vania-janet/multiturn-rag-retrieval-data huggingface dataset:
If you can't delete the key, see [troubleshooting key management service](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-troubleshoot-unable-to-delete-keys).

Block Storage for VPC volumes, snapshots, and custom images with a deleted root key appear in the list of resources with an unusable status. File Storage for VPC shares show a suspended status. The API reason code is encryption_key_deleted.

Deletion of the root key results in the following conditions.



* All instances with an unusable boot volume do not restart.
* You can't attach unusable data volumes to an instance.
* You can't restore a volume from a snapshot.
* You can't access a file share.
* You can't provision instances from unusable images.
* Billing continues for unusable resources until you delete them.



Before you force delete a root key, it's best to review all resources that are associated with that root key. Consider [temporarily disabling the key](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managingbyok-disable-root-keys) instead of deleting it to suspend the use of that root key. Root keys can be restored within 30 days, but only if they are imported root keys, not KMS generated.

For more information about deleting root keys, see the following topics.



* [Key Protect - Deleting keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-keys)
* [Hyper Protect Crypto Services - Deleting keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-keys)
Click Delete keystore.



If you are performing cryptographic operations using the PKCS #11 API, to delete the key in your PKCS #11 application, reinitialize the PKCS #11 API by using the C_Finalize() and C_Initialize() functions.





 What's next 

You can use EP11 keys for cryptographic operations with the PKCS #11 API. For more information, see

[Performing cryptographic operations with the PKCS #11 API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-pkcs-api) and

[PKCS #11 API reference](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-pkcs11-api-ref).
Disabling key: '264fadc3-7667-4b25-916e-5825fe70de0b', in instance: '390086ac-76fa-4094-8cf3-c0829bd69526'...
OK

 show key details - a state of "2" is "suspended"
$ ibmcloud kp key show example-alias-1 --output json

{
"id": "264fadc3-7667-4b25-916e-5825fe70de0b",
"name": "root-key-with-alias",
"type": "application/vnd.ibm.kms.key+json",
"algorithmType": "AES",
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-06-09T21:21:55Z",
"lastUpdateDate": "2020-06-09T21:23:26Z",
"keyVersion": {
"id": "264fadc3-7667-4b25-916e-5825fe70de0b",
"creationDate": "2020-06-09T21:21:55Z"
},
"extractable": false,
"state": 2,
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:390086ac-76fa-4094-8cf3-c0829bd69526:key:264fadc3-7667-4b25-916e-5825fe70de0b"
}







 Required parameters 



* KEY_ID_OR_ALIAS

The v4 UUID or alias of the key that you want to delete.
If the delete key event has a reason.reasonCodeof 409, the key cannot be deleted because it is possibly protecting one or more cloud resources that have a retention policy. Make a GET request to /keys/{id}/registrations to learn which resources this key is associated with. A registration with "preventKeyDeletion": true indicates that the associated resource has a retention policy. To enable deletion, contact an account owner to remove the retention policy on each resource that is associated with this key.

A delete key event might also receive a reason.reasonCode of 409 due to a dual auth deletion policy on the key. Make a GET request to /api/v2/keys/{id}/policies to see whether a dual authorization policy is associated with your key. If there is a policy set, contact the other authorized user to delete the key.





 Unable to authenticate while making a request 

If the event has a reason.reasonCode of 401, you might not have the correct authorization to perform Hyper Protect Crypto Services actions in the specified service instance. Verify with an administrator that you are assigned the correct platform and service access roles in the applicable service instance. For more information about roles, see [Roles and permissions](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-access).

Check that you are using a valid token that is associated with an account that is authorized to perform the service action.





 Unable to view or list keys in a service instance 

You can call GET api/v2/keys to list the keys that are available in your service instance. If responseData.totalResources is 0, query for keys in the deleted state by using the state parameter or adjust the offset and limit parameters in your request.





 Lifecycle action on a key with registrations did not complete 

The responseData.reasonForFailure and responseData.resourceCRN fields contain information about why the action wasn't able to be completed.

If the event has a reason.reasonCode of 409, the action cannot be completed due to the adopting service's key state conflicting with the key state that Hyper Protect Crypto Services has.
Delete key [Deleting keys with the API (single authorization)](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-keysdelete-key-api) [Deleting keys with the API (single authorization)](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-keysdelete-keys-api) 
 [Authorize deletion for a key with the API (dual authorization)](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-dual-auth-keysset-key-deletion-api) [Authorize deletion for a key with the API (dual authorization)](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-dual-auth-keysset-key-deletion-api) 
 Restore key [Restoring a deleted key with the API](https://cloud.ibm.com/docs/key-protect?topic=key-protect-restore-keysrestore-api) [Restoring a deleted key with the API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-restore-keysrestore-api) 







 Removing service authorization to a root key 

You can make your data inaccessible but retain it on the cloud by removing IAM authorization to use that root key.

