Added EKM APIs to Keys SDK

specification/keyvault/Security.KeyVault.EKM/models.tsp

@@ -12,6 +12,7 @@ namespace KeyVault;
 /**
  * A EkmConnection model object.
  */
+@added(KeyVault.Versions.v2026_01_01_preview)
 model EkmConnection {
   /**
    * EKM proxy FQDN (Fully Qualified Domain Name). Only allowed characters are a-z, A-Z, 0-9, hyphen (-), dot (.), and colon (:).
@@ -40,6 +41,7 @@ model EkmConnection {
 /**
  * EKM proxy client certificate information.
  */
+@added(KeyVault.Versions.v2026_01_01_preview)
 model EkmProxyClientCertificateInfo {
   /**
    * The client root CA certificate chain to authenticate to the EKM proxy. An array of certificates in the certificate chain, each in DER format and base64 encoded.
@@ -59,6 +61,7 @@ model EkmProxyClientCertificateInfo {
 /**
  * EKM proxy information.
  */
+@added(KeyVault.Versions.v2026_01_01_preview)
 model EkmProxyInfo {
   /**
    * The highest version of proxy interface API supported by the EKM Proxy.

specification/keyvault/Security.KeyVault.EKM/routes.tsp

@@ -15,6 +15,7 @@ namespace KeyVault;
  * The External Key Manager (EKM) Get operation returns EKM connection. This operation requires ekm/read permission.
  */
 #suppress "@azure-tools/typespec-azure-core/use-standard-operations" "Foundations.Operation is necessary for Key Vault"
+@Versioning.added(KeyVault.Versions.v2026_01_01_preview)
 @summary("Gets the EKM connection.")
 @route("/ekm")
 @get
@@ -24,6 +25,7 @@ op getEkmConnection is KeyVaultOperation<{}, EkmConnection>;
  * The External Key Manager (EKM) Certificate Get operation returns Proxy client certificate. This operation requires ekm/read permission.
  */
 #suppress "@azure-tools/typespec-azure-core/use-standard-operations" "Foundations.Operation is necessary for Key Vault"
+@Versioning.added(KeyVault.Versions.v2026_01_01_preview)
 @summary("Gets the EKM proxy client certificate.")
 @route("/ekm/certificate")
 @get
@@ -33,6 +35,7 @@ op getEkmCertificate is KeyVaultOperation<{}, EkmProxyClientCertificateInfo>;
  * The External Key Manager (EKM) Check operation checks the connectivity and authentication with the EKM proxy. This operation requires ekm/read permission.
  */
 #suppress "@azure-tools/typespec-azure-core/use-standard-operations" "Foundations.Operation is necessary for Key Vault"
+@Versioning.added(KeyVault.Versions.v2026_01_01_preview)
 @summary("Checks the connectivity and authentication with the EKM proxy.")
 @route("/ekm/check")
 @post
@@ -42,6 +45,7 @@ op checkEkmConnection is KeyVaultOperation<{}, EkmProxyInfo>;
  * The External Key Manager (EKM) sets up the EKM connection. If the EKM connection already exists, this operation fails. This operation requires ekm/write permission.
  */
 #suppress "@azure-tools/typespec-azure-core/use-standard-operations" "Foundations.Operation is necessary for Key Vault"
+@Versioning.added(KeyVault.Versions.v2026_01_01_preview)
 @summary("Creates the EKM connection.")
 @route("/ekm/create")
 @post
@@ -62,6 +66,7 @@ op createEkmConnection is KeyVaultOperation<
  * The External Key Manager (EKM) updates the existing EKM connection. If the EKM connection does not exist, this operation fails. This operation requires ekm/write permission.
  */
 #suppress "@azure-tools/typespec-azure-core/use-standard-operations" "Foundations.Operation is necessary for Key Vault"
+@Versioning.added(KeyVault.Versions.v2026_01_01_preview)
 @summary("Updates the EKM connection.")
 @route("/ekm")
 @patch(#{ implicitOptionality: true })
@@ -82,6 +87,7 @@ op updateEkmConnection is KeyVaultOperation<
  * The External Key Manager (EKM) deletes the existing EKM connection. If the EKM connection does not already exists, this operation fails. This operation requires ekm/delete permission.
  */
 #suppress "@azure-tools/typespec-azure-core/use-standard-operations" "Foundations.Operation is necessary for Key Vault"
+@Versioning.added(KeyVault.Versions.v2026_01_01_preview)
 @summary("Deletes the EKM connection.")
 @route("/ekm")
 @delete

specification/keyvault/Security.KeyVault.EKM/tspconfig.yaml

@@ -26,11 +26,11 @@ options:
   # "@azure-tools/typespec-ts": true
   "@azure-tools/typespec-go":
     service-dir: "sdk/security/keyvault"
-    package-dir: "azadmin/ekm"
+    package-dir: "azkeys/ekm"
     inject-spans: true
     single-client: true
     generate-fakes: true
-    module: "github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azadmin"
+    module: "github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys"
     module-version: "0.0.1"
   "@azure-tools/typespec-client-generator-cli":
     additionalDirectories:

specification/keyvault/Security.KeyVault.Keys/models.tsp

@@ -2,6 +2,7 @@ import "@typespec/http";
 import "@typespec/rest";
 import "@typespec/versioning";
 import "@azure-tools/typespec-azure-core";
+import "../Security.KeyVault.EKM/models.tsp";
 
 using TypeSpec.Http;
 using TypeSpec.Rest;

specification/keyvault/Security.KeyVault.Keys/routes.tsp

@@ -4,6 +4,7 @@ import "@typespec/openapi";
 import "@typespec/rest";
 import "./models.tsp";
 import "../Security.KeyVault.Common/common.tsp";
+import "../Security.KeyVault.EKM/routes.tsp";
 
 using Azure.ClientGenerator.Core;
 using TypeSpec.Http;

specification/keyvault/Security.KeyVault.Keys/tspconfig.yaml

@@ -66,3 +66,4 @@ options:
   "@azure-tools/typespec-client-generator-cli":
     additionalDirectories:
       - "specification/keyvault/Security.KeyVault.Common/"
+      - "specification/keyvault/Security.KeyVault.EKM/"

specification/keyvault/cspell.yaml

@@ -10,6 +10,7 @@ words:
   - assetid
   - azadmin
   - azekm
+  - azkeys
   - backuprestore
   - byok
   - CBCPAD
@@ -54,15 +55,9 @@ overrides:
   - filename: '**/specification/keyvault/Security.KeyVault.Certificates/tspconfig.yaml'
     words:
       - azcertificates
-  - filename: '**/specification/keyvault/Security.KeyVault.EKM/tspconfig.yaml'
-    words:
-      - azekm
   - filename: '**/specification/keyvault/Security.KeyVault.Secrets/tspconfig.yaml'
     words:
       - azsecrets
-  - filename: '**/specification/keyvault/Security.KeyVault.Keys/tspconfig.yaml'
-    words:
-      - azkeys
   - filename: '**/specification/keyvault/data-plane/Microsoft.KeyVault/**/storage.json'
     words:
       - regenerte