vania-janet/multiturn-rag-retrieval-data huggingface dataset:
When the first user authorizes a key for deletion, it remains in the [Active state](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-states) for seven days, during which all key operations are allowed on the key. To complete the deletion, another user with a Manager role can use the Key Protect GUI or API to delete the key at any point during those seven days, at which time the key will be moved to the Destroyed state. Note that because it is impossible to purge an active key, another user must delete the key before it can purged.
* The key and its associated data will be inaccessible 90 days after being deleted. When you delete a key, it is "soft deleted", meaning that the key and its associated data will be restorable up to 30 days after deletion. You are able to still retrieve associated data such as key metadata, registrations, and policies for up to 90 days. After 90 days, the key becomes eligible to be automatically [purged](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-dual-auth-keysdelete-dual-auth-keys-key-purge), or hard deleted, and its associated data will be permanently removed from the Key Protect service.







 Authorize deletion for a key in the console 

[After you enable dual authorization for an instance or key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-dual-auth), you can provide the first authorization to delete a key by using the Key Protect IBM Cloud console.



1. [Log in to the IBM Cloud console](https://cloud.ibm.com/login/).
2. Go to Menu > Resource List to view a list of your resources.
3. From your IBM Cloud resource list, select your provisioned instance of Key Protect.
4. On the application details page, use the Keys table to browse the keys in your service.
5. Click the ⋯ icon to open a list of options for the key that you want to delete.
if [ $KEY_NAME == "my-test-key-" ]]; then
echo "Deleting... $KEY_NAME $KEY_ID"
ibmcloud kp key delete $KEY_ID
fi
done

(output not shown)





 Example 6 

Lists the keys based on key states (Active, Suspended) in the Key Protect instance.

 list active and suspended keys
$ ibmcloud kp keys --key-states active,suspended

Retrieving keys...
OK
Key ID Key Name
ef2cc155-fe56-492c-845c-4d1f0688c7ba my-active-key
636e9f3a-feaf-4033-8603-687754dc7e51 my-suspended-key





 Example 7 

Lists the keys based on key type (root) in the Key Protect instance.

 list root keys
$ ibmcloud kp keys -t root

Retrieving keys...
OK
Key ID Key Name
2f1cb135-fa16-40dc-815c-4d1f0ee8c7ba my-root-key





 Example 8 

Lists the keys in the Key Protect instance with the key name or alias exactly matching the characters in the string "TEST" without quotation marks.

 list keys with identifiers exactly matching TEST
$ ibmcloud kp keys -l exact:TEST

Retrieving keys...
OK
Key ID Key Name
636e9f3a-feaf-4033-8603-687754dc7e51 TEST





 Example 9 

Lists the keys in the Key Protect instance and sort the keys based on their id and the date the key was created starting with the newest (the hyphen, '-', indicates sort by descending order).

 sort keys by id and descending creationDate
$ ibmcloud kp keys -b id,-creationDate

Retrieving keys...
OK
Key ID Key Name
* UI
* API







 Deleting keys by using dual authorization 

You can use IBM Cloud® Hyper Protect Crypto Services to safely delete root keys or standard keys by using a dual authorization process.

Before you delete keys, make sure you understand [the concept of deleting and purging keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-purge-keys) and review the [considerations](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-purge-keysdelete-purge-keys-considerations).



 Considerations for deleting a key using dual authorization 

Deleting a key that has a [dual authorization policy](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-dual-auth) requires an authorization from two users. With the Hyper Protect Crypto Services key management service API, you can provide the first authorization by [setting the key for deletion](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-dual-auth-keysset-key-deletion-api). Then, a different user provides a second authorization by using the IBM Cloud console or key management service API to delete the key.

Before you delete a key by using dual authorization:



* Determine who can authorize deletion of your Hyper Protect Crypto Services resources. To use dual authorization, be sure to identify a user who can set the key for deletion, and another user who can delete the key. Users with a Writer or Manager access policy can set keys for deletion. Users with a Manager access policy can delete keys.
* Plan to delete the key within a 7-day waiting period. When the first user authorizes a key for deletion, Hyper Protect Crypto Services sets a 7-day waiting period on the key.
[Actions icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/action-menu-icon.svg) > Delete on the row for the API key in the API keys section.





