---
title: "Restores a backed up key to a vault."
method: POST
path: "/keys/restore"
tags: ["Keys"]
---

# Restores a backed up key to a vault.

`POST /keys/restore`

Imports a previously backed up key into Azure Key Vault, restoring the key, its key identifier, attributes and access control policies. The RESTORE operation may be used to import a previously backed up key. Individual versions of a key cannot be restored. The key is restored in its entirety with the same key name as it had when it was backed up. If the key name is not available in the target Key Vault, the RESTORE operation will be rejected. While the key name is retained during restore, the final key identifier will change if the key is restored to a different vault. Restore will restore all versions and preserve version identifiers. The RESTORE operation is subject to security constraints: The target Key Vault must be owned by the same Microsoft Azure Subscription as the source Key Vault The user must have RESTORE permission in the target Key Vault. This operation requires the keys/restore permission.

## Query parameters

- `api-version` string, required

## Request body

- KeyRestoreParameters — The key restore parameters.
  - `value` string, base64url, required — The backup blob associated with a key bundle.

## Response `200`

Restored key bundle in the vault.

- KeyBundle — A KeyBundle consisting of a WebKey plus its attributes.
  - `key` JsonWebKey — As of http://tools.ietf.org/html/draft-ietf-jose-json-web-key-18
    - `kid` string — Key identifier.
    - `kty` 'EC' | 'EC-HSM' | 'RSA' | 'RSA-HSM' | 'oct' — JsonWebKey Key Type (kty), as defined in https://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-40.
    - `key_ops` string[]
    - `n` string, base64url — RSA modulus.
    - `e` string, base64url — RSA public exponent.
    - `d` string, base64url — RSA private exponent, or the D component of an EC private key.
    - `dp` string, base64url — RSA private key parameter.
    - `dq` string, base64url — RSA private key parameter.
    - `qi` string, base64url — RSA private key parameter.
    - `p` string, base64url — RSA secret prime.
    - `q` string, base64url — RSA secret prime, with p < q.
    - `k` string, base64url — Symmetric key.
    - `key_hsm` string, base64url — HSM Token, used with 'Bring Your Own Key'.
    - `crv` 'P-256' | 'P-384' | 'P-521' | 'P-256K' — Elliptic curve name. For valid values, see JsonWebKeyCurveName.
    - `x` string, base64url — X component of an EC public key.
    - `y` string, base64url — Y component of an EC public key.
  - `attributes` KeyAttributes — The object attributes managed by the KeyVault service.
    - `enabled` boolean — Determines whether the object is enabled.
    - `nbf` integer — Not before date in UTC.
    - `exp` integer — Expiry date in UTC.
    - `created` integer — Creation time in UTC.
    - `updated` integer — Last updated time in UTC.
  - `tags` object — Application specific metadata in the form of key-value pairs.
  - `managed` boolean — True if the key's lifetime is managed by key vault. If this is a key backing a certificate, then managed will be true.

## Other responses

- `default` — Key Vault error response describing why the operation failed.

---

[API](https://skmtc.net/azure/apis/keyvaultclient.md) · [All operations](https://skmtc.net/azure/apis/keyvaultclient/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/azure/keyvaultclient/revisions/1f612999ec40/schema)