vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* [Retrieving an import token with the CLI](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-import-tokensretrieve-import-token-cli)
* [What's next](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-import-tokenscreate-import-token-next-steps)



[Viewing a list of root keys or standard keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-keysview-keys)



* [Viewing root keys or standard keys with the console](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-keysview-key-gui)
* [Viewing root keys or standard keys with the key management service API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-keysview-key-api)



[Viewing details about a root key or a standard key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-key-detailsview-key-details)



* [Viewing key details with the IBM Cloud console](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-key-detailsview-key-details-ui)
* [Viewing key details with the key management service API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-key-detailsview-key-details-api)



[Retrieving a root key or a standard key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-keyretrieve-key)



* [Retrieving a key with the key management service API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-keyget-key-api)
4. Click Access policy.
5. Under Service, select Hyper Protect Crypto Services and click Next.
6. Under Resources, select Specific resources.
7. Select the Service Instance ID attribute type and enter the [instance ID that is retrieved](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-instance-ID).
8. Click Add a condition, enter the following identifying information about the key, and click Next:



1. Select Resource Type, and enter key.
2. Select Resource ID, and enter the ID that is assigned to your key by the Hyper Protect Crypto Services service.



9. Under Roles and actions, choose a combination of [platform and service access roles](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-accessroles) to assign access for the user and click Next.
10. (Optional) Under Conditions (optional), click Review to check the access policy.
11. After confirmation, click Add > Assign.









 Granting access to key rings in an instance 

A key ring is a collection of keys that are located within your service instance, in which you can restrict access through IAM access policy. For more information on key rings, see [Managing key rings](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-managing-key-rings).

You can grant access to key rings within a Hyper Protect Crypto Services instance by using the IBM Cloud console, IAM API, or IAM CLI.

Review [roles and permissions](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-access) to learn how IBM Cloud IAM roles map to Hyper Protect Crypto Services actions.



 Granting access to key rings with the console 

To assign access to a key ring with the console:



1. From the menu bar, click Manage > Access (IAM), and select Users to browse the existing users in your account.
2.
For more information, see [Restoring your data from another region](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-restore-data).
* How do I get support for Hyper Protect Crypto Services?

If you have technical questions about Hyper Protect Crypto Services, post your question on [Stack Overflow](https://stackoverflow.com/questions/tagged/hyper-protect-crypto) and tag your question with ibm-cloud and hyper-protect-crypto.

For more information about opening an IBM support ticket, or about support levels and ticket severities, see [Using the Support Center](https://cloud.ibm.com/docs/get-support?topic=get-support-using-avatar).
* Are there any prerequisites for using Hyper Protect Crypto Services?

To use Hyper Protect Crypto Services, you need to have a Pay-As-You-Go or Subscription IBM Cloud account.

If you don't have an IBM Cloud account, create an account first by going to [IBM Cloud registration](https://cloud.ibm.com/registration). To check your account type, go to [IBM Cloud](https://cloud.ibm.com/login) and click Management > Account > Account settings. You can also [apply your promo code](https://cloud.ibm.com/docs/billing-usage?topic=billing-usage-applying-promo-codes) if you have one. For more information about IBM Cloud accounts, see [FAQs for accounts](https://cloud.ibm.com/docs/account?topic=account-accountfaqs).

The service can be provisioned quickly by following instructions in [Provisioning service instances](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-provision).
curl "https://(endpoint)/(bucket-name)/?uploads"
-H "Authorization: bearer (token)"







 Stop incomplete multipart uploads 

curl -X "DELETE" "https://(endpoint)/(bucket-name)/(object-key)?uploadId"
-H "Authorization: bearer (token)"







 Configure a Static Website 

curl --location --request PUT 'https://<endpoint>/<bucketname>?website' --header 'Authorization: bearer <token>' --header 'ibm-service-instance-id: <resource_instance_id> --header 'Content-MD5: <hashed-output>' --header 'Content-Type: text/plain' --data-raw '<WebsiteConfiguration>
<IndexDocument>
<Suffix>index.html</Suffix>
</IndexDocument>
<ErrorDocument>
<Key>error.html</Key>
</ErrorDocument>
</WebsiteConfiguration>'

