vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* UI
* API







 Purging keys manually 

A deleted key becomes purged automatically after 90 days of the deletion. If you want to purge a key before it gets automatically purged, make sure that you are assigned the KMS Key Purge role for your Hyper Protect Crypto Services instance. A key can be purged manually only after it is deleted for 4 hours.

Before you purge keys, make sure that you understand [the concept of deleting and purging keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-purge-keys) and review the [considerations](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-purge-keysdelete-purge-keys-considerations).

To manually purge a key, you need to be assigned the KMS Key Purge role. Even a Manager cannot purge a key. For more information about service access roles, see [IAM service access roles](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-accessservice-access-roles).



 Purging keys in the console 

If you prefer to purging a key by using a graphical interface, you can use the IBM Cloud console by completing the following steps:



1. [Log in to the IBM Cloud console](https://cloud.ibm.com/login).
2. Go to Menu > Resource list to view a list of your resources.
3. From your IBM Cloud resource list, select your provisioned instance of Hyper Protect Crypto Services.
4. On the KMS keys page, use the Keys table to browse the keys in your service.
5. Select the key that you want to purge and make sure that the state is Destroyed. Click the Actions icon !
After the soft-deletion period, the key can be deleted without the force. You can check the [association between the key and your deployment](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-key-details) to determine when you can delete the key.





 Cryptoshredding 

Cryptoshredding is a destructive action. When the key is deleted, your data is unrecoverable.

Hyper Protect Crypto Services enables [initiation of a force delete](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-keys) of a key that is in use by IBM Cloud® services, including your Cloud Databases deployments. This action is called cryptoshredding. Deleting a key that is in use on your deployment locks the disks that contain your data and disables your deployment. You are still able to access the UI and some metadata such as security settings in the UI, CLI, and API but you are not able to access any of the databases or data that is contained within them. Key deletion is [sent to the Activity Tracker](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-at-events) as hs-crypto.secrets.delete.
For more information, see [Disabling root keys](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managingbyok-disable-root-keys).

Deleting a root key has greater consequences. Deleting a root key purges usage of the key for all resources in the VPC. By default, the KMS prevents you from deleting a root key that's actively protecting a resource. However, you can still force the deletion of a root key. You have limited time to [restore a deleted root key](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managingbyok-restore-root-key) that you imported to the KMS. For more information, see [Deleting root keys](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managingbyok-delete-root-keys).





 Can I remove IAM authorization from Cloud Block Storage for VPC to the KMS and still delete my Block Storage for VPC volumes with customer-managed encryption? 

If you remove IAM authorization before you delete your BYOK volume (or image), the delete operation completes without unregistering the root keys in the KMS instance. In other words, the root key remains registered for a resource that doesn't exist. Always delete a BYOK resource before you remove IAM authorization. For more information about safely removing service authorization, see [Removing service authorization to a root key](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managinginstance-byok-inaccessible-data).





 What can I do if my root key is compromised? 

Independently back up your data. Then, delete the compromised root key and power down the instance with volumes that are encrypted with that key.

Also, consider setting up a key rotation policy that automatically rotates your keys based on a schedule.
For more information about the relationship of user actions and key states, see [Root key states and user actions](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managingbyok-root-key-states).

Because deleting a root key makes all resources that are protected by it unusable (status = unusable), program your applications to check the status of the resource (such as a volume, snapshot, or image) before it attempts to use it. If the root key is restorable, restore it for use, or create and use a different root key.



Table 6. API procedures for managing root keys

 User action Key Protect API procedure Hyper Protect Crypto Services API procedure 

 Disable key [Disabling a root key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-disable-keysdisable-api) [Disabling a root key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-disable-keysdisable-api) 
 Enable key [Enabling a disabled root key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-disable-keysenable-api) [Enabling a disabled root key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-disable-keysenable-api) 
 Delete key [Deleting keys with the API (single authorization)](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-keysdelete-key-api) [Deleting keys with the API (single authorization)](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-keysdelete-keys-api)
To retrieve a list of your available keys, run the [kp keys](https://cloud.ibm.com/docs/key-protect-cli-plugin?topic=key-protect-cli-plugin-key-protect-cli-referencekp-keys) command.
* -e, --enable

Once you enable the dual-auth-delete policy you cannot disable it. You cannot delete a key without two (dual) authorizations. The process must be completed within 7 days, otherwise the dual authorization policy is automatically canceled, which means the key can be deleted by anyone that has authorization (two authorizations are not needed).

If you enabled the dual authorization policy accidentally and you want to delete the key, you can disable the key (using the kp key disable command) and wait 7 days for the dual authorization policy to expire. At which time you can delete the key.

You cannot delete the Key Protect instance as long as their active keys. A key with a dual authorization policy is an active key.







