vania-janet/multiturn-rag-retrieval-data huggingface dataset:
This is an example of canceling a previously scheduled key delete.

 this key has a dual-auth-delete policy
$ ibmcloud kp key policies $KEY_ID --output json

[
{
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-06-22T19:13:00Z",
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:a192d603-0b8d-452f-aac3-f9e1f95e7411:policy:2427dbde-6cff-41eb-8b5a-ff26b038cafc",
"lastUpdateDate": "2020-06-22T21:29:10Z",
"updatedBy": "user id ...<redacted>...",
"dualAuthDelete": { "enabled": true
}
}
]

 cancel a previously scheduled key delete
$ ibmcloud kp key cancel-delete $KEY_ID

Cancelling key for deletion...
OK





 Required parameters 



* KEY_ID_OR_ALIAS

The v4 UUID or alias of the key that you want to delete. To retrieve a list of your available keys, run the [kp keys](https://cloud.ibm.com/docs/key-protect-cli-pluginkp-keys) command.









 kp key create 

[Create a root key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-create-root-keys) in the Key Protect instance that you specify or [import your own key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-import-root-keys)
For more information, see [Creating an ingestion key](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-ingestion_keyingestion_key_api_create).
3. Delete the old key. Make sure you use the ID of the key that you identified previously. For more information, see [Deleting a key](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-ingestion_keyingestion_key_api_delete).
4. After you rotate the ingestion key, you must update the ingestion key for any log sources that you have configured to forward logs to this Log Analysis instance. For example, see [Resetting the ingestion key that is used by a Kubernetes cluster](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-kube_reset_ingestion).
correlation_id='fffdd8a9-405a-4a91-a5a7-52c30d11424d',
msg='Conflict: Key could not be deleted. Please see "reasons" for more details.',
reasons='[PROTECTED_RESOURCE_ERR: Key is protecting one or more cloud resources -
FOR_MORE_INFO_REFER: https://cloud.ibm.com/docs/key-protect?topic=key-protect-troubleshootingunable-to-delete-keys]'

 delete the KP root key; use --force because the registration between COS and KMS still exists
$ ibmcloud kp key delete $MY_COS_KEY_ID --force --output json

 delete the KMS instance
$ ibmcloud resource service-instance-delete $KMS_NAME --force

 delete the COS instance
$ ibmcloud resource service-instance-delete $COS_NAME --force

 view resources (COS and KMS should no longer exist)
$ ibmcloud resource service-instances

Retrieving instances with type service_instance in resource group Default in all locations under account <account name> as <email address>...
OK
No service instance found.







 Required parameters 



* KEY_ID_OR_ALIAS

The v4 UUID or alias of the key that you want to query.
* -i, --instance-id

The IBM Cloud instance ID that identifies your Key Protect instance.

You can set an environment variable instead of specifying -i with the following command: $ export KP_INSTANCE_ID=<INSTANCE_ID>.







 Optional parameters 



* -c, --crn-query

Specify the crn query whose registrations need to be listed
* -k, --key-id

Specify the key id whose registrations need to be listed.
* -o, --output

Set the CLI output format. By default, all commands print in table format. To change the output format to JSON, use --output json.
After you [enable dual authorization for an instance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-dual-auth) or [for a key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-dual-auth-key-policy), you can provide the first authorization to delete a key by using the IBM Cloud console.



1. [Log in to the IBM Cloud console](https://cloud.ibm.com/).
2. Go to Menu > Resource list to view a list of your resources.
3. From your IBM Cloud resource list, select your provisioned instance of Hyper Protect Crypto Services.
4. On the KMS keys page, use the Keys table to browse the keys in your service.
5. Click the Actions icon ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/action-menu-icon.svg) to open a list of options for the key that you want to delete.
6. From the options menu, click Schedule key deletion and review the key's associated resources.
7. Enter the name of the key that is to be deleted, and click Schedule key deletion.
8. Contact the second approver to complete the deletion of the key.







 Step 2. Delete the key 

To delete the key, the second approver must have Manager access policy for the instance or key in order to authorize the key for deletion.



