vania-janet/multiturn-rag-retrieval-data huggingface dataset:
[schedule-delete](https://cloud.ibm.com/docs/cli?topic=cli-key-protect-cli-referencekp-key-schedule-delete) Authorize a key, with a dual-auth-delete policy, to be deleted 
 [show](https://cloud.ibm.com/docs/cli?topic=cli-key-protect-cli-referencekp-key-show) Retrieve a key 
 [sync](https://cloud.ibm.com/docs/cli?topic=cli-key-protect-cli-referencekp-key-sync) Synchronize a key's associated resources 
 [unwrap](https://cloud.ibm.com/docs/cli?topic=cli-key-protect-cli-referencekp-key-unwrap) Unwrap a data encryption key 
 [update](https://cloud.ibm.com/docs/cli?topic=cli-key-protect-cli-referencekp-key-update) Update a key, transferring it to a new key ring 
 [versions](https://cloud.ibm.com/docs/cli?topic=cli-key-protect-cli-referencekp-key-versions) List all key versions 
 [wrap](https://cloud.ibm.com/docs/cli?topic=cli-key-protect-cli-referencekp-key-wrap) Wrap a data encryption key 







 kp key-ring command 

Key Ring support allows for managing groups of keys for best practices using kp key-ring.



Table 4. Sub-commands for managing key-rings

 Sub-command Status v0.7.0 Description 

 [create](https://cloud.ibm.com/docs/cli?topic=cli-key-protect-cli-referencekp-key-ring-create) Creates a key ring within a kp instance
For more information, search for [Removing an authorization](https://cloud.ibm.com/docs/account?topic=account-serviceauthremove-auth) in "Using authorizations to grant access between services".





 Restore temporary access 

To restore access after you temporarily remove it, follow these steps:



1. Re-create the authorization between your Watson service and Key Protect instance as shown in [Step 3. Grant service access](https://cloud.ibm.com/docs/watson-knowledge-studio?topic=watson-keyserviceserviceauth-key).
2. Tell your IBM Client Success Manager (CSM) that you want to restore access through Key Protect.



After you re-create the authorization and your CSM confirms Watson that any delegated authorizations are reconnected, the Watson instance starts accepting connections again.





 Permanently prevent access to your data 

To delete your data securely, delete both the encrypted Watson service instance and the Key Protect key.

When you delete a data encryption key, it is not recoverable and you cannot decrypt the key. You prevent further access to the data, but you also cannot recover the data.

For more information about deleting keys, see [Deleting keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-keys) in the Key Protect docs.





 Rotating keys 

Key rotation is an important part of mitigating the risk of a data breach. Periodically changing keys reduces the potential data loss if the key is lost or compromised. For more information, see [Setting a rotation policy](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-rotation-policy) in the Key Protect docs.





 Identify which key is encrypting your service instance 

To see which Key Protect instance is used to encrypt the data, use the link in the service details.



1. Go to your [resource list](https://cloud.ibm.com/resources).
2. Click the name of the Watson service instance.
3.
For more information, search for [Removing an authorization](https://cloud.ibm.com/docs/account?topic=account-serviceauthremove-auth) in "Using authorizations to grant access between services".





 Restore temporary access 

To restore access after you temporarily remove it, follow these steps:



1. Re-create the authorization between your Watson service and Key Protect instance as shown in [Step 3. Grant service access](https://cloud.ibm.com/docs/discovery?topic=watson-keyserviceserviceauth-key).
2. Tell your IBM Client Success Manager (CSM) that you want to restore access through Key Protect.



After you re-create the authorization and your CSM confirms Watson that any delegated authorizations are reconnected, the Watson instance starts accepting connections again.





 Permanently prevent access to your data 

To delete your data securely, delete both the encrypted Watson service instance and the Key Protect key.

When you delete a data encryption key, it is not recoverable and you cannot decrypt the key. You prevent further access to the data, but you also cannot recover the data.