 Optional parameters 



* -o, --output

Set the CLI output format. By default, all commands print in table format. To change the output format to JSON, use --output json.
* --key-ring

A unique, human readable name for the key-ring. Required if the user doesn't have permissions on the default key ring.









 kp key policy-update rotation 

When you set an automatic rotation policy for a root key, you shorten the lifetime of the key at regular intervals, and you limit the amount of information that is protected by that key. Users can also enable or disable the key rotation policy on a key.

You can only create a rotation policy for root keys that are generated in Key Protect. If you imported the root key initially, you must provide a new base64-encoded key material to rotate the key. For more information, see [Rotating root keys on-demand](https://cloud.ibm.com/docs/key-protect?topic=key-protect-rotate-keys).
This is an example of scheduleing a key to be deleted.

 schedule this key to be deleted
$ ibmcloud kp key schedule-delete $KEY_ID_OR_ALIAS

Scheduling key for deletion...
OK

 this key has a dual-auth-delete policy
$ ibmcloud kp key policies $KEY_ID_OR_ALIAS --output json

[
{
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-06-22T19:13:00Z",
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:a192d603-0b8d-452f-aac3-f9e1f95e7411:policy:2427dbde-6cff-41eb-8b5a-ff26b038cafc",
"lastUpdateDate": "2020-06-22T21:36:16Z",
"updatedBy": "user id ...<redacted>...",
"dualAuthDelete": { "enabled": true
}
}
]





 Required parameters 



* KEY_ID_OR_ALIAS

The v4 UUID or alias of the key that you want to delete. To retrieve a list of your available keys, run the [kp keys](https://cloud.ibm.com/docs/cli?topic=cli-key-protect-cli-referencekp-keys) command.







 Optional parameters 



* --key-ring

A unique, human readable name for the key-ring. Required if the user doesn't have permissions on the default key ring.









 kp key show 

Retrieve details about a key, such as the key metadata and key material.
view resources (COS and KMS should no longer exist)
$ ibmcloud resource service-instances

Retrieving instances with type service_instance in resource group Default in all locations under account <account name> as <email address>...
OK
No service instance found.







 Required parameters 



* KEY_ID_OR_ALIAS

The v4 UUID or alias of the key that you want to delete. To retrieve a list of your available keys, run the [kp keys](https://cloud.ibm.com/docs/key-protect-cli-pluginkp-keys) command.
* -i, --instance-id

The IBM Cloud instance ID that identifies your Key Protect instance.

You can set an environment variable instead of specifying -i with the following command: $ export KP_INSTANCE_ID=<INSTANCE_ID>.







 Optional parameters 



* -f, --force

Delete a key, with force, which is used to delete a key that has "registrations." Registrations are associations between root keys and other cloud resources, such as Cloud Object Storage (COS) buckets or Cloud Databases deployments.

For more information, see [kp registrations](https://cloud.ibm.com/docs/key-protect-cli-pluginkp-registrations)
* -o, --output

Set the CLI output format. By default, all commands print in table format. To change the output format to JSON, use --output json.
* --key-ring

A unique, human readable name for the key-ring. Required if the user doesn't have permissions on the default key ring.









 kp key disable 

The kp key disable command disables a root key and temporarily revokes access to the key's associated data in the cloud.

As an admin, you might need to temporarily [disable a root key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-disable-keys) if you suspect a possible security exposure, compromise, or breach with your data.
correlation_id='fe0db627-1726-4827-a9d2-c21d728e1c92',
msg='Conflict: 1 prior authorization(s) are required for deletion: Key could not be deleted.
Please see "reasons" for more details.',
reasons='[AUTHORIZATIONS_NOT_MET: Number of authorizations required to delete is not met -
FOR_MORE_INFO_REFER: https://cloud.ibm.com/apidocs/key-protect]'





 Required parameters 



* KEY_ID_OR_ALIAS

The v4 UUID or alias of the key that you want to query. To retrieve a list of your available keys, run the [kp keys](https://cloud.ibm.com/docs/key-protect-cli-pluginkp-keys) command.
* -e, --enable

Once you enable the dual-auth-delete policy you cannot disable it. You cannot delete a key without two (dual) authorizations. The process must be completed within 7 days, otherwise the dual authorization policy is automatically canceled, which means the key can be deleted by anyone that has authorization (two authorizations are not needed).

If you enabled the dual authorization policy accidentally and you want to delete the key, you can disable the key (using the kp key disable command) and wait 7 days for the dual authorization policy to expire. At which time you can delete the key.

You cannot delete the Key Protect instance as long as their active keys. A key with a dual authorization policy is an active key.







 Optional parameters 



* -o, --output

Set the CLI output format. By default, all commands print in table format. To change the output format to JSON, use --output json.
* --key-ring

A unique, human readable name for the key-ring. Required if the user doesn't have permissions on the default key ring.









 kp key policy-update rotation
Removing an SSH key 

When an SSH key that is stored on the IBM Cloud® console is obsolete or is no longer needed, you can remove the key. Remove obsolete SSH keys as soon as possible to make sure that enough space is available for more, valid keys.