1. In the Keys table of the KMS keys page, you can find keys that are authorized for deletion with the following indicators:



* The Set for deletion column has a value of True. The authorization expiration time is displayed in the Deletion expiration column.
* A Trash can icon !
This is an example of canceling a previously scheduled key delete.

 this key has a dual-auth-delete policy
$ ibmcloud kp key policies $KEY_ID --output json

[
{
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-06-22T19:13:00Z",
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:a192d603-0b8d-452f-aac3-f9e1f95e7411:policy:2427dbde-6cff-41eb-8b5a-ff26b038cafc",
"lastUpdateDate": "2020-06-22T21:29:10Z",
"updatedBy": "user id ...<redacted>...",
"dualAuthDelete": { "enabled": true
}
}
]

 cancel a previously scheduled key delete
$ ibmcloud kp key cancel-delete $KEY_ID

Cancelling key for deletion...
OK





 Required parameters 



* KEY_ID_OR_ALIAS

The v4 UUID or alias of the key that you want to delete. To retrieve a list of your available keys, run the [kp keys](https://cloud.ibm.com/docs/key-protect-cli-plugin?topic=key-protect-cli-plugin-key-protect-cli-referencekp-keys) command.









 kp key create
You can undo the deletion by calling the [undelete](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-vault-manage-kv-cli&interface=uikv-version-restore-cli) command.

vault kv delete [-versions=VERSIONS] [-format=FORMAT] ibmcloud/kv/SECRET_NAME

Delete the specified versions of a key-value secret in a custom group.

vault kv delete [-versions=VERSIONS] [-format=FORMAT] ibmcloud/kv/GROUP_ID/SECRET_NAME



 Prerequisites 

You need the [Manager service role](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam) to delete key-value secrets.





 Command options 

-versions
: The versions that you want to delete.

-format
: Prints the output in the format that you specify. Valid formats are table, json, and yaml. The default is table. You can also set the output format by using the VAULT_FORMAT environment variable.





 Example 

Delete specified versions of a key-value secret.

vault kv delete -versions=2 ibmcloud/kv/my-test-kv-secret

Delete specified versions of a key-value secret in a custom group.

vault kv delete -versions=2 ibmcloud/kv/9426e546-83de-4da5-9631-d70c993186c8/my-test-kv-secret





 Output 

The command to delete specified versions of a kv secret returns no output.







 Undelete a key-value secret 

Restore a previously deleted version of a key-value secret.

vault kv undelete [-versions=VERSIONS] [-format=FORMAT] ibmcloud/kv/SECRET_NAME

Restore a previously deleted version of a key-value secret in a custom group.

vault kv undelete [-versions=VERSIONS] [-format=FORMAT] ibmcloud/kv/GROUP_ID/SECRET_NAME



 Prerequisites
Before you can delete an instance, you must delete every key in that instance.

Because the Keys table in the console shows only Enabled keys by default, use the filters to show keys in all states. This can reveal keys that must be deleted to delete the instance which are not being displayed in the table.

After all keys have been deleted, you can proceed with deletion of the instance.





 What is a root key? 

Root keys are primary resources in Key Protect. They are symmetric key-wrapping keys that are used as roots of trust for protecting other keys that are stored in a data service with [envelope encryption](https://cloud.ibm.com/docs/key-protect?topic=key-protect-envelope-encryption).

With Key Protect, you can create, store, and manage the lifecycle of root keys to achieve full control of other keys stored in the cloud.

After a root key has been created, neither a user nor IBM can see its key material.





 What is a data encryption key (DEK)? 

A DEK is a key used by services like IBM Cloud Object Storage service to perform IBM-managed AES256 encryption of the data stored in the cloud object storage. The DEK keys are randomly generated and stored securely with the cloud object storage service near the resources they encrypt. The DEK is used for default encryption in all cases regardless of whether the customer wants to manage the encryption keys or not. The ICOS DEK is not managed by clients nor do they need to rotate it. For cases where clients do want to manage the encryption, they indirectly control the DEK by wrapping the DEK with their own "root key" stored in their Key Protect instance. A root key can be generated or imported, and managed by you in your Key Protect instance (for example, by rotating keys).

