---
title: "Wraps a symmetric key using a specified key."
method: POST
path: "/keys/{key-name}/{key-version}/wrapkey"
tags: ["Keys"]
---

# Wraps a symmetric key using a specified key.

`POST /keys/{key-name}/{key-version}/wrapkey`

The WRAP operation supports encryption of a symmetric key using a key encryption key that has previously been stored in an Azure Key Vault. The WRAP operation is only strictly necessary for symmetric keys stored in Azure Key Vault since protection with an asymmetric key can be performed using the public portion of the key. This operation is supported for asymmetric keys as a convenience for callers that have a key-reference but do not have access to the public key material. This operation requires the keys/wrapKey permission.

## Path parameters

- `key-name` string, required
- `key-version` string, required

## Query parameters

- `api-version` string, required

## Request body

- KeyOperationsParameters — The key operations parameters.
  - `alg` 'RSA-OAEP' | 'RSA-OAEP-256' | 'RSA1_5', required — algorithm identifier
  - `value` string, base64url, required

## Response `200`

The wrapped symmetric key.

- KeyOperationResult — The key operation result.
  - `kid` string — Key identifier
  - `value` string, base64url

## Other responses

- `default` — Key Vault error response describing why the operation failed.

---

[API](https://skmtc.net/azure/apis/keyvaultclient.md) · [All operations](https://skmtc.net/azure/apis/keyvaultclient/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/azure/keyvaultclient/revisions/1f612999ec40/schema)