vania-janet/multiturn-rag-retrieval-data huggingface dataset:
You can use Key Protect to safely delete encryption keys by using a dual authorization process. When you delete a key, you shred its contents and associated data. Any data that is encrypted by the key becomes inaccessible.

Deleting a key that has a [dual authorization policy](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-dual-auth) requires an authorization from two users. With the Key Protect API, you can provide the first authorization by [setting the key for deletion](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-dual-auth-keysset-key-deletion-api). Then, a different user provides a second authorization by using the [GUI](https://cloud.ibm.com/login/) or [API](https://cloud.ibm.com/apidocs/key-protect) to delete the key.

ibmcloud kp key policy-update dual-auth-delete KEY_ID_OR_ALIAS
-i, --instance-id INSTANCE_ID
-e, --enable
[--key-ring KEY_RING_ID]
[-o, --output OUTPUT]



 Example 

This example enables the dual authorization delete policy.

 create a root key
$ KEY_ID=$(ibmcloud kp key create my-root-key --output json | jq -r '.["id"]')

$ echo $KEY_ID

d887bfe8-5166-4dad-af32-7e3055ca1873

 show key details
$ ibmcloud kp key show $KEY_ID --output json

{
"id": "d887bfe8-5166-4dad-af32-7e3055ca1873",
"name": "my-root-key",
"type": "application/vnd.ibm.kms.key+json",
Deleting key rings with the API 

You can delete a key ring by making a DELETE call to the following endpoint.

https://<region>.kms.cloud.ibm.com/api/v2/key_rings/<key_ring_id>

This action won't succeed if the key ring contains at least one key, regardless of key state (including keys in the Destroyed state).



1. [Retrieve your authentication credentials to work with keys in the service](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-up-api).
2. Retrieve the ID of the key ring that you want to delete.

You can find the ID for a key ring in your Key Protect instance by [retrieving a list of your key rings](https://cloud.ibm.com/docs/key-protect?topic=key-protect-grouping-keyslist-key-ring-api).
3. Run the following curl command to delete the key ring.

$ curl -X DELETE "https://<region>.kms.cloud.ibm.com/api/v2/key_rings/<key_ring_id>" -H "authorization: Bearer <IAM_token>" -H "bluemix-instance: <instance_ID>" -H "prefer: <return_preference>"

Replace the variables in the example request according to the following table.





Table 4. Describes the variables that are needed to delete keys with the Key Protect API.

 Variable Description 

 region Required. The region abbreviation, such as us-south or eu-gb, that represents the geographic area where your Key Protect instance resides. <br> <br>For more information, see [Regional service endpoints](https://cloud.ibm.com/docs/key-protect?topic=key-protect-regionsservice-endpoints). 
 key_ring_id Required. The unique identifier for the key ring that you would like to delete. 
 IAM_token Required. Your IBM Cloud access token.
Why can't I delete keys? 

When you use the Hyper Protect Crypto Services user interface, you're unable to delete a key.

 What’s happening 

From the IBM Cloud dashboard, you select your instance of the Hyper Protect Crypto Services service.

You're assigned a Manager access policy for the service instance. You try to delete a key, but the action fails with either of the following error messages:



* Error message 1:

> The service was not able to delete key "<key_name>". The key cannot be deleted because it is protecting one or more cloud resources that have a retention policy.
* Error message 2:

> The service was not able to delete key "<key_name>". Because the key is enabled with the dual authorization policy and you set the key for deletion, a second approver needs to continue with the key deletion operation.



 Why it’s happening 

The following reasons might cause the errors:



* If error message 1 is displayed, this key is actively protecting one or more cloud resources, such as a Cloud Object Storage bucket.
* If error message 2 is displayed, this key is enabled with the dual authorization policy that requires a deletion authorization from two users. You set the key for deletion and you need to contact the second approver to complete the deletion.



 How to fix it 

The following instructions can help you solve the problems:



* To resolve the error that is reported in error message 1, [review the resources](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-protected-resources) that are associated with the key before you delete a key.