Key Protect can generate DEKs (which wraps keys without passing plaintext) through its HSM.





 What is envelope encryption? 

Envelope encryption is the practice of encrypting data with a data encryption key, and then encrypting the data encryption key with a highly secure key-wrapping key. Your data is protected at rest by applying multiple layers of encryption.
2. Go to Menu > Resource list to view a list of your resources.
3. From your IBM Cloud resource list, select your provisioned instance of Hyper Protect Crypto Services.
4. On the KMS keys page, use the Keys table to browse the keys in your service.
5. Select the key that you want to purge and make sure that the state is Destroyed. Click the Actions icon ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/action-menu-icon.svg) to open a list of options for the key.
6. From the options menu, click Purge key.
7. Check the box to confirm the action and click Purge key.



You are not able to purge a key if you perform the purging action in 4 hours after you delete the key.





 Purging keys with the API 

You can purge a deleted key by making a DELETE call to the following endpoint:

https://api.<region>.hs-crypto.cloud.ibm.com:<port>/api/v2/keys/<key_ID>/purge



1. [Retrieve your service and authentication credentials to work with keys in the service](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-kms-api).
2. Retrieve the ID of the key that you want to delete.

You can find the ID for a key in your service instance by [retrieving a list of your keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-keys), or by accessing the IBM Cloud console.
3. Run the following cURL command to permanently delete the key and the contents.
This is an example of scheduleing a key to be deleted.

 schedule this key to be deleted
$ ibmcloud kp key schedule-delete $KEY_ID_OR_ALIAS

Scheduling key for deletion...
OK

 this key has a dual-auth-delete policy
$ ibmcloud kp key policies $KEY_ID_OR_ALIAS --output json

[
{
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-06-22T19:13:00Z",
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:a192d603-0b8d-452f-aac3-f9e1f95e7411:policy:2427dbde-6cff-41eb-8b5a-ff26b038cafc",
"lastUpdateDate": "2020-06-22T21:36:16Z",
"updatedBy": "user id ...<redacted>...",
"dualAuthDelete": { "enabled": true
}
}
]





 Required parameters 



* KEY_ID_OR_ALIAS

The v4 UUID or alias of the key that you want to delete. To retrieve a list of your available keys, run the [kp keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-keys) command.







 Optional parameters 



* --key-ring

A unique, human readable name for the key-ring. Required if the user doesn't have permissions on the default key ring.









 kp key show 

Retrieve details about a key, such as the key metadata and key material.
To retrieve a list of your available keys, run the [kp keys](https://cloud.ibm.com/docs/cli?topic=cli-key-protect-cli-referencekp-keys) command.
* -e, --enable

Once you enable the dual-auth-delete policy you cannot disable it. You cannot delete a key without two (dual) authorizations. The process must be completed within 7 days, otherwise the dual authorization policy is automatically canceled, which means the key can be deleted by anyone that has authorization (two authorizations are not needed).

If you enabled the dual authorization policy accidentally and you want to delete the key, you can disable the key (using the kp key disable command) and wait 7 days for the dual authorization policy to expire. At which time you can delete the key.

You cannot delete the Key Protect instance as long as their active keys. A key with a dual authorization policy is an active key.







 Optional parameters 



* -o, --output

Set the CLI output format. By default, all commands print in table format. To change the output format to JSON, use --output json.
* --key-ring

A unique, human readable name for the key-ring. Required if the user doesn't have permissions on the default key ring.









 kp key policy-update rotation 

When you set an automatic rotation policy for a root key, you shorten the lifetime of the key at regular intervals, and you limit the amount of information that is protected by that key. Users can also enable or disable the key rotation policy on a key.

