# What changed in azure-keyvault-keys

> 34 changes in azure-keyvault-keys 4 from its official release notes, upgrade guides and advisories: 26 breaking, 2 security, 3 new APIs and options. Each one cited. Sources checked 2026-10-24. HTML: https://unstale.sh/pypi/azure-keyvault-keys/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## azure-keyvault-keys 4

### Breaking changes

- Request URLs containing backslashes in the authority are rejected before authentication. (4.11.3) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-keyvault-keys_4.11.3)
- The minimum required cryptography version is now 44.0.2. (4.11.1) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-keyvault-keys_4.11.1)
- The sync method and async delete_key now return pollers that return a DeletedKey. (4.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-keyvault-keys_4.0.0)
- The method now has one positional parameter, name; optional parameters moved into kwargs. (4.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-keyvault-keys_4.0.0)
- The method now has positional parameters name and key_type; optional parameters moved into kwargs. (4.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-keyvault-keys_4.0.0)
- The method now has one positional parameter, name; optional parameters moved into kwargs. (4.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-keyvault-keys_4.0.0)
- Operations return class instances instead of tuples. (4.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-keyvault-keys_4.0.0)
- Removed this method from CryptographyClient. (4.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-keyvault-keys_4.0.0)
- The decrypted_bytes property was renamed to plaintext. (4.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-keyvault-keys_4.0.0)
- The sync method was renamed to begin_delete_key. (4.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-keyvault-keys_4.0.0)
- The async method now returns a poller that returns a DeletedKey. (4.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-keyvault-keys_4.0.0)
- The method now has positional parameters name and key; optional parameters moved into kwargs. (4.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-keyvault-keys_4.0.0)
- Renamed this class to KeyVaultKey. (4.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-keyvault-keys_4.0.0)
- The vault_endpoint parameter was renamed to vault_url. (4.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-keyvault-keys_4.0.0)
- Removed this method from KeyClient. (4.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-keyvault-keys_4.0.0)
- The created property was renamed to created_on. (4.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-keyvault-keys_4.0.0)
- The expires property was renamed to expires_on. (4.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-keyvault-keys_4.0.0)
- The updated property was renamed to updated_on. (4.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-keyvault-keys_4.0.0)
- Renamed this method to list_properties_of_key_versions. (4.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-keyvault-keys_4.0.0)
- Renamed this method to list_properties_of_keys. (4.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-keyvault-keys_4.0.0)
- Renamed this class to UnwrapResult. (4.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-keyvault-keys_4.0.0)
- The unwrapped_bytes property was renamed to key. (4.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-keyvault-keys_4.0.0)
- The method now has positional parameters name and optional version; other optional parameters moved into kwargs. (4.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-keyvault-keys_4.0.0)
- The vault_endpoint property was renamed to vault_url in all models. (4.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-keyvault-keys_4.0.0)
- The result property was renamed to is_valid. (4.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-keyvault-keys_4.0.0)
- Renamed this class to WrapResult. (4.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-keyvault-keys_4.0.0)

### Security

- Cached challenges are verified before token use, and rejected or malformed entries are cleared without removing newer entries installed concurrently. (4.11.3) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-keyvault-keys_4.11.3)
- The authentication challenge is cached only after its resource is verified, preventing rejected challenges from being cached and reused by subsequent requests. (4.11.2) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-keyvault-keys_4.11.2)

### New APIs and options

- Added support for service API version 2025-07-01. (4.11.1) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-keyvault-keys_4.11.1)
- All CryptographyClient returns now include an algorithm property. (4.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-keyvault-keys_4.0.0)
- All CryptographyClient returns now include a key_id property. (4.0.0) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-keyvault-keys_4.0.0)

### Behavior and default changes

- Key Vault API version 2025-07-01 is now the default. (4.11.1) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-keyvault-keys_4.11.1)

### Fixes and other changes

- Redirect header updates and cleanup are preserved when request bodies are restored during authentication. (4.11.3) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-keyvault-keys_4.11.3)
- When a 401 response omits this header, stale request authorization is removed and the observed cached challenge is cleared without retrying authentication. (4.11.3) — [release notes](https://github.com/Azure/azure-sdk-for-python/releases/tag/azure-keyvault-keys_4.11.3)