You can [force deletion on a key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-keysdelete-key-force) that's protecting a cloud resource. However, the action won't succeed if the key's associated resource is nonerasable due to a retention policy.
Enable key [Enabling a root key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-disable-keysenable-ui). [Enabling a root key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-disable-keysenable-ui). 
 Delete key [Deleting keys in the console (single authorization)](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-keysdelete-key-gui). [Deleting keys with the GUI (single authorization)](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-keysdelete-keys-gui). 
 [Deleting a key with dual authorization](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-dual-auth-keysdelete-dual-auth-keys-api). [Authorize deletion for a key with the GUI (dual authorization)](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-dual-auth-keysset-key-deletion-console). 
 Restore key [Restoring a deleted key with the console](https://cloud.ibm.com/docs/key-protect?topic=key-protect-restore-keysrestore-ui). [Restoring a deleted key with the GUI](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-restore-keysrestore-ui). 







 Manage root keys with the API 

You can use the API to disable, enable, delete, or restore your root keys. Table 6 describes each action and links to detailed steps for the Key Protect or Hyper Protect Crypto Services API.
If it is important to your use case to purge a key sooner than 90 days (the soonest a key can be purged after a normal deletion), the key can be purged after four hours if a user [has the KeyPurge role](https://cloud.ibm.com/docs/key-protect?topic=key-protect-grant-access-keysgrant-access-keys-specific-functions).

Because a purged key has its key material permanently shredded and metadata inaccessible, a purged key cannot be restored. It is therefore even more important to ensure that the key has no vital associated resources.

To purge a key:



1. Follow the instructions to [Delete a key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-keysdelete-keys-gui).
2. After waiting at least four hours, once again navigate to the key and click the ⋯ icon.
3. From the options, select Purge from the options below and confirm the key deletion in the next screen by ensuring the key has no associated resources and that you have the necessary KeyPurge user attribute.







 Deleting keys with the API 

If a user [has the KeyPurge role](https://cloud.ibm.com/docs/key-protect?topic=key-protect-grant-access-keysgrant-access-keys-specific-functions), they can purge a key after four hours.

By default, Key Protect requires one authorization to delete a key. You can delete a key and its contents by making a DELETE call to the following endpoint.

https://<region>.kms.cloud.ibm.com/api/v2/keys/<keyID_or_alias>

This action won't succeed if the key is actively protecting one or more cloud resources.
[Actions icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/action-menu-icon.svg) and choose Remove from vault.

When you remove the managed key from the vault that the key is assigned to, the remaining key metadata is removed permanently.



The managed key has been deleted and detached from all target keystores. All key materials and metadata have been destroyed.





 Deleting managed keys with the API 

To delete a managed key through the API, follow these steps:



1. [Retrieve your service and authentication credentials to work with keys in the service](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-uko-api).
2. Delete a managed key by making a DELETE call to the following endpoint.

https://uko.<region>.hs-crypto.cloud.ibm.com:<port>/api/v4/managed_keys/<id>

Replace <id> with the ID of your managed key.

For detailed instructions and code examples about using the API method, check out the [Hyper Protect Crypto Services Unified Key Orchestrator API reference doc](https://cloud.ibm.com/apidocs/ukodelete-managed-key).







 What's next 



* To find out instructions on creating a managed key, check out [Creating managed keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-managed-keys).
* To find out how to delete an internal keystore, check out [Deleting internal keystores](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-internal-keystores).
Deleting key: 584fb0d9-dec2-47b8-bde5-50f05fd66261, from instance: 98d39ab8-cf44-4517-9583-2ad05c7e9bd5...