When you [authorize use](https://cloud.ibm.com/docs/account?topic=account-serviceauthserviceauth) of your root key, you grant permission for IBM to use the key to encrypt your resource. Authorization is done at the key management service level through IAM, when you authorize service between your service (for example, Cloud Block Storage) and the key management service.

You can remove any authorization between services in your account when you have the Administrator role on the target service (in this case, the key management service).
* UI
* API







 Restoring keys 

When a key is deleted, it is moved to a "destroyed" state. However, information about the key (such as its metadata) can still be viewed and you have 30 days to restore the key to an active state. For this reason, a key deletion is considered a "soft delete" in that the key still exists but can no longer be used to access the data it has encrypted. This topic describes the process to restore a key and the limitations of the key restoration process.

As part of a testing and development process, it is normal to create and delete keys often. These keys are not gone forever; rather they are "soft deleted" and moved to a destroyed state. This does not mean they have been destroyed in the sense that they are gone forever. Instead, it simply means they cannot be used as part of any key actions such as using the key to encrypt or decrypt data. The key data can only be looked at, and, if the key was deleted in error, it might be possible to restore the key to an active state.

This intermediate period, in which a key has been deleted but can still be restored, lasts for 30 days. Between 30 days and 90 days, the key data can still be accessed, but the key can no longer be restored. After 90 days, the key becomes eligible to be automatically purged, which can occur at any time after 90 days. Purged keys, unlike destroyed keys, are gone forever.



Table 1. Ties key states to the time from a key's deletion to what actions are possible with the key.

 Time from key deletion Name of key state Can view/access key data? Can restore? 

 One-30 days Destroyed Yes Yes 
 30-90 days Destroyed Yes No 
 After 90 days Purged* No No 



Note: because purged keys are completely inaccessible and "destroyed" in the common usage of the word, there is technically no "purged" key state. Purged keys are simply gone and therefore don't have a "state" one way or another.
Why can't I delete internal keystores? 

You are not able to delete the internal KMS keystore through either UI or API.

  What’s happening 

You have destroyed all keys in the KMS keystore. However, when you try to delete the keystore, you still receive an error similar to one of the following:

> The service was not able to delete keystore <keystore_name> because it still contains some keys. Conflict: Key ring could not be deleted: Please see reasons for more details.

  Why it’s happening 

The KMS key metadata is to be automatically removed in 90 days. Before that, the key metadata still remains in the keystore and you cannot delete the keystore.

  How to fix it 

Delete the internal KMS keystore after the key metadata gets removed automatically. Or, you can [manually remove all key metadata using the KMS API](https://cloud.ibm.com/apidocs/hs-cryptopurgekey) in 4 hours after you destroy the key. Make sure that you have the KMS Key Purge role assigned. For more information about roles, see [Managing user access](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-manage-access).
Deleting a key moves it into a Destroyed state, a "soft" deletion in which the key can still be seen and restored for 30 days. After 90 days, the key will be automatically purged, or "hard deleted", and its associated data will be permanently shredded and removed from the Key Protect service. If it is desirable that a key be purged sooner than 90 days, it is also possible to hard delete a key four hours after it has been moved into the Destroyed state.

After a key has been deleted, any data that is encrypted by the key becomes inaccessible, though this can be reversed if the key is restored within the 30-day time frame. After 30 days, key metadata, registrations, and policies are available for up to 90 days, at which point the key becomes eligible to be purged. Note that once a key is no longer restorable and has been purged, its associated data can no longer be accessed. As a result, [destroying resources](https://cloud.ibm.com/docs/key-protect?topic=key-protect-security-and-compliancedata-deletion) is not recommended for production environments unless absolutely necessary.
* What happens if I try to delete a key that's actively encrypting data?

For your protection, Key Protect prevents the deletion of a key that's actively encrypting data in the cloud. If you try to delete a key that's registered with a cloud resource, the action won't succeed.

If needed, you can [force deletion on a key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-keysdelete-keys-force-delete) by using the Key Protect APIs. [Review which resources are encrypted by the key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-view-protected-resources) and verify with the owner of the resources to ensure you no longer require access to that data.

If you can't delete a key because a retention policy exists on the associated resource, contact the account owner to remove the retention policy on that resource.
A successful DELETE api/v2/keys/<keyID_or_alias>/aliases/<key_alias> request returns an HTTP 204 No Content response, which indicates that the alias associated with your key was deleted.

It takes up to five minutes for an alias to be completely deleted from the service.





