vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* UI
* API







 Viewing a list of keys 

You can view a list of your managed keys in Unified Key Orchestrator with the IBM Cloud® console, or programmatically with the Unified Key Orchestrator API.



 Viewing a list of keys with the IBM Cloud console 

To view a list of your keys by using the console, complete the following steps:



1. [Log in to the Hyper Protect Crypto Services instance](https://cloud.ibm.com/login).
2. Click Managed keys from the navigation to view all the available keys.
3. Browse the general characteristics of your keys in the table.

To customize how the table is to be presented, click the Settings icon![Settings icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/settings.svg) and check the columns to be displayed.



Table 1. Managed keys table

 Property Description 

 Name The unique, human-readable name that is assigned to your key. 
 Version The version of the managed key. It is in the format of V plus the version number. For example, V2 means that [the key was rotated](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-rotate-keys) once and this is the second version of the key material. 
 ID A string that uniquely identifies the key. 
 Vault The vault that controls access to the managed key. 
 State Key states include Pre-active, Active, Deactivated, and Destroyed. For more information, see [Monitoring the lifecycle of encryption keys in Unified Key Orchestrator](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-key-states).<br><br>If your key state is different from the key state in its target keystores, an Out of sync flag is displayed beside the state. There can be multiple reasons why the key state is out of sync.
For more information, see [Monitoring the lifecycle of encryption keys in Unified Key Orchestrator](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-key-states). 
 Last rotated The time range when the key was last rotated. 









 Searching for keys with the IBM Cloud console 

To search for a key by using the console, complete the following steps:



1. [Log in to the Hyper Protect Crypto Services instance](https://cloud.ibm.com/login).
2. Click Managed keys from the navigation to view all the available keys.
3. To search for key name or description, type a word in the search bar.







 Searching keys with the API 

To search for a managed key by ID through the API, follow these steps:



1. [Retrieve your service and authentication credentials to work with keys in the service](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-uko-api).
2. Retrieve a managed key and its details by making a GET call to the following endpoint.

https://uko.<region>.hs-crypto.cloud.ibm.com:<port>/api/v4/managed_keys/<id>

Replace <id> with the ID of your managed key.

For detailed instructions and code examples about using the API method, check out the [Hyper Protect Crypto Services Unified Key Orchestrator API reference doc](https://cloud.ibm.com/apidocs/ukoget-managed-key).







 What's next 



* To find out more about managing your key list, check out [Viewing a list of keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-key-list).
* To find out instructions on editing a managed key, check out [Editing key details](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-edit-kms-keys).
The command returns the output similar to the following example:

{
"status_in_keystores": [
{
"keystore": {
"id": "b28bf13d-f49d-4b00-8b8d-457d38ad1e15",
"name": "AWS KMS Keystore Name",
"type": "aws_kms",
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/keystores/b28bf13d-f49d-4b00-8b8d-457d38ad1e15"
},
"status": "not_present"
}
]
}







 hpcs uko managed-key-update-from-template 

Update a managed key to match the latest version of the associated key template. You can install, activate, or deactivate the key on target keystores in the group defined by the key template.

ibmcloud hpcs uko managed-key-update-from-template --id ID --uko-vault UKO-VAULT --if-match IF-MATCH



* Command options

--id (string)
: Required. The UUID of the key. You can use the ibmcloud hpcs uko managed-keys command to retrieve the key UUID.

--uko-vault (string)
: Required. The UUID of the vault where the update is to take place. You can use the ibmcloud hpcs uko vaults command to retrieve the vault UUID.

--if-match (string)
: Required. The precondition of the update, which is the value of the ETag from the header on a GET request. You can use the ibmcloud hpcs uko managed-key command to retrieve the ETag.
* Example

ibmcloud hpcs uko managed-key-update-from-template
[Listing all backup policy plans](https://cloud.ibm.com/apidocs/vpc/latestlist-backup-policy-plans) or a specific [plan details](https://cloud.ibm.com/apidocs/vpc/latestget-backup-policy-plan) shows the copies of the snapshot in other regions. For more information, see [Cross-regional backup copies](https://cloud.ibm.com/docs/vpc?topic=vpc-backup-service-aboutbackup-service-crc).

