Q: Cosmos db RewrapClientEncryptionKeyAsync return 400 Bad Request I am trying to use this method "RewrapClientEncryptionKeyAsync" to change the CMK(azure key vault) in a cosmos db following this example: https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-always-encrypted?tabs=dotnet#cmk-rotation but when the code calls that method I always get the same error:
Azure.RequestFailedException: 'GET method does not allow the operation'.
Status: 400 (Bad Request)
ErrorCode: BadParameter
Content:
{"error":{"code": "BadParameter", "message": "GET method does not allow the operation."}}}
I am using DefaultAzureCredential() to get the client cosmos, also the instance for the client and the database looks fine; using my current key (old version) I can create and read items without problem. The application has the same permissions for both old and new key, for wrap and unwrap encryption operations and also rotate on rotation policy operations.
The code is in a .net 6 console application and the version of the nugets are:
Azure.Identity 1.6.0, Azure.Security.KeyVault.Keys 4.3.0, Microsoft.Azure.Cosmos.Encryption 1.0.0 and Microsoft.Azure.Cosmos 3.26.1.

A: 
Status: 400 (Bad Request) ErrorCode: BadParameter

400 BadRequest errors are often caused by incorrect URIs. Check for URI type or syntax issues and the correct URL format for key vault is like below,
https://<your-unique-key-vault-name>.vault.azure.net/

OR,
The user doesn't have the required permission.
To avoid this, configure a keyvault access policy to allow user-assigned managed IDs to access the secret.

For more information you can refer to this Microsoft Document