As a reminder, the Content-MD5 header needs to be the binary representation of a base64-encoded MD5 hash.

echo -n (XML block) | openssl dgst -md5 -binary | openssl enc -base64





 Next Steps 

The detailed description of the RESTful API for IBM Cloud Object Storage can be found in the [S3 Compatibility API Documentation](https://cloud.ibm.com/apidocs/cos/cos-compatibility) or the [Configuration API Documentation](https://cloud.ibm.com/apidocs/cos/cos-configuration).
$ curl -X GET "https://api.<region>.hs-crypto.cloud.ibm.com/api/v2/instance/policies?policy=metrics"   -H "accept: application/vnd.ibm.kms.policy+json"   -H "authorization: Bearer <IAM_token>"   -H "bluemix-instance: <instance_ID>"







 Disabling metrics for your Hyper Protect Crypto Services instance with the API 

As an instance manager, disable an existing metrics policy for a Hyper Protect Crypto Services instance by making a PUT call to the following endpoint.

https://api.<region>.hs-crypto.cloud.ibm.com/api/v2/instance/policies?policy=metrics



1. [Retrieve your authentication credentials to work with the API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-kms-api).

To enable metrics policies, you must be assigned a Manager IAM role for your Hyper Protect Crypto Services instance. To learn how IAM roles map to Hyper Protect Crypto Services service actions, check out [Service access roles](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-accessservice-access-roles).
2. Disable an existing metrics policy for your Hyper Protect Crypto Services instance by running the following curl command.

$ curl -X PUT "https://api.<region>.hs-crypto.cloud.ibm.com/api/v2/instance/policies?policy=metrics" -H "accept: application/vnd.ibm.kms.policy+json" -H "authorization: Bearer <IAM_token>" -H "bluemix-instance: <instance_ID>" -H "content-type: application/vnd.ibm.kms.policy+json" -d '{
"metadata": {
"collectionType": "application/vnd.ibm.kms.policy+json",
"collectionTotal": 1
},
To provision an instance of Hyper Protect Crypto Services with Unified Key Orchestrator from the IBM Cloud console, complete the following steps:



1. [Log in to your IBM Cloud account](https://cloud.ibm.com/login).
2. Click Create resource to view the list of services that are available on IBM Cloud.
3. Under Category, select Security.
4. From the list of services displayed, click the Hyper Protect Crypto Services tile.
5. On the service page, select the With Unified Key Orchestrator pricing plan.
6. Fill in the form with the details that are required.



* Under Region, select a [region](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regions) that you want to create your Hyper Protect Crypto Services resources in.

