vania-janet/multiturn-rag-retrieval-data huggingface dataset:
When you change the Active key to Deactivated state, the key is detached from all the target keystores, and not accessible to all associated resources and their data. Make sure that you open the confirmation tile to check all the associated resources before you continue. However, you can still reactivate the key so that it is accessible to the resources again.
4. To destroy a Pre-active or Deactivated key, click the Actions icon ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/action-menu-icon.svg) and choose Destroyed.

When you destroy a managed key, the key cannot be restored in Unified Key Orchestrator. However, you can still restore your keys in external keystores depending on the settings of the cloud providers. For more information, see [Azure Key Vault soft-delete overview](https://docs.microsoft.com/en-us/azure/key-vault/general/soft-delete-overview), [Deleting AWS KMS keys](https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html), or [Deleting and purging keys in Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-purge-keys).
5. Click Destroy key to confirm.
6. To remove the key and the metadata from the vault, click the Actions icon ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/action-menu-icon.svg) and choose Remove from vault.

When you remove the managed key from the vault that the key is assigned to, the remaining key metadata is removed permanently.



The managed key has been deleted and detached from all target keystores.
b70f62a1-4d52-4526-91a9-ce47bf14c2a5 my-test-key-1
b8794334-eea6-4c0d-8fe1-8086300b13f7 my-test-key-6
bc459a2f-56cb-445e-b4ee-9d1866b57560 my-test-key-11

 list the last group of keys
$ list_keys 5 15

cc7faf46-43cf-43b2-be98-7d1815371639 my-test-key-8
cf0a3d8b-4856-4aa5-be6a-88cca465eab0 my-test-key-20
df530c55-39c0-44e8-b7db-397593f70d90 my-test-key-3
e9b08526-3227-406c-b83f-c28844bd952b my-test-key-9
f141be88-5a34-4290-8513-4f01d934e75a my-test-key-5

 delete the test keys
$ KEYS=$(ibmcloud kp keys --output json | jq -r '.[] | .id')

$ for KEY_ID in $(echo "${KEYS}"); do
KEY_NAME=$(ibmcloud kp key show $KEY_ID --output json | jq -r '.["name"]')
if [ $KEY_NAME == "my-test-key-" ]]; then
echo "Deleting... $KEY_NAME $KEY_ID"
ibmcloud kp key delete $KEY_ID
fi
done

(output not shown)





 Example 6 

Lists the keys based on key states (Active, Suspended) in the Key Protect instance.

 list active and suspended keys
(https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-troubleshoot-unable-to-create-keystroubleshoot-unable-to-create-keys)

[Why can't I delete an initialized service instance?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-troubleshoot-delete-instancetroubleshoot-delete-instance)

[Why can't I delete keys?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-troubleshoot-unable-to-delete-keystroubleshoot-unable-to-delete-keys)

[Why can't I perform any actions by using the IBM Cloud console?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-troubleshoot-ui-session-timeouttroubleshoot-ui-session-timeout)

[Why can't I rotate root keys?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-troubleshoot-unable-to-rotate-root-keystroubleshoot-unable-to-rotate-root-keys)

[Why can't I view or list keys?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-troubleshoot-unable-to-list-keys-apitroubleshoot-unable-to-list-keys-api)

[Why can't I view or list specific keys?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-troubleshoot-unable-to-list-specific-keystroubleshoot-unable-to-list-specific-keys)





 Troubleshooting master key rotation 

[Why can't I rotate master keys by using key part files?]
87679194-52d0-42af-81e1-bffd64f87315 my-test-key-7
90138be5-1dd1-4eea-b7c1-73cc8609e7f7 my-test-key-19
b70f62a1-4d52-4526-91a9-ce47bf14c2a5 my-test-key-1
b8794334-eea6-4c0d-8fe1-8086300b13f7 my-test-key-6
bc459a2f-56cb-445e-b4ee-9d1866b57560 my-test-key-11

 list the last group of keys
$ list_keys 5 15

cc7faf46-43cf-43b2-be98-7d1815371639 my-test-key-8
cf0a3d8b-4856-4aa5-be6a-88cca465eab0 my-test-key-20
df530c55-39c0-44e8-b7db-397593f70d90 my-test-key-3
e9b08526-3227-406c-b83f-c28844bd952b my-test-key-9
f141be88-5a34-4290-8513-4f01d934e75a my-test-key-5

 delete the test keys
$ KEYS=$(ibmcloud kp keys --output json | jq -r '.[] | .id')

