vania-janet/multiturn-rag-retrieval-data huggingface dataset:
For example, when you create, import, delete, or read a key in Key Protect, an Activity Tracker event is generated. These events are automatically forwarded to the Activity Tracker service in the same region where the Key Protect service is provisioned.

To find out more, check out [IBM Cloud® Activity Tracker events](https://cloud.ibm.com/docs/key-protect?topic=key-protect-at-events).





 How can I check what data is encrypted by which root key? 

When you use a root key to protect at rest data with envelope encryption, the cloud services that use the key can create a registration between the key and the resource that it protects. Registrations are associations between keys and cloud resources that help you get a full view of which encryption keys protect what data on IBM Cloud.

You can [browse the registrations](https://cloud.ibm.com/docs/key-protect?topic=key-protect-view-protected-resources) that are available for your keys and cloud resources by using the Key Protect APIs.





 What happens when I delete a key? 

In the event that a key is no longer needed or should be removed, Key Protect allows you to delete and ultimately purge keys, an action that shreds the key material and makes any of the data encrypted with it inaccessible.

Deleting a key moves it into a Destroyed state, a "soft" deletion in which the key can still be seen and restored for 30 days. After 90 days, the key will be automatically purged, or "hard deleted", and its associated data will be permanently shredded and removed from the Key Protect service. If it is desirable that a key be purged sooner than 90 days, it is also possible to hard delete a key four hours after it has been moved into the Destroyed state.

After a key has been deleted, any data that is encrypted by the key becomes inaccessible, though this can be reversed if the key is restored within the 30-day time frame. After 30 days, key metadata, registrations, and policies are available for up to 90 days, at which point the key becomes eligible to be purged.
* [Considerations for deleting a key using dual authorization](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-dual-auth-keysdual-auth-deletion-considerations)
* [Authorize deletion for a key with the IBM Cloud console](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-dual-auth-keysset-key-deletion-console)
* [Authorize deletion for a key with the API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-dual-auth-keysset-key-deletion-api)
* [What's next](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-dual-auth-keysdelete-daul-auth-keys-next)



[Setting dual authorization policies for keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-dual-auth-key-policyset-dual-auth-key-policy)



* [Managing dual authorization policies with the key management service API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-dual-auth-key-policymanage-dual-auth-key-policies-api)



[Purging keys manually](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-purge-keyspurge-keys)



* [Purging keys in the console](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-purge-keyspurge-keys-gui)
* [Purging keys with the API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-purge-keyspurge-keys-api)
}'





 Updating your SSH key by using the CLI 

You can update an existing key by using the ibmcloud is key-update command. After you update an existing key, the key is renamed immediately. For more information, see [ibmcloud is key-delete](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-referencekey-delete). You must specify both the current SSH key name by using the KEY variable and the new SSH key name by using the NEW_NAME variable in the --name option.

ibmcloud is key-update KEY [--name NEW_NAME]





 Updating your SSH key by using the API 

To update an existing SSH key by using the API, use [Update a key](https://cloud.ibm.com/apidocs/vpc/latestupdate-key).

For the $id variable, specify the current name of the SSH key. For the name property, specify the new name for the SSH key.

curl -X PATCH "$vpc_api_endpoint/v1/keys/$id?version=2023-03-30&generation=2" -H "Authorization: Bearer $iam_token" -d '{ "name": "my-key-1-updated" }'





 Deleting your SSH key by using the CLI 

To delete one or more SSH keys by using the CLI, use the ibmcloud is key-delete command. For more information, see [ibmcloud is key-delete](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-referencekey-delete). Specify name of each SSH key that you delete by using the KEY variable.

ibmcloud is key-delete (KEY1 KEY2 ...)





 Deleting your SSH key by using the API 

To delete one or more SSH keys by using the API, use [Delete a key](https://cloud.ibm.com/apidocs/vpc/latestdelete-key).
As an admin, you might need to [temporarily disable a root key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-disable-keys) if you suspect a possible security exposure, compromise, or breach with your data. When you disable a root key, you suspend its encrypt and decrypt operations. After confirming that a security risk is no longer active, you can reestablish access to your data by enabling the disabled root key.





 Deleting keys and cryptographic erasure 

Cryptographic erasure (or crypto-shredding) is a method of rendering encrypted data unreadable by [deleting the encryption keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-security-and-compliancedata-deletion) rather than the data itself. When a [root key is deleted in Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-keys), it will affect all objects in any buckets created using that root key, effectively "shredding" the data and preventing any further reading or writing to the buckets. This process is not instantaneous, but occurs within approximatedly 90 seconds after the key is deleted.

