deleted_secrets

Creates, updates, deletes, gets or lists a deleted_secrets resource.

Overview

Name	deleted_secrets
Type	Resource
Id	azure.key_vault_secrets.deleted_secrets

Fields

The following fields are returned by SELECT queries:

get_deleted_secret

Name	Datatype	Description
id	string	The secret id.
attributes	object	The secret management attributes.
contentType	string	The content type of the secret.
deletedDate	string (date-time)	The time when the secret was deleted, in UTC.
kid	string	If this is a secret backing a KV certificate, then this field specifies the corresponding key backing the KV certificate.
managed	boolean	True if the secret's lifetime is managed by key vault. If this is a secret backing a certificate, then managed will be true.
previousVersion	string	The version of the previous certificate, if applicable. Applies only to certificates created after June 1, 2025. Certificates created before this date are not retroactively updated.
recoveryId	string	The url of the recovery object, used to identify and recover the deleted secret.
scheduledPurgeDate	string (date-time)	The time when the secret is scheduled to be purged, in UTC.
tags	object	Application specific metadata in the form of key-value pairs.
value	string	The secret value.

get_deleted_secrets

Name	Datatype	Description
id	string	Secret identifier.
attributes	object	The secret management attributes.
contentType	string	Type of the secret value such as a password.
deletedDate	string (date-time)	The time when the secret was deleted, in UTC.
managed	boolean	True if the secret's lifetime is managed by key vault. If this is a key backing a certificate, then managed will be true.
recoveryId	string	The url of the recovery object, used to identify and recover the deleted secret.
scheduledPurgeDate	string (date-time)	The time when the secret is scheduled to be purged, in UTC.
tags	object	Application specific metadata in the form of key-value pairs.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_deleted_secret	select	secret_name, vault_name		Gets the specified deleted secret. The Get Deleted Secret operation returns the specified deleted secret along with its attributes. This operation requires the secrets/get permission.
get_deleted_secrets	select	vault_name	maxresults	Lists deleted secrets for the specified vault. The Get Deleted Secrets operation returns the secrets that have been deleted for a vault enabled for soft-delete. This operation requires the secrets/list permission.
purge_deleted_secret	delete	secret_name, vault_name		Permanently deletes the specified secret. The purge deleted secret operation removes the secret permanently, without the possibility of recovery. This operation can only be enabled on a soft-delete enabled vault. This operation requires the secrets/purge permission.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
secret_name	string	The name of the secret. Required.
vault_name	string	Key vault name. (default: )
maxresults	integer	Maximum number of results to return in a page. If not specified the service will return up to 25 results. Default value is None.

SELECT examples

get_deleted_secret

Gets the specified deleted secret. The Get Deleted Secret operation returns the specified deleted secret along with its attributes. This operation requires the secrets/get permission.

SELECT
id,
attributes,
contentType,
deletedDate,
kid,
managed,
previousVersion,
recoveryId,
scheduledPurgeDate,
tags,
value
FROM azure.key_vault_secrets.deleted_secrets
WHERE secret_name = '{{ secret_name }}' -- required
AND vault_name = '{{ vault_name }}' -- required
;

get_deleted_secrets

Lists deleted secrets for the specified vault. The Get Deleted Secrets operation returns the secrets that have been deleted for a vault enabled for soft-delete. This operation requires the secrets/list permission.

SELECT
id,
attributes,
contentType,
deletedDate,
managed,
recoveryId,
scheduledPurgeDate,
tags
FROM azure.key_vault_secrets.deleted_secrets
WHERE vault_name = '{{ vault_name }}' -- required
AND maxresults = '{{ maxresults }}'
;

DELETE examples

purge_deleted_secret

Permanently deletes the specified secret. The purge deleted secret operation removes the secret permanently, without the possibility of recovery. This operation can only be enabled on a soft-delete enabled vault. This operation requires the secrets/purge permission.

DELETE FROM azure.key_vault_secrets.deleted_secrets
WHERE secret_name = '{{ secret_name }}' --required
AND vault_name = '{{ vault_name }}' --required
;