What authentication does the KeyVaultClient use?

The data plane requires an Azure Active Directory OAuth 2.0 bearer token whose audience is https://vault.azure.net. Through Jentic the AAD client secret or refresh token is held in the your Jentic One instance and a vault-scoped bearer token is injected per call so the agent never sees raw secrets.

Can I sign a payload without exporting the key?

Yes. POST to /keys/{key-name}/sign with the algorithm (e.g. RS256) and the digest in the request body. The vault performs the signing inside its HSM boundary and returns only the signature, so the private key never leaves the vault.

What are the rate limits for KeyVaultClient?

Key Vault enforces per-vault transaction quotas - typically 2,000 transactions every 10 seconds for HSM keys and higher for software-protected keys, with limits surfaced via 429 responses including a Retry-After header. Cryptographic operations and key management operations have separate buckets, so balance batch-signing carefully.

How do I fetch a secret through Jentic?

Run pip install jentic, then search Jentic with 'get a secret from azure key vault', load the get-secret operation, and execute with the vault host and secret-name. Jentic returns the secret bundle including value, contentType, and tags.

Can I recover a deleted secret with this API?

Yes - when soft delete is enabled on the vault. List candidates via GET /deletedsecrets, then POST /deletedsecrets/{secret-name}/recover to restore the secret to its prior version. Without soft delete the secret is permanently gone, so verify the vault property before relying on this flow.

Can I limit what my agent is allowed to do with the Microsoft Azure Key Vault API?

Yes. Because your Jentic One instance is self-hosted, your own rules decide which Key Vault operations and credentials the agent may use. Since this API puts the object name in the URL path, such as /secrets/{secret-name} and /keys/{key-name}/sign, you can pin the agent to specific objects and to read-only actions like getting a secret or signing with a named key. Writing a secret, creating a certificate, or backing up a key stays off limits unless you explicitly grant those operations.