SUCCESS

Deleted Key
584fb0d9-dec2-47b8-bde5-50f05fd66261



 Required parameters 

KEY_ID
: The ID of the key that you want to delete. To retrieve a list of your available keys, run the [kp list](#kp-list-039) command.







 kp policy set 

Create or replace the policy that is associated with the root key that you specify.

ibmcloud kp policy set KEY_ID -i $INSTANCE_ID --set-type POLICY_TYPE
[-p --policy INTERVAL]



 Required parameters 

KEY_ID
: The ID of the key that you want to query. To retrieve a list of your available keys, run the [kp list](#kp-list-039) command.





 Optional parameters 

-p, --policy
: Specify the rotation time interval (in months) for a key. The default value is 1.







 kp policy get 

Retrieve details about a key policy, such as the key's automatic rotation interval.

ibmcloud kp policy get KEY_ID -i $INSTANCE_ID



 Required parameters 

KEY_ID
: The ID of the key that you want to query. To retrieve a list of your available keys, run the [kp list](#kp-list-039) command.





 Optional parameters 

-o, --output
: Set the CLI output format. By default, all commands print in table format. To change the output format to JSON, use --output json.







 kp import-token create 

[Create an import token](https://cloud.ibm.com/docs/key-protect?topic=key-protect-create-import-tokens) in the Key Protect instance that you specify.
To retrieve a list of your available keys, run the [kp keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-keys) command.
* -e, --enable

Once you enable the dual-auth-delete policy you cannot disable it. You cannot delete a key without two (dual) authorizations. The process must be completed within 7 days, otherwise the dual authorization policy is automatically canceled, which means the key can be deleted by anyone that has authorization (two authorizations are not needed).

If you enabled the dual authorization policy accidentally and you want to delete the key, you can disable the key (using the kp key disable command) and wait 7 days for the dual authorization policy to expire. At which time you can delete the key.

You cannot delete the Key Protect instance as long as their active keys. A key with a dual authorization policy is an active key.







 Optional parameters 



* -o, --output

Set the CLI output format. By default, all commands print in table format. To change the output format to JSON, use --output json.
* --key-ring

A unique, human readable name for the key-ring. Required if the user doesn't have permissions on the default key ring.









 kp key policy-update rotation 

When you set an automatic rotation policy for a root key, you shorten the lifetime of the key at regular intervals, and you limit the amount of information that is protected by that key. Users can also enable or disable the key rotation policy on a key.

You can only create a rotation policy for root keys that are generated in Key Protect. If you imported the root key initially, you must provide a new base64-encoded key material to rotate the key. For more information, see [Rotating root keys on-demand](https://cloud.ibm.com/docs/key-protect?topic=key-protect-rotate-keys).

ibmcloud kp key policy-update rotation KEY_ID|KEY_ALIAS
Delete the key by clicking the X next to the key to be deleted.







 Rotating an ingestion key through the UI 

If the ingestion key is compromised or you have a policy to renew it after a number of days, you can generate a new key and delete the old one.

To renew the ingestion key for an IBM Cloud Activity Tracker instance by using the IBM Cloud Activity Tracker Web UI, complete the following steps:



1. [Launch the IBM Cloud Activity Tracker web UI](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-launch).
2. Click the Settings icon ![Settings icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/images/admin.png) > Organization.
3. Select API keys.

You can see the ingestion keys that are enabled.
4. Select Generate Ingestion Key.

A new key is added to the list.
5. Delete the old ingestion key. Click X next to the ingestion key to be deleted.



After you reset the ingestion key, you must update the ingestion key for any event sources that you have configured to forward events to this IBM Cloud Activity Tracker instance.

For example, if you have configured streaming to an Activity Tracker instance, and you rotate the service key of the destinaltion Activity Tracker instance, you need to reconfigure streaming to continue streaming data. For more info, see [Configuring streaming to a Activity Tracker instance through the UI](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-streaming-configure-l2l).







 Getting the ingestion key through the CLI 

To get the ingestion key for a logging instance through the command line, complete the following steps:



1.
1. [Log in to the IBM Cloud console](https://cloud.ibm.com/login).
2. Go to Menu > Resource list to view a list of your resources.
3. From your IBM Cloud resource list, select your provisioned instance of Hyper Protect Crypto Services.
4. Select the KMS key rings tab in the side menu to browse the key rings.
5. Find the key ring that you want to delete and click the Deletion icon ![Deletion icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/delete.svg) at the end of the row.
6. Confirm the deletion and click Delete key ring.