$ for KEY_ID in $(echo "${KEYS}"); do
KEY_NAME=$(ibmcloud kp key show $KEY_ID --output json | jq -r '.["name"]')
if [ $KEY_NAME == "my-test-key-" ]]; then
echo "Deleting...
What's next 



* To restore a previously deleted key, check out [Restoring keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-restore-keys).
* To create another root key, check out [Creating root keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-root-keys).
* To delete the service instance, check out [Deleting service instances](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-instance)
* To find out more about programmatically managing your keys, [check out the Hyper Protect Crypto Services key management service API reference doc](https://cloud.ibm.com/apidocs/hs-crypto).
This process is commonly referred to as Bring Your Own Key (BYOK). With Key Protect and Hyper Protect Crypto Services, you can create, import, and manage encryption keys. You can assign access policies to the keys, assign users or service IDs to the keys, or give the key access only to a specific service.

For more information, see [Managing encryption](https://cloud.ibm.com/docs/app-configuration?topic=app-configuration-ac-managing-encryption).





 How can I delete my information? 

When you delete an instance of App Configuration, all of the associated data is also deleted. When the service instance is deleted, a 7-day reclamation period begins. During that time, you are able to restore the instance and all of the associated user data. However, if the instance and data are permanently deleted, it cannot be restored. App Configuration does not store any data from permanently deleted instances.

The App Configuration data retention policy describes how long your data is stored after you delete the service. The data retention policy is included in the App Configuration service description, which you can find in the [IBM Cloud Terms and Notices](https://cloud.ibm.com/docs/overview?topic=overview-terms).



 Deleting an instance 

If you no longer need an instance of App Configuration, you can delete the service instance and any data that is stored using ibmcloud CLI. You can also choose to delete your service instance by using the console.

To restore a deleted instance or to delete the instance permanently you can use Resource Reclamations. Refer to [Using resource reclamations](https://cloud.ibm.com/docs/account?topic=account-resource-reclamation) to know more on the resource reclamation.
You must also have at least Viewer access for the Secrets Manager service.



1. Go to Manage > Access IAM > Authorizations.
2. Select the Secrets Manager service as the source service.
3. Select the instance of the Key Protect or Hyper Protect Crypto Services as the target service.
4. Select the key that you created in the previous steps.
5. Assign the Reader role.
6. Click Authorize to confirm the authorization.



If you choose to [delete your Secrets Manager instance later](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-mng-dataservice-delete), this authorization is also deleted by IAM.
4. Create an instance of the Secrets Manager service.



1. Select the region that corresponds to the region for the instance of the key management service that you created previously.
2. Select your Key Protect or Hyper Protect Crypto Services instance.
3. Select the Root key that you previously authorized.
4. Click Create.











 Deleting your data in Secrets Manager 

When you delete your instance of Secrets Manager, all the user data that is associated with it is also deleted. When the service instance is deleted, a 7-day reclamation period begins. During that time, you're able to restore the instance and all of its associated user data. However, if the instance and data are permanently deleted, it can no longer be restored. Secrets Manager does not store any data from permanently deleted instances.

If your instance was automatically deleted as part of the release of new pricing plans, you can use the reclamation process to restore it. After it is restored, you must upgrade your plan within 1 hour or it will be deleted again.

The Secrets Manager data retention policy describes how long your data is stored after you delete the service. The data retention policy is included in the Secrets Manager service description, which you can find in the [IBM Cloud Terms and Notices](https://cloud.ibm.com/docs/overview?topic=overview-terms).



