vania-janet/multiturn-rag-retrieval-data huggingface dataset:
"deleted": false
}
]
}

 step 3 - capture the key id
$ KEY_ID=aa713df1-857c-4c46-be80-3051756280c9

 step 4 - allow the expiration date to pass by sleeping for 1 (one) minute
$ sleep 60

 step 5 - delete the key
$ ibmcloud kp key delete $KEY_ID

Deleting key: 'aa713df1-857c-4c46-be80-3051756280c9', from instance: 'a192d603-0b8d-452f-aac3-f9e1f95e7411'...
OK
Deleted Key
aa713df1-857c-4c46-be80-3051756280c9

 step 6 - fails because you cannot restore a deleted key after the expiration date
$ curl -X POST "https://us-south.kms.cloud.ibm.com/api/v2/keys/$KEY_ID/restore" -H "authorization: Bearer $ACCESS_TOKEN" -H "bluemix-instance: $KP_INSTANCE_ID" -H "content-type: application/vnd.ibm.kms.key_action+json" -d '{
"metadata": {
"collectionType": "application/vnd.ibm.kms.key+json",
"collectionTotal": 1
},
"resources": [
{
"payload": "'$KEY_MATERIAL'"
}
]
}'
Show more





 JSON response 

{
"metadata": {
"collectionType": "application/vnd.ibm.kms.error+json",
"collectionTotal": 1
},
"resources": [
{
"errorMsg": "Bad Request: The key expired on 2020-08-14 19:33:47 +0000 UTC: Key could not be restored.
correlation_id='fe0db627-1726-4827-a9d2-c21d728e1c92',
msg='Conflict: 1 prior authorization(s) are required for deletion: Key could not be deleted.
Please see "reasons" for more details.',
reasons='[AUTHORIZATIONS_NOT_MET: Number of authorizations required to delete is not met -
FOR_MORE_INFO_REFER: https://cloud.ibm.com/apidocs/key-protect]'





 Required parameters 

KEY_ID
: The ID of the key that you want to query. To retrieve a list of your available keys, run the [kp keys](#kp-keys) command.





 Optional parameters 

-o, --output
: Set the CLI output format. By default, all commands print in table format. To change the output format to JSON, use --output json.







 kp key policy-update rotation 

When you set an automatic rotation policy for a root key, you shorten the lifetime of the key at regular intervals, and you limit the amount of information that is protected by that key.

You can only create a rotation policy for root keys that are generated in Key Protect. If you imported the root key initially, you must provide a new base64-encoded key material to rotate the key. For more information, see [Rotating root keys on-demand](https://cloud.ibm.com/docs/key-protect?topic=key-protect-rotate-keys).

ibmcloud kp key policy-update rotation KEY_ID
-i, --instance-id INSTANCE_ID
[-m, --monthly-interval MONTHS]
[-o, --output OUTPUT]



 Example 

This example applies a policy to rotate the key every 2 months.

 create a root key
$ KEY_ID=$(ibmcloud kp key create my-root-key --output json | jq -r '.["id"]')

$ echo $KEY_ID
When you restore a key, you move the key from the Destroyed (state value is 5) to the Active (state value is 1) key state, and you restore access to any data that was previously encrypted with the key.

You can restore a deleted key within 30 days of its deletion. This capability is available only for root keys that were created with a key material, also known as the "payload."

You can only restore root keys that were created with a key material, using the kp key create command with the -k, --key-material option. You cannot restore a root key if the --key-material option was not specified.

If you want to restore a deleted root key then you must save the key material that was used to create the root key. You cannot restore a deleted key without provided the original key material.



 Example 

Follow these steps to create the only imported keys may be restored error.



