---
title: "The update key operation changes specified attributes of a stored key and can be applied to any key type and key version stored in Azure Key Vault."
method: PATCH
path: "/keys/{key-name}/{key-version}"
---

# The update key operation changes specified attributes of a stored key and can be applied to any key type and key version stored in Azure Key Vault.

`PATCH /keys/{key-name}/{key-version}`

In order to perform this operation, the key must already exist in the Key Vault. Note: The cryptographic material of a key itself cannot be changed. This operation requires the keys/update permission.

## Path parameters

- `key-name` string, required
- `key-version` string, required

## Query parameters

- `api-version` string, required

## Request body

- KeyUpdateParameters — The key update parameters.
  - `key_ops` JsonWebKeyOperation[] — Json web key operations. For more information on possible key operations, see JsonWebKeyOperation.
  - `attributes` KeyAttributes — The attributes of a key managed by the key vault service.
    - `enabled` boolean — Determines whether the object is enabled.
    - `nbf` integer — Not before date in UTC.
    - `exp` integer — Expiry date in UTC.
    - `created` integer — Creation time in UTC.
    - `updated` integer — Last updated time in UTC.
    - `recoverableDays` integer — softDelete data retention days. Value should be >=7 and <=90 when softDelete enabled, otherwise 0.
    - `recoveryLevel` 'Purgeable' | 'Recoverable+Purgeable' | 'Recoverable' | 'Recoverable+ProtectedSubscription' | 'CustomizedRecoverable+Purgeable' | 'CustomizedRecoverable' | 'CustomizedRecoverable+ProtectedSubscription' — Reflects the deletion recovery level currently in effect for certificates in the current vault. If it contains 'Purgeable', the certificate can be permanently deleted by a privileged user; otherwise, only the system can purge the certificate, at the end of the retention interval.
    - `exportable` boolean — Indicates if the private key can be exported. Release policy must be provided when creating the first version of an exportable key.
    - `hsmPlatform` string — The underlying HSM Platform.
    - `attestation` KeyAttestation — The key attestation information.
      - `certificatePemFile` string, base64url — A base64url-encoded string containing certificates in PEM format, used for attestation validation.
      - `privateKeyAttestation` string, base64url — The attestation blob bytes encoded as base64url string corresponding to a private key.
      - `publicKeyAttestation` string, base64url — The attestation blob bytes encoded as base64url string corresponding to a public key in case of asymmetric key.
      - `version` string — The version of the attestation.
  - `tags` object — Application specific metadata in the form of key-value pairs.
  - `release_policy` KeyReleasePolicy — The policy rules under which the key can be exported.
    - `contentType` string — Content type and version of key release policy
    - `immutable` boolean — Defines the mutability state of the policy. Once marked immutable, this flag cannot be reset and the policy cannot be changed under any circumstances.
    - `data` string, base64url — Blob encoding the policy rules under which the key can be released. Blob must be base64 URL encoded.

## Response `200`

The request has succeeded.

- KeyBundle — A KeyBundle consisting of a WebKey plus its attributes.
  - `key` JsonWebKey — As of http://tools.ietf.org/html/draft-ietf-jose-json-web-key-18
    - `kid` string — Key identifier.
    - `kty` 'EC' | 'EC-HSM' | 'RSA' | 'RSA-HSM' | 'oct' | 'oct-HSM' — JsonWebKey Key Type (kty), as defined in https://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-40.
    - `key_ops` string[] — Json web key operations. For more information on possible key operations, see JsonWebKeyOperation.
    - `n` string, base64url — RSA modulus.
    - `e` string, base64url — RSA public exponent.
    - `d` string, base64url — RSA private exponent, or the D component of an EC private key.
    - `dp` string, base64url — RSA private key parameter.
    - `dq` string, base64url — RSA private key parameter.
    - `qi` string, base64url — RSA private key parameter.
    - `p` string, base64url — RSA secret prime.
    - `q` string, base64url — RSA secret prime, with p < q.
    - `k` string, base64url — Symmetric key.
    - `key_hsm` string, base64url — Protected Key, used with 'Bring Your Own Key'.
    - `crv` 'P-256' | 'P-384' | 'P-521' | 'P-256K' — Elliptic curve name. For valid values, see JsonWebKeyCurveName.
    - `x` string, base64url — X component of an EC public key.
    - `y` string, base64url — Y component of an EC public key.
  - `attributes` KeyAttributes — The attributes of a key managed by the key vault service.
    - `enabled` boolean — Determines whether the object is enabled.
    - `nbf` integer — Not before date in UTC.
    - `exp` integer — Expiry date in UTC.
    - `created` integer — Creation time in UTC.
    - `updated` integer — Last updated time in UTC.
    - `recoverableDays` integer — softDelete data retention days. Value should be >=7 and <=90 when softDelete enabled, otherwise 0.
    - `recoveryLevel` 'Purgeable' | 'Recoverable+Purgeable' | 'Recoverable' | 'Recoverable+ProtectedSubscription' | 'CustomizedRecoverable+Purgeable' | 'CustomizedRecoverable' | 'CustomizedRecoverable+ProtectedSubscription' — Reflects the deletion recovery level currently in effect for certificates in the current vault. If it contains 'Purgeable', the certificate can be permanently deleted by a privileged user; otherwise, only the system can purge the certificate, at the end of the retention interval.
    - `exportable` boolean — Indicates if the private key can be exported. Release policy must be provided when creating the first version of an exportable key.
    - `hsmPlatform` string — The underlying HSM Platform.
    - `attestation` KeyAttestation — The key attestation information.
      - `certificatePemFile` string, base64url — A base64url-encoded string containing certificates in PEM format, used for attestation validation.
      - `privateKeyAttestation` string, base64url — The attestation blob bytes encoded as base64url string corresponding to a private key.
      - `publicKeyAttestation` string, base64url — The attestation blob bytes encoded as base64url string corresponding to a public key in case of asymmetric key.
      - `version` string — The version of the attestation.
  - `tags` object — Application specific metadata in the form of key-value pairs.
  - `managed` boolean — True if the key's lifetime is managed by key vault. If this is a key backing a certificate, then managed will be true.
  - `release_policy` KeyReleasePolicy — The policy rules under which the key can be exported.
    - `contentType` string — Content type and version of key release policy
    - `immutable` boolean — Defines the mutability state of the policy. Once marked immutable, this flag cannot be reset and the policy cannot be changed under any circumstances.
    - `data` string, base64url — Blob encoding the policy rules under which the key can be released. Blob must be base64 URL encoded.

## Other responses

- `default` — An unexpected error response.

---

[API](https://skmtc.net/azure/apis/keyvault-keys.md) · [All operations](https://skmtc.net/azure/apis/keyvault-keys/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/azure/keyvault-keys/versions/7bedded21050/schema)