Extended SSH key encryption. When [creating](https://cloud.ibm.com/apidocs/vpc/latestcreate-key) an SSH key, you can now specify a type property value of ed25519 for the crypto-system used by the key. If type is not specified during key creation, the default value rsa continues to be used. When [listing all keys](https://cloud.ibm.com/apidocs/vpc/latestlist-keys) and [retrieving a key](https://cloud.ibm.com/apidocs/vpc/latestget-key), the response provides the key type used. For more information, see [Getting started with SSH keys](https://cloud.ibm.com/docs/vpc?topic=vpc-ssh-keys&interface=api). See also [Extended SSH key encryption](https://cloud.ibm.com/docs/vpc?topic=vpc-metadata-api-change-log27-june-2023-metadata) in the VPC Instance Metadata API change log.







 20 June 2023 



 For all version dates 

Instance group integration with Network Load Balancer for VPC. Network load balancer is now integrated with instance groups to improve pool member scaling.
Once the encryption keys are deleted, you can be assured that your data that is protected by these keys is no longer retrievable. The service is built on FIPS 140-2 Level 4 certified HSM, which offers the highest level of protection in the cloud industry. Hyper Protect Crypto Services provides the same [key management service API](https://cloud.ibm.com/apidocs/hs-crypto) as IBM Key Protect for IBM Cloud for you to build your applications or leverage IBM Cloud data and infrastructure services.
* What is Hardware Security Module?

A Hardware Security Module (HSM) provides secure key storage and cryptographic operations within a tamper-resistant hardware device for sensitive data. HSMs use the key material without exposing it outside the cryptographic boundary of the hardware.
* What is a cloud HSM?

A cloud HSM is a cloud-based hardware security module to manage your own encryption keys and to perform cryptographic operations in IBM Cloud. Hyper Protect Crypto Services is built on FIPS 140-2 Level 4 certified HSM, which offers the highest level of protection in the cloud industry. With the Keep Your Own Key (KYOK) support, customers can configure the master key An encryption key that is used to protect a crypto unit. The master key provides full control of the hardware security module and ownership of the root of trust that encrypts the chain keys, including the root key and standard key. and take the ownership of the cloud HSM. Customers have full control and authority over the entire key hierarchy, where no IBM Cloud administrators have access to your keys.
* What are the responsibilities of users and IBM Cloud for Hyper Protect Crypto Services?

Hyper Protect Crypto Services is a platform-as-a-service on IBM Cloud. IBM Cloud is responsible for management of servers, network, storage, virtualization, middleware, and runtime, which ensures good performance and high availability. Customers are responsible for the management of data and applications, specifically encryption keys that are stored in Hyper Protect Crypto Services and user applications that use keys or cryptographic functions for cryptographic operations.
* How is this service different from IBM Cloud HSM?

IBM has an IaaS IBM Cloud HSM service, which is different from the Hyper Protect Crypto Services.
Monitoring the lifecycle of encryption keys - Standard Plan 

IBM Cloud® Hyper Protect Crypto Services follows the security guidelines by [NIST SP 800-57 for key states](https://www.nist.gov/publications/recommendation-key-management-part-1-general-0).



 Key states and transitions 

Cryptographic keys, in their lifetime, transition through several states that are a function of how long the keys are in existence and whether data is protected.

Hyper Protect Crypto Services provides a graphical user interface and a REST API for tracking keys as they move through several states in their lifecycle. The following diagram shows how a key passes through states between the generation and the destruction.

Zoom

![Encryption key states and transitions](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/hs-crypto//images/key-states.svg)

Figure 1. Key states and transitions



Table 1. Describes key states and transitions.