 Deleting a Secrets Manager instance
Deleting key: 6a8a129b-0cd4-4667-ba57-b355a125a7ca, from instance: a192d603-0b8d-452f-aac3-f9e1f95e7411...
FAILED
kp.Error:
correlation_id='8ad33eb2-7bbf-4b7a-a02e-221959920342',
msg='Conflict: 1 prior authorization(s) are required for deletion: Key could not be deleted. Please see "reasons" for more details.',
reasons='[AUTHORIZATIONS_NOT_MET: Number of authorizations required to delete is not met -
FOR_MORE_INFO_REFER: https://cloud.ibm.com/apidocs/key-protect]'

 disable the instance dual authorization policy
$ ibmcloud kp instance policy-update dual-auth-delete --disable

Updating instance policy...
OK

 attempt to delete the key - this fails because the key policy
 does not change when the instance policy is updated
$ ibmcloud kp key delete 6a8a129b-0cd4-4667-ba57-b355a125a7ca

Deleting key: 6a8a129b-0cd4-4667-ba57-b355a125a7ca, from instance: a192d603-0b8d-452f-aac3-f9e1f95e7411...
FAILED
kp.Error:
correlation_id='cbc0d18b-a816-45ab-af6a-b8e18dc3e628',
msg='Conflict: 1 prior authorization(s) are required for deletion: Key could not be deleted. Please see "reasons" for more details.',
reasons='[AUTHORIZATIONS_NOT_MET: Number of authorizations required to delete is not met -
Deleting key: 52a9d772-8982-4620-bfb4-b070dd812a0c, from instance: b0d84b32-09d0-4314-8049-da78e3b9ab6f...
FAILED
kp.Error:
correlation_id='c27b7948-4a1f-4cbd-8770-cb3616888e27',
msg='Conflict: Key could not be deleted. Please see "reasons" for more details.',
reasons='[PROTECTED_RESOURCE_ERR: Key is protecting one or more cloud resources -
FOR_MORE_INFO_REFER: https://cloud.ibm.com/docs/key-protect?topic=key-protect-troubleshootingunable-to-delete-keys]'

 delete the KP root key; use --force because the registration between COS and KMS still exists
$ ibmcloud kp key delete $MY_COS_KEY_ID --force --output json

{
"id": "52a9d772-8982-4620-bfb4-b070dd812a0c"
}

 delete the KMS instance
$ ibmcloud resource service-instance-delete $KMS_NAME --force

 delete the COS instance
$ ibmcloud resource service-instance-delete $COS_NAME --force

 view resources (COS and KMS should no longer exist)
$ ibmcloud resource service-instances

Retrieving instances with type service_instance in resource group Default in all locations under account <account name> as <email address>...
OK
No service instance found.







 Required parameters 



* KEY_ID_OR_ALIAS

The v4 UUID or alias of the key that you want to delete.
Undelete a key-value secret 

Restore a previously deleted version of a key-value secret.

vault kv undelete [-versions=VERSIONS] [-format=FORMAT] ibmcloud/kv/SECRET_NAME

Restore a previously deleted version of a key-value secret in a custom group.

vault kv undelete [-versions=VERSIONS] [-format=FORMAT] ibmcloud/kv/GROUP_ID/SECRET_NAME



 Prerequisites 

You need the [Manager service role](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam) to restore secrets.





 Command options 

-versions
: The versions that you want to delete.

-format
: Prints the output in the format that you specify. Valid formats are table, json, and yaml. The default is table. You can also set the output format by using the VAULT_FORMAT environment variable.





 Example 

Undelete specified versions of a key-value secret.

vault kv undelete -versions=2 ibmcloud/kv/my-test-kv-secret

Undelete specified versions of a key-value secret.

vault kv undelete -versions=2 ibmcloud/kv/9426e546-83de-4da5-9631-d70c993186c8/my-test-kv-secret





 Output 

The command to undelete specified versions of a kv secret returns the following output:

Success! Data written to: ibmcloud/kv/undelete/my-test-kv-secret







 Destroy versions of a secret 

Destroy specified versions of a key-value secret permanently. To soft delete versions of a secret instead, use the [delete specified versions](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-vault-manage-kv-cli&interface=uikv-delete-versions-cli) command.

vault kv destroy [-versions=VERSIONS] [-format=FORMAT] ibmcloud/kv/SECRET_NAME

Destroy the specified versions of a key-value secret in a custom group.
For more information about deleting keys, check out [About deleting and purging keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-purge-keys).





