Azure Key Vault

Azure Key Vault is Microsoft's managed key store: an RSA key created inside a vault can encrypt and decrypt on request but can never be exported, so a workflow can protect data with it without ever holding the private key.

Authentication

• Microsoft Entra ID (client credentials)

Actions

Generic API request. Call any Azure Key Vault data-plane endpoint on this connection, for the case where no shipped action covers it yet. The connection supplies the vault base URL, the authentication, the api-version query parameter and the egress route, so only the path, query and body are yours to fill.

• List keysList the keys held in the vault this connection is pinned to, so you can discover a key name to pass to azurekeyvault:wrapkey or azurekeyvault:unwrapkey.
• Unwrap keyRecover a symmetric key that azurekeyvault:wrapkey previously wrapped, so a workflow can use it without the RSA private key ever leaving the vault.
• Wrap keyEncrypt a symmetric key under an RSA key held in the vault, so the wrapped value can be stored next to the data it protects while the unwrapping key never leaves Azure.

Product names, logos and brands are the property of their respective owners and are used here for identification only. Their use does not imply endorsement by, or affiliation with, those owners.