 State Integer Mapping Description 

 Pre-active 0 Keys are initially created in the Pre-active state. A pre-active key cannot be used to cryptographically protect data. 
 Active 1 Keys move immediately into the Active state on the activation date. This transition marks the beginning of a key's cryptoperiod. Keys with no activation date become active immediately and remain active until they expire or are destroyed. 
 Suspended 2 A key moves into the Suspended state when it is [disabled for encrypt and decrypt operations](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-disable-keys). In this state, the key is unable to cryptographically protect data and can be moved only to the Active or Destroyed states. 
 Deactivated 3 A key moves into the Deactivated state on the expiration date, if one is assigned. In this state, the key is unable to cryptographically protect data and can be moved only to the Destroyed state. 
 Destroyed 5 Deleted keys are in the Destroyed state.
Encryption key -
Encryption provider_managed
Resource group defaults
Created 2023-02-23T18:52:00+00:00
Zone eu-de-2
Health State ok
Volume Attachment Instance Reference -
Source snapshot ID Name
r138-92c3efcb-4588-4c9c-828b-c52836629954 my-bootable-snapshot

Operating system CentOS 7.x - Minimal Install (amd64)
Source image ID Name
r010-067bd38b-7ddd-49d9-a7f3-6e0a798e0554 ibm-centos-7-9-minimal-amd64-5

Active false
Busy false
Tags env:test,bkp:test,bcp:test







 Applying tags to Block Storage for VPC volumes with the API 

To apply tags to a Block Storage for VPC volume, follow these steps:



1. Make a GET /volumes/{volume_id} call and copy the hash string from the Etag property in the response header. You need to use the hash string when you specify If-Match in the PATCH /volumes/{volume_id} request to create user tags for the volume in step 2. To generate the response header information, make an API call similar to the following example:

curl -sSL -D GET "https://us-south.iaas.cloud.ibm.com/v1/volumes/{volume_id}?version=2022-04-25&generation=2" -H "Authorization: Bearer $TOKEN" -o /dev/null

In the response header, you see something like this:

HTTP/2 200
date: Tue, 28 Apr 2022 17:48:03 GMT
content-type: application/json; charset=utf-8
content-length: 1049
cf-ray: 69903d250c4966ef-DFW
cache-control: max-age=0, no-cache, no-store, must-revalidate
expires: -1
Why can't I view or list specific keys? 

When you call the Hyper Protect Crypto Services key management service API, you're unable to list specific keys that you have access to.

  What’s happening 

You call GET api/v2/keys to list the keys that are available in your service instance.

You can see a list of keys, but you can't find a specific key that is stored in the instance. You verify with your administrator that you're assigned the applicable [level of access to keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-grant-access-keys) that you're unable to view. You also verify with your administrator that the key belongs to the service instance that you're targeting.

  Why it’s happening 

The service instance contains a large number of keys, and the specific keys that you're looking for aren't returned by default when you call GET api/v2/keys to list keys.

  How to fix it 

Check with an administrator to understand the total number of keys that are stored in the instance. By default, GET api/v2/keys returns the first 200 keys. If the service instance contains more than 200 keys, you need to use the [offset and limit parameters](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-keysretrieve-subset-keys-api) to list another subset of keys.

For example, if you want to list keys 201 - 210 that are available in a service instance, you use ../keys?offset=200&limit=10 to skip the first 200 keys.
If you need to adjust resources or use a Key Protect key, add any of the optional parameters key_protect_key, members_disk_allocation_mb, members_memory_allocation_mb, and members_cpu_allocation_count, and their preferred values to the body of the request.







