TransparentDataEncryptions.json

{
  "swagger": "2.0",
  "info": {
    "version": "2021-11-01",
    "title": "SqlManagementClient",
    "description": "The Azure SQL Database management API provides a RESTful set of web APIs that interact with Azure SQL Database services to manage your databases. The API enables users to create, retrieve, update, and delete databases, servers, and other entities."
  },
  "host": "management.azure.com",
  "schemes": [
    "https"
  ],
  "consumes": [
    "application/json"
  ],
  "produces": [
    "application/json"
  ],
  "paths": {
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Sql/servers/{serverName}/databases/{databaseName}/transparentDataEncryption": {
      "get": {
        "tags": [
          "TransparentDataEncryptions"
        ],
        "description": "Gets a list of the logical database's transparent data encryption.",
        "operationId": "TransparentDataEncryptions_ListByDatabase",
        "parameters": [
          {
            "$ref": "../../../common/v1/types.json#/parameters/ResourceGroupParameter"
          },
          {
            "name": "serverName",
            "in": "path",
            "description": "The name of the server.",
            "required": true,
            "type": "string"
          },
          {
            "name": "databaseName",
            "in": "path",
            "description": "The name of the logical database for which the transparent data encryption is defined.",
            "required": true,
            "type": "string"
          },
          {
            "$ref": "../../../common/v1/types.json#/parameters/SubscriptionIdParameter"
          },
          {
            "$ref": "../../../common/v1/types.json#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "Successfully retrieved the list of Logical database transparent data encryption.",
            "schema": {
              "$ref": "#/definitions/LogicalDatabaseTransparentDataEncryptionListResult"
            }
          },
          "default": {
            "description": "*** Error Responses: ***\n\n * 400 SecurityAdalPrincipalCertExpiredError - The operation could not be completed because the Azure Key Vault principal certificate has expired.\n\n * 400 AkvHostNotResolvingFromNode - AKV host '{0}' is not resolvable from SQL, on server '{1}'.\n\n * 400 SecurityInvalidAzureKeyVaultRecoveryLevel - The provided Key Vault uri is not valid.\n\n * 400 KeyMaterialNotFoundOnRemoteServer - Remote server does not have access to key material used as a TDE protector.\n\n * 400 AzureKeyVaultRsaKeyNotSupported - The provided key vault uses unsupported RSA Key Size or Key Type. The supported RSA key size is 2048 or 3072 and Key Type is RSA or RSA-HSM.\n\n * 400 AzureKeyVaultKeyDisabled - The operation could not be completed on the server because the Azure Key Vault key is disabled.\n\n * 400 AzureKeyVaultInvalidExpirationDate - The operation could not be completed because the Azure Key Vault key expiration date is invalid.\n\n * 400 SameKeyUriNotFoundOnRemoteServer - Secondary server does not have the key material from the same key vault as the primary server's encryption protector with key auto-rotation enabled.\n\n * 400 SecurityAzureKeyVaultUrlNullOrEmpty - The operation could not be completed because the Azure Key Vault Uri is null or empty.\n\n * 400 SameKeyMaterialNotFoundOnRemoteServer - Secondary server does not have the key material of the primary server's encryption protector.\n\n * 400 PerDatabaseCMKRestoreNotSupported - Database restore is not supported when Database-level CMK is configured in preview.\n\n * 400 AzureKeyVaultNoServerIdentity - The server identity is not correctly configured.