pypi / azure-keyvault-keys
azure-keyvault-keys
What changed in azure-keyvault-keys 4, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-24.
26 breaking2 security3 new APIs and options1 behavior and defaults2 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initazure-keyvault-keys 434 changes
Breaking changes 26
Request URLs containing backslashes in the authority are rejected before authentication.
The minimum required cryptography version is now 44.0.2.
The sync method and async delete_key now return pollers that return a DeletedKey.
The method now has one positional parameter, name; optional parameters moved into kwargs.
The method now has positional parameters name and key_type; optional parameters moved into kwargs.
The method now has one positional parameter, name; optional parameters moved into kwargs.
Operations return class instances instead of tuples.
Removed this method from CryptographyClient.
The decrypted_bytes property was renamed to plaintext.
The sync method was renamed to begin_delete_key.
The async method now returns a poller that returns a DeletedKey.
The method now has positional parameters name and key; optional parameters moved into kwargs.
Renamed this class to KeyVaultKey.
The vault_endpoint parameter was renamed to vault_url.
Removed this method from KeyClient.
The created property was renamed to created_on.
The expires property was renamed to expires_on.
The updated property was renamed to updated_on.
Renamed this method to list_properties_of_key_versions.
Renamed this method to list_properties_of_keys.
Renamed this class to UnwrapResult.
The unwrapped_bytes property was renamed to key.
The method now has positional parameters name and optional version; other optional parameters moved into kwargs.
The vault_endpoint property was renamed to vault_url in all models.
The result property was renamed to is_valid.
Renamed this class to WrapResult.
Security 2
Cached challenges are verified before token use, and rejected or malformed entries are cleared without removing newer entries installed concurrently.
The authentication challenge is cached only after its resource is verified, preventing rejected challenges from being cached and reused by subsequent requests.
New APIs and options 3
Added support for service API version 2025-07-01.
All CryptographyClient returns now include an algorithm property.
All CryptographyClient returns now include a key_id property.
Behavior and default changes 1
Key Vault API version 2025-07-01 is now the default.
Fixes and other changes 2
Redirect header updates and cleanup are preserved when request bodies are restored during authentication.
When a 401 response omits this header, stale request authorization is removed and the observed cached challenge is cleared without retrying authentication.