 Backups and Restoration 



* IBM Cloud Databases are not responsible for restoration, timeliness, or validity of said backups.
* Actions that you take as a user can compromise the integrity of backups, such as under-allocating memory and disk. Users can monitor that backups are successful by using the API, and periodically restore a backup to ensure validity and integrity. Users can retrieve the most recent-scheduled backup details from the [Cloud Databases CLI plug-in](https://cloud.ibm.com/docs/databases-for-elasticsearch?topic=databases-for-elasticsearch-dashboard-backupsbackups-in-the-cli) and the [Cloud Databases API](https://cloud.ibm.com/docs/databases-for-elasticsearch?topic=databases-for-elasticsearch-dashboard-backupsrestoring-a-backup-through-the-api).
* As a managed service, Cloud Databases monitors the state of your backups and can attempt to remediate when possible. If you encounter issues from which you cannot recover, contact support for more help.







 Backup Locations 

Backup location differs per database region. Ensure that the backup region location matches your data location requirements.



Table 1. Database and Backup Regions

 Database Region Backup Region 

 Dallas US Cross Regional Object Storage 
 Washington D.C. US Cross Regional Object Storage 
 London EU Cross Regional Object Storage 
 Frankfurt EU Cross Regional Object Storage 
 Tokyo AP Cross Regional Object Storage 
 Osaka AP Cross Regional Object Storage 
 Sydney AP Cross Regional Object Storage 
 Toronto Montreal Object Storage 
 Chennai Chennai Object Storage 
 Sao Paolo Sao Paolo Object Storage 



For more details about Cloud Databases Object Storage locations, review the location's [documentation](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-endpointsendpoints-geo).





 Point-in-Time Recovery
11-May 19:30:36 -0500 BKUP-I-04128 job completed at 11-May-2022 19:30:36 -0500
11-May 19:30:36 -0500 BKUP-I-04129 elapsed time 00:00:10 ...

You can use the following syntax to show only backup data size.

for i in $(ls -d /); do echo "backup history of $i"; find $i -name ".XLOG" ! -name "Agent" -print -exec /opt/BUAgent/xlogcat {} ; | grep -A 1 "deltized bytes processed"; done

backup history of AgtUpgd.backup/
backup history of Languages/
backup history of test/
13-May 19:30:31 -0500 BKUP-I-00013 deltized bytes processed: 0 (0 bytes)
13-May 19:30:31 -0500 BKUP-I-00014 compressed bytes processed: 0 (0 bytes)
11-May 19:30:36 -0500 BKUP-I-00013 deltized bytes processed: 0 (0 bytes)
11-May 19:30:36 -0500 BKUP-I-00014 compressed bytes processed: 0 (0 bytes)
10-May 19:30:15 -0500 BKUP-I-00013 deltized bytes processed: 0 (0 bytes)
10-May 19:30:15 -0500 BKUP-I-00014 compressed bytes processed: 0 (0 bytes)
* I'd like to free up space in my vault, how can I remove a specific safeset?

Customers cannot delete the backup safesets. If you want to remove a specific safeset, create a [support case](https://cloud.ibm.com/unifiedsupport/supportcenter) so that the IBM Cloud Backup Admins can erase it on the backend.

When a Backup deletion request is submitted to the vaults, the data is automatically deleted from the associated vaults. Because backup deletion requests are submitted and processed by the vaults immediately, backup deletion requests cannot be canceled.
--id=93777bca-baef-4070-b9b5-a2e6079df1b4 
--uko-vault=5295ad47-2ce9-43c3-b9e7-e5a9482c362b 
--output json
* Output

The command returns the output similar to the following example:

{
"total_count": 3,
"limit": 20,
"offset": 0,
"first": {
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/managed_key/5295ad47-2ce9-43c3-b9e7-e5a9482c362b/associated_resources?limit=20"
},
"last": {
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/managed_key/5295ad47-2ce9-43c3-b9e7-e5a9482c362b/associated_resources?limit=20&offset=0"
},
"previous": {
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/managed_keys?offset=80"
},
"next": {
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/managed_keys?offset=120"
},
"associated_resources": [
{
"vault": {
"id": "5295ad47-2ce9-43c3-b9e7-e5a9482c362b",
"name": "Test Vault Name",
* Decide whether you might want to make your data temporarily inaccessible by [removing service authorization](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managing&interface=uiinstance-byok-inaccessible-data).
* Review the [Activity Tracker](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managing&interface=uibyok-key-rotation-activity-tracker-events) to verify events as you manage the lifecycle of your keys.





