Database Accounts - List Keys

Service:: Cosmos DB Resource Provider

API Version:: 2026-03-15

Lists the access keys for the specified Azure Cosmos DB database account.

POST https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DocumentDB/databaseAccounts/{accountName}/listKeys?api-version=2026-03-15

URI Parameters

Name	In	Required	Type	Description
accountName	path	True	string minLength: 3 maxLength: 50 pattern: ^[a-z0-9]+(-[a-z0-9]+)*	Cosmos DB database account name.
resourceGroupName	path	True	string minLength: 1 maxLength: 90	The name of the resource group. The name is case insensitive.
subscriptionId	path	True	string (uuid)	The ID of the target subscription. The value must be an UUID.
api-version	query	True	string minLength: 1	The API version to use for this operation.

Responses

Name	Type	Description
200 OK	DatabaseAccountListKeysResult	Azure operation completed successfully.
Other Status Codes	ErrorResponse	An unexpected error response.

Security

azure_auth

Azure Active Directory OAuth2 Flow.

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name	Description
user_impersonation	impersonate your user account

Examples

CosmosDBDatabaseAccountListKeys

POST https://management.azure.com/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/rg1/providers/Microsoft.DocumentDB/databaseAccounts/ddb1/listKeys?api-version=2026-03-15

from azure.identity import DefaultAzureCredential

from azure.mgmt.cosmosdb import CosmosDBManagementClient

"""
# PREREQUISITES
    pip install azure-identity
    pip install azure-mgmt-cosmosdb
# USAGE
    python cosmos_db_database_account_list_keys.py

    Before run the sample, please set the values of the client ID, tenant ID and client secret
    of the AAD application as environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID,
    AZURE_CLIENT_SECRET. For more info about how to get the value, please see:
    https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal
"""


def main():
    client = CosmosDBManagementClient(
        credential=DefaultAzureCredential(),
        subscription_id="SUBSCRIPTION_ID",
    )

    response = client.database_accounts.list_keys(
        resource_group_name="rg1",
        account_name="ddb1",
    )
    print(response)


# x-ms-original-file: 2026-03-15/CosmosDBDatabaseAccountListKeys.json
if __name__ == "__main__":
    main()

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Sample response

Status code:: 200

{
  "primaryMasterKey": "primaryMasterKey",
  "secondaryMasterKey": "secondaryMasterKey",
  "primaryReadonlyMasterKey": "primaryReadonlyMasterKey",
  "secondaryReadonlyMasterKey": "secondaryReadonlyMasterKey"
}

Definitions

Name	Description
DatabaseAccountListKeysResult	The access keys for the given database account.
ErrorResponse	Error Response.

DatabaseAccountListKeysResult

Object

The access keys for the given database account.

Name	Type	Description
primaryMasterKey	string	Base 64 encoded value of the primary read-write key.
primaryReadonlyMasterKey	string	Base 64 encoded value of the primary read-only key.
secondaryMasterKey	string	Base 64 encoded value of the secondary read-write key.
secondaryReadonlyMasterKey	string	Base 64 encoded value of the secondary read-only key.

ErrorResponse

Object

Error Response.

Name	Type	Description
code	string	Error code.
message	string	Error message indicating why the operation failed.