1. Create a root key without a key material (payload)
2. Delete the key
3. Sleep 30 seconds
4. Create a key material
5. Restore the key and provide a key material (payload)



 step 1 - create a root key without a key material (payload)
$ KEY_ID=$(ibmcloud kp key create example-key -i $KP_INSTANCE_ID --output json | jq -r '.["id"]')

$ echo $KEY_ID

e631925f-affb-457e-886d-57cb2a5f565b

 step 2 - delete the key
$ ibmcloud kp key delete $KEY_ID -i $KP_INSTANCE_ID

Deleting key: 'e631925f-affb-457e-886d-57cb2a5f565b', from instance: 'a192d603-0b8d-452f-aac3-f9e1f95e7411'...
OK
Deleted Key
A registration with "preventKeyDeletion": true indicates that the associated resource has a retention policy. To enable deletion, contact an account owner to remove the retention policy on each resource that is associated with this key.

A delete key event could also receive a reason.reasonCode of 409 due to a dual auth deletion policy on the key. Make a GET request to /api/v2/keys/{id}/policies to see if there is a dual authorization policy associated with your key. If there is a policy set, contact the other authorized user to schedule the key for deletion.





 Unable to authenticate while make a request 

If the event has a reason.reasonCode of 401, you do not have the correct authorization to perform Key Protect actions in the specified Key Protect instance. Verify with an administrator that you are assigned the correct platform and service access roles in the applicable service instance. For more information about roles, see [Roles and permissions](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-access).

Check that you are using a valid token that is associated with an account authorized to perform the service action.





 Unable to view or list keys in a Key Protect instance 

If you make a call to GET api/v2/keys to list the keys that are available in your Key Protect instance and responseData.totalResources is 0, you may need to query for keys in the deleted state using the state parameter or adjust the offset and limit parameters in your request.





 Lifecycle action on a key with registrations did not complete 

The responseData.reasonForFailure and responseData.resourceCRN fields contain information on why the action wasn't able to be completed.

If the event has a reason.reasonCode of 409, the action could not be completed due to the adopting service's key state conflicting with the key state that Key Protect has.

If the event has a reason.reasonCode of 408, the action could not be completed because Key Protect was not notified that all appropriate actions were taken within 4 hours of the action request.







 Event Severity
Verify whether a key has a retention policy by checking the preventKeyDeletion field of the [registration details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-view-protected-resourcesview-protected-resources-api) for the key. Then, you must contact an account owner to remove the retention policy on each resource that is associated with the key before you can delete the key.
3. Verify the key's deletion authorization policy. By default, keys in Key Protect only require a single deletion authorization by a user with the Manager role However, if a [dual authorization policy has been set](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-dual-auth-key-policy), two users with the Manager role will have to approve the deletion.



Key Protect restricts the ability to purge keys after only four hours to users with the [KeyPurge role](https://cloud.ibm.com/docs/key-protect?topic=key-protect-grant-access-keysgrant-access-keys-specific-functions), which must be specifically set for a user as it is not enabled by default, even for the instance owner. This ability is restricted precisely because purged keys cannot be restored. If there is any doubt whether a key should be purged four hours after it has been deleted, do not purge it.





 API Example 

Please refer to the prerequisites and configuration settings associated with the [API reference](https://cloud.ibm.com/apidocs/key-protectpurgekey), before using this example.

curl -X DELETE
https://<region>.kms.cloud.ibm.com/api/v2/keys/<keyID_or_alias>/purge
-H 'accept: application/vnd.ibm.kms.key+json'
-H 'authorization: Bearer <IAM_token>'
-H 'bluemix-instance: <instance_ID>'

Replace the variables in the example request according to the following table.



Table 2.
Creating key: 'my-root-key', in instance: '390086ac-76fa-4094-8cf3-c0829bd69526'...
OK
Key ID Key Alias
24203f96-b134-440e-981a-a24f2d432256 my-alias







 Required parameters 



* KEY_ID

The ID of the key that you want to modify. To retrieve a list of your available keys, run the [kp keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-keys) command.
* KEY_ALIAS

The alias, or alternate identifier, of the key that you want to modify. The identifier must be: alphanumeric, and no spaces or special characters other than '-' or '_', and can not be a version 4 UUID.
* -i, --instance-ID

The IBM Cloud instance ID that identifies your Key Protect instance.

You can set an environment variable instead of specifying -i with the following command: $ export KP_INSTANCE_ID=<INSTANCE_ID>.







