---
title: "Unwraps a symmetric key using the specified key that was initially used for wrapping that key."
method: POST
path: "/keys/{key-name}/{key-version}/unwrapkey"
tags: ["Keys"]
---

# Unwraps a symmetric key using the specified key that was initially used for wrapping that key.

`POST /keys/{key-name}/{key-version}/unwrapkey`

The UNWRAP operation supports decryption of a symmetric key using the target key encryption key. This operation is the reverse of the WRAP operation. The UNWRAP operation applies to asymmetric and symmetric keys stored in Azure Key Vault since it uses the private portion of the key. This operation requires the keys/unwrapKey permission.

## Path parameters

- `key-name` string, required
- `key-version` string, required

## Query parameters

- `api-version` string, required

## Request body

- KeyOperationsParameters — The key operations parameters.
  - `alg` 'RSA-OAEP' | 'RSA-OAEP-256' | 'RSA1_5', required — algorithm identifier
  - `value` string, base64url, required

## Response `200`

The unwrapped symmetric key.

- KeyOperationResult — The key operation result.
  - `kid` string — Key identifier
  - `value` string, base64url

## Other responses

- `default` — Key Vault error response describing why the operation failed.

---

[API](https://skmtc.net/azure/apis/keyvaultclient.md) · [All operations](https://skmtc.net/azure/apis/keyvaultclient/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/azure/keyvaultclient/revisions/1f612999ec40/schema)