units:
    - object
    - request
    periods:
    - month
    - per-use
  - name: Managed HSM
    access: other
    model: metered
    model_how: stated
    units:
    - compute
    - request
    periods:
    - hour
    - per-use