 Managing other user's classic infrastructure API keys 

If you are an ancestor in the classic infrastructure hierarchy for a user, you can view and delete classic infrastructure API keys for users, including VPN only users.

Only users who create the API key can retrieve the API key value after it's created.

In the IBM Cloud console, go to Manage > Access (IAM) > API keys, and select Classic infrastructure API keys. Then, click the Actions icon ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/action-menu-icon.svg), and select actions whether it's to view the details or delete the API key.
Deactivated 3 A Deactivated key is no longer allowed for operations that generate new cryptographic data, such as encryption or signing, but can still be used for operations on existing data to do decryption or signature verification. When you deactivate a key, the key is detached from all the target keystores, and not accessible to all associated resources and their data. However, you can still reactivate the key so that it is accessible to the resources again. 
 Destroyed 5 A Destroyed key is a key record for which the actual key material has been permanently erased. The record of the key is retained to be available for later queries or audits until you manually remove the key from the vault. Keys in the Destroyed state cannot be restored in Unified Key Orchestrator. However, you can still restore your keys in external keystores depending on the settings of the cloud providers. 



If the key state in some target keystores is different from the managed key state, you receive a Key out of sync warning message. An Out of sync flag is also displayed in the corresponding keystore card or the key list. There can be multiple reasons why the key is out of sync. For example, you have deactivated the key in this target keystore before, or you activate the key through the CLI and the console doesn't reflect the state timely. When you hover over this flag, you can see the specific reason. You can sync the key state by clicking Sync keys on the Key details page.





 Key states and service actions 

Key states affect whether an action that you perform on a key succeeds or fails. For example, if a managed key is in the Active state, you cannot destroy the key before you deactivate it first.

The following table shows how Unified Key Orchestrator handles service actions based on the state of a key. The column headers represent the key states, and the row headers represent the actions that you can perform on a key. The Checkmark icon !
At lock creation, you can set one of the following modes to clear any matching locks on a secret version. Note: When you are locking the previous version, the mode parameter is ignored.



* exclusive: Removes any other locks with matching names if they are found in the previous version of the secret.
* exclusive_delete: Same as exclusive, but also permanently deletes the data of the previous secret version if it doesn't have any locks.

Allowable values are: exclusive, exclusive_delete.







 Examples 

ibmcloud secrets-manager secret-version-lock --secret-type=arbitrary --id=exampleString --version-id=exampleString --locks='[{"name": "lock-1", "description": "lock for consumer-1", "attributes": {"anyKey": "anyValue"}}]' --mode=exclusive







 ibmcloud secrets-manager secret-version-unlock 

Delete one or more locks that are associated with the specified secret version.

A successful request deletes the locks that you specify. To remove all locks, you can pass {"locks": [""]} in in the request body. Otherwise, specify the names of the locks that you want to delete. For example, {"locks": ["lock-1", "lock-2"]}.

Note: A secret is considered unlocked and able to be revoked or deleted only after all of its locks are removed. To understand whether a secret contains locks, check the locks_total field that is returned as part of the metadata of your secret.

ibmcloud secrets-manager secret-version-unlock --secret-type SECRET-TYPE --id ID --version-id VERSION-ID [--locks LOCKS]



 Command options 

--secret-type (string)
: The secret type. Required.

Allowable values are: arbitrary, iam_credentials, imported_cert, public_cert, private_cert, username_password, kv.

--id (string)
: The v4 UUID that uniquely identifies the secret. Required.
Really delete the service instance <instance_name> with ID crn:v1:bluemix:public:kms:us-south:a/ea988d3289c24739a0977651b46fb145:a152eee4-262e-4a39-ae13-a71b9882dcb6::? [y/N] > y
FAILED
Error Code: RC-ServiceBrokerErrorResponse
Message: [409, Conflict] Conflict: Instance contains 2 active keys. Remove all keys before de-provisioning







 What's next 

To find out more about programmatically managing your keys, [check out the Key Protect API reference doc](https://cloud.ibm.com/apidocs/key-protect).
* UI
* CLI
* API







 Deleting secrets 

You can use IBM Cloud® Secrets Manager to delete a secret and its contents by using the console or service APIs.