\n\n * 400 PerDatabaseCMKHSNotSupported - Database-level CMK in preview is not supported for Hyperscale edition.\n\n * 400 AzureKeyVaultInvalidUri - An invalid response from Azure Key Vault. Please use a valid Azure Key Vault URI.\n\n * 400 AzureKeyVaultMissingPermissions - The server is missing required permissions on the Azure Key Vault. \n\n * 400 UmiMissingAkvPermissions - PrimaryUserAssignedIdentityId provided by user does not have access to KeyId provided\n\n * 400 AkvEndpointNotReachableFromNode - AKV endpoint '{0}' is not reachable from SQL, on server '{1}'.\n\n * 400 SecurityAzureKeyVaultInvalidKeyName - The operation could not be completed because of an invalid Server Key name.\n\n * 400 AdalGenericError - The operation could not be completed because an Azure Active Directory error was encountered.\n\n * 400 AdalServicePrincipalNotFound - The operation could not be completed because an Azure Active Directory library Service Principal not found error was encountered.\n\n * 400 AzureKeyVaultMalformedVaultUri - The provided Key Vault uri is not valid.\n\n * 400 SecurityAzureKeyVaultGeoChainError - Creating secondary of secondary (a process known as chaining) is not supported when enabling Transparent Data Encryption using Azure Key Vault (BYOK).\n\n * 400 PerDatabaseCMKDWNotSupported - Database-level CMK in preview is not supported for Datawarehouse edition.\n\n * 400 ReadOnly - Cannot enable or modify database encryption on a database that is read-only, has read-only files or is not recovered.\n\n * 400 CanNotDropAlterOnMirror - Please modify Transparent Data Encryption on the primary databases.\n\n * 400 AttemptedEncryptionOnSystemDatabase - Cannot encrypt a system database. Database encryption operations cannot be performed for 'master', 'model', 'tempdb', 'msdb', or 'resource' databases.\n\n * 401 CanNotChangeReadOnlyDuringTdeScan - Cannot modify filegroup read-only/read-write state while an encryption transition is in progress.\n\n * 409 ServerKeyNameAlreadyExists - The server key already exists on the server.\n\n * 409 ServerKeyUriAlreadyExists - The server key URI already exists on the server.\n\n * 409 ServerKeyDoesNotExists - The server key does not exist.\n\n * 409 AzureKeyVaultKeyNameNotFound - The operation could not be completed because the Azure Key Vault Key name does not exist.\n\n * 409 AzureKeyVaultKeyInUse - The key is currently being used by the server.\n\n * 409 NeedsLogBackup - Please wait several minutes for a log backup to occur. \n\n * 409 EncryptionInProgress - Cannot modify encryption while an encryption scan in progress.\n\n * 409 KeyChangeInProgress - Cannot change database encryption key while an encryption, decryption, or key change scan is in progress.\n\n * 409 NoBulkOperationLock - CREATE/ALTER/DROP DATABASE ENCRYPTION KEY failed because a lock could not be placed on database. Try again later.\n\n * 409 AltStateConflict - The operation cannot be performed on database because it is involved in a database mirroring session or an availability group. Some operations are not allowed on a database that is participating in a database mirroring session or in an availability group.\n\n * 503 AzureKeyVaultConnectionFailed - The operation could not be completed on the server because attempts to connect to Azure Key Vault have failed\n\n * 503 AzureKeyVaultGenericConnectionError - The operation could not be completed because an error was encountered when attempting to retrieve Key Vault information .\n\n * 503 NoDekLock - CREATE/ALTER/DROP DATABASE ENCRYPTION KEY failed because a lock could not be placed on the database. Try again later."