 Key Alias FAQ 

Below are additional details about key aliases:



* An alias is independent from a key. An alias is it's own resource and any actions taken on it will not affect the associated key. For example, deleting an alias will not delete the associated key.
* An alias can only be associated with one key at a time. An alias can only be associated with one key that is located in the same instance and region. If you would like to change the key that the alias is associated with, you will need to delete the alias, wait up to five minutes, then recreate the alias and map it to necessary key.
* You can create an alias with the same name in a different instance or region. Each alias will be associated with a different key in each instance or region. This enables your service's application code to be reusable in different instances or regions. For example, if you have an alias named Application Key in both the US-South and US-East regions, with each linked to a different key.







 APIs that use key alias 

The following table lists the APIs that you can use to create and use a key alias.



Table 3. Describes the variables that are APIs that use key alias.

 API Key Alias Impact 

 [Create Root Keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-create-root-keys) You can create up to 5 aliases while creating a root key. 
 [Create Standard Keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-create-standard-keys) You can create up to 5 aliases while creating a standard key. 
 [Retrieve a key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-retrieve-key) You can retrieve a key by ID or alias.
Retrieve the ID of the key that you want to delete.

You can find the ID for a key in your service instance by [retrieving a list of your keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-keys), or by accessing the IBM Cloud console.
3. Run the following cURL command to permanently delete the key and the contents.

curl -X DELETE "https://api.<region>.hs-crypto.cloud.ibm.com:<port>/api/v2/keys/<key_ID>/purge" -H "authorization: Bearer <IAM_token>" -H "bluemix-instance: <instance_ID>" -H "x-kms-key-ring: <key_ring_ID>" -H "prefer: <return_preference>"

Replace the variables in the example request according to the following table.



Table 1. Describes the variables needed to purge keys with the API

 Variable Description 

 region Required. The region abbreviation, such as us-south or au-syd, that represents the geographic area where your Hyper Protect Crypto Services instance resides. For more information, see [Regional service endpoints](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regionsservice-endpoints). 
 port Required. The port number of the API endpoint. 
 key_ID Required. The unique identifier for the key that you would like to delete. 
 IAM_token Required. Your IBM Cloud access token. Include the full contents of the IAM token, including the Bearer value, in the cURL request. For more information, see [Retrieving an access token](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-access-token). 
 instance_ID Required. The unique identifier that is assigned to your Hyper Protect Crypto Services instance.
* [Disable a key rotation policy](https://cloud.ibm.com/apidocs/hs-crypto::text=policy%2Bjson%22%2C%0A%20%20%20%20%20%20%20%20%22rotation%22%3A%20%7B%0A%20%20%20%20%20%20%20%20%20%20%22-,enabled,-%22%3A%20%3Ctrue%7Cfalse%3E%2C%0A%20%20%20%20%20%20%20%20%20%20%22interval_month) to allow an automatic key rotation policy to be paused temporarily.







 January 2022 

The following methods are added:



* Update the key ring of a key. After you create a key, you can transfer the key to a different key ring by sending a PATCH /api/v2/keys/{id} request and specifying the new key ring ID.
* Purge key to permanently delete a key. After you purge a key, you are no longer able to access the key and its associated resources. This action is performed in a DELETE /api/v2/keys/{id}/purge request.







 April 2021 

The method of restoring keys is updated. Now all root keys and standard keys can be restored within 30 days of the deletion and no key material is required.
6 - Key could not be deleted... 



 HTTP status code 

409 - Conflict

The HTTP 409 Conflict client error response code indicates that an error in the client request can be resolved per the specified reason code returned.





 Context 

The message returns a reason in the message that provides the specific context.





 Message 

Reason code: AUTHORIZATIONS_NOT_MET

The key cannot be deleted because it failed the dual authorization request. Before you delete this key, make sure dual authorization procedures are followed. See the topic, [Deleting keys using dual authorization](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-dual-auth-keys).

Reason code: PROTECTED_RESOURCE_ERR

The key cannot be deleted because the key has one or more associated resources. See the topic, [Considerations before deleting and purging a key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-purge-keysdelete-purge-keys-considerations).

Reason code: PREV_KEY_DEL_ERR

The key cannot be deleted because it's protecting a cloud resource that has a retention policy. Before you delete this key, contact an account owner to remove the retention policy on each resource that is associated with the key. See the topic, [Considerations before deleting and purging a key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-purge-keysdelete-purge-keys-considerations).



 Example Response 1 

{
"metadata": {
"collectionType": "application/vnd.ibm.kms.error+json",
"collectionTotal": 1
},
"resources": [
{
"errorMsg": "Key could not be deleted. Please 'reasons' for more details.",
"reasons":
{
"code": "AUTHORIZATIONS_NOT_MET",
"message": "The key cannot be deleted because it failed the dual authorization request."
You can undo the deletion by calling the [undelete](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-vault-manage-kv-clikv-version-restore-cli) command.

vault kv delete [-format=FORMAT] ibmcloud/kv/SECRET_NAME

Delete the latest version of a key-value secret in a custom group.

vault kv delete [-format=FORMAT] ibmcloud/kv/GROUP_ID/SECRET_NAME



 Prerequisites 

You need the [Manager service role](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam) to delete key-value secrets.