 Before you begin 

Before you begin, be sure that you have the required level of access. To delete secrets, you need the [Manager service role](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam).

If you have a service ID or API key that was generated by the IAM credentials secret engine and delete your instance of Secrets Manager, you must also delete the secret from IAM.





 Deleting secrets in the UI 

You can use the Secrets Manager UI to manually delete your secrets.



1. In the console, click the Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/icon_hamburger.svg)> Resource List.
2. From the list of services, select your instance of Secrets Manager.
3. Use the Secrets table to browse the secrets in your instance.
4. In the row for the secret that you want to delete, click the Actions menu ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/actions-icon-vertical.svg)> Delete.
5. Enter the name of the secret to confirm its deletion.
6. Click Delete.

After you delete a secret, the secret transitions to the Destroyed state. Secrets in this state are no longer recoverable. Metadata that is associated with the secret, such as the secret's deletion date, is kept in the Secrets Manager database.







 Deleting secrets from the CLI
If you can't delete a key because a retention policy exists on the associated resource, contact the account owner to remove the retention policy on that resource.





 What happens when I disable a key? 

When you disable a key, the key transitions to the Suspended state. Keys in this state are no longer available for encrypt or decrypt operations, and any data that's associated with the key becomes inaccessible.

Disabling a key is a reversible action. You can always [enable a disabled key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-disable-keysenable-api) and restore access to the data that was previously encrypted with the key.





 What is a dual authorization policy? 

Dual authorization is a two-step process that requires an action from two approvers to delete a key. By forcing two entities to authorize the deletion of a key, you minimize the chances of inadvertent deletion or malicious actions.

With Key Protect, you can [enforce dual authorization policies](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-dual-auth) at the instance level or for individual keys.





 What happens after I enable a dual authorization policy? 

After you enable a dual authorization policy for a Key Protect instance, any keys that you add to the instance inherit the policy at the key level. Dual authorization policies for keys cannot be reverted.

If you have existing keys in a Key Protect instance, those keys will continue to require only a single authorization to be deleted. If you want to enable those keys for dual authorization, you can use the Key Protect APIs t [set dual authorization policies for those individual keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-dual-auth-key-policy).





 Can I disable a dual authorization settings for my Key Protect instance? 

Yes.
In the Target keystores card, click Edit to add or remove the target keystores where the key is activated. You can use a key only for encryption and decryption after it is activated in at least one target keystore.



* Add target keystores

If you want to assign and activate the key in more target keystores, click Edit and check the corresponding target keystore cards. The Active key state is synced across all target keystores.
* Remove target keystores

If you want to unassign and deactivate the key in some target keystores, click Edit and clear the checkbox in the corresponding target keystore cards. After the removal, the key material remains unless you destroy the key. The key state in the removed target keystores becomes Deactivated and cannot be synced with the managed key state in the future. However, you can reactivate the key by reassigning the key to these keystores so that the key state is synced again.

A managed key is synced across multiple target keystores that it is assigned to. You can fully remove a key from a target keystore only after the key is destroyed. However, you can deactivate the key or remove the target keystores at any time.
* Sync keys

If the key state in some target keystores is different from the managed key state, you receive a Key out of sync warning message. An Out of sync flag is also displayed in the corresponding keystore card. There can be multiple reasons why the key state is out of sync. For example, you have deactivated the key in this target keystore before, or you activate the key through the CLI and the console doesn't reflect the state timely. When you hover over this flag, you can see the specific reason. You can sync the key state by clicking Sync keys.