You can only create a rotation policy for root keys that are generated in Key Protect. If you imported the root key initially, you must provide a new base64-encoded key material to rotate the key. For more information, see [Rotating root keys on-demand](https://cloud.ibm.com/docs/key-protect?topic=key-protect-rotate-keys).

ibmcloud kp key policy-update rotation KEY_ID|KEY_ALIAS
[cancel-delete](https://cloud.ibm.com/docs/key-protect-cli-pluginkp-key-cancel-delete) Cancel a previously scheduled request to delete a key 
 [create](https://cloud.ibm.com/docs/key-protect-cli-pluginkp-key-create) Create a key or import your own key 
 [delete](https://cloud.ibm.com/docs/key-protect-cli-pluginkp-key-delete) Delete a key 
 [disable](https://cloud.ibm.com/docs/key-protect-cli-pluginkp-key-disable) Disable a key 
 [enable](https://cloud.ibm.com/docs/key-protect-cli-pluginkp-key-enable) Enable a key 
 [policies](https://cloud.ibm.com/docs/key-protect-cli-pluginkp-key-policies) Retrieve a list of policies 
 policy-update [dual-auth-delete](https://cloud.ibm.com/docs/key-protect-cli-pluginkp-key-policy-update-dual) Update the key policy for "dual auth delete" 
 policy-update [rotation](https://cloud.ibm.com/docs/key-protect-cli-pluginkp-key-policy-update-rotation) Update the key policy for "rotation" 
 [purge](https://cloud.ibm.com/docs/key-protect-cli-pluginkp-key-purge) Purge a deleted key 
 [restore](https://cloud.ibm.com/docs/key-protect-cli-pluginkp-key-restore) Restore a root key that was previously deleted 
 [rotate](https://cloud.ibm.com/docs/key-protect-cli-pluginkp-key-rotate) Rotate a root key
If you are required to retain any data related to a purged key (key metadata, registrations, policies, etc) for an extended period of time, it is recommended to perform the necessary API or CLI calls to retrieve and store that data in your own storage device.



 Considerations before deleting and purging a key 

Key Protect blocks the deletion of any key that's actively protecting any registered cloud resources. Before you delete a key:



1. [Review the registered IBM resources](https://cloud.ibm.com/docs/key-protect?topic=key-protect-view-protected-resources) that are associated with the key. If needed, you can [force deletion on a key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-purge-keysdelete-keys-force-delete) that's protecting a registered cloud resource. However, the action won't succeed if the key's associated resource is non-erasable due to a [retention policy](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-immutableimmutable-terminology-policy), which is a Write Once Read Many (WORM) policy set on the customer's relevant cloud resource.
2. Verify whether a key has a retention policy by checking the preventKeyDeletion field of the [registration details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-view-protected-resourcesview-protected-resources-api) for the key. Then, you must contact an account owner to remove the retention policy on each resource that is associated with the key before you can delete the key.
3. Verify the key's deletion authorization policy.
The side panel is displayed.
4. Click Delete to delete the keystore and all the metadata.
5. Click Delete keystore to confirm the deletion.



The internal keystore has been deleted with all the managed keys deactivated in this keystore and associated resources detached.





 Deleting internal keystores with the API 

To delete an internal keystore through the API, follow these steps:



1. [Retrieve your service and authentication credentials to work with keystores in the service](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-uko-api).
2. Delete an internal keystore by making a DELETE call to the following endpoint.

https://uko.<region>.hs-crypto.cloud.ibm.com:<port>/api/v4/keystores/<id>

Replace <id> with the ID of your keystore.

For detailed instructions and code examples about using the API method, check out the [Hyper Protect Crypto Services Unified Key Orchestrator API reference doc](https://cloud.ibm.com/apidocs/ukodelete-keystore).







 What's next 



* To find out instructions on adding a keystore, check out [Creating internal keystores](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-internal-keystores) or [Connecting to external keystores](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-connect-external-keystores).
* To find out instructions on editing an internal keystore, check out [Editing internal keystores](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-edit-internal-keystores).
* To find out how to delete a vault, check out [Deleting vaults](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-vaults).
Disable key [Disabling a root key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-disable-keysdisable-api) [Disabling a root key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-disable-keysdisable-api) 
 Enable key [Enabling a disabled root key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-disable-keysenable-api) [Enabling a disabled root key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-disable-keysenable-api) 
 Delete key [Deleting keys with the API (single authorization)](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-keysdelete-key-api) [Deleting keys with the API (single authorization)](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-keysdelete-keys-api) 
 [Authorize deletion for a key with the API (dual authorization)](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-dual-auth-keysset-key-deletion-api) [Authorize deletion for a key with the API (dual authorization)](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-dual-auth-keysset-key-deletion-api) 
 Restore key [Restoring a deleted key with the API](https://cloud.ibm.com/docs/key-protect?topic=key-protect-restore-keysrestore-api) [Restoring a deleted key with the API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-restore-keysrestore-api) 







 Removing service authorization to a root key
If a user [has the KeyPurge role](https://cloud.ibm.com/docs/key-protect?topic=key-protect-grant-access-keysgrant-access-keys-specific-functions), they can purge a key after four hours.