 Optional parameters 



* -o, --output

Set the CLI output format. By default, all commands print in table format. To change the output format to JSON, use --output json.









 kp key cancel-delete 

A key with a dual-auth-delete policy requires authorization from two administrative users to delete the key.

This command (kp key cancel-delete) cancels, or removes, a prior authorization.

The [kp key schedule-delete](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-schedule-delete) command is the "authorization" to delete the key.

Follow this process to delete a key with a dual-auth-delete policy.



1. Create a key and enable the dual-auth-delete policy
2.
Retention policy Indicates whether the cloud resource can be erased. If the value is Enabled, the cloud resource cannot be erased, and the key that is associated with the cloud resource cannot be deleted. If the value is Disabled, the cloud resource can be erased. You can delete the key that is associated with the cloud resource if needed. 









 Viewing associated resources with the API 

To view the associated resources through the API, follow these steps:



1. [Retrieve your service and authentication credentials to work with keys in the service](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-uko-api).
2. View the associated resources by making a GET call to the following endpoint.

https://uko.<region>.hs-crypto.cloud.ibm.com:<port>/api/v4/managed_keys/{id}/associated_resources

Replace <id> with the ID of your managed key.
3. If you want to view the resources that are associated with all keys in a keystore, make a GET call to the following endpoint.

https://uko.<region>.hs-crypto.cloud.ibm.com:<port>/api/v4/keystores/{id}/associated_resources

Replace <id> with the ID of the keystore.



For detailed instructions and code examples about using the API method, check out the [Hyper Protect Crypto Services Unified Key Orchestrator API reference doc](https://cloud.ibm.com/apidocs/uko).





 What's next 



* For more information about envelope encryption, see [Protecting your data with envelope encryption](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-envelope-encryption).
* For a list of cloud services that supports envelope encryption, see [Integrating IBM Cloud services with Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-integrate-services).
* UI
* API







 Deleting keys that have a dual-authorization deletion policy 

You can use IBM® Key Protect for IBM Cloud® to safely delete encryption keys by using a dual authorization process.

Before deleting keys, make sure to review the [Considerations before deleting and purging a key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-purge-keysdelete-purge-keys-considerations).



 Considerations for a key that has a dual-authorization deletion policy 

[Dual authorization policies](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-dual-auth) are set to ensure that keys are not deleted in error by requiring the authorization of two specified users. Whatever the reason for a dual authorization policy, the method for deletion is the same. One of the users authorized to delete the key schedules it for deletion, which must be confirmed by another user.

Before you delete a key by using dual authorization:



* Determine who can authorize deletion of your Key Protect resources. To use dual authorization, be sure to identify a user who can set the key for deletion and another who can delete the key. Users with a Writer or Manager role can set keys for deletion, but only users with a Manager role can delete keys.
* Plan to delete the key within a seven day authorization period. When the first user authorizes a key for deletion, it remains in the [Active state](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-states) for seven days, during which all key operations are allowed on the key. To complete the deletion, another user with a Manager role can use the Key Protect GUI or API to delete the key at any point during those seven days, at which time the key will be moved to the Destroyed state. Note that because it is impossible to purge an active key, another user must delete the key before it can purged.
* The key and its associated data will be inaccessible 90 days after being deleted.
view resources (COS and KMS should no longer exist)
$ ibmcloud resource service-instances

Retrieving instances with type service_instance in resource group Default in all locations under account <account name> as <email address>...
OK
No service instance found.







 Required parameters 



* KEY_ID_OR_ALIAS

The v4 UUID or alias of the key that you want to delete. To retrieve a list of your available keys, run the [kp keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-keys) command.
* -i, --instance-id

The IBM Cloud instance ID that identifies your Key Protect instance.

You can set an environment variable instead of specifying -i with the following command: $ export KP_INSTANCE_ID=<INSTANCE_ID>.







 Optional parameters 



* -f, --force

Delete a key, with force, which is used to delete a key that has "registrations." Registrations are associations between root keys and other cloud resources, such as Cloud Object Storage (COS) buckets or Cloud Databases deployments.

