Make key_Version optional for encrypt, sign, wrapKey (#4249)

After talking with the Key Vault and Managed HSM teams, we want to promote using the latest key version for encrypting, sign, and wrapping DEKs; however, encourage passing a version to their reverse operations.

Requires Azure/azure-rest-api-specs#42571

Author: heaths

sdk/keyvault/assets.json

@@ -2,5 +2,5 @@
   "AssetsRepo": "Azure/azure-sdk-assets",
   "AssetsRepoPrefixPath": "rust",
   "TagPrefix": "rust/keyvault",
-  "Tag": "rust/keyvault_c9f2f1865c"
+  "Tag": "rust/keyvault_e3dd11701a"
 }

sdk/keyvault/azure_security_keyvault_certificates/CHANGELOG.md

@@ -10,6 +10,8 @@
 
 ### Other Changes
 
+- Updated dependencies.
+
 ## 0.12.0 (2026-04-08)
 
 ### Other Changes

sdk/keyvault/azure_security_keyvault_certificates/README.md

@@ -234,7 +234,7 @@ use azure_security_keyvault_certificates::{
     ResourceExt,
 };
 use azure_security_keyvault_keys::{
-    models::{SignParameters, SignatureAlgorithm},
+    models::{KeyClientSignOptions, SignParameters, SignatureAlgorithm},
 };
 use openssl::sha::sha256;
 
@@ -285,7 +285,14 @@ let body = SignParameters {
 };
 
 let signature = key_client
-    .sign("ec-signing-certificate", &certificate_version, body.try_into()?, None)
+    .sign(
+        "ec-signing-certificate",
+        body.try_into()?,
+        Some(KeyClientSignOptions {
+            key_version: Some(certificate_version.clone()),
+            ..Default::default()
+        }),
+    )
     .await?
     .into_model()?;
 

sdk/keyvault/azure_security_keyvault_certificates/tests/certificate_client.rs

@@ -19,7 +19,7 @@ use azure_security_keyvault_certificates::{
     CertificateClient, CertificateClientOptions, ResourceExt as _,
 };
 use azure_security_keyvault_keys::{
-    models::{SignParameters, SignatureAlgorithm},
+    models::{KeyClientSignOptions, SignParameters, SignatureAlgorithm},
     KeyClient, KeyClientOptions,
 };
 use azure_security_keyvault_test::Retry;
@@ -357,7 +357,14 @@ async fn sign_jwt_with_ec_certificate(ctx: TestContext) -> Result<()> {
         value: Some(digest),
     };
     let signature = key_client
-        .sign(NAME, &certificate_version, body.try_into()?, None)
+        .sign(
+            NAME,
+            body.try_into()?,
+            Some(KeyClientSignOptions {
+                key_version: Some(certificate_version.clone()),
+                ..Default::default()
+            }),
+        )
         .await?
         .into_model()?;
     assert!(signature.result.is_some());

sdk/keyvault/azure_security_keyvault_keys/CHANGELOG.md

@@ -4,8 +4,12 @@
 
 ### Features Added
 
+- Added support for `ResourceIdExt` to `KeyOperationResult`.
+
 ### Breaking Changes
 
+- Moved `key_version` parameter to be an optional parameter for `KeyClient::encrypt()`, `sign()`, and `wrapKey()`.
+
 ### Bugs Fixed
 
 ### Other Changes

sdk/keyvault/azure_security_keyvault_keys/README.md

@@ -234,7 +234,7 @@ use azure_security_keyvault_keys::{
     models::{
         CreateKeyParameters, EncryptionAlgorithm, KeyOperationParameters, KeyType,
     },
-    ResourceExt,
+    ResourceExt, ResourceId,
 };
 use rand::random;
 
@@ -249,7 +249,6 @@ let key = client
     .create_key("key-name", body.try_into()?, None)
     .await?
     .into_model()?;
-let key_version = key.resource_id()?.version.expect("key version required");
 
 // Generate a symmetric data encryption key (DEK). You'd encrypt your data using this DEK.
 let dek = random::<u32>().to_le_bytes().to_vec();
@@ -261,16 +260,21 @@ let mut parameters = KeyOperationParameters {
     ..Default::default()
 };
 let wrapped = client
-    .wrap_key("key-name", &key_version, parameters.clone().try_into()?, None)
+    .wrap_key("key-name", parameters.clone().try_into()?, None)
     .await?
     .into_model()?;
 
 assert!(matches!(wrapped.result.as_ref(), Some(result) if !result.is_empty()));
 
+// Retain the key ID that was used to wrap so you can unwrap using the same version later.
+// We'll parse the version to pass to `unwrap_key` below.
+let ResourceId { version, .. } = wrapped.resource_id()?;
+let key_version = version.as_deref().unwrap_or_default();
+
 // Unwrap the DEK.
 parameters.value = wrapped.result;
 let unwrapped = client
-    .unwrap_key("key-name", &key_version, parameters.try_into()?, None)
+    .unwrap_key("key-name", key_version, parameters.try_into()?, None)
     .await?
     .into_model()?;
 

sdk/keyvault/azure_security_keyvault_keys/src/generated/clients/key_client.rs

@@ -123,7 +123,7 @@ fn deconstruct(url: &Url) -> Result<ResourceId> {
 }
 
 mod private {
-    use crate::models::{DeletedKey, DeletedKeyProperties, Key, KeyProperties};
+    use crate::models::{DeletedKey, DeletedKeyProperties, Key, KeyOperationResult, KeyProperties};
 
     pub trait AsId {
         fn as_id(&self) -> Option<&String>;
@@ -152,6 +152,12 @@ mod private {
             self.kid.as_ref()
         }
     }
+
+    impl AsId for KeyOperationResult {
+        fn as_id(&self) -> Option<&String> {
+            self.kid.as_ref()
+        }
+    }
 }
 
 #[cfg(test)]