Although objects in a crypto-shredded bucket can not be read, and new object can not be written, existing objects will continue to consume storage until they are deleted by a user.





 Restoring a deleted key 

As an admin, you might need to [restore a root key that you imported](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-restore-keys) to Hyper Protect Crypto Services so that you can access data that the key previously protected. When you restore a key, you move the key from the Destroyed to the Active key state, and you restore access to any data that was previously encrypted with the key. This must occur within 30 days of deleting a key.
All root keys and standard keys, whether generated by Hyper Protect Crypto Services or imported by you, can be restored.



 How do I know whether a key can be restored? 

To see whether a destroyed key can be restored:



1. Navigate to your Hyper Protect Crypto Services instance in the IBM Cloud console.
2. In the navigation, make sure you are on the KMS keys page.
3. Find the key that you want to restore and make sure that the key is in a Destroyed state.
4. Check whether an Undo icon ![Undo icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/undo.svg) is displayed next to the Destroyed state. The icon indicates that the key is eligible to be restored. You can restore a key within 30 days after the deletion. The restoration expiration date is displayed when you hover over the icon.







 Restoring a deleted key with the console 

If you prefer to restore your key by using a graphical interface, you can use the IBM Cloud console.

Complete the following steps to restore the key:



1. [Log in to the IBM Cloud console](https://cloud.ibm.com/).
2. Go to Menu > Resource list to view a list of your resources.
3. From your IBM Cloud resource list, select your provisioned instance of Hyper Protect Crypto Services.
4. On the KMS keys page, use the Keys table to browse the keys in your service.
5. Select the key that you want to restore and click the Actions icon ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/action-menu-icon.svg) to open a list of options for the key.
6. From the options menu, click Restore key.
7.
* To resolve the error that is reported in error message 1, [review the resources](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-protected-resources) that are associated with the key before you delete a key.

You can [force deletion on a key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-keysdelete-key-force) that's protecting a cloud resource. However, the action won't succeed if the key's associated resource is nonerasable due to a retention policy. You can verify whether a key is associated with a nonerasable resource by [checking the registration details](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-protected-resourcesview-protected-resources-api) for the key. Then, you must contact an account owner to remove the retention policy on each resource that is associated with the key before you can delete the key.

If you don't need the resources that are associated with the key any more, you can also first delete the associated resources and then delete the key.
* To resolve the error that is reported in error message 2, you need to assign two approvers to delete a key if you enable the dual authorization policy [for your instance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-dual-auth) or [for a key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-dual-auth-key-policy).

The first approver must have a Writer or Manager role to first schedule the key deletion and the second approver must have a Manager role to complete the deletion within 7 days. For more information, see [Deleting keys by using dual authorization](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-dual-auth-keys).
"id": "52a9d772-8982-4620-bfb4-b070dd812a0c"
}

 delete the KMS instance
$ ibmcloud resource service-instance-delete $KMS_NAME --force

 delete the COS instance
$ ibmcloud resource service-instance-delete $COS_NAME --force

 view resources (COS and KMS should no longer exist)
$ ibmcloud resource service-instances

Retrieving instances with type service_instance in resource group Default in all locations under account <account name> as <email address>...
OK
No service instance found.







 Required parameters 

KEY_ID
: The ID of the key that you want to delete. To retrieve a list of your available keys, run the [kp keys](#kp-keys) command.





 Optional parameters 

-f, --force
: Delete a key, with force, which is used to delete a key that has "registrations." Registrations are associations between root keys and other cloud resources, such as Cloud Object Storage (COS) buckets or Cloud Databases deployments.

For more information, see [kp registrations](#kp-registrations)







 kp key disable 

The kp key disable command disables a root key and temporarily revokes access to the key's associated data in the cloud.

As an admin, you might need to temporarily [disable a root key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-disable-keys) if you suspect a possible security exposure, compromise, or breach with your data.

Disabling a root key suspends its encrypt and decrypt operations. After confirming that a security risk is no longer active, you can restore access to your data by [enabling](https://cloud.ibm.com/docs/key-protect?topic=key-protect-cli-reference-five-twokp-key-enable) the disabled root key.
For more information, see [IBM Cloud IAM limits](https://cloud.ibm.com/docs/account?topic=account-known-issues&interface=cliiam_limits).