During master key rotation, you can activate IBM Cloud KMS key in internal keystores. However, it will be shown as Out of sync. You can sync the key after the master key rotation is complete.
* Create target keystores

Assigning and activating a key in multiple keystores enables redundancy.
The created key is displayed as the first row in the Enterprise PKCS #11 keys table.





 Deleting EP11 keys 

For default service access roles that support deleting EP11 keys, see [service access roles](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-accessservice-access-roles). If you are to create custom roles, make sure to assign the following actions to the custom role:



* hs-crypto.keystore.listkeystoresbyids
* hs-crypto.keystore.listkeysbyids
* hs-crypto.keystore.deletekey



For instructions on creating custom roles, see [Creating custom roles](https://cloud.ibm.com/docs/account?topic=account-custom-roles).

If you want to delete an EP11 key, complete the following steps:

After you delete an EP11 key, you are not able to access the data associated with the key. This action cannot be undone.



1. Select the EP11 keys tab in the side menu, and find the key that you want to delete in the list.
2. Click the Actions icon ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/action-menu-icon.svg) in the key row, and click Delete key.
3. Verify the ID of the key to be deleted, and check the box to confirm the deletion.
4. Click Delete keystore.



If you are performing cryptographic operations using the PKCS #11 API, to delete the key in your PKCS #11 application, reinitialize the PKCS #11 API by using the C_Finalize() and C_Initialize() functions.





 What's next 

You can use EP11 keys for cryptographic operations with the PKCS #11 API. For more information, see
To assign a different name to a referenced key, use the format NAME:NEW_NAME=KEY_A. For example, to add an environment variable named myKey for a single key key1 in a secret that is named secretName, use the value secretName:myKey=key1.



This value is optional.

--env-from-secret-rm, --env-sec-rm
: Remove environment variable references to full secrets by using the secret name. To remove individual key references to secrets, use the --env-rm option. This option can be specified multiple times. This value is optional.

--env-rm
: Remove environment variable references to the key of a key-value pair in a configmap or secret. To remove individual key references and literal values, specify the name of the key. This option can be specified multiple times. This value is optional.

--ephemeral-storage, --es
: The amount of ephemeral storage for this job run. Use M for megabytes or G for gigabytes. This value is optional.

--force, -f
: Do not verify the existence of specified configmap and secret references. Configmap references are specified with the --env-from-configmap option. Secret references are specified with the --env-from-secret option. This value is optional. The default value is false.

--instances, --is
: Specifies the number of instances that are used for this job run. When you use this option, the system converts to array indices. For example, if you specify instances of 5, the system converts to array-indices of 0 - 4. This option can only be specified if the --array-indices option is not specified. This value is optional. The default value is 0.

--maxexecutiontime, --met
: The maximum execution time in seconds for this job run. This option can only be specified if mode is task. This value is optional. The default value is 7200.

--memory, -m
"updatedBy": "user id ...<redacted>...",
"rotation": {
"interval_month": 2
}
}
]





 Required parameters 

KEY_ID
: The ID of the key that you want to query. To retrieve a list of your available keys, run the [kp keys](#kp-keys) command.





 Optional parameters 

-d, --dual-auth
: Show policies that have a dual-auth-delete policy.







 kp key policy-update dual-auth-delete 

You can use Key Protect to safely delete encryption keys by using a dual authorization process. When you delete a key, you shred its contents and associated data. Any data that is encrypted by the key becomes inaccessible.

Deleting a key that has a [dual authorization policy](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-dual-auth) requires an authorization from two users. With the Key Protect API, you can provide the first authorization by [setting the key for deletion](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-dual-auth-keysset-key-deletion-api). Then, a different user provides a second authorization by using the [GUI](https://cloud.ibm.com/login/) or [API](https://cloud.ibm.com/apidocs/key-protect) to delete the key.

ibmcloud kp key policy-update dual-auth-delete KEY_ID
-i, --instance-id INSTANCE_ID
-e, --enable
[-o, --output OUTPUT]



 Example 

This example enables the dual authorization delete policy.

 create a root key
$ KEY_ID=$(ibmcloud kp key create my-root-key --output json | jq -r '.["id"]')

$ echo $KEY_ID
If you delete a root key that a cluster uses, the cluster becomes unusable, loses all its data, and can't be recovered. When you rotate a root key, you can't reuse a previous root key for the same cluster. Similarly, if you disable a root key, operations that rely on reading secrets fail. Unlike deleting a root key, however, you can reenable a disabled key to make your cluster usable again.