 Deleting key rings with the API 

You can delete a key ring by making a DELETE call to the following endpoint.

https://api.<region>.hs-crypto.cloud.ibm.com:<port>/api/v2/key_rings/<key_ring_id>



1. [Retrieve your authentication credentials to work with keys in the service](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-kms-api).
2. Retrieve the ID of the key ring that you want to delete.

You can find the ID for a key ring in your Hyper Protect Crypto Services instance by [retrieving a list of your key rings](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-managing-key-ringslist-key-ring).
3. Run the following curl command to delete the key ring.
KEY_ID
: ID value of the service key for which you want to get details.

KEY_NAME
: Name that you want to give the key. The maximum size of a name is 30 characters.





 Delete a key 

To delete an service key, run the following command.

curl -X DELETE "https://API_ENDPOINT/v1/config/keys/KEY_ID"
-H 'content-type: application/json' -H 'servicekey: SERVICE_KEY'

Where:

API_ENDPOINT
: Depending on [your account settings](https://cloud.ibm.com/docs/account?topic=account-service-endpoints-overview), you can use public or private endpoints to manage categories programmatically. For information about endpoints per region, see [API endpoints](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-endpointsendpoints_api).

KEY_ID
: ID value of the service key to be deleted.

SERVICE_KEY
: Service key value. A service key is a unique code that is passed in an API request to identify the calling application or user. The service key is specific to a logging instance. For more information on how to generate a service key, see [Managing service keys](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-service_keys).







 Rotating the service key by using the API 

If the service key is compromised or you have a policy that requies renewal of a key after a number of days, you can generate a new key and delete the old one.

To rotate a key, complete the following steps:



1. Get the details of the key that you want to rotate.

You can list all service keys to obtain the ID of the key that you want to rotate. For more information, see [Listing all service keys](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-service_keysservice_keys_api_list).
This error indicates that keys are still in this instance. Before you can delete an instance, you must delete every key in that instance.

Because the Keys table in the console shows only Enabled keys by default, use the filters to show keys in all states. This can reveal keys that must be deleted to delete the instance which are not being displayed in the table.

After all keys have been deleted, you can proceed with deletion of the instance.
* What is a root key?

Root keys are primary resources in Key Protect. They are symmetric key-wrapping keys that are used as roots of trust for protecting other keys that are stored in a data service with [envelope encryption](https://cloud.ibm.com/docs/key-protect?topic=key-protect-envelope-encryption).

With Key Protect, you can create, store, and manage the lifecycle of root keys to achieve full control of other keys stored in the cloud.

After a root key has been created, neither a user nor IBM can see its key material.
* What is a data encryption key (DEK)?

A DEK is a key used by services like IBM Cloud Object Storage service to perform IBM-managed AES256 encryption of the data stored in the cloud object storage. The DEK keys are randomly generated and stored securely with the cloud object storage service near the resources they encrypt. The DEK is used for default encryption in all cases regardless of whether the customer wants to manage the encryption keys or not. The ICOS DEK is not managed by clients nor do they need to rotate it. For cases where clients do want to manage the encryption, they indirectly control the DEK by wrapping the DEK with their own "root key" stored in their Key Protect instance. A root key can be generated or imported, and managed by you in your Key Protect instance (for example, by rotating keys).

Key Protect can generate DEKs (which wraps keys without passing plaintext) through its HSM.
* What is envelope encryption?

Envelope encryption is the practice of encrypting data with a data encryption key, and then encrypting the data encryption key with a highly secure key-wrapping key. Your data is protected at rest by applying multiple layers of encryption.
[The image shows the Key Protect dashboard view.](https://cloud.ibm.com/docs-content/v1/content/0bc8db34a3d90b2a5103c9c71b08a96de9525bbc/key-protect/images/import-keys-demo.png)

You can browse the general characteristics of your keys from the application details page. Choose from a list of options for managing your key, such as [rotating the key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-rotate-keysrotate-key-gui) or [deleting the key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-keysdelete-key-gui).