 How many key versions do you have? 

To see how many versions you have of each key you have deployed:



1. [Log in to the IBM Cloud console](https://cloud.ibm.com/login/).
2. Go to Menu > Resource List to view a list of your resources.
3. From your IBM Cloud resource list, select your provisioned instance of Key Protect.
4. On the Keys panel, click the ⋯ icon and select Key details. This opens a side panel that shows, among other things, the number of versions of this key you have.
5. Repeat this process for every key in your instance. Note that because only root keys can be rotated, all of your standard keys only have one version.
2. Select IBM Cloud API keys.
3. Click Create an IBM Cloud API key.
4. Give your key a name and describe it. Click Create. A screen displays with your key.
5. Click Copy or Download your key. When you close the screen, you can no longer access the key.
6. Make the following cURL request with the API key that you created.

curl -k -X POST --header "Content-Type: application/x-www-form-urlencoded" --header "Accept: application/json" --data-urlencode "grant_type=urn:ibm:params:oauth:grant-type:apikey" --data-urlencode "apikey=<apikey>" "https://iam.cloud.ibm.com/identity/token"



4. Make a PUT request to either the /users endpoint.

curl -X PUT "https://<region>.appid.cloud.ibm.com/management/v4/<tenantID>/users/<userID>/profile" -H "accept: application/json" -H "Content-Type: application/json" -H "authorization: Bearer <token>"
-d "{ "attributes": { "points": "150" } { "role": "admin" }}"







 Deleting a profile with the UI 

As an administrator, you can remove someone as a user of your application by deleting their profile.



1. Navigate to the User Profiles > Profiles tab of your App ID instance.
2. Look through the table or search by using an email address to find the user that you want to see the information for. The search term must be exact.
3. In the overflow menu of the user's row, click Delete. A confirmation screen opens.
4. Verify that you're deleting the correct user by checking their email against the one displayed. If it is the correct user, click Delete. This action cannot be undone.
https://uko.<region>.hs-crypto.cloud.ibm.com:<port>/api/v4/managed_keys

The managed key is to be activated in all keystores in the keystore group that is defined in the key template.

For detailed instructions and code examples about using the API method, check out the [Hyper Protect Crypto Services Unified Key Orchestrator API reference doc](https://cloud.ibm.com/apidocs/ukocreate-managed-key).







 What's next 



* To find out instructions on editing a managed key, check out [Editing key details](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-edit-kms-keys).
* To find out more about managing your key list, check out [Viewing a list of keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-key-list) or [Filtering and searching keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-search-key-list).
* To find out instructions on deleting a managed key, check out [Deleting managed keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-managed-keys).
Considerations before you delete and purge a key 

Hyper Protect Crypto Services blocks the deletion of any key that is actively protecting any registered cloud resources. Before you delete a key, bare the following considerations in mind:



1. [Review the registered IBM resources](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-protected-resources) that are associated with the key. If needed, you can [force deletion on a key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-keysdelete-key-force) that protects a registered cloud resource. However, the action can't succeed if the associated resource is not erasable because of a [retention policy](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-immutableimmutable-terminology-policy). The policy is a WORM (Write-Once-Read-Many) policy that is set on the customer's relevant cloud resource.
2. Verify whether a key has a retention policy by checking the preventKeyDeletion field of the [registration details](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-protected-resourcesview-protected-resources-api) for the key. You must then contact an account owner to remove the retention policy on each resource that is associated with the key before you can delete the key.
3. Verify the deletion authorization policy of the key. By default, keys in Hyper Protect Crypto Services require only a single deletion authorization by one user with the Manager role. However, if a [dual authorization policy is set](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-dual-auth-key-policy), two users with the Manager role are needed to approve the deletion.
4. Make sure that you are assigned the KMS Key Purge role if you want to purge a key manually.
* UI
* API







 Deleting vaults 

You can delete your vaults in Unified Key Orchestrator with the IBM Cloud® console, or programmatically with the Unified Key Orchestrator API.

If you want to delete a vault, you need to delete all managed keys, and delete or disconnect from all target keystores that are managed in the vault first. The Delete function is available for empty vaults only. For detailed instructions, see [Deleting managed keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-keys), [Deleting internal keystores](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-internal-keystores), and [Disconnecting from external keystores](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-disconnect-external-keystores).