  Before you begin 

First, go to the device menu and makre sure that you have the correct account permissions to complete the tasks.



*  Go to your console's device menu. For more information, see [Navigating to devices](https://cloud.ibm.com/docs/infrastructure/ssh-keys?topic=virtual-servers-navigating-devices).
*  Make sure that you have any necessary account permissions and device access. Only the account owner, or a user with the Manage Users classic infrastructure permission, can adjust the permissions.



For more information about permissions, see [Classic infrastructure permissions](https://cloud.ibm.com/docs/iam?topic=iam-infrapermissioninfrapermission) and [Managing device access](https://cloud.ibm.com/docs/vsi?topic=virtual-servers-managing-device-access).





  Removing an SSH key 



1.  From the Devices menu, select Manage > SSH Keys.
2.  Click the Remove icon next to the SSH key that you want to remove.
3.  Click Yes to confirm.







  Next steps 

After you remove an SSH key, it is immediately removed from the list. The key can no longer be used when you provision a new device or when you perform an OS reload on an existing device. If the key is removed in error or needs to be added back to the IBM Cloud console, see [Adding an SSH key](https://cloud.ibm.com/docs/infrastructure/ssh-keys?topic=ssh-keys-adding-an-ssh-keyadding-an-ssh-key).
After 30 days, the key can no longer be restored. For more information, check out [Restoring keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-restore-keys).

Note that even if the key is not restored, your data remains in those services in its encrypted form. Metadata that is associated with a key, such as the key's transition history and name, is kept in the Key Protect database.

To help you determine what data is protected by a key, you can use Key Protect APIs to [view associations between a key and your cloud resources](https://cloud.ibm.com/docs/key-protect?topic=key-protect-view-protected-resources).





 Account cancelation and data deletion 

Although instances that have non-deleted keys in them cannot be deleted, it is possible to close an [IBM Cloud account](https://cloud.ibm.com/docs/account?topic=account-account_settings) without first deleting all Key Protect instances. If an account is closed and instances and keys belonging to it still exist, the instances and keys are permanently hard deleted.

For more information about closing an account, check out [Closing an account](https://cloud.ibm.com/docs/account?topic=account-account_settingscancel-account).







 Compliance readiness 

Key Protect meets controls for global, industry, and regional compliance standards, including GDPR, HIPAA, and ISO 27001/27017/27018, and others.

For a complete listing of IBM Cloud compliance certifications, see [Compliance on the IBM Cloud](https://ibm.com/cloud/compliance).



 EU support 

Key Protect has extra controls in place to protect your Key Protect resources in the European Union (EU).

If you use Key Protect resources in the Frankfurt, Germany region to process personal data for European citizens, you can enable the EU Supported setting for your IBM Cloud account.
To remove all locks, you can pass {"locks": [""]} in in the request body. Otherwise, specify the names of the locks that you want to delete. For example, {"locks": ["lock-1", "lock-2"]}.

A secret is considered unlocked and able to be revoked or deleted only after all of its locks are removed. To understand whether a secret contains locks, check the locks_total field that is returned as part of the metadata of your secret.



 Example request 

Remove all locks on a secret version.

curl -X POST "https://{instance_id}.{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/{secret_type}/locks/{secret_id}/versions/{version_id}/unlock" -H 'X-Vault-Token: {Vault-Token}'
-H 'Content-Type: application/json' -D '{
"locks": [""]
}'

Replace {version_id} in the URL path with the current alias to remove locks from the current secret version. The aliases current or previous are allowed.

Remove two locks on the current version of a secret in an existing secret group.

curl -X POST "https://{instance_id}.{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/{secret_type}/locks/groups/{group_id}/{secret_id}/versions/current/unlock" -H 'X-Vault-Token: {Vault-Token}'
-H 'Content-Type: application/json' -D '{
"locks": ["lock-name-1", "lock-name-2"]
}'





 Example response 

A request to remove all locks returns the following response:

{
"request_id": "4708ebbf-eab0-e68a-9e72-d1c67a209fdc",
"lease_id": "",
"renewable": false,
For more information about deleting root keys, see the following topics.



* [Key Protect - Deleting keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-keys)
* [Hyper Protect Crypto Services - Deleting keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-keys)



For more information about how to see the list of deleted root keys and possibly restore imported root keys, see [Restoring deleted root keys](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managing&interface=uibyok-restore-root-key).





 Restoring deleted root keys 

Restoring an imported root key returns the key to an active state, and reestablishes access to the key. (Root keys that were generated by the KMS can't be restored.) You can restore access to all resources that were previously protected by the root key. You can resume regular actions, such as restarting an instance and attaching data volumes.