 View root key registrations 

Block Storage for VPC volumes, snapshots, File Storage for VPC shares, and custom images that are encrypted with your key are registered against the root key in the key management service (Key Protect or Hyper Protect Crypto Services). By viewing the registration, you can map your resources to their associated encryption keys. You can quickly see which resources are protected by a root key. You can also assess the risk that is involved in disabling or deleting a key by viewing which keys are actively protecting data.

For more information the following topics.



* Key Protect - [Viewing associations between root keys and encrypted IBM Cloud resources](https://cloud.ibm.com/docs/key-protect?topic=key-protect-view-protected-resources)
* Hyper Protect Crypto Services - [Viewing associations between root keys and encrypted IBM Cloud resources](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-protected-resources)







 Verify root key rotation in the UI 

When you create volume, snapshot, file share, or custom image with customer-managed encryption, your root key is automatically registered in the KMS instance. You can view the registration to verify whether the key was rotated. The following procedure shows how to verify key rotation for a Block Storage for VPC volume, but steps are similar for other resources.



1. From the [IBM Cloud console)](https://cloud.ibm.com/login), go to menu icon !
Key storage is reencrypted. Encryption keys that are managed in the service instance are decrypted using the current master key in the current master key registers and reencrypted using the new master key in the new master key registers.
5. The new master key is loaded to the current master key registers of the operational and recovery crypto units for the service instance in Valid state, and the new master key registers are cleared and back to Empty state.



For detailed instructions on how to rotate master keys by using recovery crypto units, see [Rotating master keys by using recovery crypto units](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-rotate-master-key-cli-recovery-crypto-unit).





 Rotating master keys by using workstation files 

Master keys that are created from workstation files can be rotated by using TKE CLI plug-in. When master keys are rotated, master key parts are stored in files on the local workstation.

Similar to using the Management Utilities, you need to first create the 2 or 3 key parts that you are going to use. To be able to rotate the master key, the current master key registers must be in Valid state with the same verification pattern and the new master key registers must be Empty.

You can rotate the master key using TKE CLI plug-in regardless of whether your service instance has recovery crypto units assigned to it or not.

The following flow shows how master key rotation works in this mode:



1. Load the new master key register by using the cryptounit-mk-load command. The state of the new master key register is changed from Empty to Full uncommitted.
2. Commit the new master key value by using the cryptounit-mk-commit command. The new master key register state is changed to Full committed.
3. Reencrypt key storage and activate the new master key by using the cryptounit-mk-rotate command:



1. Encryption keys in key storage are decrypted by using the value in the current master key register and then reencrypted by using the value in the new master key register.
[Viewing associations between root keys and encrypted IBM Cloud resources](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-protected-resourcesview-protected-resources)



* [Viewing protected resources with the console](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-protected-resourcesview-protected-resources-gui)
* [Viewing protected resources with the API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-protected-resourcesview-protected-resources-api)
* [What's next](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-protected-resourcesview-protected-resources-next-steps)



[Synchronizing associated resources](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-sync-associated-resourcessync-associated-resources)



* [Syncing associated resources with the console](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-sync-associated-resourcessync-associated-resources-ui)
* [Syncing associated resources with the API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-sync-associated-resourcessync-associated-resources-api)







 Managing EP11 keys, keystores, and certificates - Standard Plan 

[Managing EP11 keystores with the IBM Cloud console](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-ep11-keystores-uimanage-ep11-keystores-ui)



* [Before you begin](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-ep11-keystores-uimanage-ep11-keystores-ui-before)