secrets

Creates, updates, deletes, gets or lists a secrets resource.

Overview

Name	secrets
Type	Resource
Id	azure.key_vault_secrets.secrets

Fields

The following fields are returned by SELECT queries:

get_secret

Name	Datatype	Description
id	string	The secret id.
attributes	object	The secret management attributes.
contentType	string	The content type of the secret.
kid	string	If this is a secret backing a KV certificate, then this field specifies the corresponding key backing the KV certificate.
managed	boolean	True if the secret's lifetime is managed by key vault. If this is a secret backing a certificate, then managed will be true.
previousVersion	string	The version of the previous certificate, if applicable. Applies only to certificates created after June 1, 2025. Certificates created before this date are not retroactively updated.
tags	object	Application specific metadata in the form of key-value pairs.
value	string	The secret value.

get_secrets

Name	Datatype	Description
id	string	Secret identifier.
attributes	object	The secret management attributes.
contentType	string	Type of the secret value such as a password.
managed	boolean	True if the secret's lifetime is managed by key vault. If this is a key backing a certificate, then managed will be true.
tags	object	Application specific metadata in the form of key-value pairs.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_secret	select	secret_name, secret_version, vault_name	outContentType	Get a specified secret from a given key vault. The GET operation is applicable to any secret stored in Azure Key Vault. This operation requires the secrets/get permission.
get_secrets	select	vault_name	maxresults	List secrets in a specified key vault. The Get Secrets operation is applicable to the entire vault. However, only the base secret identifier and its attributes are provided in the response. Individual secret versions are not listed in the response. This operation requires the secrets/list permission.
update_secret	update	secret_name, secret_version, vault_name		Updates the attributes associated with a specified secret in a given key vault. The UPDATE operation changes specified attributes of an existing stored secret. Attributes that are not specified in the request are left unchanged. The value of a secret itself cannot be changed. This operation requires the secrets/set permission.
set_secret	replace	secret_name, vault_name, value		Sets a secret in a specified key vault. The SET operation adds a secret to the Azure Key Vault. If the named secret already exists, Azure Key Vault creates a new version of that secret. This operation requires the secrets/set permission.
delete_secret	delete	secret_name, vault_name		Deletes a secret from a specified key vault. The DELETE operation applies to any secret stored in Azure Key Vault. DELETE cannot be applied to an individual version of a secret. This operation requires the secrets/delete permission.
backup_secret	exec	secret_name, vault_name		Backs up the specified secret. Requests that a backup of the specified secret be downloaded to the client. All versions of the secret will be downloaded. This operation requires the secrets/backup permission.
restore_secret	exec	vault_name, value		Restores a backed up secret to a vault. Restores a backed up secret, and all its versions, to a vault. This operation requires the secrets/restore permission.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
secret_name	string	The name of the secret. Required.
secret_version	string	The version of the secret. Required.
vault_name	string	Key vault name. (default: )
maxresults	integer	Maximum number of results to return in a page. If not specified the service will return up to 25 results. Default value is None.
outContentType	string	The media type (MIME type) of the certificate. If a supported format is specified, the certificate content is converted to the requested format. Currently, only PFX to PEM conversion is supported. If an unsupported format is specified, the request is rejected. If not specified, the certificate is returned in its original format without conversion. Known values are: "application/x-pkcs12" and "application/x-pem-file". Default value is None.

SELECT examples

get_secret

Get a specified secret from a given key vault. The GET operation is applicable to any secret stored in Azure Key Vault. This operation requires the secrets/get permission.

SELECT
id,
attributes,
contentType,
kid,
managed,
previousVersion,
tags,
value
FROM azure.key_vault_secrets.secrets
WHERE secret_name = '{{ secret_name }}' -- required
AND secret_version = '{{ secret_version }}' -- required
AND vault_name = '{{ vault_name }}' -- required
AND outContentType = '{{ outContentType }}'
;

get_secrets

List secrets in a specified key vault. The Get Secrets operation is applicable to the entire vault. However, only the base secret identifier and its attributes are provided in the response. Individual secret versions are not listed in the response. This operation requires the secrets/list permission.

SELECT
id,
attributes,
contentType,
managed,
tags
FROM azure.key_vault_secrets.secrets
WHERE vault_name = '{{ vault_name }}' -- required
AND maxresults = '{{ maxresults }}'
;

UPDATE examples

update_secret

Updates the attributes associated with a specified secret in a given key vault. The UPDATE operation changes specified attributes of an existing stored secret. Attributes that are not specified in the request are left unchanged. The value of a secret itself cannot be changed. This operation requires the secrets/set permission.

UPDATE azure.key_vault_secrets.secrets
SET 
contentType = '{{ contentType }}',
attributes = '{{ attributes }}',
tags = '{{ tags }}'
WHERE 
secret_name = '{{ secret_name }}' --required
AND secret_version = '{{ secret_version }}' --required
AND vault_name = '{{ vault_name }}' --required
RETURNING
id,
attributes,
contentType,
kid,
managed,
previousVersion,
tags,
value;

REPLACE examples

set_secret

Sets a secret in a specified key vault. The SET operation adds a secret to the Azure Key Vault. If the named secret already exists, Azure Key Vault creates a new version of that secret. This operation requires the secrets/set permission.

REPLACE azure.key_vault_secrets.secrets
SET 
value = '{{ value }}',
tags = '{{ tags }}',
contentType = '{{ contentType }}',
attributes = '{{ attributes }}'
WHERE 
secret_name = '{{ secret_name }}' --required
AND vault_name = '{{ vault_name }}' --required
AND value = '{{ value }}' --required
RETURNING
id,
attributes,
contentType,
kid,
managed,
previousVersion,
tags,
value;

DELETE examples

delete_secret

Deletes a secret from a specified key vault. The DELETE operation applies to any secret stored in Azure Key Vault. DELETE cannot be applied to an individual version of a secret. This operation requires the secrets/delete permission.

DELETE FROM azure.key_vault_secrets.secrets
WHERE secret_name = '{{ secret_name }}' --required
AND vault_name = '{{ vault_name }}' --required
;

Lifecycle Methods

backup_secret

Backs up the specified secret. Requests that a backup of the specified secret be downloaded to the client. All versions of the secret will be downloaded. This operation requires the secrets/backup permission.

EXEC azure.key_vault_secrets.secrets.backup_secret 
@secret_name='{{ secret_name }}' --required, 
@vault_name='{{ vault_name }}' --required
;

restore_secret

Restores a backed up secret to a vault. Restores a backed up secret, and all its versions, to a vault. This operation requires the secrets/restore permission.

EXEC azure.key_vault_secrets.secrets.restore_secret 
@vault_name='{{ vault_name }}' --required 
@@json=
'{
"value": "{{ value }}"
}'
;