Azure · azure-sdk · Mar 25, 2026 · Mar 25, 2026 · Copilot · Mar 25, 2026
@@ -1,5 +1,17 @@
 # Release History
 
+## 4.11.0 (2026-03-25)
+
+### Features Added
+
+- Added support for service API version `2025-07-01`
+- Added support for retrieving secrets with `out_content_type`
+- Added the `previous_version` property to `SecretProperties`
+
+### Other Changes
+
+- Key Vault API version `2025-07-01` is now the default
+
 ## 4.10.1 (Unreleased)
 
 ### Features Added

@@ -1,7 +1,8 @@
 include *.md
 include LICENSE
-include azure/keyvault/secrets/py.typed
+include azure/keyvault/secrets/_generated/py.typed
 recursive-include tests *.py
 recursive-include samples *.py *.md
 include azure/__init__.py
 include azure/keyvault/__init__.py
+include azure/keyvault/secrets/__init__.py
@@ -0,0 +1,10 @@
+{
+  "apiVersion": "2025-07-01",
+  "apiVersions": {
+    "KeyVault": "2025-07-01"
+  },
+  "commit": "942c8b2fd38b3be3f322e219c97c5c3a75f2e97b",
+  "repository_url": "https://github.com/Azure/azure-rest-api-specs",
+  "typespec_src": "specification/keyvault/data-plane/Secrets",
+  "emitterVersion": "0.61.1"
+}
@@ -0,0 +1,42 @@
+{
+    "CrossLanguagePackageId": "KeyVault",
+    "CrossLanguageDefinitionId": {
+        "azure.keyvault.secrets._generated.models.BackupSecretResult": "KeyVault.BackupSecretResult",
+        "azure.keyvault.secrets._generated.models.DeletedSecretBundle": "KeyVault.DeletedSecretBundle",
+        "azure.keyvault.secrets._generated.models.DeletedSecretItem": "KeyVault.DeletedSecretItem",
+        "azure.keyvault.secrets._generated.models.KeyVaultError": "KeyVaultError",
+        "azure.keyvault.secrets._generated.models.KeyVaultErrorError": "KeyVaultError.error.anonymous",
+        "azure.keyvault.secrets._generated.models.SecretAttributes": "KeyVault.SecretAttributes",
+        "azure.keyvault.secrets._generated.models.SecretBundle": "KeyVault.SecretBundle",
+        "azure.keyvault.secrets._generated.models.SecretItem": "KeyVault.SecretItem",
+        "azure.keyvault.secrets._generated.models.SecretRestoreParameters": "KeyVault.SecretRestoreParameters",
+        "azure.keyvault.secrets._generated.models.SecretSetParameters": "KeyVault.SecretSetParameters",
+        "azure.keyvault.secrets._generated.models.SecretUpdateParameters": "KeyVault.SecretUpdateParameters",
+        "azure.keyvault.secrets._generated.models.DeletionRecoveryLevel": "KeyVault.DeletionRecoveryLevel",
+        "azure.keyvault.secrets._generated.models.ContentType": "KeyVault.ContentType",
+        "azure.keyvault.secrets._generated.KeyVaultClient.set_secret": "KeyVault.setSecret",
+        "azure.keyvault.secrets._generated.aio.KeyVaultClient.set_secret": "KeyVault.setSecret",
+        "azure.keyvault.secrets._generated.KeyVaultClient.delete_secret": "KeyVault.deleteSecret",
+        "azure.keyvault.secrets._generated.aio.KeyVaultClient.delete_secret": "KeyVault.deleteSecret",
+        "azure.keyvault.secrets._generated.KeyVaultClient.update_secret": "KeyVault.updateSecret",
+        "azure.keyvault.secrets._generated.aio.KeyVaultClient.update_secret": "KeyVault.updateSecret",
+        "azure.keyvault.secrets._generated.KeyVaultClient.get_secret": "KeyVault.getSecret",
+        "azure.keyvault.secrets._generated.aio.KeyVaultClient.get_secret": "KeyVault.getSecret",
+        "azure.keyvault.secrets._generated.KeyVaultClient.get_secrets": "KeyVault.getSecrets",
+        "azure.keyvault.secrets._generated.aio.KeyVaultClient.get_secrets": "KeyVault.getSecrets",
+        "azure.keyvault.secrets._generated.KeyVaultClient.get_secret_versions": "KeyVault.getSecretVersions",
+        "azure.keyvault.secrets._generated.aio.KeyVaultClient.get_secret_versions": "KeyVault.getSecretVersions",
+        "azure.keyvault.secrets._generated.KeyVaultClient.get_deleted_secrets": "KeyVault.getDeletedSecrets",
+        "azure.keyvault.secrets._generated.aio.KeyVaultClient.get_deleted_secrets": "KeyVault.getDeletedSecrets",
+        "azure.keyvault.secrets._generated.KeyVaultClient.get_deleted_secret": "KeyVault.getDeletedSecret",
+        "azure.keyvault.secrets._generated.aio.KeyVaultClient.get_deleted_secret": "KeyVault.getDeletedSecret",
+        "azure.keyvault.secrets._generated.KeyVaultClient.purge_deleted_secret": "KeyVault.purgeDeletedSecret",
+        "azure.keyvault.secrets._generated.aio.KeyVaultClient.purge_deleted_secret": "KeyVault.purgeDeletedSecret",
+        "azure.keyvault.secrets._generated.KeyVaultClient.recover_deleted_secret": "KeyVault.recoverDeletedSecret",
+        "azure.keyvault.secrets._generated.aio.KeyVaultClient.recover_deleted_secret": "KeyVault.recoverDeletedSecret",
+        "azure.keyvault.secrets._generated.KeyVaultClient.backup_secret": "KeyVault.backupSecret",
+        "azure.keyvault.secrets._generated.aio.KeyVaultClient.backup_secret": "KeyVault.backupSecret",
+        "azure.keyvault.secrets._generated.KeyVaultClient.restore_secret": "KeyVault.restoreSecret",
+        "azure.keyvault.secrets._generated.aio.KeyVaultClient.restore_secret": "KeyVault.restoreSecret"
+    }
+}
@@ -2,5 +2,5 @@
   "AssetsRepo": "Azure/azure-sdk-assets",
   "AssetsRepoPrefixPath": "python",
   "TagPrefix": "python/keyvault/azure-keyvault-secrets",
-  "Tag": "python/keyvault/azure-keyvault-secrets_05a26dd08a"
+  "Tag": "python/keyvault/azure-keyvault-secrets_956559ff2d"
 }
@@ -1,6 +1 @@
-# ------------------------------------
-# Copyright (c) Microsoft Corporation.
-# Licensed under the MIT License.
-# ------------------------------------
-# pylint:disable=missing-docstring
 __path__ = __import__("pkgutil").extend_path(__path__, __name__)  # type: ignore
@@ -1,6 +1 @@
-# ------------------------------------
-# Copyright (c) Microsoft Corporation.
-# Licensed under the MIT License.
-# ------------------------------------
-# pylint:disable=missing-docstring
 __path__ = __import__("pkgutil").extend_path(__path__, __name__)  # type: ignore
@@ -42,11 +42,20 @@ class SecretClient(KeyVaultClientBase):
     # pylint:disable=protected-access
 
