vania-janet/multiturn-rag-retrieval-data huggingface dataset:
For more information, see [Managing key rings](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-managing-key-rings). 
 return_preference A header that alters server behavior for POST and DELETE operations. When you set the return_preference variable to return=minimal, the service returns a successful deletion response. When you set the variable to return=representation, the service returns both the key material and the key metadata. 



If the return_preference variable is set to return=representation, the details of the DELETE request are returned in the response entity-body.

The following JSON object shows a sample returned value.

{
"metadata": {
"collectionType": "application/vnd.ibm.kms.key+json",
"collectionTotal": 1
},
"resources": [
{
"type": "application/vnd.ibm.kms.key+json",
"id": "02fd6835-6001-4482-a892-13bd2085f75d",
"name": "test-root-key",
"aliases":
"alias-1",
"alias-2"
],
"state": 5,
"extractable": false,
"crn": "crn:v1:bluemix:public:hs-crypto:us-south:a/f047b55a3362ac06afad8a3f2f5586ea:12e8c9c2-a162-472d-b7d6-8b9a86b815a6:key:02fd6835-6001-4482-a892-13bd2085f75d",
"imported": false,
"creationDate": "2020-03-10T20:41:27Z",
"createdBy": "...",
"algorithmType": "AES",
This workflow creates a root key using an import token, deletes the key, then restores the key.

This is a two-step process.



1. Create a root key using an import token and then delete the key
2. Create an import token, which is required to restore the key, and restore the key



Creating a root key using an import token has a time limit (the -e, --expiration option). When you restore a key you need an import token. Which is why you need to go through an import token process to restore a key.

Step 1 - create a root key using an import token and then delete the key

 create an import token that expires in 5 minutes and allows 10 retrievals
$ ibmcloud kp import-token create -e 300 -m 10

Created Expires Max Retrievals Remaining Retrievals
2020-06-18 12:21:59 +0000 UTC 2020-06-18 12:26:59 +0000 UTC 10 10

 create a random, base64-encoded, 32-byte key material
$ KEY_MATERIAL=$(openssl rand -base64 32)

$ echo $KEY_MATERIAL

sADDNDE3pcJlbYXu2z5QFORvsxV1PosRiAPERrhYJdk=

 extract the nonce that was created by the "kp import-token create" command
$ NONCE=$(ibmcloud kp import-token show | jq -r '.["nonce"]')

$ echo $NONCE

/QhqOsqlVPC+ZPWz

 extract the public key that was created by the "kp import-token create" command
$ PUBLIC_KEY=$(ibmcloud kp import-token show | jq -r '.["payload"]')

$ echo $PUBLIC_KEY

LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0t ...<redacted>... QyBLRVktLS0tLQo=

 encrypt the key material using the public key
: The [release of Key Protect CLI version 0.6.5](https://cloud.ibm.com/docs/key-protect?topic=key-protect-cli-changelog) introduces new structures for empty results when querying. Learn more at [the CLI reference](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-reference).







 August 2021 



 05 August 2021 

Announcing Key Protect support for key purge enhancements
: The ability to purge keys that have been deleted after four hours using the UI has been added. For more information, check out [About purging and deleting keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-purge-keysdelete-purge-keys-considerations). Also, the ability to view your instance ID and cloud resource name (CRN) has been made easier. For more information, check out [Retrieving your instance ID and cloud resource name (CRN)](https://cloud.ibm.com/docs/key-protect?topic=key-protect-retrieve-instance-ID).







 June 2021 



 30 June 2021 

Announcing Key Protect CLI plug-in v.0.6.3
: The Key Protect CLI plugin has been updated to version 0.6.3. Minor changes in this [release](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-reference) include support for IBM Cloud® Hyper Protect Crypto Services specific algorithms in [Key Create](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-create) and [Key Rotate](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-rotate).







 April 2021 



 22 April 2021 

Key Protect announces changes to the console
: Optional. Do not show the message of the day or update reminders.





 Example 

ibmcloud sat key ls







 ibmcloud sat key rm 

Delete a Satellite Config key. Once the key is deleted, any cluster still using this key is unable to connect to Satellite Config.

ibmcloud sat key rm --key KEY [-f] [-q]



 Minimum required permissions 

IBM Cloud IAM Editor platform role for the Resource resource in Satellite. For more information, see [Checking user permissions](https://cloud.ibm.com/docs/satellite?topic=satellite-iam-assign-accesschecking-perms).





 Command options 

--key
: The name or the ID of a Satellite Config key.

-f
: Optional. Force the command to run with no user prompts.

-q
: Optional. Do not show the message of the day or update reminders.





