STG101 - Server-Side Encryption with Rekeying

sdk/storage/azure-storage-blob/src/main/java/com/azure/storage/blob/options/AppendBlobAppendBlockFromUrlOptions.java

@@ -6,6 +6,7 @@
 import com.azure.core.annotation.Fluent;
 import com.azure.core.http.HttpAuthorization;
 import com.azure.core.util.CoreUtils;
+import com.azure.storage.blob.models.CustomerProvidedKey;
 import com.azure.storage.blob.models.FileShareTokenIntent;
 import com.azure.storage.blob.models.AppendBlobRequestConditions;
 import com.azure.storage.blob.models.BlobRange;
@@ -23,6 +24,7 @@ public final class AppendBlobAppendBlockFromUrlOptions {
     private BlobRequestConditions sourceRequestConditions;
     private HttpAuthorization sourceAuthorization;
     private FileShareTokenIntent sourceShareTokenIntent;
+    private CustomerProvidedKey sourceCustomerProvidedKey;
 
     /**
      * Creates a new instance of {@link AppendBlobAppendBlockFromUrlOptions}.
@@ -166,4 +168,27 @@ public AppendBlobAppendBlockFromUrlOptions setSourceShareTokenIntent(FileShareTo
         this.sourceShareTokenIntent = sourceShareTokenIntent;
         return this;
     }
+
+    /**
+     * Gets the optional {@link CustomerProvidedKey} used for encrypting the source blob.
+     * Applicable only for service version 2026-02-06 or later.
+     *
+     * @return the {@link CustomerProvidedKey} used for encrypting the source blob.
+     */
+    public CustomerProvidedKey getSourceCustomerProvidedKey() {
+        return sourceCustomerProvidedKey;
+    }
+
+    /**
+     * Sets the optional {@link CustomerProvidedKey} used for encrypting the source blob.
+     * Applicable only for service version 2026-02-06 or later.
+     *
+     * @param sourceCustomerProvidedKey The {@link CustomerProvidedKey} used for encrypting the source blob.
+     * @return The updated options.
+     */
+    public AppendBlobAppendBlockFromUrlOptions
+        setSourceCustomerProvidedKey(CustomerProvidedKey sourceCustomerProvidedKey) {
+        this.sourceCustomerProvidedKey = sourceCustomerProvidedKey;
+        return this;
+    }
 }

sdk/storage/azure-storage-blob/src/main/java/com/azure/storage/blob/options/BlobUploadFromUrlOptions.java

@@ -5,6 +5,7 @@
 
 import com.azure.core.http.HttpAuthorization;
 import com.azure.core.util.CoreUtils;
+import com.azure.storage.blob.models.CustomerProvidedKey;
 import com.azure.storage.blob.models.FileShareTokenIntent;
 import com.azure.storage.blob.models.AccessTier;
 import com.azure.storage.blob.models.BlobCopySourceTagsMode;
@@ -29,6 +30,7 @@ public class BlobUploadFromUrlOptions {
     private HttpAuthorization sourceAuthorization;
     private BlobCopySourceTagsMode copySourceTags;
     private FileShareTokenIntent sourceShareTokenIntent;
+    private CustomerProvidedKey sourceCustomerProvidedKey;
 
     /**
      * Creates a new instance of {@link BlobUploadFromUrlOptions}.
@@ -259,4 +261,26 @@ public BlobUploadFromUrlOptions setSourceShareTokenIntent(FileShareTokenIntent s
         this.sourceShareTokenIntent = sourceShareTokenIntent;
         return this;
     }
+
+    /**
+     * Gets the optional {@link CustomerProvidedKey} used for encrypting the source blob.
+     * Applicable only for service version 2026-02-06 or later.
+     *
+     * @return the {@link CustomerProvidedKey} used for encrypting the source blob.
+     */
+    public CustomerProvidedKey getSourceCustomerProvidedKey() {
+        return sourceCustomerProvidedKey;
+    }
+
+    /**
+     * Sets the optional {@link CustomerProvidedKey} used for encrypting the source blob.
+     * Applicable only for service version 2026-02-06 or later.
+     *
+     * @param sourceCustomerProvidedKey The {@link CustomerProvidedKey} used for encrypting the source blob.
+     * @return The updated options.
+     */
+    public BlobUploadFromUrlOptions setSourceCustomerProvidedKey(CustomerProvidedKey sourceCustomerProvidedKey) {
+        this.sourceCustomerProvidedKey = sourceCustomerProvidedKey;
+        return this;
+    }
 }

sdk/storage/azure-storage-blob/src/main/java/com/azure/storage/blob/options/BlockBlobStageBlockFromUrlOptions.java

