vania-janet/multiturn-rag-retrieval-data huggingface dataset:
(https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-troubleshoot-unauthorized-tokentroubleshoot-unauthorized-token)

[Why can't I change signature thresholds?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-troubleshoot-unable-to-change-signature-thresholdstroubleshoot-unable-to-change-signature-thresholds)

[Why can't I list crypto units?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-troubleshoot-list-crypto-unitstroubleshoot-list-crypto-units)





 Troubleshooting Unified Key Orchestrator 

[Why can't I assign keys to Azure Key Vault?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-troubleshoot-import-azure-keytroubleshoot-import-azure-key)

[Why can't I create internal keystores?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-troubleshoot-create-internal-keystorestroubleshoot-create-internal-keystores)

[Why can't I create vaults?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-troubleshoot-create-vaulttroubleshoot-create-vault)

[Why can't I delete vaults?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-troubleshoot-delete-vaulttroubleshoot-delete-vault)

[Why can't I delete internal keystores?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-troubleshoot-delete-keystoretroubleshoot-delete-keystore)

[Why do I fail to see the changes to my key in Azure Key Vault?]
reasons='[KEY_ACTION_INVALID_STATE_ERR: Key is not in a valid state -
FOR_MORE_INFO_REFER: https://cloud.ibm.com/apidocs/key-protect]'





 Example 3 

Create a root key with an alias, use that alias to identify the key to be disabled, verify the key state (suspended), then enable the root key and verify the new key state (active).

 create a root key
$ ibmcloud kp key create root-key-with-alias -a example-alias-1 --output json

{
"id": "264fadc3-7667-4b25-916e-5825fe70de0b",
"name": "root-key-with-alias",
"type": "application/vnd.ibm.kms.key+json",
"extractable": false,
"state": 1,
"aliases": [
"example-alias"
],
"deleted": false,
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:390086ac-76fa-4094-8cf3-c0829bd69526:key:264fadc3-7667-4b25-916e-5825fe70de0b"
}

 show key details using the alias as identifier - a state of "1" is "active"
$ ibmcloud kp key show example-alias-1 --output json

{
"id": "264fadc3-7667-4b25-916e-5825fe70de0b",
"name": "root-key-with-alias",
"type": "application/vnd.ibm.kms.key+json",
"algorithmType": "AES",
* Signature is invalid [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-invalid-sig-exp-err-message)
* The provided ciphertext is invalid or corrupted - [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-unprocessable-ciphertext-err)
* This request requires that the key version is later than current registration key version - [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-key-version-invalid)







 HTTP 500 - Internal Server Error 



* Key metadata became corrupted: Please delete this key - [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-incomplete-metadata-err)









 Sorted by reason code 

This section sorts error messages by the reason code.



* AUTHORIZATIONS_NOT_MET - [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-authorizations-not-met)
* BAD_BODY_ERR - [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-bad-body-err)
* BEARER_SUB_EXTRACTION_ERR - [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-bearer-sub-extraction-err)
* BODY_QUERY_PARAM_MISMATCH_ERR - [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-body-query-param-mismatch-err)
(https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-support-maintenancefaq-routine-maintenance)
* [How do I get support for Hyper Protect Crypto Services?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-support-maintenancefaq-hpcs-support)







 Troubleshooting key management service 

[Why am I not authorized to make key management service API request?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-troubleshoot-unable-to-authenticate-apitroubleshoot-unable-to-authenticate-api)

[Why am I receiving a CKR_IBM_WK_NOT_INITIALIZED error when I use CLI or API?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-troubleshoot-error-CLI-APItroubleshoot-error-CLI-API)

[Why can't I create a standard key after I load another master key?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-troubleshoot-unable-to-create-standard-keystroubleshoot-unable-to-create-standard-keys)

[Why can't I create or import keys?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-troubleshoot-unable-to-create-keystroubleshoot-unable-to-create-keys)

[Why can't I delete an initialized service instance?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-troubleshoot-delete-instancetroubleshoot-delete-instance)

[Why can't I delete keys?]
You can't delete a block storage volume by name or ID.

