vania-janet/multiturn-rag-retrieval-data huggingface dataset:
As an admin, you might need to [restore a root key that you imported](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-restore-keys) to Hyper Protect Crypto Services so that you can access data that the key previously protected. When you restore a key, you move the key from the Destroyed to the Active key state, and you restore access to any data that was previously encrypted with the key. This must occur within 30 days of deleting a key.

If a key that was originally uploaded by a user is deleted, and then restored using different key material, it will result in a loss of data. It is recommended to keep n-5 keys archived somewhere in order to ensure that the correct key material is available for restoration.







 Activity Tracking 

When Hyper Protect Crypto Services root keys are deleted, rotated, suspended, enabled, or restored, an [Activity Tracker management event](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-at-eventsat-actions-global) (cloud-object-storage.bucket-key-state.update) is generated in addition to any events logged by Hyper Protect Crypto Services.

In the event of a server-side failure in a lifecycle action on a key, that failure is not logged by COS. If Hyper Protect Crypto Services does not receive a success from COS for the event handling within four hours of the event being sent, Hyper Protect Crypto Services will log a failure.

The cloud-object-storage.bucket-key-state.update actions are triggered by events taking place in Hyper Protect Crypto Services, and require that the bucket is registered with the Hyper Protect Crypto Services service. This registration happens automatically when a bucket is created with a Hyper Protect Crypto Services root key.

Buckets created prior to February 26th, 2020 are not registered with the Hyper Protect Crypto Services service and will not receive notifications of encryption key lifecycle events at this time.
Hyper Protect Crypto Services with Unified Key Orchestrator is a cloud native service in IBM Cloud, which offers key management and orchestration in a hybrid multicloud environment.





 What multizone regions is Hyper Protect Crypto Services with Unified Key Orchestrator available in? 

Hyper Protect Crypto Services with Unified Key Orchestrator is available in all regions where Hyper Protect Crypto Services is available. Refer to [Regions and locations](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regions) for a list of available regions of Hyper Protect Crypto Services.





 Can I still use Hyper Protect Crypto Services with Unified Key Orchestrator for key management even if Hyper Protect Crypto Services is not available in the IBM Cloud region that my service resides in? 

Yes. You can choose a data center within your required data residency region and use Unified Key Orchestrator in any regions where Hyper Protect Crypto Services is available. Note that your encryption keys is managed in the regions where your Hyper Protect Crypto Services instances are available.





 How many keystores can be created for an instance of Hyper Protect Crypto Services with Unified Key Orchestrator? 

There is an internal KMS keystore limit of 50, but there is no external keystore limit. The first five internal keystores and the very first external keystore are free of charge. Each additional internal or external keystore is charged with a tiered pricing starting at $225 USD per month. For keystores that are created or connected less than a month, the cost is prorated based on actual days within the month. For more information about pricing, see [the pricing sample](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-pricingfaq-how-charge-hpcs-uko).
* [Frequency of root key rotation](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-root-key-rotation-introrotation-frequency)
* [What's next](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-root-key-rotation-introroot-key-rotation-next)









 Understanding Hyper Protect Crypto Services with Unified Key Orchestrator Plan 

[Overview - Unified Key Orchestrator Plan](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-overviewuko-overview)



* [Why IBM Cloud Hyper Protect Crypto Services?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-overviewuko-why_hpcs)
* [Why Unified Key Orchestrator?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-overviewwhy-uko)
* [Key features](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-overviewuko-key-features)
* [What's next](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-overviewuko-overview-next)



[Service architecture - Unified Key Orchestrator Plan](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-architecture-workload-isolationuko-architecture-workload-isolation)



* [Hyper Protect Crypto Services architecture](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-architecture-workload-isolationuko-architecture)
The response body also contains the public encryption key that you can use to [encrypt a root key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-importing-keysusing-import-tokens) before you upload the key material to a Hyper Protect Crypto Services service instance.

In the example, the payload value represents the public key that is associated with the import token. This value is base64 encoded. For extra security, Hyper Protect Crypto Services also provides a nonce value that is used to verify the originality of a key import request to the service. To learn more about how to use these values, check out [Tutorial: Creating and importing encryption keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-tutorial-import-keys).







 Retrieving an import token with the CLI 

Complete the following steps to retrieve an import token by using the Key Protect CLI, which is integrated in Hyper Protect Crypto Services:



1. [Set up the Key Protect CLI](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-cli).
2. Retrieve an import token with the following command:

ibmcloud kp import-token show

You can find more parameters for this command in the [Key Protect CLI reference](https://cloud.ibm.com/docs/key-protect?topic=key-protect-cli-plugin-key-protect-cli-referencekp-import-token-show).