          }
        },
        "x-ms-pageable": {
          "nextLinkName": "nextLink"
        },
        "x-ms-examples": {
          "Get a list of the database's transparent data encryption": {
            "$ref": "./examples/TransparentDataEncryptionList.json"
          }
        }
      }
    },
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Sql/servers/{serverName}/databases/{databaseName}/transparentDataEncryption/{tdeName}": {
      "get": {
        "tags": [
          "TransparentDataEncryptions"
        ],
        "description": "Gets a logical database's transparent data encryption.",
        "operationId": "TransparentDataEncryptions_Get",
        "parameters": [
          {
            "$ref": "../../../common/v1/types.json#/parameters/ResourceGroupParameter"
          },
          {
            "name": "serverName",
            "in": "path",
            "description": "The name of the server.",
            "required": true,
            "type": "string"
          },
          {
            "name": "databaseName",
            "in": "path",
            "description": "The name of the logical database for which the transparent data encryption is defined.",
            "required": true,
            "type": "string"
          },
          {
            "name": "tdeName",
            "in": "path",
            "description": "The name of the transparent data encryption configuration.",
            "required": true,
            "type": "string",
            "enum": [
              "current"
            ],
            "x-ms-enum": {
              "name": "TransparentDataEncryptionName",
              "modelAsString": true
            }
          },
          {
            "$ref": "../../../common/v1/types.json#/parameters/SubscriptionIdParameter"
          },
          {
            "$ref": "../../../common/v1/types.json#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "Successfully retrieved the Logical database transparent data encryption.",
            "schema": {
              "$ref": "#/definitions/LogicalDatabaseTransparentDataEncryption"
            }
          },
          "default": {
            "description": "*** Error Responses: ***\n\n * 400 SecurityAdalPrincipalCertExpiredError - The operation could not be completed because the Azure Key Vault principal certificate has expired.\n\n * 400 AkvHostNotResolvingFromNode - AKV host '{0}' is not resolvable from SQL, on server '{1}'.\n\n * 400 SecurityInvalidAzureKeyVaultRecoveryLevel - The provided Key Vault uri is not valid.\n\n * 400 KeyMaterialNotFoundOnRemoteServer - Remote server does not have access to key material used as a TDE protector.\n\n * 400 AzureKeyVaultRsaKeyNotSupported - The provided key vault uses unsupported RSA Key Size or Key Type. The supported RSA key size is 2048 or 3072 and Key Type is RSA or RSA-HSM.\n\n * 400 AzureKeyVaultKeyDisabled - The operation could not be completed on the server because the Azure Key Vault key is disabled.\n\n * 400 AzureKeyVaultInvalidExpirationDate - The operation could not be completed because the Azure Key Vault key expiration date is invalid.\n\n * 400 SameKeyUriNotFoundOnRemoteServer - Secondary server does not have the key material from the same key vault as the primary server's encryption protector with key auto-rotation enabled.\n\n * 400 SecurityAzureKeyVaultUrlNullOrEmpty - The operation could not be completed because the Azure Key Vault Uri is null or empty.\n\n * 400 SameKeyMaterialNotFoundOnRemoteServer - Secondary server does not have the key material of the primary server's encryption protector.\n\n * 400 PerDatabaseCMKRestoreNotSupported - Database restore is not supported when Database-level CMK is configured in preview.\n\n * 400 AzureKeyVaultNoServerIdentity - The server identity is not correctly configured.\n\n * 400 PerDatabaseCMKHSNotSupported - Database-level CMK in preview is not supported for Hyperscale edition.\n\n * 400 AzureKeyVaultInvalidUri - An invalid response from Azure Key Vault. Please use a valid Azure Key Vault URI.\n\n * 400 AzureKeyVaultMissingPermissions - The server is missing required permissions on the Azure Key Vault. \n\n * 400 UmiMissingAkvPermissions - PrimaryUserAssignedIdentityId provided by user does not have access to KeyId provided\n\n * 400 AkvEndpointNotReachableFromNode - AKV endpoint '{0}' is not reachable from SQL, on server '{1}'.\n\n * 400 SecurityAzureKeyVaultInvalidKeyName - The operation could not be completed because of an invalid Server Key name.