docs: def create_keyvault(access_token, subscription_id, rgname, vault_name, location,
                      template_deployment=True, tenant_id=None, object_id=None):
      '''Create a new key vault in the named resource group.
  
      Args:
          access_token (str): A valid Azure authentication token.
          subscription_id (str): Azure subscription id.
          rgname (str): Azure resource group name.
          vault_name (str): Name of the new key vault.
          location (str): Azure data center location. E.g. westus2.
          template_deployment (boolean): Whether to allow deployment from template.
          tenant_id (str): Optionally specify a tenant ID (otherwise picks first response) from
                           ist_tenants().
          object_id (str): Optionally specify an object ID representing user or principal for the
                           access policy.
  
      Returns:
          HTTP response. JSON body of key vault properties.
      '''
      endpoint = ''.join([get_rm_endpoint(),
                          '/subscriptions/', subscription_id,
                          '/resourcegroups/', rgname,
                          '/providers/Microsoft.KeyVault/vaults/', vault_name,
                          '?api-version=', KEYVAULT_API])
      # get tenant ID if not specified
      if tenant_id is None:
          ret = list_tenants(access_token)
          tenant_id = ret['value'][0]['tenantId']
      # if object_id is None:
      access_policies = [{'tenantId': tenant_id, 'objectId': object_id,
                          'permissions': {
                              'keys': ['get', 'create', 'delete', 'list', 'update', 'import',
                                       'backup', 'restore', 'recover'],
                              'secrets': ['get', 'list', 'set', 'delete', 'backup', 'restore',
                                          'recover'],
                              'certificates': ['get', 'list', 'delete', 'create', 'import', 'update',
                                               'managecontacts', 'getissuers', 'listissuers',
                                               'setissuers', 'deleteissuers', 'manageissuers',
                                               'recover'],
                              'storage': ['get', 'list', 'delete', 'set', 'update', 'regeneratekey',
                                          'setsas', 'listsas', 'getsas', 'deletesas']
                          }}]
      vault_properties = {'tenantId': tenant_id, 'sku': {'family': 'A', 'name': 'standard'},
                          'enabledForTemplateDeployment': template_deployment,
                          'accessPolicies': access_policies}
      vault_body = {'location': location, 'properties': vault_properties}
      body = json.dumps(vault_body)
      return do_put(endpoint, body, access_token)