 Step 9. Clean up 



1. Gather the identifier for the encryption key that you imported in the previous step.

ROOT_KEY_ID=$(jq -r '.resources[].id' createRootKeyResponse.json)
2. Remove the encryption key from your Key Protect instance.

$ curl -X DELETE "$KP_API_URL/api/v2/keys/$ROOT_KEY_ID" -H "accept: application/vnd.ibm.collection+json" -H "authorization: $ACCESS_TOKEN" -H "bluemix-instance: $INSTANCE_ID" | jq .
3. Remove the all the local files associated with this tutorial.

rm .json .bin .pem
4. Delete the test directory that you created for this tutorial.

cd .. && rm -r key-protect-test
5. Optional: Remove your Key Protect service instance.

ibmcloud resource service-instance-delete import-keys-demo
For more information about the required and optional request parameters, see the [API reference](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2lock-secret).









 Unlocking secrets 

A secret is considered unlocked and able to be modified or deleted only after all of its associated locks are removed. You can use the Secrets Manager UI or APIs to delete locks that are associated with a secret.



 Deleting locks in the UI 

You can delete a lock that is attached to an existing secret by using the Secrets Manager UI.



1. In the console, click the Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/icon_hamburger.svg)> Resource List.
2. From the list of services, select your instance of Secrets Manager.
3. In the Secrets Manager UI, go to the Secrets list.
4. In the row for the secret that you want to update, click the Actions menu ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/actions-icon-vertical.svg)> Locks.
5. In the row for the lock that you want to delete, click the Actions menu ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/actions-icon-vertical.svg)> Delete.
6. To confirm the deletion, type the name of the secret. Click Delete.

Your lock is now deleted. To completely unlock the secret, you can remove all existing locks.







 Deleting locks with the API
Deleting key aliases with the console 

Delete a key alias with the console by completing the following steps:



1. [Log in to the IBM Cloud console](https://cloud.ibm.com/login).
2. Go to Menu > Resource list to view a list of your resources.
3. From your IBM Cloud resource list, select your provisioned instance of Hyper Protect Crypto Services.
4. Select the KMS keys tab in the side menu and find the key that you want to create key aliases for.
5. Click the Actions icon ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/action-menu-icon.svg) to open the list of options for the key and click Edit key aliases.
6. Delete the key alias that you want to remove and click Save.







 Deleting key aliases with the API 

Delete a key alias by making a DELETE call to the following endpoint.

https://api.<region>.hs-crypto.cloud.ibm.com:<port>/api/v2/keys/<key_ID>/aliases/<alias>



1. [Retrieve your authentication credentials to work with keys in the service](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-kms-api).
2. Delete a key alias by running the following curl command.
This is an example of canceling a previously scheduled key delete.

 this key has a dual-auth-delete policy
$ ibmcloud kp key policies $KEY_ID --output json

[
{
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-06-22T19:13:00Z",
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:a192d603-0b8d-452f-aac3-f9e1f95e7411:policy:2427dbde-6cff-41eb-8b5a-ff26b038cafc",
"lastUpdateDate": "2020-06-22T21:29:10Z",
"updatedBy": "user id ...<redacted>...",
"dualAuthDelete": { "enabled": true
}
}
]

 cancel a previously scheduled key delete
$ ibmcloud kp key cancel-delete $KEY_ID

Cancelling key for deletion...
OK





 Required parameters 



* KEY_ID_OR_ALIAS

The v4 UUID or alias of the key that you want to delete. To retrieve a list of your available keys, run the [kp keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-keys) command.









 kp key create 

[Create a root key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-create-root-keys) in the Key Protect instance that you specify or [import your own key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-import-root-keys)