 Why it’s happening 

The volume name and ID are not accepted.

 How to fix it 

Verify that the volume name or identifier is correct and that the volume is not attached to a virtual server instance. Also, verify that the volume is not in a pending state.





 Expandable volume remains in an updating state when an attempt is made to delete an instance 

 What’s happening 

When you attempt to delete a virtual server instance with an attached volume that is being resized, the volume remains in an updating state and can't be deleted.

 Why it’s happening 

A volume is being resized and you tried to delete the instance that the volume is attached to, either manually or by auto-delete. The status of the volume remains updating and the volume isn't deleted with the instance.

 How to fix it 

A volume must be in an available state for operations such as attach, detach, delete. When you are expanding a volume, wait for the volume resize to complete before you perform any operations. If you try to delete a volume that's resizing, the volume remains in an updating state and is not deleted with the instance. To delete the volume, reattach the volume to a different instance, and make sure that the resizing is complete (volume status becomes available), and then delete the volume.





 Removing IAM authorization from the storage service to the KMS causes root key deregistration failure 

 What’s happening 

The root keys in the Key management service (KMS) instance remain registered to the deleted block storage volume or image resources.

 Why it’s happening 

If you remove IAM authorization from Cloud Block Storage to the KMS before you delete all BYOK volumes or images, the root key fails to unregister from the resource.

 How to fix it 

As best practice, delete all storage or image resources before you remove IAM authorization. If you already removed authorization, you must restore the IAM authorization between Cloud Block Storage (source service) and your KMS (target service).
* ECDHE-ECDSA-AES128-SHA256
* ECDHE-ECDSA-AES256-SHA384
* ECDHE-RSA-AES128-SHA256
* ECDHE-RSA-AES256-SHA384



* TLS 1.3:



* TLS_AES_256_GCM_SHA384
* TLS_AES_128_GCM_SHA256
* TLS_CHACHA20_POLY1305_SHA256





If you attempt to use a cipher that is not on this list, you may experience connectivity issues. Update your client to use one of the supported ciphers. If you are using openssl, you can use the command openssl ciphers -v at the command line (or, for some installations of openssl, use the -s -v options) to show a verbose list of what ciphers your client supports.





 Data deletion 

When you delete a key, the service marks the key as deleted, and the key transitions to the Destroyed state. Keys in this state can no longer decrypt data that is associated with the key. Therefore, before you delete a key, review the data that is associated with the key and ensure that you no longer require access to it. Do not delete a key that is actively protecting data in your production environments.

If a key is deleted in error, it is possible to restore the key within 30 days of the key being deleted. After 30 days, the key can no longer be restored. For more information, check out [Restoring keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-restore-keys).

Note that even if the key is not restored, your data remains in those services in its encrypted form. Metadata that is associated with a key, such as the key's transition history and name, is kept in the Key Protect database.
Time from key deletion Name of key state Can view/access key data? Can restore? 

 One-30 days Destroyed Yes Yes 
 30-90 days Destroyed Yes No 
 After 90 days Purged* No No 



Note: because purged keys are completely inaccessible and "destroyed" in the common usage of the word, there is technically no "purged" key state. Purged keys are simply gone and therefore don't have a "state" one way or another. However, it can be useful to think of "purged" as being a state because nonexistence is part of the lifecycle of a key. If you need to purge a key sooner than 90 days, it requires a special key purging role. For more information, check out [Deleting keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-keys).

All keys, whether created in Key Protect or imported, and whether it is a root or standard key, can be restored.

For more information about key states, check out [Monitoring the lifecycle of encryption keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-states).



 How do I know whether a key can be restored? 

To see whether a destroyed key can be restored:



1. Navigate to your Key Protect instance in the IBM Cloud console.
2. In the left navigation, make sure you are on the Keys screen.
3. Find the key you want to restore. Note: only keys in a Destroyed state can be restored.
4. Under the Last updated column, note the date. Then refer to Table 1, which can be found above. If the key has been deleted within the last 30 days, it can be restored. If it has been more then 30 days, you will not be able to restore the key. If you attempt to restore a key that is no longer eligible to be restored, you will receive an error when trying to restore the key.