By default, Key Protect requires one authorization to delete a key. You can delete a key and its contents by making a DELETE call to the following endpoint.

https://<region>.kms.cloud.ibm.com/api/v2/keys/<keyID_or_alias>

This action won't succeed if the key is actively protecting one or more cloud resources. You can [review the resources](https://cloud.ibm.com/docs/key-protect?topic=key-protect-view-protected-resources) that are associated with the key, or [use the force parameter](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-keysdelete-keys-force-delete) at query time to delete the key.



1. [Retrieve your authentication credentials to work with keys in the service](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-up-api).
2. Retrieve the ID of the key that you want to delete.

You can find the ID for a key in your Key Protect instance by [retrieving a list of your keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-view-keys), or by accessing the Key Protect dashboard.
3. Run the following curl command to delete the key and its contents.

$ curl -X DELETE "https://<region>.kms.cloud.ibm.com/api/v2/keys/<keyID_or_alias>" -H "authorization: Bearer <IAM_token>" -H "bluemix-instance: <instance_ID>" -H "x-kms-key-ring: <key_ring_ID>" -H "prefer: <return_preference>"
* UI
* API







 Deleting internal keystores 

You can delete internal keystores in Unified Key Orchestrator with the IBM Cloud® console, or programmatically with the Unified Key Orchestrator API. After you delete an internal keystore, all the managed keys are deactivated in this keystore， and associated resources are detached.

To delete an internal keystore, [delete all activated keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-managed-keys) in this keystore first. The key metadata remains in the keystore for 90 days before it gets removed automatically. You can delete the keystore only after the key metadata gets removed. If you want to delete the keystore immediately, [manually remove all key metadata using the KMS API](https://cloud.ibm.com/apidocs/hs-cryptopurgekey) in 4 hours after you destroy the key. Make sure that you have the KMS Key Purge role assigned. For more information about roles, see [Managing user access](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-manage-access).



 Deleting internal keystores with the IBM Cloud console 

To delete an internal keystore by using the console, complete the following steps:



1. [Log in to the Hyper Protect Crypto Services instance](https://cloud.ibm.com/login).
2. Click Target keystores from the navigation to view all the available keystores.
3. Click the keystore that you want to delete. The side panel is displayed.
4. Click Delete to delete the keystore and all the metadata.
5. Click Delete keystore to confirm the deletion.



The internal keystore has been deleted with all the managed keys deactivated in this keystore and associated resources detached.





 Deleting internal keystores with the API 

To delete an internal keystore through the API, follow these steps:



1.
This is an example of canceling a previously scheduled key delete.

 this key has a dual-auth-delete policy
$ ibmcloud kp key policies $KEY_ID --output json

[
{
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-06-22T19:13:00Z",
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:a192d603-0b8d-452f-aac3-f9e1f95e7411:policy:2427dbde-6cff-41eb-8b5a-ff26b038cafc",
"lastUpdateDate": "2020-06-22T21:29:10Z",
"updatedBy": "user id ...<redacted>...",
"dualAuthDelete": { "enabled": true
}
}
]

 cancel a previously scheduled key delete
$ ibmcloud kp key cancel-delete $KEY_ID

Cancelling key for deletion...
OK





 Required parameters 



* KEY_ID_OR_ALIAS

The v4 UUID or alias of the key that you want to delete. To retrieve a list of your available keys, run the [kp keys](https://cloud.ibm.com/docs/cli?topic=cli-key-protect-cli-referencekp-keys) command.









 kp key create 

[Create a root key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-create-root-keys) in the Key Protect instance that you specify or [import your own key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-import-root-keys)