---
title: "Decrypts a single block of encrypted data."
method: POST
path: "/keys/{key-name}/{key-version}/decrypt"
---

# Decrypts a single block of encrypted data.

`POST /keys/{key-name}/{key-version}/decrypt`

The DECRYPT operation decrypts a well-formed block of ciphertext using the target encryption key and specified algorithm. This operation is the reverse of the ENCRYPT operation; only a single block of data may be decrypted, the size of this block is dependent on the target key and the algorithm to be used. The DECRYPT operation applies to asymmetric and symmetric keys stored in Azure Key Vault since it uses the private portion of the key. This operation requires the keys/decrypt permission. Microsoft recommends not to use CBC algorithms for decryption without first ensuring the integrity of the ciphertext using an HMAC, for example. See https://learn.microsoft.com/dotnet/standard/security/vulnerabilities-cbc-mode for more information.

## Path parameters

- `key-name` string, required
- `key-version` string, required

## Query parameters

- `api-version` string, required

## Request body

- KeyOperationsParameters — The key operations parameters.
  - `alg` 'RSA-OAEP' | 'RSA-OAEP-256' | 'RSA1_5' | 'A128GCM' | 'A192GCM' | 'A256GCM' | 'A128KW' | 'A192KW' | 'A256KW' | 'A128CBC' | 'A192CBC' | 'A256CBC' | 'A128CBCPAD' | 'A192CBCPAD' | 'A256CBCPAD' | 'CKM_AES_KEY_WRAP' | 'CKM_AES_KEY_WRAP_PAD', required — An algorithm used for encryption and decryption.
  - `value` string, base64url, required — The value to operate on.
  - `iv` string, base64url — Cryptographically random, non-repeating initialization vector for symmetric algorithms.
  - `aad` string, base64url — Additional data to authenticate but not encrypt/decrypt when using authenticated crypto algorithms.
  - `tag` string, base64url — The tag to authenticate when performing decryption with an authenticated algorithm.

## Response `200`

The request has succeeded.

- KeyOperationResult — The key operation result.
  - `kid` string — Key identifier
  - `value` string, base64url — The result of the operation.
  - `iv` string, base64url — Cryptographically random, non-repeating initialization vector for symmetric algorithms.
  - `tag` string, base64url — The tag to authenticate when performing decryption with an authenticated algorithm.
  - `aad` string, base64url — Additional data to authenticate but not encrypt/decrypt when using authenticated crypto algorithms.

## Other responses

- `default` — An unexpected error response.

---

[API](https://skmtc.net/azure/apis/keyvault-keys.md) · [All operations](https://skmtc.net/azure/apis/keyvault-keys/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/azure/keyvault-keys/versions/7bedded21050/schema)