 Restoring a deleted key with the console 

If you prefer to restore your key by using a graphical interface, you can use the IBM Cloud console.
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/managed_keys/3dab42dc-6941-4841-8d27-4dabcc5aa09e"
}







 hpcs uko managed-key-destroy 

Destroy a managed key and perform key destruction operations on keystores in the keystore group associated with the managed key. This operation cannot be undone. Make sure that the managed key is in a deactivated state before you run this command.

ibmcloud hpcs uko managed-key-destroy --id ID --uko-vault UKO-VAULT --if-match IF-MATCH



* Command options

--id (string)
: Required. The UUID of the key. You can use the ibmcloud hpcs uko managed-keys command to retrieve the key UUID.

--uko-vault (string)
: Required. The UUID of the vault where the update is to take place. You can use the ibmcloud hpcs uko vaults command to retrieve the vault UUID.

--if-match (string)
: Required. The precondition of the update, which is the value of the ETag from the header on a GET request. You can use the ibmcloud hpcs uko managed-key command to retrieve the ETag.
* Example

ibmcloud hpcs uko managed-key-destroy 
--id=21a7498e-2ae4-47ee-85ac-a19bf64e92fa 
--uko-vault=eb66ebbd-7230-4cde-89bf-17282cda5faa 
--if-match=2022-05-27T10:14:13Z 
--output json
* Output

The command returns the output similar to the following example:

ETag
2022-05-27T10:15:38Z
{
msg='Bad Request:
Key could not be restored.
Please see reasons for more details.',
reasons='[KEY_IMPT_REQ_ERR:
Only imported keys may be restored. -
FOR_MORE_INFO_REFER: https://cloud.ibm.com/apidocs/key-protect]'

 step 5 - this API request fails because you can only restore keys
 that were imported (created with a key material or an import token)
$ curl -X POST "https://us-south.kms.cloud.ibm.com/api/v2/keys/$KEY_ID/restore" -H "authorization: Bearer $ACCESS_TOKEN" -H "bluemix-instance: $KP_INSTANCE_ID" -H "content-type: application/vnd.ibm.kms.key_action+json" -d '{
"metadata": {
"collectionType": "application/vnd.ibm.kms.key+json",
"collectionTotal": 1
},
"resources": [
{
"payload": "'$KEY_MATERIAL'"
}
]
}'
Show more



 JSON response 

{
"metadata": {
"collectionType": "application/vnd.ibm.kms.error+json",
"collectionTotal": 1
},
"resources": [
{
"errorMsg": "Bad Request: Key could not be restored. Please see reasons for more details.",
"reasons":
{
"code": "KEY_IMPT_REQ_ERR",
"message": "Only imported keys may be restored.",
"status": 400,
"moreInfo": "https://cloud.ibm.com/apidocs/key-protect"
}
]
}
]
}











 17 - Requested action can only be completed... 



 Message
Signature is invalid [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-invalid_sig_exp_err)
22. The action could not be performed on... [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-key-expired-err)
23. The encrypted nonce given does not match... [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-incorrect-nonce-err)
24. The import token has expired [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-import-token-expired-err)
25. The key cannot be deleted because it's... [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-prev-key-del-err)
26. The key is not dual auth enabled and... [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-not-dual-auth-err)
27. The key was updated recently [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-req-too-early-err)
28. The provided ciphertext is invalid or... [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-unprocessable-ciphertext-err)
29. The provided encrypted nonce was not...
You cannot delete an instance when it is in deleting, pending, starting, stopping, or restarting status. The instance must be in running or stopped status. If the status does not change, [contact support](https://cloud.ibm.com/docs/vpc-on-classic?topic=vpc-on-classic-getting-help-and-support).





 instance_invalid_hostname 

Message: The instance cannot be created because the hostname is not valid.