\n\n * 400 AdalGenericError - The operation could not be completed because an Azure Active Directory error was encountered.\n\n * 400 AdalServicePrincipalNotFound - The operation could not be completed because an Azure Active Directory library Service Principal not found error was encountered.\n\n * 400 AzureKeyVaultMalformedVaultUri - The provided Key Vault uri is not valid.\n\n * 400 SecurityAzureKeyVaultGeoChainError - Creating secondary of secondary (a process known as chaining) is not supported when enabling Transparent Data Encryption using Azure Key Vault (BYOK).\n\n * 400 PerDatabaseCMKDWNotSupported - Database-level CMK in preview is not supported for Datawarehouse edition.\n\n * 400 ReadOnly - Cannot enable or modify database encryption on a database that is read-only, has read-only files or is not recovered.\n\n * 400 CanNotDropAlterOnMirror - Please modify Transparent Data Encryption on the primary databases.\n\n * 400 AttemptedEncryptionOnSystemDatabase - Cannot encrypt a system database. Database encryption operations cannot be performed for 'master', 'model', 'tempdb', 'msdb', or 'resource' databases.\n\n * 401 CanNotChangeReadOnlyDuringTdeScan - Cannot modify filegroup read-only/read-write state while an encryption transition is in progress.\n\n * 409 ServerKeyNameAlreadyExists - The server key already exists on the server.\n\n * 409 ServerKeyUriAlreadyExists - The server key URI already exists on the server.\n\n * 409 ServerKeyDoesNotExists - The server key does not exist.\n\n * 409 AzureKeyVaultKeyNameNotFound - The operation could not be completed because the Azure Key Vault Key name does not exist.\n\n * 409 AzureKeyVaultKeyInUse - The key is currently being used by the server.\n\n * 409 NeedsLogBackup - Please wait several minutes for a log backup to occur. \n\n * 409 EncryptionInProgress - Cannot modify encryption while an encryption scan in progress.\n\n * 409 KeyChangeInProgress - Cannot change database encryption key while an encryption, decryption, or key change scan is in progress.\n\n * 409 NoBulkOperationLock - CREATE/ALTER/DROP DATABASE ENCRYPTION KEY failed because a lock could not be placed on database. Try again later.\n\n * 409 AltStateConflict - The operation cannot be performed on database because it is involved in a database mirroring session or an availability group. Some operations are not allowed on a database that is participating in a database mirroring session or in an availability group.\n\n * 503 AzureKeyVaultConnectionFailed - The operation could not be completed on the server because attempts to connect to Azure Key Vault have failed\n\n * 503 AzureKeyVaultGenericConnectionError - The operation could not be completed because an error was encountered when attempting to retrieve Key Vault information .\n\n * 503 NoDekLock - CREATE/ALTER/DROP DATABASE ENCRYPTION KEY failed because a lock could not be placed on the database. Try again later."
          }
        },
        "x-ms-examples": {
          "Get a database's transparent data encryption": {
            "$ref": "./examples/TransparentDataEncryptionGet.json"
          }
        }
      },
      "put": {
        "tags": [
          "TransparentDataEncryptions"
        ],
        "description": "Updates a logical database's transparent data encryption configuration.",
        "operationId": "TransparentDataEncryptions_CreateOrUpdate",
        "parameters": [
          {
            "$ref": "../../../common/v1/types.json#/parameters/ResourceGroupParameter"
          },
          {
            "name": "serverName",
            "in": "path",
            "description": "The name of the server.",
            "required": true,
            "type": "string"
          },
          {
            "name": "databaseName",
            "in": "path",
            "description": "The name of the logical database for which the security alert policy is defined.",
            "required": true,
            "type": "string"
          },
          {
            "name": "tdeName",
            "in": "path",
            "description": "The name of the transparent data encryption configuration.",
            "required": true,
            "type": "string",
            "enum": [
              "current"
            ],
            "x-ms-enum": {
              "name": "TransparentDataEncryptionName",
              "modelAsString": true
            }
          },
          {
            "name": "parameters",
            "in": "body",