 What's next 



* To find out more about using an import token to securely bring encryption keys to IBM Cloud, check out [Importing root keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-import-root-keys).
Warning hs-crypto.secrets.rotate<br><br>hs-crypto.secrets.restore<br><br>hs-crypto.secrets.enable<br><br>hs-crypto.secrets.disable<br><br>hs-crypto.secrets.setkeyfordeletion<br><br>hs-crypto.secrets.unsetkeyfordeletion<br><br>hs-crypto.policies.write<br><br>hs-crypto.hs-crypto.instance-policies.write 
 Normal hs-crypto.secrets.create<br><br>hs-crypto.secrets.read<br><br>hs-crypto.secrets-metadata.read<br><br>hs-crypto.secrets.head<br><br>hs-crypto.secrets.list<br><br>hs-crypto.secrets.wrap<br><br>hs-crypto.secrets.unwrap<br><br>hs-crypto.secrets.rewrap<br><br>hs-crypto.secrets-key-versions.list<br><br>hs-crypto.secrets-event.ack<br><br>hs-crypto.policies.read<br><br>hs-crypto.instance-policies.read <br>hs-crypto.import-token.create<br><br>hs-crypto.import-token.read<br><br>hs-crypto.registrations.create<br><br>hs-crypto.registrations.write<br><br>hs-crypto.registrations.merge<br><br>hs-crypto.registrations.list<br><br>hs-crypto.secrets.ack-
(https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-security-compliancefaq-EP11-mechanisms)
* [What compliance standards does Hyper Protect Crypto Services meet?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-security-compliancefaq-compliance-standards)
* [Can I monitor my service instance?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-security-compliancefaq-monitor-instance)



[FAQs: High availability and disaster recovery](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-ha-drfaq-ha-dr)



* [How do I set up a high availability configuration?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-ha-drfaq-ha-configuration)
* [Can I back up my service instance manually?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-ha-drfaq-backup-manually)
* [What happens if my service instance fails?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-ha-drfaq-instance-fail)
* [How can I restore the content from backups?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-ha-drfaq-store-backup)
* [What happens if I delete my service instances?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-ha-drfaq-delete-instance)
* [Can I back up the keys before I delete a service instance?]
Enhancing security - Unified Key Orchestrator Plan only 

[Managing user access](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-manage-accessuko-manage-access)



* [Roles and permissions](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-manage-accessuko-roles)
* [Assigning access to Hyper Protect Crypto Services in the console](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-manage-accessassign-access-console)
* [Assigning access to Hyper Protect Crypto Services in the CLI](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-manage-accessassign-access-cli)
* [Assigning access to Hyper Protect Crypto Services by using the API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-manage-accessassign-access-api)
* [Assigning access to Hyper Protect Crypto Services by using Terraform](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-manage-accessassign-access-terraform)
* [Managing access to multiple instances](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-manage-accessuko-manage-multiple-instances)
* [What's next](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-manage-accessuko-manage-access-next)



[Granting access to vaults](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-grant-access-vaultsgrant-access-vaults)



* [Step 1.
Security <br><br> * [Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-shared-responsibilities)<br><br><br> <br><br> * [Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-shared-responsibilities)<br><br><br> <br><br> * App ID [4]<br><br><br> 
 Logging and monitoring <br><br> * [Activity Tracker Event Routing](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-shared-responsibilities)<br> * Security and Compliance Center<br> * [Flow Logs for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-responsibilities-vpc)<br><br><br> <br><br> * [Activity Tracker Event Routing](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-shared-responsibilities)<br> * Security and Compliance Center<br><br><br> 
 Integration <br><br> * [Event Streams](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-event_streams_responsibilities)<br><br><br> 
 Databases <br><br> * [Hyper Protect DBaaS for MongoDB](https://cloud.ibm.com/docs/hyper-protect-dbaas-for-mongodb?topic=hyper-protect-dbaas-for-mongodb-responsibilities-hpdbass)<br> * [Hyper Protect DBaaS for PostgreSQL](https://cloud.ibm.com/docs/hyper-protect-dbaas-for-postgresql?topic=hyper-protect-dbaas-for-postgresql-responsibilities-hpdbass)<br><br><br>
instance_name Required. The name of your Hyper Protect Crypto Services service instance. 
 region_name Required. The region abbreviation, such as us-south or au-syd, that represents the geographic area where your Hyper Protect Crypto Services service instance resides. For more information, see [Regional service endpoints](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regions). <br>Currently, the us-south and us-east regions are enabled with recovery crypto units by default, which means, when a service instance is provisioned in either regions, you are enabled with the option to back up your master keys in the recovery crypto units located in both regions. For details, see [Introducing service instance initialization modes](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-instance-modeinstance-initialization-recovery-crypto-unit). 
 number_of_operational_crypto_units Optional. Multiple crypto units are distributed among different supported availability zones in the selected region to increase availability. At least two crypto units are to be enabled for high availability. If you do not specify the number of crypto units, two crypto units are assigned by default. 