For more information about deleting keys, see [Deleting keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-keys) in the Key Protect docs.





 Rotating keys 

Key rotation is an important part of mitigating the risk of a data breach. Periodically changing keys reduces the potential data loss if the key is lost or compromised. For more information, see [Setting a rotation policy](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-rotation-policy) in the Key Protect docs.





 Identify which key is encrypting your service instance 

To see which Key Protect instance is used to encrypt the data, use the link in the service details.



1. Go to your [resource list](https://cloud.ibm.com/resources).
2. Click the name of the Watson service instance.
3.
When you disable a root key that was previously enabled, the key transitions from the Active (value is 1) to the Suspended (value is 2) key state.

To disable a root key, you must be assigned a Manager service access role for the instance or key. To learn how IAM roles map to Key Protect service actions, check out [Service access roles](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-accessmanage-access-roles).

If you're using an integrated Cloud Service that supports revoking access to a disabled root key, the service may take up to a maximum of 4 hours before access to the root key's associated data is revoked.

After access to the associated data is revoked, a corresponding disable event is displayed in the IBM Cloud Activity Tracker web UI. The disable event indicates the key has been revoked (and is now disabled) and the key can not be used for encrypt and decrypt operations.

ibmcloud kp key disable KEY_ID_OR_ALIAS
-i, --instance-id INSTANCE_ID
[--key-ring KEY_RING_ID]



 Examples 

These are examples of kp key disable.



 Example 1 

Create a root key, disable it, verify the key state (suspended), enable the root key, and verify the key state (active).

 create a root key
$ ibmcloud kp key create my-root-key --output json

{
"id": "264fadc3-7667-4b25-916e-5825fe70de0b",
"name": "my-root-key",
"type": "application/vnd.ibm.kms.key+json",
"extractable": false,
"state": 1,
If you have existing keys in a Key Protect instance, those keys will continue to require only a single authorization to be deleted. If you want to enable those keys for dual authorization, you can use the Key Protect APIs t [set dual authorization policies for those individual keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-dual-auth-key-policy).





 Can I disable a dual authorization settings for my Key Protect instance? 

Yes. If you need to add a key that doesn't require dual authorization to your Key Protect instance, you can always [disable dual authorization for the Key Protect instance](/docs/key-protect?topic=key-protect-manage-dual-auth#disable dual-auth-instance-policy-ui) so that any new or future keys won't require it.





 What happens when I need to delete or deprovision my Key Protect instance? 

If you decide to move on from Key Protect, you must delete any remaining keys from your Key Protect instance before you can delete or deprovision the service. After you delete your Key Protect instance, Key Protect uses[envelope encryption](https://cloud.ibm.com/docs/key-protect?topic=key-protect-envelope-encryption) to crypto-shred any data that is associated with the Key Protect instance.





 Why does the user interface show unauthorized access? 

Setting and retrieving the network access policy is only supported through the application programming interface (API). Network access policy support will be added to the user interface (UI), command line interface (CLI), and software development kit (SDK) in the future.

After the network access policy is set to private-only the UI cannot be used for any Key Protect actions.

Keys in a private-only instance will not be shown in the UI and any Key Protect actions in the UI will return an unauthorized error (HTTP status code 401).
For example, you may get a 409 response when uploading a file which is older than the one already on the server resulting in a version control conflict.





 Context 

This error occurs when you try to authorize a deletion or remove an authorization and the key does not have a dual authorization policy.

These examples show the error using the API and the CLI.