@@ -6,6 +6,7 @@
 import com.azure.core.annotation.Fluent;
 import com.azure.core.http.HttpAuthorization;
 import com.azure.core.util.CoreUtils;
+import com.azure.storage.blob.models.CustomerProvidedKey;
 import com.azure.storage.blob.models.FileShareTokenIntent;
 import com.azure.storage.blob.models.BlobRange;
 import com.azure.storage.blob.models.BlobRequestConditions;
@@ -23,6 +24,7 @@ public final class BlockBlobStageBlockFromUrlOptions {
     private BlobRequestConditions sourceRequestConditions;
     private HttpAuthorization sourceAuthorization;
     private FileShareTokenIntent sourceShareTokenIntent;
+    private CustomerProvidedKey sourceCustomerProvidedKey;
 
     /**
      * Creates a new instance of {@link BlockBlobStageBlockFromUrlOptions}.
@@ -176,4 +178,27 @@ public BlockBlobStageBlockFromUrlOptions setSourceShareTokenIntent(FileShareToke
         this.sourceShareTokenIntent = sourceShareTokenIntent;
         return this;
     }
+
+    /**
+     * Gets the optional {@link CustomerProvidedKey} used for encrypting the source blob.
+     * Applicable only for service version 2026-02-06 or later.
+     *
+     * @return the {@link CustomerProvidedKey} used for encrypting the source blob.
+     */
+    public CustomerProvidedKey getSourceCustomerProvidedKey() {
+        return sourceCustomerProvidedKey;
+    }
+
+    /**
+     * Sets the optional {@link CustomerProvidedKey} used for encrypting the source blob.
+     * Applicable only for service version 2026-02-06 or later.
+     *
+     * @param sourceCustomerProvidedKey The {@link CustomerProvidedKey} used for encrypting the source blob.
+     * @return The updated options.
+     */
+    public BlockBlobStageBlockFromUrlOptions
+        setSourceCustomerProvidedKey(CustomerProvidedKey sourceCustomerProvidedKey) {
+        this.sourceCustomerProvidedKey = sourceCustomerProvidedKey;
+        return this;
+    }
 }

sdk/storage/azure-storage-blob/src/main/java/com/azure/storage/blob/options/PageBlobUploadPagesFromUrlOptions.java

@@ -6,6 +6,7 @@
 import com.azure.core.annotation.Fluent;
 import com.azure.core.http.HttpAuthorization;
 import com.azure.core.util.CoreUtils;
+import com.azure.storage.blob.models.CustomerProvidedKey;
 import com.azure.storage.blob.models.FileShareTokenIntent;
 import com.azure.storage.blob.models.BlobRequestConditions;
 import com.azure.storage.blob.models.PageBlobRequestConditions;
@@ -24,6 +25,7 @@ public final class PageBlobUploadPagesFromUrlOptions {
     private BlobRequestConditions sourceRequestConditions;
     private HttpAuthorization sourceAuthorization;
     private FileShareTokenIntent sourceShareTokenIntent;
+    private CustomerProvidedKey sourceCustomerProvidedKey;
 
     /**
      * Creates a new instance of {@link PageBlobUploadPagesFromUrlOptions}.
@@ -177,4 +179,27 @@ public PageBlobUploadPagesFromUrlOptions setSourceShareTokenIntent(FileShareToke
         this.sourceShareTokenIntent = sourceShareTokenIntent;
         return this;
     }
+
+    /**
+     * Gets the optional {@link CustomerProvidedKey} used for encrypting the source blob.
+     * Applicable only for service version 2026-02-06 or later.
+     *
+     * @return the {@link CustomerProvidedKey} used for encrypting the source blob.
+     */
+    public CustomerProvidedKey getSourceCustomerProvidedKey() {
+        return sourceCustomerProvidedKey;
+    }
+
+    /**
+     * Sets the optional {@link CustomerProvidedKey} used for encrypting the source blob.
+     * Applicable only for service version 2026-02-06 or later.
+     *
+     * @param sourceCustomerProvidedKey The {@link CustomerProvidedKey} used for encrypting the source blob.
+     * @return The updated options.
+     */
+    public PageBlobUploadPagesFromUrlOptions
+        setSourceCustomerProvidedKey(CustomerProvidedKey sourceCustomerProvidedKey) {
+        this.sourceCustomerProvidedKey = sourceCustomerProvidedKey;
+        return this;
+    }
 }

sdk/storage/azure-storage-blob/src/main/java/com/azure/storage/blob/specialized/AppendBlobAsyncClient.java

