Azure.Storage.Sas.SasQueryParameters

SasQueryParameters

public class SasQueryParameters

A SasQueryParameters object represents the components that make up an Azure Storage Shared Access Signature's query parameters. It includes components used by all Azure Storage resources (Blob Containers, Blobs, Files, and Queues). You can construct a new instance using the service specific SAS builder types. For more information, Create a service SAS.

public const string DefaultSasVersion = "2025-07-05"

The default service version to use for Shared Access Signatures.

public static SasQueryParameters Empty { get; }

Gets empty shared access signature query parameters.

public string AgentObjectId { get; }

Gets the Unauthorized AAD Object Id associated with the shared access signature. The AAD Object Id of a user that is assumed to be unauthorized by the owner of the User Delegation Key. The Azure Storage Service will perform an additional POSIX ACL check to determine if the user is authorized to perform the requested operation. This cannot be used in conjuction with PreauthorizedAgentObjectId. Only valid in an HNS enabled account. If this value is set in an non-HNS enabled account, an authorization failure will be thrown.

public string CacheControl { get; }

Gets the Cache-Control response header, which allows for specifying the client-side caching to be used for blob and file downloads.

public string ContentDisposition { get; }

Gets the Content-Disposition response header, which allows for specifying the way that the blob or file content can be displayed in the browser.

public string ContentEncoding { get; }

Gets the Content-Encoding response header, which allows for specifying the type of encoding used for blob and file downloads.

public string ContentLanguage { get; }

Gets the Content-Language response header, which allows for specifying the language of the downloaded blob or file content.

public string ContentType { get; }

Gets the Content-Type response header, which allows for specifying the type of the downloaded blob or file content.

public string CorrelationId { get; }

Gets the Correlation Id associated with the shared access signature. This is used to correlate the storage audit logs with the audit logs used by the principal generating and distributing SAS.

public int? DirectoryDepth { get; }

Gets the Directory Depth specificed in the canonicalizedresource field of the string-to-sign. The depth of the directory is the number of directories beneath the root folder. Required when resource (sr) = d to indicate the depth of the directory. The value must be a non-negative integer.

public string EncryptionScope { get; }

Gets the Encryption Scope associated with the shared access signature.

public DateTimeOffset ExpiresOn { get; }

Gets the time at which the shared access signature becomes invalid. MinValue means not set.

public string Identifier { get; }

Gets the optional unique value up to 64 characters in length that correlates to an access policy specified for the blob container, queue, or share.

public SasIPRange IPRange { get; }

Gets the optional IP address or a range of IP addresses from which to accept requests. When specifying a range, note that the range is inclusive.

public string Permissions { get; }

Gets the permissions associated with the shared access signature. The user is restricted to operations allowed by the permissions. This field must be omitted if it has been specified in an associated stored access policy.

public string PreauthorizedAgentObjectId { get; }

Gets the Authorized AAD Object Id associated with the shared access signature. The AAD Object ID of a user authorized by the owner of the User Delegation Key to perform the action granted by the SAS. The Azure Storage service will ensure that the owner of the user delegation key has the required permissions before granting access but no additional permission check for the user specified in this value will be performed. This cannot be used in conjuction with AgentObjectId. Only valid in an HNS enabled account. If this value is set in an non-HNS enabled account, an authorization failure will be thrown.

public SasProtocol Protocol { get; }

Optional. Specifies the protocol permitted for a request made with the shared access signature.

public string Resource { get; }

Gets the resources are accessible via the shared access signature.

public AccountSasResourceTypes? ResourceTypes { get; }

Gets which resources are accessible via the shared access signature.

public AccountSasServices? Services { get; }

Gets the signed services accessible with an account level shared access signature.

public string Signature { get; }

Gets the string-to-sign, a unique string constructed from the fields that must be verified in order to authenticate the request. The signature is an HMAC computed over the string-to-sign and key using the SHA256 algorithm, and then encoded using Base64 encoding.

public DateTimeOffset StartsOn { get; }

Gets the optional time at which the shared access signature becomes valid. If omitted, start time for this call is assumed to be the time when the storage service receives the request. MinValue means not set.

public string Version { get; }

Gets the storage service version to use to authenticate requests made with this shared access signature, and the service version to use when handling requests made with this shared access signature.

protected SasQueryParameters()

Initializes a new instance of the SasQueryParameters class.

protected SasQueryParameters(IDictionary<string, string> values)

Creates a new instance of the SasQueryParameters type based on the supplied query parameters values. All SAS-related query parameters will be removed from values.

protected SasQueryParameters(string version, AccountSasServices? services, AccountSasResourceTypes? resourceTypes, SasProtocol protocol, DateTimeOffset startsOn, DateTimeOffset expiresOn, SasIPRange ipRange, string identifier, string resource, string permissions, string signature, string cacheControl = null, string contentDisposition = null, string contentEncoding = null, string contentLanguage = null, string contentType = null, string authorizedAadObjectId = null, string unauthorizedAadObjectId = null, string correlationId = null, int? directoryDepth = default, string encryptionScope = null)

Creates a new SasQueryParameters instance.

protected static SasQueryParameters Create(IDictionary<string, string> values)

Creates a new instance of the SasQueryParameters type based on the supplied query parameters values. All SAS-related query parameters will be removed from values.

protected static SasQueryParameters Create(string version, AccountSasServices? services, AccountSasResourceTypes? resourceTypes, SasProtocol protocol, DateTimeOffset startsOn, DateTimeOffset expiresOn, SasIPRange ipRange, string identifier, string resource, string permissions, string signature, string cacheControl = null, string contentDisposition = null, string contentEncoding = null, string contentLanguage = null, string contentType = null, string authorizedAadObjectId = null, string unauthorizedAadObjectId = null, string correlationId = null, int? directoryDepth = default, string encryptionScope = null)

Creates a new SasQueryParameters instance.