 Example 1 

This example attempts to authorize a deletion and remove an authorization using the API.

 create a root key
$ curl -X POST "https://us-south.kms.cloud.ibm.com/api/v2/keys" -H "authorization: Bearer $ACCESS_TOKEN" -H "bluemix-instance: $KP_INSTANCE_ID" -H "content-type: application/vnd.ibm.kms.key+json" -d '{
"metadata": {
"collectionType": "application/vnd.ibm.kms.key+json",
"collectionTotal": 1
},
"resources": [
{
"type": "application/vnd.ibm.kms.key+json",
"name": "root-example-key",
"description": "root-example-key",
"extractable": false
}
]
}'
Show more



 JSON response 

{
"metadata": {
"collectionType": "application/vnd.ibm.kms.key+json",
"collectionTotal": 1
},
"resources": [
{
"type": "application/vnd.ibm.kms.key+json",
"id": "eb086d96-3b2c-48b5-bf31-c8f0305eea77",
"name": "root-example-key",
"description": "root-example-key",
"state": 1,
"extractable": false,
For more information, search for [Removing an authorization](https://cloud.ibm.com/docs/account?topic=account-serviceauthremove-auth) in "Using authorizations to grant access between services".





 Restore temporary access 

To restore access after you temporarily remove it, follow these steps:



1. Re-create the authorization between your Watson service and Key Protect instance as shown in [Step 3. Grant service access](https://cloud.ibm.com/docs/watson?topic=watson-keyserviceserviceauth-key).
2. Tell your IBM Client Success Manager (CSM) that you want to restore access through Key Protect.



After you re-create the authorization and your CSM confirms Watson that any delegated authorizations are reconnected, the Watson instance starts accepting connections again.





 Permanently prevent access to your data 

To delete your data securely, delete both the encrypted Watson service instance and the Key Protect key.

When you delete a data encryption key, it is not recoverable and you cannot decrypt the key. You prevent further access to the data, but you also cannot recover the data.

For more information about deleting keys, see [Deleting keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-keys) in the Key Protect docs.





 Rotating keys 

Key rotation is an important part of mitigating the risk of a data breach. Periodically changing keys reduces the potential data loss if the key is lost or compromised. For more information, see [Setting a rotation policy](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-rotation-policy) in the Key Protect docs.





 Identify which key is encrypting your service instance 

To see which Key Protect instance is used to encrypt the data, use the link in the service details.



1. Go to your [resource list](https://cloud.ibm.com/resources).
2. Click the name of the Watson service instance.
3.
[Actions icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/actions-icon-vertical.svg)> Delete.
5. Enter the name of the secret to confirm its deletion.
6. Click Delete.

After you delete a secret, the secret transitions to the Destroyed state. Secrets in this state are no longer recoverable. Metadata that is associated with the secret, such as the secret's deletion date, is kept in the Secrets Manager database.







 Deleting secrets from the CLI 

To delete a secret, run the [ibmcloud secrets-manager secret-delete](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-cli-plugin-secrets-manager-clisecrets-manager-cli-secret-delete-command) command.

ibmcloud secrets-manager secret-delete --id ID

After you delete a secret, the secret transitions to the Destroyed state. Secrets in this state are no longer recoverable. Metadata that is associated with the secret, such as the secret's deletion date, is kept in the Secrets Manager database.

For more information about the command options, see [ibmcloud secrets-manager secret](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-cli-plugin-secrets-manager-clisecrets-manager-cli-secret-command).





 Deleting secrets with the API 

You can delete secrets by calling the Secrets Manager API.

The following example request deletes a secret and its contents. When you call the API, replace the ID variables and IAM token with the values that are specific to your Secrets Manager instance.

curl -X DELETE
--H "Authorization: Bearer {iam_token}" 
"https://{instance_ID}.
Retrieving policy details for instance: a192d603-0b8d-452f-aac3-f9e1f95e7411...
OK
Created By user id ...<redacted>...
Creation Date 2020-06-22T16:17:52Z
Last Updated 2020-06-22T18:17:32Z
Updated By user id ...<redacted>...
Policy Type allowedNetwork
Enabled true
Network Allowed public-and-private





 Required parameters 



* -d, --disable
* -e, --enable

Disable or enable the network access policy. One option is required.
* -i, --instance-ID

The IBM Cloud instance ID that identifies your Key Protect instance.