@@ -33,6 +33,7 @@
 import com.azure.storage.blob.models.BlobStorageException;
 import com.azure.storage.blob.models.CpkInfo;
 import com.azure.storage.blob.models.CustomerProvidedKey;
+import com.azure.storage.blob.models.EncryptionAlgorithmType;
 import com.azure.storage.blob.options.AppendBlobAppendBlockFromUrlOptions;
 import com.azure.storage.blob.options.AppendBlobCreateOptions;
 import com.azure.storage.blob.options.AppendBlobSealOptions;
@@ -385,9 +386,8 @@ Mono<Response<AppendBlobItem>> createIfNotExistsWithResponse(AppendBlobCreateOpt
 
     /**
      * Commits a new block of data to the end of the existing append blob.
-     * <p>
-     * Note that the data passed must be replayable if retries are enabled (the default). In other words, the
-     * {@code Flux} must produce the same data each time it is subscribed to.
+     * <p>Note that the data passed must be replayable if retries are enabled (the default). In other words, the
+     * {@code Flux} must produce the same data each time it is subscribed to.</p>
      *
      * For service versions 2022-11-02 and later, the max block size is 100 MB. For previous versions, the max block
      * size is 4 MB. For more information, see the
@@ -415,9 +415,8 @@ public Mono<AppendBlobItem> appendBlock(Flux<ByteBuffer> data, long length) {
 
     /**
      * Commits a new block of data to the end of the existing append blob.
-     * <p>
-     * Note that the data passed must be replayable if retries are enabled (the default). In other words, the
-     * {@code Flux} must produce the same data each time it is subscribed to.
+     * <p>Note that the data passed must be replayable if retries are enabled (the default). In other words, the
+     * {@code Flux} must produce the same data each time it is subscribed to.</p>
      *
      * For service versions 2022-11-02 and later, the max block size is 100 MB. For previous versions, the max block
      * size is 4 MB. For more information, see the
@@ -608,6 +607,13 @@ Mono<Response<AppendBlobItem>> appendBlockFromUrlWithResponse(AppendBlobAppendBl
         String sourceAuth
             = options.getSourceAuthorization() == null ? null : options.getSourceAuthorization().toString();
 
+        // Extract source CPK properties only if non-null
+        CustomerProvidedKey sourceCustomerProvidedKey = options.getSourceCustomerProvidedKey();
+        String sourceCpkKey = sourceCustomerProvidedKey != null ? sourceCustomerProvidedKey.getKey() : null;
+        String sourceCpkKeySha256 = sourceCustomerProvidedKey != null ? sourceCustomerProvidedKey.getKeySha256() : null;
+        EncryptionAlgorithmType sourceCpkAlgorithm
+            = sourceCustomerProvidedKey != null ? sourceCustomerProvidedKey.getEncryptionAlgorithm() : null;
+
         return this.azureBlobStorage.getAppendBlobs()
             .appendBlockFromUrlWithResponseAsync(containerName, blobName, options.getSourceUrl(), 0,
                 sourceRange.toString(), options.getSourceContentMd5(), null, null, null,
@@ -617,7 +623,8 @@ Mono<Response<AppendBlobItem>> appendBlockFromUrlWithResponse(AppendBlobAppendBl
                 destRequestConditions.getIfNoneMatch(), destRequestConditions.getTagsConditions(),
                 sourceRequestConditions.getIfModifiedSince(), sourceRequestConditions.getIfUnmodifiedSince(),
                 sourceRequestConditions.getIfMatch(), sourceRequestConditions.getIfNoneMatch(), null, sourceAuth,
-                options.getSourceShareTokenIntent(), getCustomerProvidedKey(), encryptionScope, context)
+                options.getSourceShareTokenIntent(), sourceCpkKey, sourceCpkKeySha256, sourceCpkAlgorithm,
+                getCustomerProvidedKey(), encryptionScope, context)
             .map(rb -> {
                 AppendBlobsAppendBlockFromUrlHeaders hd = rb.getDeserializedHeaders();
                 AppendBlobItem item = new AppendBlobItem(hd.getETag(), hd.getLastModified(), hd.getContentMD5(),

sdk/storage/azure-storage-blob/src/main/java/com/azure/storage/blob/specialized/AppendBlobClient.java

@@ -433,9 +433,8 @@ public Response<AppendBlobItem> createIfNotExistsWithResponse(AppendBlobCreateOp
 