Currently, the us-south and us-east regions are enabled with recovery crypto units by default, which means, when a service instance is provisioned in either regions, you are enabled with the option to back up your master keys in the recovery crypto units located in both regions. For details, see [Introducing service instance initialization modes](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-instance-modeinstance-initialization-recovery-crypto-unit).
* Under Service name, enter a name for your service instance.
* Under Select a resource group, select the resource group where you want to organize and manage your service instance. You can select the initial resource group that is named Default or other groups that you create. For more information, see [Creating and managing resource groups](https://cloud.ibm.com/docs/account?topic=account-rgs).
* Under Tags (Optional), add tags to organize your resources. If your tags are billing related, consider writing tags as key: value pairs to help group-related tags, such as costctr:124. For more information about tags, see [Working with tags](https://cloud.ibm.com/docs/account?topic=account-tag).
For more information, see [Retrieving an access token](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-access-token). 
 instance_ID Required. The unique identifier that is assigned to your Hyper Protect Crypto Services service instance. For more information, see [Retrieving an instance ID](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-instance-ID). 
 key_alias Required. A unique, human-readable name for easy identification of your key. To protect your privacy, do not store your personal data as metadata for your key. 
 key_description An extended description of your key. To protect your privacy, do not store your personal data as metadata for your key. 
 encrypted_key Required. The new key material that is encrypted by the import token. The value must be base64 encoded. Ensure that the key material meets the following requirements:<br><br><br><br> * The key must be 128, 192, or 256 bits.<br> * The bytes of data, for example 32 bytes for 256 bits, must be encoded by using base64 encoding.<br><br><br><br>To learn more, see [Tutorial: Creating and importing encryption keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-tutorial-import-keystutorial-import-encrypt-key). 
 key_type A boolean value that determines whether the key material can leave the service. When you set the extractable attribute to false, the service designates the key as a root key that you can use for wrap or unwrap operations. 
 encrypted_nonce Required. The AES-GCM encrypted nonce that ensures that the bits you send as part of a request are exactly the same as what we receive. The nonce validates the key that you are restoring.
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/vaults/5295ad47-2ce9-43c3-b9e7-e5a9482c362b"
},
"managed_key": {
"id": "93777bca-baef-4070-b9b5-a2e6079df1b4",
"name": "My Managed Key",
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/managed_keys/5295ad47-2ce9-43c3-b9e7-e5a9482c362b"
},
"referenced_keystore": {
"id": "93777bca-baef-4070-b9b5-a2e6079df1b4",
"name": "My Managed Key",
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/managed_keys/5295ad47-2ce9-43c3-b9e7-e5a9482c362b"
},
"key_id_in_keystore": "93777bca-baef-4070-b9b5-a2e6079df1b4",
"type": "com_ibm_cloud_kms_registration",
"com_ibm_cloud_kms_registration": {
"prevents_key_deletion": false,
"service_name": "cloud-object-storage",
"service_instance_name": "Cloud Object Storage-7s",
For more information, see [Retrieving an access token](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-access-token). 
 instance_ID Required. The unique identifier that is assigned to your Hyper Protect Crypto Services instance. For more information, see [Retrieving an instance ID](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-instance-ID). 
 correlation_ID The unique identifier that is used to track and correlate transactions. 



A successful GET api/v2/key_rings request returns a collection of key rings that are available in your Hyper Protect Crypto Services service instance.

{
"metadata": {
"collectionType": "application/vnd.ibm.kms.key_ring+json",
"collectionTotal": 2
},
"resources": [
{
"id": "default"
},
{
"id": "Sample Key Ring 2",
"creationDate": "2020-03-12T11:00:06Z",
"createdBy": "..."
}
]
}









 Deleting key rings 

You can delete a key ring with the console or with the key management service API.

The default key ring cannot be deleted. You are also not able to delete a key ring if the key ring contains at least one key, regardless of the key state (including keys in the Destroyed state).



 Deleting key rings with the console 

To delete a key ring with the console, complete the following steps:



1. [Log in to the IBM Cloud console](https://cloud.ibm.com/login).
2. Go to Menu > Resource list to view a list of your resources.
3. From your IBM Cloud resource list, select your provisioned instance of Hyper Protect Crypto Services.
4. Select the KMS key rings tab in the side menu to browse the key rings.
5.
3000235 - Check whether Hyper Protect Crypto Services encryption keys that are generated by the service are rotated automatically at least every months
3000240 - Check whether Bare Metal Servers are ordered with redundant power supplies to ensure workload protection
3000242 - Check whether Databases for Redis has no more than users with the IAM administrator role
3000243 - Check whether Databases for PostreSQL has no more than users with the IAM administrator role
3000244 - Check whether Databases for MongoDB has no more than users with the IAM administrator role
3000245 - Check whether Databases for Elasticsearch has no more than users with the IAM administrator role
3000109 - Check whether Cloudant has no more than users with the IAM administrator role
3000247 - Check whether Key Protect has no more than users with the IAM administrator role
3000246 - Check whether Databases for etcd has no more than users with the IAM administrator role
3000248 - Check whether Kubernetes Service has no more than users with the IAM administrator role
3000249 - Check whether Databases for EnterpriseDB has no more than users with the IAM administrator role
3000251 - Check whether Databases for Elasticsearch has no more than service IDs with the IAM administrator role
3000252 - Check whether Key Protect has no more than service IDs with the IAM administrator role
3000253 - Check whether Databases for etcd has no more than service IDs with the IAM administrator role
3000254 - Check whether Kubernetes Service has no more than service IDs with the IAM administrator role
3000255 - Check whether Databases for EnterpriseDB has no more than service IDs with the IAM administrator role
3000312 - Check whether Databases for MongoDB has no more than service IDs with the IAM administrator role
3000313 - Check whether Databases for Redis has no more than service IDs with the IAM administrator role
3000314 - Check whether Databases for PostgreSQL has no more than service IDs with the IAM administrator role
3000110 - Check whether Cloudant has no more than service IDs with the IAM administrator role
3000111 - Check whether Cloudant has at least users with the IAM manager role
Granting access to vaults 