For more information, see [kp registrations](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-registrations)
* -o, --output

Set the CLI output format. By default, all commands print in table format. To change the output format to JSON, use --output json.
* --key-ring

A unique, human readable name for the key-ring. Required if the user doesn't have permissions on the default key ring.









 kp key disable 

The kp key disable command disables a root key and temporarily revokes access to the key's associated data in the cloud.
Removing key references with the CLI 

You can remove a referenced key in a secret or configmap from a job or app.

In this scenario, let's remove the url key from the keyref job.

Even though the --env-from-configmap option was used on a job to reference the url key in the mydatabasecm configmap, you can use the --env-rm option to remove individual keys. You can use the --env-rm option with the [job update](https://cloud.ibm.com/docs/codeengine?topic=codeengine-clicli-job-update) or [app update](https://cloud.ibm.com/docs/codeengine?topic=codeengine-clicli-application-update) commands to remove key references regardless of whether the keys are individual key references in a secret or configmap, or whether the keys were directly set on a job or app with the --env option.



1. Update the keydef job to remove the reference to the url key.

ibmcloud ce job update --name keyref --env-rm url
2. View the details of the keyref job. The output illustrates that the reference to the url key is removed.

ibmcloud ce job get -n keyref

Example output

Getting job 'keyref'...
OK

Name: keyref
ID: abcdefgh-abcd-abcd-abcd-1a2b3c4d5e6f
Project Name: myproject
Project ID: 01234567-abcd-abcd-abcd-abcdabcd1111
Age: 6m27s
Created: 2021-02-12T07:18:44-06:00
[...]

Commands:
env
Image: busybox
Resource Allocation:
CPU: 1
Memory: 4G

Runtime:
Array Indices: 0
Max Execution Time: 7200
Retry Limit: 3
For more information, see [ibmcloud is key-delete](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-referencekey-delete). Specify name of each SSH key that you delete by using the KEY variable.

ibmcloud is key-delete (KEY1 KEY2 ...)





 Deleting your SSH key by using the API 

To delete one or more SSH keys by using the API, use [Delete a key](https://cloud.ibm.com/apidocs/vpc/latestdelete-key).

For the $id variable, specify the name of the SSH key you want to delete.

curl -X DELETE "$vpc_api_endpoint/v1/keys/$id?version=2023-03-30&generation=2" -H "Authorization: Bearer $iam_token"
kp key command 

The kp key command manages individual keys.



Table 3. Sub-commands for managing keys

 Sub-command Status v0.5.2 Description 

 [cancel-delete](https://cloud.ibm.com/docs/key-protect?topic=key-protect-cli-reference-five-twokp-key-cancel-delete) New Cancel a previously scheduled request to delete a key 
 [create](https://cloud.ibm.com/docs/key-protect?topic=key-protect-cli-reference-five-twokp-key-create) Create a key or import your own key 
 [delete](https://cloud.ibm.com/docs/key-protect?topic=key-protect-cli-reference-five-twokp-key-delete) Delete a key permanently 
 [disable](https://cloud.ibm.com/docs/key-protect?topic=key-protect-cli-reference-five-twokp-key-disable) New Disable a key 
 [enable](https://cloud.ibm.com/docs/key-protect?topic=key-protect-cli-reference-five-twokp-key-enable) New Enable a key 
 [policies](https://cloud.ibm.com/docs/key-protect?topic=key-protect-cli-reference-five-twokp-key-policies) Retrieve a list of policies 
 policy-update [dual-auth-delete](https://cloud.ibm.com/docs/key-protect?topic=key-protect-cli-reference-five-twokp-key-policy-update-dual) Update Update the key policy for "dual auth delete" 
 policy-update [rotation](https://cloud.ibm.com/docs/key-protect?topic=key-protect-cli-reference-five-twokp-key-policy-update-rotation) Update Update the key polcy for "rotation"
After the soft-deletion period the key can be deleted without the force. You can check the [association between the key and your deployment](https://cloud.ibm.com/docs/key-protect?topic=key-protect-view-protected-resources) to determine when you can delete the key.