You can set an environment variable instead of specifying -i with the following command: $ export KP_INSTANCE_ID=<INSTANCE_ID>.
* -t, --network-type

Specify the type of network access allowed. Options are public-and-private or private-only.









 kp instance policy-update dual-auth-delete 

Use the dual-auth-delete policy to safely delete encryption keys. When you delete a key, you shred its contents and associated data. Any data that is encrypted by the key becomes inaccessible.

Deleting a key that has a dual authorization policy requires an authorization from two users.

For more information, see [deleting keys using dual authorization](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-dual-auth-keys) and [setting dual authorization policies for keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-dual-auth-key-policy).



 Notes 

Dual authorization delete for an instance is different than dual authorization delete for keys.

Once you enable dual-auth-delete for a key you cannot disable it or remove it. You must wait 7 days for the policy to expire.
After the key is disabled, the State of the key is moved to Suspended in the Keys table.





 Enabling a root key 

If you want to re-enable a root key that is [disabled](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-disable-keysdisable-ui), complete the following steps:

You must wait 30 seconds after you disable a root key before you are able to enable it again.



1. [Log in to the IBM Cloud console](https://cloud.ibm.com/).
2. Go to Menu > Resource list to view a list of your resources.
3. From your IBM Cloud resource list, select your provisioned instance of Hyper Protect Crypto Services.
4. On the KMS keys page, use the Keys table to browse the keys in your service.
5. Click the Actions icon ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/action-menu-icon.svg) to open a list of options for the key that you want to enable.
6. From the options menu, click Enable key.



After the key is enabled, the State of the key is transferred to Active in the Keys table.







 Disabling and enabling root keys with the API 



 Disabling a root key 

When you disable a root key, the key moves to the [Suspended state](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-key-states), and it can no longer be used to encrypt data.

For an integrated cloud service that supports revoking access to a disabled root key, the service can take up to 4 hours to revoke access to the associated data of the root key. After access to the associated data is revoked, a corresponding disable event is displayed in the Activity Tracker web UI.
However, if you power down the VM and then power it back on, any instances with encrypted boot volumes do not start. You can enable a root key in a suspended state and resume normal operations. For more information, see [Disabling root keys](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managingbyok-disable-root-keys).

Deleting a root key has greater consequences. Deleting a root key purges usage of the key for all resources in the VPC. By default, the KMS prevents you from deleting a root key that's actively protecting a resource. However, you can still force the deletion of a root key. You have limited time to [restore a deleted root key](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managingbyok-restore-root-key) that you imported to the KMS. For more information, see [Deleting root keys](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managingbyok-delete-root-keys).
* Can I remove IAM authorization from Cloud Block Storage for VPC to the KMS and still delete my Block Storage for VPC volumes with customer-managed encryption?

 Can I remove IAM authorization from Cloud Block Storage for VPC to the KMS and still delete my Block Storage for VPC volumes with customer-managed encryption? 

If you remove IAM authorization before you delete your BYOK volume (or image), the delete operation completes without unregistering the root keys in the KMS instance. In other words, the root key remains registered for a resource that doesn't exist. Always delete a BYOK resource before you remove IAM authorization. For more information about safely removing service authorization, see [Removing service authorization to a root key](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managinginstance-byok-inaccessible-data).
* What can I do if my root key is compromised?
All data is retained, subject to the normal retention limits configured in your instance.

An activity tracker event is generated to report the action. For more information, see [Activity Tracker events](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-at_events).





 Rotating the key 

Key Protect and Hyper Protect Crypto Services support the rotation of root keys, either on demand or on a schedule. When this occurs, Event Notifications adopts the new key by rewrapping the DEK as described in [how customer-managed encryption works](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-managing-encryptionen-encryption-how).

An activity tracker event is generated to report the action. For more information, see [Activity Tracker events](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-at_events).







