class_docstr: An example of a KmsClient implementation with master keys
  managed by Hashicorp Vault KMS.
  See Vault documentation: https://www.vaultproject.io/api/secret/transit
  Not for production use!
docstr: Call Vault to unwrap wrapped_key with key
  identified by master_key_identifier
docstr_tok: ["Call","Vault","to","unwrap","wrapped_key","with","key","identified","by","master_key_identifier"]
code: def unwrap_key(self, wrapped_key, master_key_identifier):
      """Call Vault to unwrap wrapped_key with key
      identified by master_key_identifier"""
      endpoint = self.kms_url + VaultClient.UNWRAP_ENDPOINT
      headers = {
          VaultClient.TOKEN_HEADER: self.kms_connection_config.key_access_token
      }
      r = requests.post(
          endpoint + master_key_identifier,
          headers=headers,
          data={"ciphertext": wrapped_key},
      )
      r.raise_for_status()
      r_dict = r.json()
      plaintext = r_dict["data"]["plaintext"]
      key_bytes = base64.b64decode(plaintext)
      return key_bytes
  
file_path: arrow/python/examples/parquet_encryption/sample_vault_kms_client.py
imports: import argparse
  import base64
  import os
  import requests
  import pyarrow
  import pyarrow.parquet
  import pyarrow.parquet.encryption
label_desc: Use image node_id 3 for calling the VaultClient obj's underlying member method code with example usage: obj.unwrap_key(wrapped_key, master_key_identifier) and returns: key_bytes