 Cryptoshredding 

Cryptoshredding is a destructive action. Once the key is deleted your data is unrecoverable.

Key Protect or Hyper Protect Crypto Services allows you to initiate a force delete of a key that is in use by IBM Cloud® services using [Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-keys) or [Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-keys), including your Db2 on Cloud deployments. This action is called cryptoshredding. Deleting a key that is in use on your deployment locks the disks containing your data and disables your deployment. You are still able to access the UI and some metadata such as security settings in the UI, CLI, and API but you are not able to access any of the databases or data contained within them. Key deletion is sent to the Log Analysis Activity Tracker as kms.secrets.delete using [Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-at-events) and as hs-crypto.secrets.delete using [Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-at-events).
Key Protect provides for a [force delete](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-keys) of a key that is in use by IBM Cloud® services, including your Cloud Databases deployments. This action is called cryptoshredding.

Cryptoshredding is a destructive action. When the key is deleted, your data is unrecoverable even from a soft delete state.





 Backups Removal 

Backups cannot be manually deleted. However, if you delete your deployment, its backups are deleted automatically.





 Reenabling from a soft delete 

You are able to discover available soft-deleted instances by using the IBM Cloud CLI [ibmcloud resource reclamations](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_resourceibmcloud_resource_reclamations) command.

You can then "undelete", recover, or reclaim an available soft-deleted instance by using the IBM Cloud CLI [ibmcloud resource reclamation-restore](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_resourceibmcloud_resource_reclamation_restore) command:

ibmcloud resource reclamation-restore resource_ID
A unique, human readable name for the key-ring. Required if the user doesn't have permissions on the default key ring.









 kp key delete 

[Delete a key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-keys) that is stored in your Key Protect service.

ibmcloud kp key delete KEY_ID_OR_ALIAS
-i, --instance-id INSTANCE_ID
[--key-ring KEY_RING_ID]
[-f, --force]
[-o, --output OUTPUT]



 Examples 

These are examples of kp key delete.



 Example 1 

Delete a root key.

 create a root key
$ ibmcloud kp key create my-root-key

Creating key: 'my-root-key', in instance: '390086ac-76fa-4094-8cf3-c0829bd69526'...
OK
Key ID Key Name
8635b804-9966-4918-a16b-d561fdbf181f my-root-key

 show key details
$ ibmcloud kp key show 8635b804-9966-4918-a16b-d561fdbf181f

Grabbing info for key id: 8635b804-9966-4918-a16b-d561fdbf181f...
OK
Key ID Key Name Description Creation Date Expiration Date
8635b804-9966-4918-a16b-d561fdbf181f my-root-key 2020-05-05 19:58:02 +0000 UTC Key does not expire

 delete the key
$ ibmcloud kp key delete 8635b804-9966-4918-a16b-d561fdbf181f
If no action is taken by the second user and the 7-day period expires, you must [restart the dual authorization process](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-dual-auth-keysset-key-deletion-api) to delete the key.







 Authorize deletion for a key with the API 



 Step 1. Authorize deletion for a key 

After you enable dual authorization [for an instance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-dual-auth) or [for a key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-dual-auth-key-policy), you can provide the first authorization to delete a key by making a POST call to the following endpoint.

https://api.<region>.hs-crypto.cloud.ibm.com:<port>/api/v2/keys/<key_ID>/actions/setKeyForDeletion



1. [Retrieve your authentication credentials to work with keys in the service](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-kms-api).

To set a key for deletion, you must be assigned a Manager or Writer access policy for the instance or key. To learn how IAM roles map to Hyper Protect Crypto Services actions, check out [Service access roles](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-accessservice-access-roles).
2. Copy the ID of the key that you want to set or authorize for deletion.
3. Provide the first authorization to delete the key.

curl -X POST 
'https://api.<region>.hs-crypto.cloud.ibm.com:<port>/api/v2/keys/<key_ID>/actions/setKeyForDeletion'