     /**
      * Commits a new block of data to the end of the existing append blob.
-     * <p>
-     * Note that the data passed must be replayable if retries are enabled (the default). In other words, the
-     * {@code Flux} must produce the same data each time it is subscribed to.
+     * <p>Note that the data passed must be replayable if retries are enabled (the default). In other words, the
+     * {@code Flux} must produce the same data each time it is subscribed to.</p>
      *
      * For service versions 2022-11-02 and later, the max block size is 100 MB. For previous versions, the max block
      * size is 4 MB. For more information, see the
@@ -464,9 +463,8 @@ public AppendBlobItem appendBlock(InputStream data, long length) {
 
     /**
      * Commits a new block of data to the end of the existing append blob.
-     * <p>
-     * Note that the data passed must be replayable if retries are enabled (the default). In other words, the
-     * {@code Flux} must produce the same data each time it is subscribed to.
+     * <p>Note that the data passed must be replayable if retries are enabled (the default). In other words, the
+     * {@code Flux} must produce the same data each time it is subscribed to.</p>
      *
      * For service versions 2022-11-02 and later, the max block size is 100 MB. For previous versions, the max block
      * size is 4 MB. For more information, see the

sdk/storage/azure-storage-blob/src/main/java/com/azure/storage/blob/specialized/BlockBlobAsyncClient.java

@@ -32,6 +32,7 @@
 import com.azure.storage.blob.models.BlockLookupList;
 import com.azure.storage.blob.models.CpkInfo;
 import com.azure.storage.blob.models.CustomerProvidedKey;
+import com.azure.storage.blob.models.EncryptionAlgorithmType;
 import com.azure.storage.blob.options.BlobUploadFromUrlOptions;
 import com.azure.storage.blob.options.BlockBlobCommitBlockListOptions;
 import com.azure.storage.blob.options.BlockBlobListBlocksOptions;
@@ -572,6 +573,13 @@ Mono<Response<BlockBlobItem>> uploadFromUrlWithResponse(BlobUploadFromUrlOptions
         String sourceAuth
             = options.getSourceAuthorization() == null ? null : options.getSourceAuthorization().toString();
 
+        // Extract source CPK properties only if non-null
+        CustomerProvidedKey sourceCustomerProvidedKey = options.getSourceCustomerProvidedKey();
+        String sourceCpkKey = sourceCustomerProvidedKey != null ? sourceCustomerProvidedKey.getKey() : null;
+        String sourceCpkKeySha256 = sourceCustomerProvidedKey != null ? sourceCustomerProvidedKey.getKeySha256() : null;
+        EncryptionAlgorithmType sourceCpkAlgorithm
+            = sourceCustomerProvidedKey != null ? sourceCustomerProvidedKey.getEncryptionAlgorithm() : null;
+
         try {
             new URL(options.getSourceUrl());
         } catch (MalformedURLException ex) {
@@ -589,8 +597,8 @@ Mono<Response<BlockBlobItem>> uploadFromUrlWithResponse(BlobUploadFromUrlOptions
                 sourceRequestConditions.getIfNoneMatch(), sourceRequestConditions.getTagsConditions(), null,
                 options.getContentMd5(), ModelHelper.tagsToString(options.getTags()),
                 options.isCopySourceBlobProperties(), sourceAuth, options.getCopySourceTagsMode(),
-                options.getSourceShareTokenIntent(), options.getHeaders(), getCustomerProvidedKey(), encryptionScope,
-                context)
+                options.getSourceShareTokenIntent(), sourceCpkKey, sourceCpkKeySha256, sourceCpkAlgorithm,
+                options.getHeaders(), getCustomerProvidedKey(), encryptionScope, context)
             .map(rb -> {
                 BlockBlobsPutBlobFromUrlHeaders hd = rb.getDeserializedHeaders();
                 BlockBlobItem item = new BlockBlobItem(hd.getETag(), hd.getLastModified(), hd.getContentMD5(),
@@ -881,13 +889,21 @@ Mono<Response<Void>> stageBlockFromUrlWithResponse(BlockBlobStageBlockFromUrlOpt
         String sourceAuth
             = options.getSourceAuthorization() == null ? null : options.getSourceAuthorization().toString();
 
