wrap Key - wrap Key

Service:

Key Vault

API Version:

7.4

Wraps a symmetric key using a specified key.
The WRAP operation supports encryption of a symmetric key using a key encryption key that has previously been stored in an Azure Key Vault. The WRAP operation is only strictly necessary for symmetric keys stored in Azure Key Vault since protection with an asymmetric key can be performed using the public portion of the key. This operation is supported for asymmetric keys as a convenience for callers that have a key-reference but do not have access to the public key material. This operation requires the keys/wrapKey permission.

POST {vaultBaseUrl}/keys/{key-name}/{key-version}/wrapkey?api-version=7.4

URI Parameters

Name	In	Required	Type	Description
key-name	path	True	string	The name of the key.
key-version	path	True	string	The version of the key.
vaultBaseUrl	path	True	string	The vault name, for example https://myvault.vault.azure.net.
api-version	query	True	string	Client API version.

Request Body

Name	Required	Type	Description
alg	True	JsonWebKeyEncryptionAlgorithm	algorithm identifier
value	True	string
aad		string	Additional data to authenticate but not encrypt/decrypt when using authenticated crypto algorithms.
iv		string	Cryptographically random, non-repeating initialization vector for symmetric algorithms.
tag		string	The tag to authenticate when performing decryption with an authenticated algorithm.

Responses

Name	Type	Description
200 OK	KeyOperationResult	The wrapped symmetric key.
Other Status Codes	KeyVaultError	Key Vault error response describing why the operation failed.

Examples

Wrapkey

Sample Request

HTTP

POST https://myvault.vault.azure.net//keys/sdktestkey/0698c2156c1a4e1da5b6bab6f6422fd6/wrapkey?api-version=7.4

{
  "alg": "RSA1_5",
  "value": "ovQIlbB0DgWhZA7sgkPxbg9H-Ly-VlNGPSgGrrZvlIo"
}

Sample Response

Status code:

200

{
  "kid": "https://myvault.vault.azure.net/keys/sdktestkey/0698c2156c1a4e1da5b6bab6f6422fd6",
  "value": "khwIe26NuAZazS7upywDBpGRmRNMW5-4h_JQKxOdB78nYVxZWnBXwCxOv7a3Sr_mCjiVzKsoQQZwL-CJzhYa0512tfYem56zls5a44y5QsdcfvuSzOvpthVhA9XkEfCJSqSY_sip5d8BelT_w_ikvd_8KqiQ_0H54RqYUN8svCpu28paHgBocHFNXTQ9NtU9ec2qgESXk7Jp4OTy9HJtQJavKDUqTJ3YmtLxUgsgBCe0FNMHUSEYC0Ys6PavYzdTwIzYCq84idmAxJOj-O_6eALJFH2sDTOQYHjzOae2t8eFmw6C-t55qjrCI91a9mUJEGPhYixiG4gR4PaEJ7wGvw"
}

Definitions

Name	Description
Error	The key vault server error.
JsonWebKeyEncryptionAlgorithm	algorithm identifier
KeyOperationResult	The key operation result.
KeyOperationsParameters	The key operations parameters.
KeyVaultError	The key vault error exception.

Error

The key vault server error.

Name	Type	Description
code	string	The error code.
innererror	Error	The key vault server error.
message	string	The error message.

JsonWebKeyEncryptionAlgorithm

algorithm identifier

Name	Type	Description
A128CBC	string
A128CBCPAD	string
A128GCM	string
A128KW	string
A192CBC	string
A192CBCPAD	string
A192GCM	string
A192KW	string
A256CBC	string
A256CBCPAD	string
A256GCM	string
A256KW	string
RSA-OAEP	string
RSA-OAEP-256	string
RSA1_5	string

KeyOperationResult

The key operation result.

Name	Type	Description
aad	string
iv	string
kid	string	Key identifier
tag	string
value	string

KeyOperationsParameters

The key operations parameters.

Name	Type	Description
aad	string	Additional data to authenticate but not encrypt/decrypt when using authenticated crypto algorithms.
alg	JsonWebKeyEncryptionAlgorithm	algorithm identifier
iv	string	Cryptographically random, non-repeating initialization vector for symmetric algorithms.
tag	string	The tag to authenticate when performing decryption with an authenticated algorithm.
value	string

KeyVaultError

The key vault error exception.

Name	Type	Description
error	Error	The key vault server error.