# Azure Key Vault Secret Path Expressions

For information on how to configure the Azure Key Vault credential provider, refer to [Azure Key Vault](</connectors/credential_providers/azure_key_vault/help/index.html>).

## Username and Password

> [!NOTE]
>
> The reference examples provided on this page are for **Secrets**; similarly, follow the same approach for **Keys** and **Certificates**.

**Before Encoding**

Using Secret ARN:

```text
secrets://azure-key-vault/https://jubileecpkeyvault.vault.azure.net/keys/HarshalFirstKey/value
```

> [!NOTE]
>
> It is recommended to omit the version ID from secret, key, or certificate identifiers to always fetch the latest value.
>
> Example: The secret identifier below includes a version ID:
>
> ```text
> https://jubileecpkeyvault.vault.azure.net/secrets/HarshalFirstKey/e5a9dd5cc1284a4caa5bef8cd733feab
> ```
>
> The recommended approach is to omit the version ID from the identifier, ensuring that the latest value is always retrieved:
>
> ```text
> https://jubileecpkeyvault.vault.azure.net/secrets/HarshalFirstKey
> ```

> [!IMPORTANT]
>
> The URL path should always start with the prefix, `secrets://`. Each attribute in the URL path must be URL-encoded. Each URL attribute in the path is case-sensitive.

**After Encoding**

After you encode the URL path, it should appear as follows:

Using Secret ARN:

```text
secrets://azure-key-vault/https%3A%2F%2Fjubileecpkeyvault.vault.azure.net%2Fkeys%2FHarshalFirstKey/value
```

The following is an explanation of the attributes of this URL:

- `azure-key-vault` - Configured Credential Provider on SailPoint.
- `https%3A%2F%2Fjubileecpkeyvault.vault.azure.net%2Fkeys%2FHarshalFirstKey` - Secret Identifier of the secret.
- `value` - The name of the secret which needs to be fetched from the JSON response.

> [!TIP]
>
> Use [urlencoder.org](<https://www.urlencoder.org/>) to encode your URL attributes.

## Prefixes and Suffixes

If any secret paths have a prefix or a suffix, you must append a query parameter to the secret path as follows:

- To add a prefix - `?prefix=<prefix>`. For example, if the secret value returned after evaluation is `LocalAdmin`, but the complete value required by the secret field is `DomainOne\LocalAdmin` then the secret path expression will be as follows to add the required prefix:

  ```text
  secrets://azure-key-vault/https%3A%2F%2Fjubileecpkeyvault.vault.azure.net%2Fkeys%2FHarshalFirstKey/value?prefix=DomainOne%5C
  ```
- To add a suffix - `?suffix=<suffix>`. For example, if the secret value returned after evaluation is `localadministrator`, but the complete value required by the secret field is `localadminstrator@sp.com` then the secret path expression will be as follows to add the required suffix:

  ```text
  secrets://azure-key-vault/https%3A%2F%2Fjubileecpkeyvault.vault.azure.net%2Fkeys%2FHarshalFirstKey/value?suffix=%40sp.com
  ```
- To add a prefix and suffix - `?prefix=<prefix>&suffix=<suffix>`. For example, if the secret value returned after evaluation is `LocalAdmin`, but the complete value required by the secret field is `DomainOne\LocalAdmin@sp.com` then the secret path expression will be as follows to add the required prefix and suffix:

  ```text
  secrets://azure-key-vault/https%3A%2F%2Fjubileecpkeyvault.vault.azure.net%2Fkeys%2FHarshalFirstKey/value?prefix=DomainOne%5C&suffix=%40sp.com
  ```

> [!IMPORTANT]
>
> All input parameters must be encoded.

Standard format for credential path:

```text
secrets://{credential-provider-source}/{secret-identifier}/{secret-key}?prefix=someValue&suffix=someValue2
```

> [!IMPORTANT]
>
> Prefix and suffix are optional.