+        // Extract source CPK properties only if non-null
+        CustomerProvidedKey sourceCustomerProvidedKey = options.getSourceCustomerProvidedKey();
+        String sourceCpkKey = sourceCustomerProvidedKey != null ? sourceCustomerProvidedKey.getKey() : null;
+        String sourceCpkKeySha256 = sourceCustomerProvidedKey != null ? sourceCustomerProvidedKey.getKeySha256() : null;
+        EncryptionAlgorithmType sourceCpkAlgorithm
+            = sourceCustomerProvidedKey != null ? sourceCustomerProvidedKey.getEncryptionAlgorithm() : null;
+
         return this.azureBlobStorage.getBlockBlobs()
             .stageBlockFromURLNoCustomHeadersWithResponseAsync(containerName, blobName, options.getBase64BlockId(), 0,
                 options.getSourceUrl(), sourceRange.toHeaderValue(), options.getSourceContentMd5(), null, null,
                 options.getLeaseId(), sourceRequestConditions.getIfModifiedSince(),
                 sourceRequestConditions.getIfUnmodifiedSince(), sourceRequestConditions.getIfMatch(),
                 sourceRequestConditions.getIfNoneMatch(), null, sourceAuth, options.getSourceShareTokenIntent(),
-                getCustomerProvidedKey(), encryptionScope, context);
+                sourceCpkKey, sourceCpkKeySha256, sourceCpkAlgorithm, getCustomerProvidedKey(), encryptionScope,
+                context);
     }
 
     /**

sdk/storage/azure-storage-blob/src/main/java/com/azure/storage/blob/specialized/PageBlobAsyncClient.java

@@ -43,6 +43,7 @@
 import com.azure.storage.blob.models.CopyStatusType;
 import com.azure.storage.blob.models.CpkInfo;
 import com.azure.storage.blob.models.CustomerProvidedKey;
+import com.azure.storage.blob.models.EncryptionAlgorithmType;
 import com.azure.storage.blob.models.PageBlobCopyIncrementalRequestConditions;
 import com.azure.storage.blob.models.PageBlobItem;
 import com.azure.storage.blob.models.PageBlobRequestConditions;
@@ -698,6 +699,13 @@ Mono<Response<PageBlobItem>> uploadPagesFromUrlWithResponse(PageBlobUploadPagesF
         String sourceAuth
             = options.getSourceAuthorization() == null ? null : options.getSourceAuthorization().toString();
 
+        // Extract source CPK properties only if non-null
+        CustomerProvidedKey sourceCustomerProvidedKey = options.getSourceCustomerProvidedKey();
+        String sourceCpkKey = sourceCustomerProvidedKey != null ? sourceCustomerProvidedKey.getKey() : null;
+        String sourceCpkKeySha256 = sourceCustomerProvidedKey != null ? sourceCustomerProvidedKey.getKeySha256() : null;
+        EncryptionAlgorithmType sourceCpkAlgorithm
+            = sourceCustomerProvidedKey != null ? sourceCustomerProvidedKey.getEncryptionAlgorithm() : null;
+
         return this.azureBlobStorage.getPageBlobs()
             .uploadPagesFromURLWithResponseAsync(containerName, blobName, options.getSourceUrl(), sourceRangeString, 0,
                 rangeString, options.getSourceContentMd5(), null, null, destRequestConditions.getLeaseId(),
@@ -708,7 +716,8 @@ Mono<Response<PageBlobItem>> uploadPagesFromUrlWithResponse(PageBlobUploadPagesF
                 destRequestConditions.getTagsConditions(), sourceRequestConditions.getIfModifiedSince(),
                 sourceRequestConditions.getIfUnmodifiedSince(), sourceRequestConditions.getIfMatch(),
                 sourceRequestConditions.getIfNoneMatch(), null, sourceAuth, options.getSourceShareTokenIntent(),
-                getCustomerProvidedKey(), encryptionScope, context)
+                sourceCpkKey, sourceCpkKeySha256, sourceCpkAlgorithm, getCustomerProvidedKey(), encryptionScope,
+                context)
             .map(rb -> {
                 PageBlobsUploadPagesFromURLHeaders hd = rb.getDeserializedHeaders();
                 PageBlobItem item = new PageBlobItem(hd.getETag(), hd.getLastModified(), hd.getContentMD5(),

sdk/storage/azure-storage-blob/swagger/README.md

@@ -16,7 +16,7 @@ autorest
 ### Code generation settings
 ``` yaml
 use: '@autorest/[email protected]'
-input-file: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/refs/heads/main/specification/storage/data-plane/Microsoft.BlobStorage/stable/2026-02-06/blob.json
+input-file: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/ac8f57ef058d0899fb316f113604c4ef5265e689/specification/storage/data-plane/Microsoft.BlobStorage/stable/2026-04-06/blob.json
 java: true
 output-folder: ../
 namespace: com.azure.storage.blob