The instance hostname must meet the following requirements:



* The hostname must contain only alphanumeric characters and dashes
* Uppercase characters are not allowed
* Leading and trailing dashes are not allowed
* Leading numbers are not allowed
* Consecutive dashes are not allowed
* Maximum length is 15 characters for Windows
* Maximum length is 40 characters for other operating systems







 instance_invalid_port_speed 

Message: The instance cannot be created because the specified network interface port speed is not valid.

The network interface port speed must be 100 or 1000 Mbps.





 instance_name_exists 

Message: The same instance name already exists.

If this problem persists, [contact support](https://cloud.ibm.com/docs/vpc-on-classic?topic=vpc-on-classic-getting-help-and-support).





 instance_sec_volume_over_quota 

Message: The instance cannot be created because the number of volume attachments would exceed the quota.

The VPC quotas per resource are specified on the [Quotas](https://cloud.ibm.com/docs/vpc-on-classic?topic=vpc-on-classic-quotas) page.





 instance_too_many_keys 

Message: The Windows instance cannot be created because the request contains multiple keys.

Windows instances only support one key.





 insufficient_space_for_subnet 

Message: Insufficient space for subnet in address prefix.

The subnet cannot be created because the number of addresses requested cannot be allocated. Try again using a smaller address count or a larger CIDR.





 internal_error 

Message: An internal error occurred.

An unexpected error occurred.
$ KEY_ID=$(ibmcloud kp key create example-key -i $KP_INSTANCE_ID --output json --standard-key | jq -r '.["id"]')

$ echo $KEY_ID

b2dae7bb-2da5-493e-99d2-a6379e35e58c

 this request fails because a standard key cannot be disabled
$ curl -X POST "https://us-south.kms.cloud.ibm.com/api/v2/keys/$KEY_ID/actions/disable" -H "authorization: Bearer $ACCESS_TOKEN" -H "bluemix-instance: $KP_INSTANCE_ID" -H "content-type: application/vnd.ibm.kms.key_action+json"



 JSON response 

{
"metadata": {
"collectionType": "application/vnd.ibm.kms.error+json",
"collectionTotal": 1
},
"resources": [
{
"errorMsg": "Bad Request: Key could not be disabled. Please see reasons for more details.",
"reasons":
{
"code": "KEY_ROOT_REQ_ERR",
"message": "Requested action can only be completed with a root key.",
"status": 400,
"moreInfo": "https://cloud.ibm.com/apidocs/key-protect"
}
]
}
]
}











 18 - Requested action can only be completed... 



 Message 

Requested action can only be completed with a root key

Reason code: KEY_ROOT_REQ_REG_ERR





 HTTP status code 

422 - Unprocessable Entity

The HTTP 422 Unprocessable Entity response status code indicates that the server understands the content type of the request entity, and the syntax of the request entity is correct, but it was unable to process the contained instructions.

The client should not repeat this request without modification.





 Context
* Unbinding a reserved IP deletes the reserved IP if the auto-delete property is set to true.





 When auto-delete is disabled 

If you create a reserved IP without binding it, auto-delete is disabled by default. A reserved IP that is unbound cannot have auto-delete enabled.

When the auto-delete option is off, unbinding leaves the reserved IP in place, but doesn't delete the reserved IP.





 When auto-delete is enabled 

If you create a virtual server instance without specifying a reserved IP, the system creates a reserved IP for you and binds it to the primary network interface. In this scenario, the auto-delete feature is enabled by default.

When the auto-delete option is on, unbinding the reserved IP from its target results in the deletion of the reserved IP.