     @distributed_trace
-    def get_secret(self, name: str, version: Optional[str] = None, **kwargs: Any) -> KeyVaultSecret:
+    def get_secret(
+        self,
+        name: str,
+        version: Optional[str] = None,
+        *,
+        out_content_type: Optional[str] = None,
+        **kwargs: Any,
+    ) -> KeyVaultSecret:
         """Get a secret. Requires the secrets/get permission.
 
         :param str name: The name of the secret
         :param str version: (optional) Version of the secret to get. If unspecified, gets the latest version.
+        :keyword str out_content_type: The desired media type of the certificate secret value. For certificate-backed
+            secrets, the service can convert supported values such as ``application/x-pem-file``.
 
         :returns: The fetched secret.
         :rtype: ~azure.keyvault.secrets.KeyVaultSecret
@@ -62,10 +71,14 @@ def get_secret(self, name: str, version: Optional[str] = None, **kwargs: Any) ->
                 :caption: Get a secret
                 :dedent: 8
         """
+        client_kwargs = dict(kwargs)
+        if out_content_type is not None:
+            client_kwargs["out_content_type"] = out_content_type
+
         bundle = self._client.get_secret(
             secret_name=name,
             secret_version=version or "",
-            **kwargs
+            **client_kwargs
         )
         return KeyVaultSecret._from_secret_bundle(bundle)
 

@@ -15,23 +15,24 @@
 from azure.core.rest import HttpRequest, HttpResponse
 
 from ._configuration import KeyVaultClientConfiguration
-from ._operations import KeyVaultClientOperationsMixin
+from ._operations import _KeyVaultClientOperationsMixin
 from ._utils.serialization import Deserializer, Serializer
 
 if TYPE_CHECKING:
     from azure.core.credentials import TokenCredential
 
 
-class KeyVaultClient(KeyVaultClientOperationsMixin):
+class KeyVaultClient(_KeyVaultClientOperationsMixin):
     """The key vault client performs cryptographic key operations and vault operations against the Key
     Vault service.
 
     :param vault_base_url: Required.
     :type vault_base_url: str
     :param credential: Credential used to authenticate requests to the service. Required.
     :type credential: ~azure.core.credentials.TokenCredential
-    :keyword api_version: The API version to use for this operation. Default value is "7.6". Note
-     that overriding this default value may result in unsupported behavior.
+    :keyword api_version: The API version to use for this operation. Known values are "2025-07-01".
+     Default value is "2025-07-01". Note that overriding this default value may result in
+     unsupported behavior.
     :paramtype api_version: str
     """
 

@@ -26,13 +26,14 @@ class KeyVaultClientConfiguration:  # pylint: disable=too-many-instance-attribut
     :type vault_base_url: str
     :param credential: Credential used to authenticate requests to the service. Required.
     :type credential: ~azure.core.credentials.TokenCredential
-    :keyword api_version: The API version to use for this operation. Default value is "7.6". Note
-     that overriding this default value may result in unsupported behavior.
+    :keyword api_version: The API version to use for this operation. Known values are "2025-07-01".
+     Default value is "2025-07-01". Note that overriding this default value may result in
+     unsupported behavior.
     :paramtype api_version: str
     """
 
     def __init__(self, vault_base_url: str, credential: "TokenCredential", **kwargs: Any) -> None:
-        api_version: str = kwargs.pop("api_version", "7.6")
+        api_version: str = kwargs.pop("api_version", "2025-07-01")
 
         if vault_base_url is None:
             raise ValueError("Parameter 'vault_base_url' must not be None.")