To delete a service key, run the following command:

ibmcloud resource service-key-delete <NAME>





 Getting the service key by using the CLI 

To get the service key through the command line, complete the following steps:



1. [Pre-requisite] [Install the IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-install-ibmcloud-cli).
2. Log in to the region in the IBM Cloud where the auditing instance is running. Run the following command: [ibmcloud login](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_cliibmcloud_login)
3. Set the resource group where the auditing instance is running. Run the following command: [ibmcloud target](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_cliibmcloud_target)

By default, the default resource group is set.
4. Get the instance name. Run the following command: [ibmcloud resource service-instances](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_resourceibmcloud_resource_service_instances)

ibmcloud resource service-instances
5. Get the name of the key that is associated with the auditing instance. Run the [ibmcloud resource service-keys](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_resourceibmcloud_resource_service_keys) command:

ibmcloud resource service-keys --instance-name <INSTANCE_NAME>

where INSTANCE_NAME is the name of the instance that you obtained in the previous step.
6. Get the IBM Cloud resource service key.
[Settings icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/images/admin.png).
3. Select Organization.
4. Select API keys.

If you have the correct permissions, the available service keys are displayed in the Ingestion Keys section.
5. Delete the key by clicking the X next to the key to be deleted.







 Rotating an ingestion key through the UI 

If the ingestion key is compromised or you have a policy to renew it after a number of days, you can generate a new key and delete the old one.

To renew the ingestion key for an IBM Log Analysis instance by using the IBM Log Analysis Web UI, complete the following steps:



1. [Launch the IBM Log Analysis web UI](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-view_logsview_logs_step2).
2. Click the Settings icon ![Settings icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/images/admin.png) > Organization.
3. Select API keys.

You can see the ingestion keys that are enabled.
4. Select Generate Ingestion Key.

A new key is added to the list.
5. Delete the old ingestion key. Click X next to the ingestion key to be deleted.



After you reset the ingestion key, you must update the ingestion key for any log sources that you have configured to forward logs to this IBM Log Analysis instance.
* To find out more about managing your key list, check out [Viewing a list of keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-key-list).
* To find out instructions on editing a managed key, check out [Editing key details](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-edit-kms-keys).
* To find out instructions on deleting a managed key, check out [Deleting managed keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-managed-keys).
[Actions icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/actions-icon-vertical.svg)> Delete.
6. To confirm the deletion, type the name of the secret. Click Delete.

Your lock is now deleted. To completely unlock the secret, you can remove all existing locks.







 Deleting locks with the API 

You can use the Secrets Manager API to delete one or more locks that are associated with the specific secret version.

A successful request deletes the locks that you specify. To remove all locks, you can pass {"locks": [""]} in the request body. Otherwise, specify the names of the locks that you want to delete. For example, {"locks": ["lock-1", "lock-2"]}.

To understand whether a secret contains locks, check the locks_total field that is returned as part of the metadata of your secret.

curl -X DELETE
-H "Authorization: Bearer {iam_token}" -H "Accept: application/json" "https://{instance_ID}.{region}.secrets-manager.appdomain.cloud/api/v2/secrets/{secret_id}/versions/{id}/locks_bulk?name=[ "lock-example-1" ]"

For more information about the required and optional request parameters, see the [API reference](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2unlock-secret).
* Go
* Node



curl -X DELETE 'https://iam.cloud.ibm.com/v1/apikeys/APIKEY_UNIQUE_ID' -H 'Authorization: Bearer TOKEN' -H 'Content-Type: application/json'

DeleteApiKeyOptions deleteApiKeyOptions = new DeleteApiKeyOptions.Builder()
.id(apikeyId)
.build();

service.deleteApiKey(deleteApiKeyOptions).execute();

delete_api_key(self,
id: str,
kwargs
) -> DetailedResponse

response = iam_identity_service.delete_api_key(id=apikey_id)

print(response)

deleteAPIKeyOptions := iamIdentityService.NewDeleteAPIKeyOptions(apikeyID)

response, err := iamIdentityService.DeleteAPIKey(deleteAPIKeyOptions)
if err != nil {
panic(err)
}

const params = {
id: apikeyId,
};

iamIdentityService.deleteApiKey(params)
.then(res => {
console.log(JSON.stringify(res.result, null, 2));
})
.catch(err => {
console.warn(err);
});





 Before you begin 

Before you can manage user API keys by using Terraform, make sure that you have completed the following:



* Install the Terraform CLI and configure the IBM Cloud Provider plug-in for Terraform. For more information, see the tutorial for [Getting started with Terraform on IBM Cloud®](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-getting-started).
To retrieve a list of your available keys, run the [kp keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-keys) command.







 Optional parameters 



* -m, --monthly-interval

Set the key rotation interval in months. The rotation interval must be 1 to 12 months.
* -e, --enable or -d, --disable

By default, key rotation policy is enabled. If user wants to disable or enable the policy, they can use -d(--disable) or -e(--enable) respectively.
* -o, --output

Set the CLI output format. By default, all commands print in table format. To change the output format to JSON, use --output json.
* --key-ring

A unique, human readable name for the key-ring. Required if the user doesn't have permissions on the default key ring.









 kp key restore 

Key Protect can restore a previously deleted root key, which restores access to its associated data in the cloud.