 Example 

ibmcloud sat key rm --key my_key







 ibmcloud sat key rotate 

Generate a new key for use by managed clusters to connect to Satellite Config.

ibmcloud sat key rotate --name NAME [-f] [-q]



 Minimum required permissions 

IBM Cloud IAM Administrator platform role for the Resource resource in Satellite. For more information, see [Checking user permissions](https://cloud.ibm.com/docs/satellite?topic=satellite-iam-assign-accesschecking-perms).





 Command options 

--name
: The name of the new Satellite Config key.

-f
: Optional. Force the command to run with no user prompts.

-q
: Optional. Do not show the message of the day or update reminders.





 Example 

ibmcloud sat key rotate --name my_key_name









 Location commands 

Use these commands to create and manage Satellite locations.



 ibmcloud sat location create 

Create a Satellite location.
ibmAnalyticsEngineApiService.deleteApplication({
instanceId: 'e64c907a-e82f-46fd-addc-ccfafbd28b09',
applicationId: 'db933645-0b68-4dcb-80d8-7b71a6c8e542',
}).then((res) => {
console.log(JSON.stringify(res.result, null, 2));
}).catch((err) => {
console.warn(err);
});
Delete a build.

ibmcloud ce build delete --name BUILD_NAME [--force] [--ignore-not-found] [--quiet]



 Command Options 

--name, -n
: The name of the build. This value is required.

--force, -f
: Force deletion without confirmation. This value is optional. The default value is false.

--ignore-not-found, --inf
: If not found, do not fail. This value is optional. The default value is false.

--quiet, -q
: Specify this option to reduce the output of the command. This value is optional. The default value is false.





 Example 

ibmcloud ce build delete --name helloworld-build





 Example output 

Are you sure you want to delete build helloworld-build? [y/N]> y
Deleting build 'helloworld-build'...
OK







 ibmcloud ce build get 

Display the details of a build.

ibmcloud ce build get --name BUILD_NAME [--output OUTPUT] [--quiet]



 Command Options 

--name, -n
: The name of the build. This value is required.

--output, -o
: Specifies the format of the command output. Valid values are json, yaml, jsonpath=JSONPATH_EXPRESSION, and jsonpath-as-json=JSONPATH_EXPRESSION. Use jsonpath to specify the path to an element of the JSON output. This value is optional.

--quiet, -q
: Specify this option to reduce the output of the command. This value is optional. The default value is false.





 Example 

ibmcloud ce build get --name helloworld-build





 Example output 

Getting build 'helloworld-build'
OK

Name: helloworld-build
ID: abcdefgh-abcd-abcd-abcd-1a2b3c4d5e6f
[Delete icon](https://cloud.ibm.com/docs-content/v1/content/ca9232b3702768f24bb897f48f10778fcda28718/watson-assistant/images/remove-response-icon.png) icon. Removing a saved response from a step affects only the step that you are editing. It does not delete the saved response or remove it from any other steps.

To edit a saved response from a step, click Edit response. Keep in mind that if you edit a saved response, your changes affect all steps that use the response. If you want to edit the response only for the step you are editing, click the Unlink from saved response![Unlink from saved response icon](https://cloud.ibm.com/docs-content/v1/content/ca9232b3702768f24bb897f48f10778fcda28718/watson-assistant/images/unlink-response-icon.png) icon. After you unlink a response, any edits you make affect only the step you are editing; they do not affect any other steps, nor are they applied to the saved response.

After you unlink a response, you cannot relink it. If you want to return to the saved response without your edits, delete the response, and then read the original saved response. If you want to make your edited version of the response available for reuse, save it as a new saved response.
Now, if allKeyStates is passed as true, the number of versions of the destroyed key is returned.

For more information, check out [Viewing key versions](https://cloud.ibm.com/docs/key-protect?topic=key-protect-view-key-versions).







 December 2022 



 2 December 2022 

IBM® Key Protect for IBM Cloud® announces new features for the Terraform plugin as part of v1.48.0
: New features include support of instance policies (for example, to set a default key rotation period), the ability to create a key and override any instance rotation policies that might exist, and the ability to enable or disable a rotation policy on a key. Also, a known bug with the endpoint URL was fixed via the environment variable.







 October 2022 



 14 October 2022 

IBM® Key Protect for IBM Cloud® announces new features for the CLI Plugin
: New features include support for creating instance rotation policies using the [UI](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-rotation-policy) and the [CLI](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-instance-policies) as well as the ability to enable and disable rotation policies for an individual key at key creation time using the [UI](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-rotation-policymanage-policies-gui) and the [CLI](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-policies). Also, the latest release includes enhanced filtering for keys the [UI](https://cloud.ibm.com/docs/key-protect?topic=key-protect-view-keysview-keys-gui) and the [CLI](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-keys).