 Disabling customer-managed encryption 

After enabling customer-managed encryption, it is not possible to disable it. Instead, you must delete the service instance and create a new instance.
A successful request returns an HTTP 204 No Content response, which indicates that your Key Protect instance is now enabled for dual authorization. Keys that you create or import to the service now require two authorizations before they can be deleted. For more information, see [Deleting keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-keys).

This new policy does not affect existing keys in your instance. If you need to enable dual authorization for an existing key, see [Creating a dual authorization policy for a key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-dual-auth-key-policycreate-dual-auth-key-policy-api).





 Optional: Verify dual auth policy enablement 

You can verify that a dual auth policy key has been enabled by issuing a list policies request:

$ curl -X GET "https://<region>.kms.cloud.ibm.com/api/v2/instance/policies?policy=dualAuthDelete"   -H "accept: application/vnd.ibm.kms.policy+json"   -H "authorization: Bearer <IAM_token>"   -H "bluemix-instance: <instance_ID>"

Where the <instance_ID> is the name of your instance and your <IAM_token> is your IAM token.





 Disabling dual authorization for your Key Protect instance with the console 

If you prefer to disable a dual authorization policy on your instance by using a graphical interface, you can use the IBM Cloud console.

After creating a Key Protect instance, complete the following steps to create a dual authorization policy:



1. [Log in to the IBM Cloud console](https://cloud.ibm.com/login/).
2. Go to Menu > Resource List to view a list of your resources.
3. From your IBM Cloud resource list, select your provisioned instance of Key Protect.
4. On the Instance policies page, use the Policies table to browse the policies in your Key Protect instance.
5.
Table 2. Describes how key states affect service actions.

 Action Pre-active Active Suspended Deactivated Destroyed 

 Get key. ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/checkmark-icon.svg) ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/checkmark-icon.svg) ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/checkmark-icon.svg) ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/checkmark-icon.svg) ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/checkmark-icon.svg) 
 List keys. ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/checkmark-icon.svg) !
For more information, see [Deleting keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-keys).
3. Optional: Verify that the dual authorization policy was updated by browsing the policies that are available for your Hyper Protect Crypto Services instance.

curl -X GET 
'https://api.<region>.hs-crypto.cloud.ibm.com:<port>/api/v2/instance/policies?policy=dualAuthDelete' 
  -H 'authorization: Bearer <IAM_token>' 
  -H 'bluemix-instance: <instance_ID>' 
  -H 'accept: application/vnd.ibm.kms.policy+json'
reasons='[AUTHORIZATIONS_NOT_MET: Number of authorizations required to delete is not met -
FOR_MORE_INFO_REFER: https://cloud.ibm.com/apidocs/key-protect]'

 disable the instance dual authorization policy
$ ibmcloud kp instance policy-update dual-auth-delete --disable

Updating instance policy...
OK

 attempt to delete the key - this fails because the key policy
 does not change when the instance policy is updated
$ ibmcloud kp key delete 6a8a129b-0cd4-4667-ba57-b355a125a7ca

Deleting key: 6a8a129b-0cd4-4667-ba57-b355a125a7ca, from instance: a192d603-0b8d-452f-aac3-f9e1f95e7411...
FAILED
kp.Error:
correlation_id='cbc0d18b-a816-45ab-af6a-b8e18dc3e628',
msg='Conflict: 1 prior authorization(s) are required for deletion: Key could not be deleted. Please see "reasons" for more details.',
reasons='[AUTHORIZATIONS_NOT_MET: Number of authorizations required to delete is not met -
FOR_MORE_INFO_REFER: https://cloud.ibm.com/apidocs/key-protect]'







 Required parameters 



* -d, --disable
* -e, --enable

Disable or enable the dual authorization policy. One option is required.
* -i, --instance-ID

The IBM Cloud instance ID that identifies your Key Protect instance.

You can set an environment variable instead of specifying -i with the following command: $ export KP_INSTANCE_ID=<INSTANCE_ID>.









 kp key alias-create 

Creates an alias for a key and displays the output in JSON format.