You can enable different levels of access to IBM Cloud® Hyper Protect Crypto Services resources in your IBM Cloud account by creating and modifying IBM Cloud

Identity and Access Management (IAM)access policies.

Access control in Unified Key Orchestrator is managed in vaults. Vaults are secure repositories for your cryptographic keys and keystores. A managed key or internal keystore can be created only in a vault.

As a Vault Administrator, you can create vaults and determine an [access policy type](https://cloud.ibm.com/docs/account?topic=account-userrolespolicytypes) for users, service IDs, and access groups based on your internal access control requirements.

Review [roles and permissions](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-access) to learn how IBM Cloud IAM roles map to Hyper Protect Crypto Services actions.



 Step 1. Retrieve the vault ID 

Retrieve the unique identifier that is associated with the vault that you want to grant someone access to.

Access the IBM Cloud UI to browse the keys that are stored in your service instance by following these steps:



1. [Log in to the Hyper Protect Crypto Services instance](https://cloud.ibm.com/login).
2. Click Vaults from the navigation to view all the available vaults.
3. Click the vault that you want to edit. The Details side panel is displayed.
4. In the General properties card, copy the vault ID by clicking the copy icon.



You can also [use the Unified Key Orchestrator API](https://cloud.ibm.com/apidocs/ukoget-vault) to retrieve a list of your vaults, along with the metadata of the vaults.





 Step 2. Grant access to vaults from the IBM Cloud UI 

To assign access to a vault for a user from the UI, complete the following steps:



1. From the menu bar, click Manage > Access (IAM), and select Users to browse the existing users in your account.
2.
Regions and locations 

You can connect your applications with the IBM Cloud® Hyper Protect Crypto Services by specifying a regional service endpoint.



 Available regions 

Hyper Protect Crypto Services is available in the following regions and locations:



* Dallas, US: us-south
* Frankfurt, Germany: eu-de
* London, UK: eu-gb - Based on the IBM Cloud Virtual Private Cloud (VPC) infrastructure
* Sydney, Australia: au-syd
* Tokyo, Japan: jp-tok - Based on the IBM Cloud Virtual Private Cloud (VPC) infrastructure
* Washington DC, US: us-east
* São-Paulo, Brazil: br-sao - Based on the IBM Cloud Virtual Private Cloud (VPC) infrastructure
* Toronto, Canada: ca-tor - Based on the IBM Cloud Virtual Private Cloud (VPC) infrastructure



You can create Hyper Protect Crypto Services resources in one of the supported IBM Cloud regions, which represent the geographic area where your Hyper Protect Crypto Services requests are handled and processed. To learn more, see [Locations, tenancy, and availability](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-ha-dravailability).

Currently, the us-south and us-east regions are enabled with recovery crypto units by default, which means, when a service instance is provisioned in either regions, you are enabled with the option to back up your master keys in the recovery crypto units located in both regions. For more information, see [Introducing service instance initialization modes](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-instance-modeinstance-initialization-recovery-crypto-unit).





 Connectivity options 

Hyper Protect Crypto Services offers two connectivity options for interacting with the service APIs.

Public endpoints
: By default, you can connect to resources in your account over the IBM Cloud public network. Your data is encrypted in transit by using the Transport Security Layer (TLS) 1.2 protocol.

