Class AzureKmsProvider

constructor

• new AzureKmsProvider(options: AzureKmsOptions): AzureKmsProvider

  Create an Azure Key Vault provider with the given options.

  Parameters

  • options: AzureKmsOptions

  Returns AzureKmsProvider

Readonlyname

vaultUrl

• get vaultUrl(): string

  The configured vault URL.

  Returns string

listKeys

• listKeys(
      _filters?: { usage?: string; enabled?: boolean },
  ): Promise<KmsKeyMetadata[]>

  List all keys, optionally filtered by usage or enabled state.

  Parameters

  • Optional_filters: { usage?: string; enabled?: boolean }

  Returns Promise<KmsKeyMetadata[]>

getKey

• getKey(_keyId: string): Promise<KmsKeyMetadata>

  Retrieve metadata for a specific key by ID.

  Parameters

  • _keyId: string

  Returns Promise<KmsKeyMetadata>

createKey

• createKey(
      _algorithm: string,
      _usage: "encrypt" | "sign" | "wrap",
      _metadata?: Record<string, string>,
  ): Promise<KmsKeyMetadata>

  Create a new key with the given algorithm and usage.

  Parameters

  • _algorithm: string
  • _usage: "encrypt" | "sign" | "wrap"
  • Optional_metadata: Record<string, string>

  Returns Promise<KmsKeyMetadata>

enableKey

• enableKey(_keyId: string): Promise<void>

  Enable a previously disabled key.

  Parameters

  • _keyId: string

  Returns Promise<void>

disableKey

• disableKey(_keyId: string): Promise<void>

  Disable a key so it cannot be used for operations.

  Parameters

  • _keyId: string

  Returns Promise<void>

scheduleKeyDeletion

• scheduleKeyDeletion(_keyId: string, _pendingWindowDays?: number): Promise<void>

  Schedule a key for deletion after a pending window.

  Parameters

  • _keyId: string
  • Optional_pendingWindowDays: number

  Returns Promise<void>

encrypt

• encrypt(
      _keyId: string,
      _plaintext: Uint8Array,
      _context?: Record<string, string>,
  ): Promise<KmsEncryptResult>

  Encrypt plaintext using a managed key.

  Parameters

  • _keyId: string
  • _plaintext: Uint8Array
  • Optional_context: Record<string, string>

  Returns Promise<KmsEncryptResult>

decrypt

• decrypt(
      _keyId: string,
      _ciphertext: string,
      _context?: Record<string, string>,
  ): Promise<KmsDecryptResult>

  Decrypt ciphertext using a managed key.

  Parameters

  • _keyId: string
  • _ciphertext: string
  • Optional_context: Record<string, string>

  Returns Promise<KmsDecryptResult>

sign

• sign(
      _keyId: string,
      _data: Uint8Array,
      _algorithm?: string,
  ): Promise<KmsSignResult>

  Sign data using a managed signing key.

  Parameters

  • _keyId: string
  • _data: Uint8Array
  • Optional_algorithm: string

  Returns Promise<KmsSignResult>

verify

• verify(
      _keyId: string,
      _data: Uint8Array,
      _signature: string,
      _algorithm?: string,
  ): Promise<boolean>

  Verify a signature against data.

  Parameters

  • _keyId: string
  • _data: Uint8Array
  • _signature: string
  • Optional_algorithm: string

  Returns Promise<boolean>

rotateKey

• rotateKey(_keyId: string): Promise<KmsKeyMetadata>

  Rotate a key to a new version.

  Parameters

  • _keyId: string

  Returns Promise<KmsKeyMetadata>

generateDataKey

• generateDataKey(
      _keyId: string,
      _keySpec?: string,
  ): Promise<{ plaintext: Uint8Array; ciphertext: string }>

  Generate a data encryption key (DEK) wrapped by the managed key.

  Parameters

  • _keyId: string
  • Optional_keySpec: string

  Returns Promise<{ plaintext: Uint8Array; ciphertext: string }>