As an admin, you might need to restore a root key that was imported into Key Protect to access data the key previously protected.

When you restore a key, you move the key from the Destroyed (value is 5) to the Active (value is 1) key state, and you restore access to any data that was previously encrypted with the key.

You can restore a deleted key within 30 days of its deletion. This capability is available only for root keys that were created with a key material.

You can only restore root keys that were created with a key material, using kp key create with the -k, --key-material option. You cannot restore a root key if the --key-material option was not specified.

If you want to restore a deleted root key then you must save the key material that was used to create the root key. You cannot restore a deleted key without provided the original key material.

ibmcloud kp key restore KEY_ID_OR_ALIAS
-i, --instance-id INSTANCE_ID
To learn how IAM roles map to Key Protect service actions, check out [Service access roles](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-accessmanage-access-roles).
2. Copy the ID of the key that you want to unset or deauthorize for deletion.
3. Remove an existing authorization to delete the key.

$ curl -X POST "https://<region>.kms.cloud.ibm.com/api/v2/keys/<keyID_or_alias>/actions/unsetKeyForDeletion" -H "accept: application/vnd.ibm.kms.key_action+json" -H "authorization: Bearer <IAM_token>" -H "bluemix-instance: <instance_ID>" -H "content-type: application/vnd.ibm.kms.key_action+json"

Replace the variables in the example request according to the following table.





Table 5. Describes the variables that are needed to unset a key for deletion.

 Variable Description 

 region Required. The region abbreviation, such as us-southor eu-gb, that represents the geographic area where your Key Protect instance resides. <br>For more information, see [Regional service endpoints](https://cloud.ibm.com/docs/key-protect?topic=key-protect-regionsservice-endpoints). 
 key_ID_or_alias Required. The unique identifier or alias for the root key that you want to rotate. 
 IAM_token Required. Your IBM Cloud access token. Include the full contents of the IAM token, including the Bearer value, in the curl request. <br> <br>For more information, see [Retrieving an access token](https://cloud.ibm.com/docs/key-protect?topic=key-protect-retrieve-access-token). 
 instance_ID Required. The unique identifier that is assigned to your Key Protect service instance.
[Filter icon](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc//images/filter-icon.png) to see more information.
5. Under States, click the down arrow to display all key states.
6. Select Deleted.



The list of root keys is refreshed, and shows all root keys in a deleted key state. The most recently deleted key is at the first of the list.

To restore a root key:



1. Click Actions(![Actions icon](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc//images/overflow.png)).
2. Select Restore key.



To complete the key restoration process, you need the key ID that was associated with the key and the original key material that you imported.

You also need to create volume attachments for your data volumes. The volume attachment IDs are different than before you deleted the root key.

For more information about restoring root keys in a KMS instance, see the following topics.



* [Key Protect - Restoring keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-restore-keys)
* [Hyper Protect Crypto Services - Restoring keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-restore-keys)







 Manage root keys in the UI 

You can use the UI to disable, enable, delete, or restore your root keys. Table 5 describes each action and links to detailed steps for Key Protect and Hyper Protect Crypto Services.
"lastUpdateDate": "2020-06-09T21:23:26Z",
"keyVersion": {
"id": "264fadc3-7667-4b25-916e-5825fe70de0b",
"creationDate": "2020-06-09T21:21:55Z"
},
"extractable": false,
"state": 2,
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:390086ac-76fa-4094-8cf3-c0829bd69526:key:264fadc3-7667-4b25-916e-5825fe70de0b"
}







 Required parameters 



* KEY_ID_OR_ALIAS

The v4 UUID or alias of the key that you want to delete. To retrieve a list of your available keys, run the [kp keys](https://cloud.ibm.com/docs/key-protect-cli-plugin?topic=key-protect-cli-plugin-key-protect-cli-referencekp-keys) command.
* -i, --instance-id

The IBM Cloud instance ID that identifies your Key Protect instance.

You can set an environment variable instead of specifying -i with the following command: $ export KP_INSTANCE_ID=<INSTANCE_ID>.







 Optional parameters 



* --key-ring

A unique, human readable name for the key-ring. Required if the user doesn't have permissions on the default key ring.









 kp key enable 

When you enable a root key that was previously disabled, the key transitions from the Suspended (value is 2) to the Active (value is 1) key state. This action restores the key's encrypt and decrypt operations.