 Deleting vaults with the IBM Cloud console 

By deleting a vault, access groups that are assigned to this vault can no longer access the vault.

To delete a vault by using the console, complete the following steps:



1. [Log in to the Hyper Protect Crypto Services instance](https://cloud.ibm.com/login).
2. Click Vaults from the navigation to view all the available vaults.
3. Click the vault that you want to delete. The Details side panel is displayed.
4. Make sure that the vault does not contain any keys or keystores, and then click Delete.
5. Click Delete vault to confirm the deletion.



The vault has been deleted and removed from the vault list. Access groups that are assigned to this vault no longer have access to the vault.





 Deleting vaults with the API 

To delete a vault through the API, follow these steps:



1.
"algorithm": "aes",
"verification_patterns": [
{
"method": "enc-zero",
"value": "DDFA4A"
}
],
"activation_date": "2027-04-18",
"expiration_date": "2028-06-29",
"tags": [
{
"name": "first-tag",
"value": "for-ibm"
}
],
"created_at": "2022-03-09T11:26:01Z",
"updated_at": "2022-03-09T11:26:04Z",
"created_by": "IBMid-1308197YB4",
"updated_by": "IBMid-1308197YB4",
"referenced_keystores": [],
"instances": [
{
"id": "ea7b6b27-d71b-4fe9-bbfe-309c7ca713a6",
"label_in_keystore": "IBM CLOUD KEY",
"type": "secret_key",
"keystore": {
"group": "Production",
"type": "ibm_cloud_kms"
}
}
],
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/managed_keys/3dab42dc-6941-4841-8d27-4dabcc5aa09e"
}







 hpcs uko managed-key-delete 

Delete a managed key by key ID from the vault. Make sure that the key is in a Destroyed state before you run this command.

ibmcloud hpcs uko managed-key-delete --id ID --uko-vault UKO-VAULT --if-match IF-MATCH



* Command options
Complete the following steps to delete a key from the directory where you have the terraform script that you use to create the key:



1. Initialize the Terraform CLI.

./terraform init
2. Create a Terraform execution plan.

./terraform plan
3. Create the resources.

./terraform destroy









 Troubleshooting 



 Failed to query available provider packages 

If you get the following error:

Error: Failed to query available provider packages
│
│ Could not retrieve the list of available versions for provider logdna/logdna: locked provider
│ registry.terraform.io/logdna/logdna 1.7.0 does not match configured version constraint 1.10.5;
│ must use terraform init -upgrade to allow selection of new versions

Run the following command:

terraform init -upgrade
console.warn(err);
});





 Unlocking an API key 

To unlock an API key by using the API, call the [IAM Identity Service API](https://cloud.ibm.com/apidocs/iam-identity-token-api?code=gounlock-api-key) as shown in the following example:



* Curl
* Java
* Python
* Go
* Node



curl -X DELETE 'https://iam.cloud.ibm.com/v1/apikeys/APIKEY_UNIQUE_ID/lock' -H 'Authorization: Bearer TOKEN' -H 'Content-Type: application/json'

UnlockApiKeyOptions unlockApiKeyOptions = new UnlockApiKeyOptions.Builder()
.id(apikeyId)
.build();

service.unlockApiKey(unlockApiKeyOptions).execute();

response = iam_identity_service.unlock_api_key(id=apikey_id)

print(response)

unlockAPIKeyOptions := iamIdentityService.NewUnlockAPIKeyOptions(apikeyID)

response, err := iamIdentityService.UnlockAPIKey(unlockAPIKeyOptions)
if err != nil {
panic(err)
}

const params = {
id: apikeyId,
};

iamIdentityService.unlockApiKey(params)
.then(res => {
console.log(JSON.stringify(res.result, null, 2));
})
.catch(err => {
console.warn(err);
});







 Deleting an API key 

If you are using a key rotation strategy, you might want to delete an older key and replace it with a new key.

To delete an API key, complete the following steps:



1. In the IBM Cloud console, go to Manage > Access (IAM) > API keys.
2.