To see a list of deleted root keys for a KMS instance, you can filter by key state. For example, to filter a list of deleted root keys in a Key Protect instance in the UI:



1. Go to the [IBM Cloud console](https://cloud.ibm.com/vpc) > Resource List > Security,
2. Locate, and click the KMS instance.
3. On the Keys page, the list of root keys that are stored in this instance is displayed.
4. Click the Filter icon![Filter icon](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc//images/filter-icon.png) to see more information.
5. Under States, click the down arrow to display all key states.
6. Select Deleted.
If needed, you can [force deletion on a key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-keysdelete-keys-force-delete) by using the Key Protect APIs. [Review which resources are encrypted by the key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-view-protected-resources) and verify with the owner of the resources to ensure you no longer require access to that data.

If you can't delete a key because a retention policy exists on the associated resource, contact the account owner to remove the retention policy on that resource.
* What happens when I disable a key?

When you disable a key, the key transitions to the Suspended state. Keys in this state are no longer available for encrypt or decrypt operations, and any data that's associated with the key becomes inaccessible.

Disabling a key is a reversible action. You can always [enable a disabled key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-disable-keysenable-api) and restore access to the data that was previously encrypted with the key.
* What is a dual authorization policy?

Dual authorization is a two-step process that requires an action from two approvers to delete a key. By forcing two entities to authorize the deletion of a key, you minimize the chances of inadvertent deletion or malicious actions.

With Key Protect, you can [enforce dual authorization policies](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-dual-auth) at the instance level or for individual keys.
* What happens after I enable a dual authorization policy?

After you enable a dual authorization policy for a Key Protect instance, any keys that you add to the instance inherit the policy at the key level. Dual authorization policies for keys cannot be reverted.

If you have existing keys in a Key Protect instance, those keys will continue to require only a single authorization to be deleted.
"collectionType": "application/vnd.ibm.kms.error+json",
"collectionTotal": 1
},
"resources": [
{
"errorMsg": "Key could not be deleted. Please 'reasons' for more details.",
"reasons":
{
"code": "PREV_KEY_DEL_ERR",
"message": "The key cannot be deleted because it's protecting a cloud resource that has a retention policy.",
"status": 409,
"moreInfo":"https://cloud.ibm.com/apidocs/key-protect"
}
]
}
]
}
Show more









 7 - Key has already been deleted... 



 Message 

Key has already been deleted: Please delete references to this key

Reason code: KEY_DELETED_ERR





 HTTP status code 

410 - Gone

The HTTP 410 Gone client error response code indicates that access to the target resource is no longer available at the origin server and that this condition is likely to be permanent.

If you don't know whether this condition is temporary or permanent, a 404 status code should be used instead.

A 410 response is cacheable by default.





 Context 

The delete key request fails because the key was previously deleted. You cannot delete a key more than once.



 Example 

 delete an existing key
$ ibmcloud kp key delete $KEY_ID -i $KP_INSTANCE_ID

Deleting key: '0c17...<redacted>...5c34', from instance: 'a192...<redacted>...7411'...
OK
Deleted Key
0c17...<redeacted>...5c34

 this request fails because the key was previously deleted
If the value is Enabled, the cloud resource can't be erased, and the key that is associated with the cloud resource can't be deleted. If the value is Disabled, the cloud resource can be erased. You can delete the key that is associated with the cloud resource if needed. 



5. Click the caret (^) icon under the Resource name column to view a list of details for a specific registration.

The following table describes the registration details.



Table 5. Describes the properties that are associated with a resource

 Field Description 

 Created The date and time that the resource was first associated with the key. 
 Last updated The date and time that the registration was updated. 
 Description The description of the registration. 
 Key version ID The version of the root key that's protecting the cloud resource. 
 Key version date The date and time that the root key version was updated. 
 Cloud resource name Represents the cloud resource that is associated with the key, including the Cloud Resource Name (CRN), version, cname, ctype, and so on. 





Besides searching for a resource, you can also for resources by Resource Name, key ID, and retention policy. To do so, click the Filter button, select the filter options from the list, and click Apply.







 Viewing protected resources with the API 

You can also browse the registrations that are available between your Hyper Protect Crypto Services keys and cloud resources by using the Hyper Protect Crypto Services key management service API.

For example, when you call GET api/v2/keys/{id}/registrations, Hyper Protect Crypto Services returns details about the key registration. The following JSON output represents a registration between a key and a cloud resource.

{
"metadata": {
"collectionType": "application/vnd.ibm.kms.registration+json",
"collectionTotal": 1
},
"resources": [
{
"keyId": "string",
"resourceCrn": "crn:v1:bluemix:public:<service-name>:<region>:a/<account-id>:<service-instance>:bucket:<bucket-name>",