5. Verify that the service instance is created successfully. Run the following command to get all the service instances that you create. Check whether the Hyper Protect Crypto Services service instance is among the list.

ibmcloud resource service-instances









 What's next 



* As a security officer, auditor, or manager, you can use the IBM Cloud Activity Tracker service to monitor the status of your instance and how administrators, users, and applications interact with Hyper Protect Crypto Services. To enable IBM Cloud Activity Tracker for your Hyper Protect Crypto Services instance, you need to provision an instance of IBM Cloud Activity Tracker in the same region where your Hyper Protect Crypto Services instance is located. For more information, see the [getting started tutorial for IBM Cloud Activity Tracker](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-getting-started).
The following table lists the API methods that add or remove envelope encryption on a resource.



Table 8. Describes the Hyper Protect Crypto Services key management service API methods

 Method Description 

 POST /keys/{root_key_ID}?action=wrap [Wrap (encrypt) a data encryption key.](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-wrap-keys) 
 POST /keys/{root_key_ID}?action=unwrap [Unwrap (decrypt) a data encryption key.](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-unwrap-keys) 



To find out more about programmatically managing your keys in Hyper Protect Crypto Services, check out the [Hyper Protect Crypto Services key management service API reference doc](https://cloud.ibm.com/apidocs/hs-crypto).





 What's next 

Add advanced encryption to your cloud resources by creating a root key in Hyper Protect Crypto Services. Add a resource to a supported cloud data service, and then select the root key that you want to use for advanced encryption.



* To find out more about creating root keys with the Hyper Protect Crypto Services service, see [Creating root keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-root-keys).
* To find out more about bringing your own root keys to the Hyper Protect Crypto Services service, see [Importing root keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-import-root-keys).
Describes the settings to create a key

 Setting Description 

 Key type The type of key that you would like to manage in Hyper Protect Crypto Services. From the list of key types, select [Root key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-understand-conceptsroot-key-concept). 
 Key name A unique, human-readable name for easy identification of your key. Length must be within 2 - 90 characters. To protect your privacy, ensure that the key name does not contain personally identifiable information (PII), such as your name or location. 
 Key alias (Optional) One or more unique, human-readable aliases that you want to assign to your key for easy recognition. Alias size can be 2 - 90 characters. You can set up to five key aliases for the key, with each separated by a comma.<br><br>Note: Each alias must be alphanumeric, case-sensitive, and cannot contain spaces or special characters other than dashes (-) or underscores (_). The alias cannot be a version 4 UUID and must not be a Hyper Protect Crypto Services reserved name: allowed_ip, key, keys, metadata, policy, policies, registration, registrations, ring, rings, rotate, wrap, unwrap, rewrap, version, versions. 
 Key ring ID Select a key ring from the list that contains the existing key rings. If you don't assign a key ring, the key is added to the default key ring. For more information about key rings, see [Managing key rings](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-managing-key-rings). 
 Expiration date (Optional) Set the date and time when the key gets expired. After the expiration date, the key moves into the Deactivated state. For more information about key state, see [Monitoring the lifecycle of encryption keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-key-states). 
 Description (Optional) Add an extended description for your key.
* Under Region, select a [region](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regions) that you want to create your Hyper Protect Crypto Services resources in.

Currently, the us-south and us-east regions are enabled with recovery crypto units by default, which means, when a service instance is provisioned in either regions, you are enabled with the option to back up your master keys in the recovery crypto units located in both regions. For more information, see [Introducing service instance initialization modes](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-instance-modeinstance-initialization-recovery-crypto-unit).
* Under Service name, enter a name for your service instance.
* Under Select a resource group, select the resource group where you want to organize and manage your service instance. You can select the initial resource group that is named Default or other groups that you create. For more information, see [Creating and managing resource groups](https://cloud.ibm.com/docs/account?topic=account-rgs).
* (Optional) Under Tags, add tags to organize your resources. If your tags are billing related, consider writing tags as key: value pairs to help with grouping, such as costctr:124. For more information about tags, see [Working with tags](https://cloud.ibm.com/docs/account?topic=account-tag).
* Under Access management tags (Optional), add tags to resources to help organize access control relationships in the project:analysis format. For more information, see [Controlling access to resources by using tags](https://cloud.ibm.com/docs/account?topic=account-access-tags-tutorial).
* Under Number of crypto units, select the number of

crypto unitsthat meets your performance needs. At least two crypto units are to be enabled for high availability. These crypto units are distributed among different supported availability zones in the selected region.
Getting started with IBM Cloud Hyper Protect Crypto Services 

hardware security module (HSM)based on IBM Cloud. With this service, you can take the ownership of the cloud HSM to fully manage your encryption keys and to perform cryptographic operations. Hyper Protect Crypto Services is also the only service in the cloud industry that is built on FIPS 140-2 Level 4-certified hardware.