Private endpoints
- mountpath: /etc/Chrystoki.conf
name: hsmconfig
secret: hsmcrypto
subpath: Chrystoki.conf
Show more

In this example, the first mountpath contains four configuration files (cafile.pem, cert.pem, key.pem, server.pem) and the hsmcrypto secret, and all of them are mounted to the mountpath /hsm. The actual name of the mountpath is hsmcrypto, and it contains an exact mapping of the key value pair to the Kubernetes secret and the location to mount it to. For example, cafile.pem is read from the path cafile.pem in the hsmcrypto mountpath using the hsmcrypto secret and mounted to /hsm/cafile.pem.

A second mountpath is included for the HSM /etc/Chrystoki.conf file. Because the HSM requires its config file in the /etc folder, which is a system directory, we need to use the subpath parameter to avoid replacing the entire /etc directory. If the subpath is not used, the entire /etc directory is replaced with the volume being mounted.

You have completed the HSM configuration for your blockchain network. Now when you deploy a new CA, peer, or ordering node, you can configure it to use the HSM that you have configured here. See [Configuring a CA, peer, or ordering node to use the HSM](https://cloud.ibm.com/docs/blockchain-sw-252?topic=blockchain-sw-252-ibp-console-adv-deploymentibp-console-adv-deployment-cfg-hsm-node) for details.

Configure the operator to work with an HSM daemon

If you configured an HSM daemon, the following sample configuration shows how to configure the openCryptoki zHSM on the operator. You need to customize the settings according to your daemon.
Introducing PKCS 11 - Unified Key Orchestrator Plan 

PKCS #11 is a standard that specifies an application programming interface (API), called Cryptoki, for devices that hold cryptographic information and perform cryptographic functions. The Cryptoki API follows a simple object-based approach. The approach addresses the goals of technology independence and resource sharing, presenting to applications a common, logical view of the device called a cryptographic token.

Cryptoki isolates an application from the details of the cryptographic device. The application does not have to change the interface to a different type of device or to run in a different environment. Thus, the application is portable. The functions of the Cryptoki API are organized into the following categories:



* [General-purpose functions](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959740) (four functions)
* [Slot and token management functions](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959741) (nine functions)
* [Session management functions](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959742) (eight functions)
* [Object management functions](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959743) (nine functions)
[Provision your Hyper Protect Crypto Services instance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-provisionprovision-gui).
2. On your Hyper Protect Crypto Services instance page, click Actions > Monitoring. On your first usage, you might see a welcome wizard. To advance to the dashboard selection menu, select Next and then Skip at the bottom of the Choosing an installation method page. Accept the prompts that follow. You can then select Hyper Protect Crypto Services.

The metrics dashboards are available only after metrics have started to be recorded. This might take a few minutes to initialize.



You are now on the Hyper Protect Crypto Services dashboard, and can start monitoring metrics of the service instance.





 How to find the Monitoring dashboard for your Hyper Protect Crypto Services service instance by using observability page 

After you configure your Monitoring instance to receive platform metrics, complete the following steps:



1. Go to the [monitoring dashboard](https://cloud.ibm.com/observe/monitoring) and find your Monitoring instance that is configured to receive platform metrics.
2. In the View Dashboard column, click View Monitoring.
3. Once you are in the Monitoring platform, click Dashboards on the side menu.
4. Select IBM under the Dashboard Templates section.
5. Select Hyper Protect Crypto Services - Overview to view the dashboard for your Hyper Protect Crypto Services instance.



You are able to see any metrics in your Monitoring instance until you enable a metrics policy for your Hyper Protect Crypto Services instance and make API requests to your Hyper Protect Crypto Services instance.





 How to scope down your metrics by using Metrics Filter Attributes 

You can scope down your metrics by using the following scope filters.



Table 4. Describes the scope filters for Hyper Protect Crypto Services metrics.

 Attribute Name Description 

 ibmResourceGroupName The name of the resource group associated with the Hyper Protect Crypto Services service instance. 
 ibmScope The account, organization, or space GUID associated with the metric. 
 ibmServiceInstanceName The service instance associated with the metric.