---
title: "The update key operation changes specified attributes of a stored key and can be applied to any key type and key version stored in Azure Key Vault."
method: PATCH
path: "/keys/{key-name}/{key-version}"
tags: ["Keys"]
---

# The update key operation changes specified attributes of a stored key and can be applied to any key type and key version stored in Azure Key Vault.

`PATCH /keys/{key-name}/{key-version}`

In order to perform this operation, the key must already exist in the Key Vault. Note: The cryptographic material of a key itself cannot be changed. This operation requires the keys/update permission.

## Path parameters

- `key-name` string, required
- `key-version` string, required

## Query parameters

- `api-version` string, required

## Request body

- KeyUpdateParameters — The key update parameters.
  - `key_ops` string[] — Json web key operations. For more information on possible key operations, see JsonWebKeyOperation.
  - `attributes` KeyAttributes — The object attributes managed by the KeyVault service.
    - `enabled` boolean — Determines whether the object is enabled.
    - `nbf` integer — Not before date in UTC.
    - `exp` integer — Expiry date in UTC.
    - `created` integer — Creation time in UTC.
    - `updated` integer — Last updated time in UTC.
  - `tags` object — Application specific metadata in the form of key-value pairs.

## Response `200`

The updated key.

- KeyBundle — A KeyBundle consisting of a WebKey plus its attributes.
  - `key` JsonWebKey — As of http://tools.ietf.org/html/draft-ietf-jose-json-web-key-18
    - `kid` string — Key identifier.
    - `kty` 'EC' | 'EC-HSM' | 'RSA' | 'RSA-HSM' | 'oct' — JsonWebKey Key Type (kty), as defined in https://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-40.
    - `key_ops` string[]
    - `n` string, base64url — RSA modulus.
    - `e` string, base64url — RSA public exponent.
    - `d` string, base64url — RSA private exponent, or the D component of an EC private key.
    - `dp` string, base64url — RSA private key parameter.
    - `dq` string, base64url — RSA private key parameter.
    - `qi` string, base64url — RSA private key parameter.
    - `p` string, base64url — RSA secret prime.
    - `q` string, base64url — RSA secret prime, with p < q.
    - `k` string, base64url — Symmetric key.
    - `key_hsm` string, base64url — HSM Token, used with 'Bring Your Own Key'.
    - `crv` 'P-256' | 'P-384' | 'P-521' | 'P-256K' — Elliptic curve name. For valid values, see JsonWebKeyCurveName.
    - `x` string, base64url — X component of an EC public key.
    - `y` string, base64url — Y component of an EC public key.
  - `attributes` KeyAttributes — The object attributes managed by the KeyVault service.
    - `enabled` boolean — Determines whether the object is enabled.
    - `nbf` integer — Not before date in UTC.
    - `exp` integer — Expiry date in UTC.
    - `created` integer — Creation time in UTC.
    - `updated` integer — Last updated time in UTC.
  - `tags` object — Application specific metadata in the form of key-value pairs.
  - `managed` boolean — True if the key's lifetime is managed by key vault. If this is a key backing a certificate, then managed will be true.

## Other responses

- `default` — Key Vault error response describing why the operation failed.

---

[API](https://skmtc.net/azure/apis/keyvaultclient.md) · [All operations](https://skmtc.net/azure/apis/keyvaultclient/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/azure/keyvaultclient/revisions/1f612999ec40/schema)