 7 October 2022
Cryptographic shredding of data If your organization detects a security issue, or your application no longer needs a set of data, you can choose to shred the data permanently from the cloud. When you delete a root key that protects other DEKs, you ensure that the keys' associated data can no longer be accessed or decrypted. 
 Delegated user access control By assigning Cloud Identity and Access Management (IAM) roles, Hyper Protect Crypto Services supports a centralized access control system to enable granular access for your keys. For more information, see [Granting access to keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-grant-access-keys). 





 Keys in envelope encryption 

The following keys are used in envelope encryption for the advanced encryption and management of data.

Master keys
: Master keys, also known as HSM master keys, are encryption keys that are used to protect the Hyper Protect Crypto Services instances. The master key provides full control of the hardware security module and ownership of the root of trust that encrypts the entire hierarchy of keys, including [root keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-understand-conceptsroot-key-concept) and [standard keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-understand-conceptsstandard-key-concept).

Root keys
: Root keys, also known as customer root keys (CRKs), are primary resources in Hyper Protect Crypto Services. They are symmetric key-wrapping keys that are used as roots of trust for wrapping (encrypting) and unwrapping (decrypting) other keys that are stored in a data service. With Hyper Protect Crypto Services, you can create, store, and manage the lifecycle of root keys to achieve full control of other keys stored in the cloud.

Data encryption keys
: Data encryption keys (DEKs) are cryptographic keys that you use for data encryption. They are provided by user-owned applications and are used to encrypt data stored in applications.
* [Hyper Protect Crypto Services notices and information](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-open-source-licensesnotice)
* [Hosting appliance notices and information](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-open-source-licenseshosting-appliance-notice)







 FAQs 

[General FAQs](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-basicsfaq-basics)



* [What's IBM Cloud Hyper Protect Crypto Services?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-basicsfaq-what-is-hpcs)
* [What is Unified Key Orchestrator?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-basicsfaq-what-is-uko)
* [What is a key management service?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-basicsfaq-what-key-management)
* [What is Hardware Security Module?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-basicsfaq-what-is-hsm)
* [What is a cloud HSM?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-basicsfaq-what-is-cloud-hsm)
* [How does Hyper Protect Crypto Services provide a single-tenant cloud service?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-basicsfaq-single-tenant)
* [What are the responsibilities of users and IBM Cloud for Hyper Protect Crypto Services?]
The region abbreviation, such as us-south or eu-de, that represents the geographic area where your Hyper Protect Crypto Services instance resides. For more information, see [Regional service endpoints](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regionsservice-endpoints). 
 IAM_token Required. Your IBM Cloud access token. Include the full contents of the IAM token, including the Bearer value, in the cURL request. For more information, see [Retrieving an access token](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-access-token). 
 instance_ID Required. The unique identifier that is assigned to your Hyper Protect Crypto Services service instance. For more information, see [Retrieving an instance ID](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-instance-ID). 
 key_ring_ID Optional. The unique identifier of the key ring that the key belongs to. If unspecified, Hyper Protect Crypto Services will search for the key in every key ring that is associated with the specified instance. Therefore, it is suggested to specify the key ring ID for a more optimized request.<br><br>Note: The key ring ID of keys that are created without an x-kms-key-ring header is: default. For more information, see [Managing key rings](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-managing-key-rings). 



A successful request returns an HTTP 204 No Content response, which indicates that your service instance is now enabled for dual authorization. Keys that you create or import to the service now require two authorizations before they can be deleted. For more information, see [Deleting keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-keys).

This new policy does not affect existing keys in your instance.
High availability and disaster recovery 

IBM Cloud® Hyper Protect Crypto Services is a highly available, regional service with automatic features that help keep your applications secure and operational.

Learn more about availability and disaster recovery strategies of Hyper Protect Crypto Services.



 Locations, tenancy, and availability 

You can create Hyper Protect Crypto Services resources in one of the supported [IBM Cloud regions](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regions), which represent the geographic area where your Hyper Protect Crypto Services requests are handled and processed. Each IBM Cloud region contains [multiple availability zones](https://www.ibm.com/cloud/data-centers/) to meet local access, low latency, and security requirements for the region.

As you plan your encryption at rest strategy with IBM Cloud, keep in mind that provisioning Hyper Protect Crypto Services in a region that is nearest to you is more likely to result in faster, more reliable connections when you interact with the Hyper Protect Crypto Services APIs. Choose a specific region if the users, apps, or services that depend on a Hyper Protect Crypto Services resource are geographically concentrated. Users and services who are far away from the region might experience higher latency.

Your encryption keys are confined to the region that you created them in. Hyper Protect Crypto Services does not copy or export encryption keys to other regions.





 In-region data redundancy and failover 

Multiple

crypto unitsin a service instance are automatically synchronized and load balanced across multiple availability zones. If one available zone that contains your provisioned service instance cannot be accessed, Hyper Protect Crypto Services has automatic in-region data failover in place. The service follows IBM Cloud requirements for planning and recovering from disaster events. For more information, see [Disaster recovery](https://cloud.ibm.com/docs/overview?topic=overview-zero-downtimedisaster-recovery).