master keys, create and manage encryption keys with the IBM Cloud console, and perform cryptographic operations with the PKCS #11 API or with the GREP11 API.



 What's next 



* Hyper Protect Crypto Services helps you meet compliance requirements and ensures the security of your data. Check out the [compliance standards and criteria](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-security-and-compliance) Hyper Protect Crypto Services has been certified.
* Hyper Protect Crypto Services provides advanced encryption to your at-rest data with envelope encryption, check out [Protecting your data with envelope encryption](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-envelope-encryption) to see how it works.
* You can use Hyper Protect Crypto Services as the encryption key provider for other services such as IBM Cloud Object Storage to bring your own encryption to your applications or data. Check out [Integrating services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-integrate-services) for the full list of supported services.
* To learn more about Hyper Protect Crypto Services concepts and terminologies, check out [Components and concepts](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-understand-concepts).
* If you are using the Standard Plan, manage your keys with [Hyper Protect Crypto Services key management service API](https://cloud.ibm.com/apidocs/hs-crypto) and [Key Protect CLI](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-cli).
"payload": "<key_material>",
"extractable": <key_type>
}
]
}'

Replace the variables in the example request according to the following table.



Table 2. Describes the variables needed to add a root key with the API

 Variable Description 

 region Required. The region abbreviation, such as us-south or au-syd, that represents the geographic area where your Hyper Protect Crypto Services instance is located. For more information, see [Regional service endpoints](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regionsservice-endpoints). 
 port Required. The port number of the API endpoint. 
 IAM_token Required. Your IBM Cloud access token. Include the full contents of the IAM token, including the Bearer value, in the cURL request. For more information, see [Retrieving an access token](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-access-token). 
 instance_ID Required. The unique identifier that is assigned to your Hyper Protect Crypto Services instance. For more information, see [Retrieving your instance ID](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-instance-ID). 
 correlation_ID The unique identifier that is used to track and correlate transactions. 
 key_alias Required. A unique, human-readable name for easy identification of your key. To protect your privacy, do not store your personal data as metadata for your key. 
 key_description An extended description of your key. To protect your privacy, do not store your personal data as metadata for your key. 
 YYYY-MM-DD<br><br>HH:MM:SS.SS The date and time that the key expires in the system, in RFC 3339 format. If the expirationDate attribute is omitted, the key does not expire.
Auditing events for Hyper Protect Crypto Services 

As a security officer, auditor, or manager, you can use the IBM Cloud® Activity Tracker service to monitor how users and applications interact with IBM Cloud® Hyper Protect Crypto Services.

IBM Cloud Activity Tracker records user-initiated activities that change the state of a service in IBM Cloud. You can use this service to investigate abnormal activity and critical actions and to comply with regulatory audit requirements. In addition, you can be alerted about actions as they happen. The events that are collected comply with the Cloud Auditing Data Federation (CADF) standard.

To enable IBM Cloud Activity Tracker for your Hyper Protect Crypto Services instance, you need to provision an instance of the IBM Cloud Activity Tracker service in the same region where your Hyper Protect Crypto Services instance is located. For more information, see the [getting started tutorial for IBM Cloud Activity Tracker](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-getting-started).

To see which action requests correlate to the following actions, check out the [key management service API reference doc](https://cloud.ibm.com/apidocs/hs-crypto) and [TKE CLI reference](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-cli-plugin-hpcs-cli-plugintke-cli-plugin).



 Historical information regarding events 



Table 1. Historical reference mapping of event names

 Reference Current event names 

 hs-crypto.governance.configread hs-crypto.governance-config.read 
 hs-crypto.importtoken.create hs-crypto.import-token.create 
 hs-crypto.importtoken.read hs-crypto.import-token.read 
 hs-crypto.importtoken.default hs-crypto.import-token.request 
 hs-crypto.instance.readallowedipport hs-crypto.instance-allowed-ip-port.read 
 hs-crypto.instance.readipwhitelistport hs-crypto.instance-ip-allowlist-port.read