 Command option 

-format
: Prints the output in the format that you specify. Valid formats are table, json, and yaml. The default is table. You can also set the output format by using the VAULT_FORMAT environment variable.





 Example 

Delete the latest version of a key-value secret.

vault kv delete -format=json ibmcloud/kv/my-test-kv-secret

Delete the latest version of a key-value secret in a custom group.

vault kv delete -format=json ibmcloud/kv/9426e546-83de-4da5-9631-d70c993186c8/my-test-kv-secret





 Output 

The command to delete the latest version of a kv secret returns no output.







 Delete specified versions of a key-value secret 

Delete the specified versions of a key-value secret. You can undo the deletion by calling the [undelete](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-vault-manage-kv-cli&interface=uikv-version-restore-cli) command.

vault kv delete [-versions=VERSIONS] [-format=FORMAT] ibmcloud/kv/SECRET_NAME

Delete the specified versions of a key-value secret in a custom group.
To delete the key, the second approver must have Manager access policy for the instance or key in order to authorize the key for deletion.



1. In the Keys table of the KMS keys page, you can find keys that are authorized for deletion with the following indicators:



* The Set for deletion column has a value of True. The authorization expiration time is displayed in the Deletion expiration column.
* A Trash can icon ![Trash can icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/icon_trash.svg) is displayed in the State column. Hover over the icon to view the deletion expiration date.



2. To delete the key, follow the instructions in [Deleting keys with the console](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-keysdelete-keys-gui).



Hyper Protect Crypto Services sets a 7-day waiting period that starts after you provide the first authorization to delete the key. During this 7-day period, the key remains in the [Active state](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-key-states) and all key operations are allowed on the key. If no action is taken by the second user and the 7-day period expires, you must [restart the dual authorization process](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-dual-auth-keysset-key-deletion-api) to delete the key.







 Authorize deletion for a key with the API 



 Step 1. Authorize deletion for a key
These are examples of kp key delete.



 Example 1 

Delete a root key.

 create a root key
$ ibmcloud kp key create my-root-key

Creating key: 'my-root-key', in instance: '390086ac-76fa-4094-8cf3-c0829bd69526'...
OK
Key ID Key Name
8635b804-9966-4918-a16b-d561fdbf181f my-root-key

 show key details
$ ibmcloud kp key show 8635b804-9966-4918-a16b-d561fdbf181f

Grabbing info for key id: 8635b804-9966-4918-a16b-d561fdbf181f...
OK
Key ID Key Name Description Creation Date Expiration Date
8635b804-9966-4918-a16b-d561fdbf181f my-root-key 2020-05-05 19:58:02 +0000 UTC Key does not expire

 delete the key
$ ibmcloud kp key delete 8635b804-9966-4918-a16b-d561fdbf181f

Deleting key: 8635b804-9966-4918-a16b-d561fdbf181f, from instance: 390086ac-76fa-4094-8cf3-c0829bd69526...
OK
Deleted Key
8635b804-9966-4918-a16b-d561fdbf181f





 Example 2 

Delete a root key and show the JSON output.

 create a root key
$ ibmcloud kp key create my-root-key --output json

{
"id": "9cca88c9-019e-4f0a-9e76-8e657c6b9720",
About deleting and purging keys 

You can delete an encryption key and the key material if you are a [Manager](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-access) for your Hyper Protect Crypto Services instance.

If a key is no longer needed, you can delete and ultimately purge keys. This action shreds the key material and makes any of the data encrypted with the keys inaccessible.

When you delete a key, the key moves into a [Destroyed state](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-key-states). Within 30 days after the deletion, the key can still be viewed and restored. After 90 days, the key is automatically purged and you will no longer able to view the key. The data that is associated with the key is also permanently removed from the Hyper Protect Crypto Services instance. If you want to purge a key before 90 days, you can also do it manually 4 hours after it is moved into the Destroyed state.

After a key is purged, the associated data can no longer be accessed. As a result, it is not suggested to [destroy resources](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-security-and-compliancedata-deletion) in production environments unless it is necessary.

The following table lists the timeframes in which you can view, restore, and purge the key after you delete a key.



Table 1. Lists how users can interact with keys during certain time intervals after a key is deleted.

 Time from key deletion Name of key state Can view or access key data? Can restore? Can user initiate purge? 

 1 second–4 hours Destroyed Yes Yes No 
 4 hours–30 days Destroyed Yes Yes Yes 
 30–90 days Destroyed Yes No Yes 
 After 90 days Purged (not a key state technically) No No Yes 



Because purged keys are inaccessible and no longer restorable, Purged is not a key state technically.