 Cross-region disaster recovery 

IBM also performs cross-region backup for your key resources. Your data is automatically backed up in another supported region daily. Depending on where you create your instance and your requirements for recovery time, you can restore your data in case of a regional disaster with the following options:
Buckets contain both inherent and user-defined metadata. Finally, objects are defined by a globally unique combination of the bucket name and the object key, or name.







 Security 



 IBM Cloud Hyper Protect Crypto Services 

[Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-overview) is a dedicated key management service and hardware security module (HSM) based on IBM Cloud. This service allows you to take the ownership of the cloud HSM to fully manage your encryption keys and to perform cryptographic operations using Keep Your Own Key (KYOK). Hyper Protect Crypto Services is also the only service in the cloud industry that is built on FIPS 140-2 Level 4-certified hardware.





 IBM Cloud App ID (optional) 

[App ID](https://cloud.ibm.com/docs/appid?topic=appid-about) helps developers to easily add authentication to their web and mobile apps with few lines of code, and secure their cloud-native applications and services on IBM Cloud.







 Logging and monitoring 



 IBM Cloud Activity Tracker Event Routing 

[Activity Tracker Event Routing](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-getting-started-routing&interface=cli) is used to collect auditable platform events that are generated by services in your IBM Cloud account. These events allow you to monitor the activity of your IBM Cloud account so that you can investigate abnormal activity and critical actions.

Activity Tracker Event Routing provides for either event routing or [hosted event search](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-getting-started-search). However, only the event routing features of Activity Tracker Event Routing are Financial Services Validated. In regions where it's available, you must configure Activity Tracker Event Routing event routing to send events to Object Storage, where they must be encrypted with KYOK.
Encryption uses a two-way function to transform data into a form that hides its original value, but can be converted back to the original state. As an example, when data is sent over a network that is secured using TLS, the data is encrypted using a TLS certificate. It is then sent over the network as crypto text, and then decrypted by the recipient. The encrypted text contains all the original data, and can be decrypted using a private key. However, hashing is a one-way function that uses data to create a unique string of numbers and letters. The hashed data cannot be converted back to the original form using the hash. To verify the data that created the hash, a recipient needs to create a new hash of the original data using the same hash function, and verify that the hash values match. A third party cannot use the hash without a copy of the original data.

It is important to be aware with this option that while Orgs A and B cannot see the actual ledger data because it is hashed, they are still able to see that Orgs C and D are transacting and can see the volume of transactions that are occurring between them.

Also, consider that data inside a private data collection can be purged from the peers that store it. While data is stored on a channel forever, collections allow members to specify how many blocks are committed to a channel before the [private data is purged](https://hyperledger-fabric.readthedocs.io/en/release-2.2/private_data_tutorial.htmlpd-purge). Once data is removed from the private data collection, the hash on the channel can no longer be used to verify the transaction that created it. In the example network in Figure 3, Org C and Org D can use a block to live policy to ensure that any data that does not need to persist forever is removed from the network entirely within a specified time period.





 Option two: Private data collections on a separate channel 

Org C and Org D can also use private data collections in the context of a separate channel to provide additional isolation for their data.
https://cloud.ibm.com/docs-content/v1/content/hs-crypto//images/thumbnail_uko_aws.png)<br><br>Securely managing AWS S3 encryption keys using Hyper Protect Crypto Services with Unified Key Orchestrator](https://mediacenter.ibm.com/media/1_1a6c6vub)[![carousel thumbnail](https://cloud.ibm.com/docs-content/v1/content/hs-crypto//images/thumbnail_vmware_integration.png)<br><br>Configuring KMIP in Hyper Protect Crypto Services for key management and distribution](https://mediacenter.ibm.com/media/1_e5gk6ktn)[![carousel thumbnail](https://cloud.ibm.com/docs-content/v1/content/hs-crypto//images/thumbnail_vmware_intro.png)<br><br>Hyper Protect Crypto Services and KMIP for VMware on IBM Cloud](https://mediacenter.ibm.com/media/0_4wm4bq4s)[![carousel thumbnail](https://cloud.ibm.com/docs-content/v1/content/hs-crypto//images/thumbnail_cos_integration.png)<br><br>Integrating Cloud Object Storage with Hyper Protect Crypto Services](https://mediacenter.ibm.com/media/0_mgxwp16v)

 Learn more 

[IBM Developer<br><br>Visit IBM Developer for technical articles, code patterns, tutorials, and more.<br><br>![112-Developer-tools.svg](https://cloud.ibm.com/media/docs/images/homepage/112-Developer-tools.svg)](https://developer.ibm.com/components/hyper-protect/)

 Latest updates