 Rotating the root key for your cluster 

To rotate the root key that is used to encrypt your cluster, you can repeat the steps to enable KMS encryption from the [CLI](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkms_cli) or [console](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkms_ui). When you rotate a root key, you can't reuse a previous root key for the same cluster.

You can [rotate the root key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-rotate-keys) from your KMS instance. This action automatically re-enables KMS in your cluster with the new root key. To manually rotate your keys, see your KMS provider docs.



* IBM® Key Protect for IBM Cloud®: See [Rotating your keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-getting-started-tutorialget-started-next-steps-best-practices-key-rotate).
* Hyper Protect Crypto Services: See [Rotating root keys manually](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-rotate-keys).









 Verifying secret encryption 

After you enable a KMS provider in your IBM Cloud Kubernetes Service cluster, you can verify that your cluster secrets are encrypted by disabling the root key. When you disable the root key, the cluster can no longer decrypt the secrets and becomes unusable, which signifies that your secrets were encrypted.

Before you begin
bc459a2f-56cb-445e-b4ee-9d1866b57560 my-test-key-11

 list the last group of keys
$ list_keys 5 15

cc7faf46-43cf-43b2-be98-7d1815371639 my-test-key-8
cf0a3d8b-4856-4aa5-be6a-88cca465eab0 my-test-key-20
df530c55-39c0-44e8-b7db-397593f70d90 my-test-key-3
e9b08526-3227-406c-b83f-c28844bd952b my-test-key-9
f141be88-5a34-4290-8513-4f01d934e75a my-test-key-5

 delete the test keys
$ KEYS=$(ibmcloud kp keys --output json | jq -r '.[] | .id')

$ for KEY_ID in $(echo "${KEYS}"); do
KEY_NAME=$(ibmcloud kp key show $KEY_ID --output json | jq -r '.["name"]')
if [ $KEY_NAME == "my-test-key-" ]]; then
echo "Deleting... $KEY_NAME $KEY_ID"
ibmcloud kp key delete $KEY_ID
fi
done

(output not shown)





 Example 6 

Lists the keys based on key states (Active, Suspended) in the Key Protect instance.

 list active and suspended keys
$ ibmcloud kp keys --key-states active,suspended

Retrieving keys...
OK
Key ID Key Name
ef2cc155-fe56-492c-845c-4d1f0688c7ba my-active-key
"lastUpdateDate": "2020-06-18T20:35:41Z",
"updatedBy": "user id ...<redacted>...",
"rotation": { "interval_month": 2
}
}
]





 Required parameters 



* KEY_ID_OR_ALIAS

The v4 UUID or alias of the key that you want to query. To retrieve a list of your available keys, run the [kp keys](https://cloud.ibm.com/docs/key-protect-cli-pluginkp-keys) command.
* -i, --instance-id

The IBM Cloud instance ID that identifies your Key Protect instance.

You can set an environment variable instead of specifying -i with the following command: $ export KP_INSTANCE_ID=<INSTANCE_ID>.







 Optional parameters 



* -d, --dual-auth

Show policies that have a dual-auth-delete policy.
* -o, --output

Set the CLI output format. By default, all commands print in table format. To change the output format to JSON, use --output json.
* -r, --rotation

Show policies that have a rotation policy.
* --key-ring

A unique, human readable name for the key-ring. Required if the user doesn't have permissions on the default key ring.









 kp key policy-update dual-auth-delete 

You can use Key Protect to safely delete encryption keys by using a dual authorization process. When you delete a key, you shred its contents and associated data. Any data that is encrypted by the key becomes inaccessible.

Deleting a key that has a [dual authorization policy](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-dual-auth) requires an authorization from two users.