---
title: "Lists the deleted keys in the specified vault."
method: GET
path: "/deletedkeys"
---

# Lists the deleted keys in the specified vault.

`GET /deletedkeys`

Retrieves a list of the keys in the Key Vault as JSON Web Key structures that contain the public part of a deleted key. This operation includes deletion-specific information. The Get Deleted Keys operation is applicable for vaults enabled for soft-delete. While the operation can be invoked on any vault, it will return an error if invoked on a non soft-delete enabled vault. This operation requires the keys/list permission.

## Query parameters

- `api-version` string, required
- `maxresults` integer

## Response `200`

The request has succeeded.

- DeletedKeyListResult — A list of keys that have been deleted in this vault.
  - `value` DeletedKeyItem[] — A response message containing a list of deleted keys in the key vault along with a link to the next page of deleted keys.
    - `kid` string — Key identifier.
    - `attributes` KeyAttributes — The attributes of a key managed by the key vault service.
      - `enabled` boolean — Determines whether the object is enabled.
      - `nbf` integer — Not before date in UTC.
      - `exp` integer — Expiry date in UTC.
      - `created` integer — Creation time in UTC.
      - `updated` integer — Last updated time in UTC.
      - `recoverableDays` integer — softDelete data retention days. Value should be >=7 and <=90 when softDelete enabled, otherwise 0.
      - `recoveryLevel` 'Purgeable' | 'Recoverable+Purgeable' | 'Recoverable' | 'Recoverable+ProtectedSubscription' | 'CustomizedRecoverable+Purgeable' | 'CustomizedRecoverable' | 'CustomizedRecoverable+ProtectedSubscription' — Reflects the deletion recovery level currently in effect for certificates in the current vault. If it contains 'Purgeable', the certificate can be permanently deleted by a privileged user; otherwise, only the system can purge the certificate, at the end of the retention interval.
      - `exportable` boolean — Indicates if the private key can be exported. Release policy must be provided when creating the first version of an exportable key.
      - `hsmPlatform` string — The underlying HSM Platform.
      - `attestation` KeyAttestation — The key attestation information.
        - `certificatePemFile` string, base64url — A base64url-encoded string containing certificates in PEM format, used for attestation validation.
        - `privateKeyAttestation` string, base64url — The attestation blob bytes encoded as base64url string corresponding to a private key.
        - `publicKeyAttestation` string, base64url — The attestation blob bytes encoded as base64url string corresponding to a public key in case of asymmetric key.
        - `version` string — The version of the attestation.
    - `tags` object — Application specific metadata in the form of key-value pairs.
    - `managed` boolean — True if the key's lifetime is managed by key vault. If this is a key backing a certificate, then managed will be true.
    - `recoveryId` string — The url of the recovery object, used to identify and recover the deleted key.
    - `scheduledPurgeDate` integer — The time when the key is scheduled to be purged, in UTC
    - `deletedDate` integer — The time when the key was deleted, in UTC
  - `nextLink` string — The URL to get the next set of deleted keys.

## Other responses

- `default` — An unexpected error response.

---

[API](https://skmtc.net/azure/apis/keyvault-keys.md) · [All operations](https://skmtc.net/azure/apis/keyvault-keys/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/azure/keyvault-keys/versions/7bedded21050/schema)