It might take several minutes for the reserved IP to be deleted.
"crn": "crn:v1:bluemix:public:hs-crypto:us-south:a/f047b55a3362ac06afad8a3f2f5586ea:12e8c9c2-a162-472d-b7d6-8b9a86b815a6:key:02fd6835-6001-4482-a892-13bd2085f75d",
"imported": false,
"creationDate": "2020-03-10T20:41:27Z",
"createdBy": "...",
"algorithmType": "AES",
"algorithmMetadata": {
"bitLength": "256",
"mode": "CBC_PAD"
},
"algorithmBitSize": 256,
"algorithmMode": "CBC_PAD",
"lastUpdateDate": "2020-03-16T20:41:27Z",
"dualAuthDelete": {
"enabled": false
},
"deleted": true,
"deletionDate": "2020-03-16T21:46:53Z",
"deletedBy": "..."
}
]
}

For a detailed description of the available parameters, see the Hyper Protect Crypto Services [key management service API reference doc](https://cloud.ibm.com/apidocs/hs-crypto).





 Using the force query parameter 

Hyper Protect Crypto Services blocks the deletion of a key that's protecting a cloud resource, such as a IBM Cloud Object Storage bucket. You can force-delete a key and the contents by making a DELETE call to the following endpoint.

https://api.<region>.hs-crypto.cloud.ibm.com:<port>/api/v2/keys/<key_ID>?force=true
* --force | -f: Optional: Force the delete without confirmation.
* --help | -h: Optional: Get help on this command.





 Example 

This example illustrates deleting a connection without confirmation:

ibmcloud tg cd $gateway $connection -f







 Deleting a connection with the API 

After the specified connection is detached, entities still within the transit gateway will no longer be able to communicate directly to it through the IBM Cloud private backbone.

You can delete a connection with the API.



 Request 

To delete a connection with the API, set the following parameters:



Table 1. Path parameters for deleting a connection

 Path Parameters Details 

 transit_gateway_id <br>Required <br>string The Transit Gateway identifier 
 id <br>Required <br>string The connection identifier 





Table 1. Query parameters for deleting a connection

 Query Parameters Details 

 version <br>Required <br>string Requests the version of the API as of a date in the format YYYY-MM-DD. Any date up to the current date may be provided. Specify the current date to request the latest version. <br>Possible values: Value must match regular expression ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ 





 Example Request 

This example request illustrates deleting a connection:

DELETE /transit_gateways/{transit_gateway_id}/connections/{id}

"{base_url}/transit_gateways/{transit_gateway_id}/connections/{id}?version={version}"

curl -X DELETE "https://transit.cloud.ibm.com/v1/transit_gateways/testgateway/connections/testconnection?version=2022-02-09" -H "accept: /"







 Response 

The following status codes will be returned:



Table 1. Status codes for deleting a connection

 Status code 

 200 The connection was removed successfully. 
 404 A Transit Gateway or Transit Gateway connection with the specified identifier could not be found. 





 Example Response
If set to true, this reserved IP automatically deletes when the target is deleted. One of: true, false (default: true).
* --output specifies the output format; only JSON is supported.
* -q, --quiet suppresses verbose output.







 Deleting a reserved IP from the CLI 

To delete a reserved IP by using the CLI, the reserved IP must be unbound. After unbinding the reserved IP, run the following command to delete it:

ibmcloud is subnet-reserved-ip-delete SUBNET (RESERVED_IP1 RESERVED_IP2 ...) [--vpc VPC] [-f, --force] [--output JSON] [-q, --quiet]

Where:



* SUBNET is the ID of the subnet.
* RESERVED_IP1 RESERVED_IP2 is the IDs of the reserved IPs. You can specify one or more.
* --vpc is the ID or name of the VPC. It is only required if you want to specify the unique resource by name inside this VPC.
* --force, -f forces the operation without confirmation.
* --output specifies the output format; only JSON is supported.
* -q, --quiet suppresses verbose output.









 Using the API 

To create a reserved IP by using the API, follow these steps:



1. Set up your [API environment](https://cloud.ibm.com/docs/vpc?topic=vpc-set-up-environmentapi-prerequisites-setup).
2. [Create a subnet](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-clicreate-a-subnet-cli).
3. Store the subnet ID in a variable to be used in the API command:

export SubnetId=<your_subnet_id>
4. Create a reserved IP, and optionally specify and address in the address property: