Overview
Azure Key Vault is Microsoft's secrets + keys + certificates management service. The Automize Key Vault connector covers secret CRUD, key operations (encrypt/decrypt/sign), certificates, and rotation.
- Regions: Each vault lives in one Azure region. Standard or Premium SKU (Premium adds HSM-backed keys).
- Plans: Per-operation pricing. Premium tier higher per-op cost for HSM-backed.
Setting up the connection
Auth type: OAuth 2.0 (Authorization Code).
- Entra ID → App registration → grant the app Key Vault Secrets User / Key Vault Crypto User / Key Vault Certificates Officer role on the vault.
- In Automize → Settings → Connectors → Azure Key Vault. Paste credentials + vault URL (https://yourvault.vault.azure.net/).
Find your credentials at https://entra.microsoft.com/.
Rate limits
Per-vault: ~2,000 transactions per 10 sec. HSM Premium tier lower.
Data model
Three object types per vault:
Secrets (key-value, e.g. DB passwords) ─┬─ Versions
Keys (asymmetric/symmetric for crypto) ─┤
Certificates (PFX/PEM) ┘Available operations
20 operations available. Click any row to jump to its detail.
| Operation | Category | What it does |
|---|---|---|
| Backup Secret | General | Backup a secret |
| Create Certificate | General | Create a new certificate |
| Create Key | General | Create a new key |
| Decrypt | General | Decrypt data using a key |
| Delete Certificate | General | Delete a certificate |
| Delete Key | General | Delete a key |
| Delete Secret | General | Delete a secret |
| Encrypt | General | Encrypt data using a key |
| Get Certificate | General | Get a certificate |
| Get Key | General | Get a key |
| Get Secret | General | Get a secret value |
| Get Secret Version | General | Get a specific version of a secret |
| List Certificates | General | List all certificates |
| List Deleted Secrets | General | List soft-deleted secrets |
| List Keys | General | List all keys |
| List Secrets | General | List all secrets |
| Purge Deleted Secret | General | Permanently delete a secret |
| Recover Deleted Secret | General | Recover a soft-deleted secret |
| Restore Secret | General | Restore a backed-up secret |
| Set Secret | General | Create or update a secret |
Operations
Backup Secret
Backup a secret
| Parameter | Required | Type | Description |
|---|---|---|---|
Secret Name secret_name | Yes | text |
Create Certificate
Create a new certificate
| Parameter | Required | Type | Description |
|---|---|---|---|
Certificate Name certificate_name | Yes | text |
Create Key
Create a new key
| Parameter | Required | Type | Description |
|---|---|---|---|
Key Name key_name | Yes | text |
Decrypt
Decrypt data using a key
| Parameter | Required | Type | Description |
|---|---|---|---|
Key Name key_name | Yes | text | |
Key Version key_version | Yes | text |
Tips
- key_name + algorithm + value (base64 ciphertext). Returns plaintext.
Delete Certificate
Delete a certificate
| Parameter | Required | Type | Description |
|---|---|---|---|
Certificate Name certificate_name | Yes | text |
Delete Key
Delete a key
| Parameter | Required | Type | Description |
|---|---|---|---|
Key Name key_name | Yes | text |
Delete Secret
Delete a secret
| Parameter | Required | Type | Description |
|---|---|---|---|
Secret Name secret_name | Yes | text |
Tips
- Soft-delete with retention period (7-90 days). Use Purge to hard-delete (irreversible).
Encrypt
Encrypt data using a key
| Parameter | Required | Type | Description |
|---|---|---|---|
Key Name key_name | Yes | text | |
Key Version key_version | Yes | text |
Tips
- key_name + algorithm (RSA-OAEP, RSA1_5) + value (base64 plaintext). Returns base64 ciphertext.
Get Certificate
Get a certificate
| Parameter | Required | Type | Description |
|---|---|---|---|
Certificate Name certificate_name | Yes | text |
Get Key
Get a key
| Parameter | Required | Type | Description |
|---|---|---|---|
Key Name key_name | Yes | text |
Get Secret
Get a secret value
| Parameter | Required | Type | Description |
|---|---|---|---|
Secret Name secret_name | Yes | text |
Tips
- secret_name + optional version (latest if omitted). Returns value + tags.
Get Secret Version
Get a specific version of a secret
| Parameter | Required | Type | Description |
|---|---|---|---|
Secret Name secret_name | Yes | text | |
Version version | Yes | text |
List Certificates
List all certificates
No input parameters.
Tips
- Returns certificate metadata + thumbprints. Get Certificate for full PEM.
List Deleted Secrets
List soft-deleted secrets
No input parameters.
List Keys
List all keys
No input parameters.
List Secrets
List all secrets
No input parameters.
Tips
- Returns metadata only (no values). Iterate then Get Secret for values needed.
Purge Deleted Secret
Permanently delete a secret
| Parameter | Required | Type | Description |
|---|---|---|---|
Secret Name secret_name | Yes | text |
Recover Deleted Secret
Recover a soft-deleted secret
| Parameter | Required | Type | Description |
|---|---|---|---|
Secret Name secret_name | Yes | text |
Restore Secret
Restore a backed-up secret
No input parameters.
Set Secret
Create or update a secret
| Parameter | Required | Type | Description |
|---|---|---|---|
Secret Name secret_name | Yes | text | |
Value value | No | text | |
Contenttype contentType | No | text | |
Attributes attributes | No | text | |
Tags tags | No | text |
Tips
- Creates new secret OR adds new version. Returns ID with version suffix.
FAQ
- Secret vs Key vs Certificate – when?
- Secret: short string (password, API key). Key: cryptographic primitive (for encrypt/sign). Certificate: bundle of cert + private key. Use Secret for most credentials; Key for crypto ops where the private key never leaves the vault.
- Soft delete recovery?
- Use Recover Secret within the retention window. After purge or expiry, gone forever.
- Managed identity vs app registration?
- Managed identity (if running in Azure) is preferred – no creds to manage. This connector uses app registration for backend access.