            "description": "The database transparent data encryption.",
            "required": true,
            "schema": {
              "$ref": "#/definitions/LogicalDatabaseTransparentDataEncryption"
            }
          },
          {
            "$ref": "../../../common/v1/types.json#/parameters/SubscriptionIdParameter"
          },
          {
            "$ref": "../../../common/v1/types.json#/parameters/ApiVersionParameter"
          }
        ],
        "responses": {
          "200": {
            "description": "Successfully updated the database Transparent Data Encryption state.",
            "schema": {
              "$ref": "#/definitions/LogicalDatabaseTransparentDataEncryption"
            }
          },
          "default": {
            "description": "*** Error Responses: ***\n\n * 400 SecurityAdalPrincipalCertExpiredError - The operation could not be completed because the Azure Key Vault principal certificate has expired.\n\n * 400 AkvHostNotResolvingFromNode - AKV host '{0}' is not resolvable from SQL, on server '{1}'.\n\n * 400 SecurityInvalidAzureKeyVaultRecoveryLevel - The provided Key Vault uri is not valid.\n\n * 400 KeyMaterialNotFoundOnRemoteServer - Remote server does not have access to key material used as a TDE protector.\n\n * 400 AzureKeyVaultRsaKeyNotSupported - The provided key vault uses unsupported RSA Key Size or Key Type. The supported RSA key size is 2048 or 3072 and Key Type is RSA or RSA-HSM.\n\n * 400 AzureKeyVaultKeyDisabled - The operation could not be completed on the server because the Azure Key Vault key is disabled.\n\n * 400 AzureKeyVaultInvalidExpirationDate - The operation could not be completed because the Azure Key Vault key expiration date is invalid.\n\n * 400 SameKeyUriNotFoundOnRemoteServer - Secondary server does not have the key material from the same key vault as the primary server's encryption protector with key auto-rotation enabled.\n\n * 400 SecurityAzureKeyVaultUrlNullOrEmpty - The operation could not be completed because the Azure Key Vault Uri is null or empty.\n\n * 400 SameKeyMaterialNotFoundOnRemoteServer - Secondary server does not have the key material of the primary server's encryption protector.\n\n * 400 PerDatabaseCMKRestoreNotSupported - Database restore is not supported when Database-level CMK is configured in preview.\n\n * 400 AzureKeyVaultNoServerIdentity - The server identity is not correctly configured.\n\n * 400 PerDatabaseCMKHSNotSupported - Database-level CMK in preview is not supported for Hyperscale edition.\n\n * 400 AzureKeyVaultInvalidUri - An invalid response from Azure Key Vault. Please use a valid Azure Key Vault URI.\n\n * 400 AzureKeyVaultMissingPermissions - The server is missing required permissions on the Azure Key Vault. \n\n * 400 UmiMissingAkvPermissions - PrimaryUserAssignedIdentityId provided by user does not have access to KeyId provided\n\n * 400 AkvEndpointNotReachableFromNode - AKV endpoint '{0}' is not reachable from SQL, on server '{1}'.\n\n * 400 SecurityAzureKeyVaultInvalidKeyName - The operation could not be completed because of an invalid Server Key name.\n\n * 400 AdalGenericError - The operation could not be completed because an Azure Active Directory error was encountered.\n\n * 400 AdalServicePrincipalNotFound - The operation could not be completed because an Azure Active Directory library Service Principal not found error was encountered.\n\n * 400 AzureKeyVaultMalformedVaultUri - The provided Key Vault uri is not valid.\n\n * 400 SecurityAzureKeyVaultGeoChainError - Creating secondary of secondary (a process known as chaining) is not supported when enabling Transparent Data Encryption using Azure Key Vault (BYOK).\n\n * 400 PerDatabaseCMKDWNotSupported - Database-level CMK in preview is not supported for Datawarehouse edition.\n\n * 400 ReadOnly - Cannot enable or modify database encryption on a database that is read-only, has read-only files or is not recovered.\n\n * 400 CanNotDropAlterOnMirror - Please modify Transparent Data Encryption on the primary databases.\n\n * 400 AttemptedEncryptionOnSystemDatabase - Cannot encrypt a system database. Database encryption operations cannot be performed for 'master', 'model', 'tempdb', 'msdb', or 'resource' databases.\n\n * 400 InvalidTransparentDataEncryptionUpdateRequest - Please enter a valid state. Please use \"Enabled\" or \"Disabled\".\n\n * 400 InvalidTransparentDataEncryptionName - The  transparent data encryption key name is not supported.