---
title: "Restores a backed up key to a vault."
method: POST
path: "/keys/restore"
---

# Restores a backed up key to a vault.

`POST /keys/restore`

Imports a previously backed up key into Azure Key Vault, restoring the key, its key identifier, attributes and access control policies. The RESTORE operation may be used to import a previously backed up key. Individual versions of a key cannot be restored. The key is restored in its entirety with the same key name as it had when it was backed up. If the key name is not available in the target Key Vault, the RESTORE operation will be rejected. While the key name is retained during restore, the final key identifier will change if the key is restored to a different vault. Restore will restore all versions and preserve version identifiers. The RESTORE operation is subject to security constraints: The target Key Vault must be owned by the same Microsoft Azure Subscription as the source Key Vault The user must have RESTORE permission in the target Key Vault. This operation requires the keys/restore permission.

## Query parameters

- `api-version` string, required

## Request body

- KeyRestoreParameters — The key restore parameters.
  - `value` string, base64url, required — The backup blob associated with a key bundle.

## Response `200`

The request has succeeded.

- KeyBundle — A KeyBundle consisting of a WebKey plus its attributes.
  - `key` JsonWebKey — As of http://tools.ietf.org/html/draft-ietf-jose-json-web-key-18
    - `kid` string — Key identifier.
    - `kty` 'EC' | 'EC-HSM' | 'RSA' | 'RSA-HSM' | 'oct' | 'oct-HSM' — JsonWebKey Key Type (kty), as defined in https://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-40.
    - `key_ops` string[] — Json web key operations. For more information on possible key operations, see JsonWebKeyOperation.
    - `n` string, base64url — RSA modulus.
    - `e` string, base64url — RSA public exponent.
    - `d` string, base64url — RSA private exponent, or the D component of an EC private key.
    - `dp` string, base64url — RSA private key parameter.
    - `dq` string, base64url — RSA private key parameter.
    - `qi` string, base64url — RSA private key parameter.
    - `p` string, base64url — RSA secret prime.
    - `q` string, base64url — RSA secret prime, with p < q.
    - `k` string, base64url — Symmetric key.
    - `key_hsm` string, base64url — Protected Key, used with 'Bring Your Own Key'.
    - `crv` 'P-256' | 'P-384' | 'P-521' | 'P-256K' — Elliptic curve name. For valid values, see JsonWebKeyCurveName.
    - `x` string, base64url — X component of an EC public key.
    - `y` string, base64url — Y component of an EC public key.
  - `attributes` KeyAttributes — The attributes of a key managed by the key vault service.
    - `enabled` boolean — Determines whether the object is enabled.
    - `nbf` integer — Not before date in UTC.
    - `exp` integer — Expiry date in UTC.
    - `created` integer — Creation time in UTC.
    - `updated` integer — Last updated time in UTC.
    - `recoverableDays` integer — softDelete data retention days. Value should be >=7 and <=90 when softDelete enabled, otherwise 0.
    - `recoveryLevel` 'Purgeable' | 'Recoverable+Purgeable' | 'Recoverable' | 'Recoverable+ProtectedSubscription' | 'CustomizedRecoverable+Purgeable' | 'CustomizedRecoverable' | 'CustomizedRecoverable+ProtectedSubscription' — Reflects the deletion recovery level currently in effect for certificates in the current vault. If it contains 'Purgeable', the certificate can be permanently deleted by a privileged user; otherwise, only the system can purge the certificate, at the end of the retention interval.
    - `exportable` boolean — Indicates if the private key can be exported. Release policy must be provided when creating the first version of an exportable key.
    - `hsmPlatform` string — The underlying HSM Platform.
    - `attestation` KeyAttestation — The key attestation information.
      - `certificatePemFile` string, base64url — A base64url-encoded string containing certificates in PEM format, used for attestation validation.
      - `privateKeyAttestation` string, base64url — The attestation blob bytes encoded as base64url string corresponding to a private key.
      - `publicKeyAttestation` string, base64url — The attestation blob bytes encoded as base64url string corresponding to a public key in case of asymmetric key.
      - `version` string — The version of the attestation.
  - `tags` object — Application specific metadata in the form of key-value pairs.
  - `managed` boolean — True if the key's lifetime is managed by key vault. If this is a key backing a certificate, then managed will be true.
  - `release_policy` KeyReleasePolicy — The policy rules under which the key can be exported.
    - `contentType` string — Content type and version of key release policy
    - `immutable` boolean — Defines the mutability state of the policy. Once marked immutable, this flag cannot be reset and the policy cannot be changed under any circumstances.
    - `data` string, base64url — Blob encoding the policy rules under which the key can be released. Blob must be base64 URL encoded.

## Other responses

- `default` — An unexpected error response.

---

[API](https://skmtc.net/azure/apis/keyvault-keys.md) · [All operations](https://skmtc.net/azure/apis/keyvault-keys/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/azure/keyvault-keys/versions/7bedded21050/schema)