\n\n * 401 CanNotChangeReadOnlyDuringTdeScan - Cannot modify filegroup read-only/read-write state while an encryption transition is in progress.\n\n * 409 ServerKeyNameAlreadyExists - The server key already exists on the server.\n\n * 409 ServerKeyUriAlreadyExists - The server key URI already exists on the server.\n\n * 409 ServerKeyDoesNotExists - The server key does not exist.\n\n * 409 AzureKeyVaultKeyNameNotFound - The operation could not be completed because the Azure Key Vault Key name does not exist.\n\n * 409 AzureKeyVaultKeyInUse - The key is currently being used by the server.\n\n * 409 NeedsLogBackup - Please wait several minutes for a log backup to occur. \n\n * 409 EncryptionInProgress - Cannot modify encryption while an encryption scan in progress.\n\n * 409 KeyChangeInProgress - Cannot change database encryption key while an encryption, decryption, or key change scan is in progress.\n\n * 409 NoBulkOperationLock - CREATE/ALTER/DROP DATABASE ENCRYPTION KEY failed because a lock could not be placed on database. Try again later.\n\n * 409 AltStateConflict - The operation cannot be performed on database because it is involved in a database mirroring session or an availability group. Some operations are not allowed on a database that is participating in a database mirroring session or in an availability group.\n\n * 503 AzureKeyVaultConnectionFailed - The operation could not be completed on the server because attempts to connect to Azure Key Vault have failed\n\n * 503 AzureKeyVaultGenericConnectionError - The operation could not be completed because an error was encountered when attempting to retrieve Key Vault information .\n\n * 503 NoDekLock - CREATE/ALTER/DROP DATABASE ENCRYPTION KEY failed because a lock could not be placed on the database. Try again later."
          },
          "201": {
            "description": "Successfully created the database transparent data encryption state.",
            "schema": {
              "$ref": "#/definitions/LogicalDatabaseTransparentDataEncryption"
            }
          },
          "202": {
            "description": "Creating or updating the database transparent data encryption configuration is in progress."
          }
        },
        "x-ms-examples": {
          "Update a database's Transparent Data Encryption state with minimal parameters": {
            "$ref": "./examples/TransparentDataEncryptionUpdate.json"
          }
        }
      }
    }
  },
  "definitions": {
    "LogicalDatabaseTransparentDataEncryption": {
      "description": "A logical database transparent data encryption state.",
      "type": "object",
      "allOf": [
        {
          "$ref": "../../../common/v1/types.json#/definitions/ProxyResource"
        }
      ],
      "properties": {
        "properties": {
          "$ref": "#/definitions/TransparentDataEncryptionProperties",
          "description": "Resource properties.",
          "x-ms-client-flatten": true
        }
      }
    },
    "LogicalDatabaseTransparentDataEncryptionListResult": {
      "description": "A list of transparent data encryptions",
      "type": "object",
      "properties": {
        "value": {
          "description": "Array of results.",
          "type": "array",
          "items": {
            "$ref": "#/definitions/LogicalDatabaseTransparentDataEncryption"
          },
          "readOnly": true
        },
        "nextLink": {
          "description": "Link to retrieve next page of results.",
          "type": "string",
          "readOnly": true
        }
      }
    },
    "TransparentDataEncryptionProperties": {
      "description": "Properties of a transparent data encryption.",
      "required": [
        "state"
      ],
      "type": "object",
      "properties": {
        "state": {
          "description": "Specifies the state of the transparent data encryption.",
          "enum": [
            "Enabled",
            "Disabled"
          ],
          "type": "string",
          "x-ms-enum": {
            "name": "TransparentDataEncryptionState",
            "modelAsString": false
          }
        }
      }
    }
  },
  "parameters": {},
  "securityDefinitions": {
    "azure_auth": {
      "type": "oauth2",
      "description": "Azure Active Directory OAuth2 Flow",
      "flow": "implicit",
      "authorizationUrl": "https://login.microsoftonline.com/common/oauth2/authorize",
      "scopes": {
        "user_impersonation": "impersonate your user account"
      }
    }
  }
}