vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Creating key: 'my-root-key', in instance: '390086ac-76fa-4094-8cf3-c0829bd69526'...
OK
Key ID Key Alias
24203f96-b134-440e-981a-a24f2d432256 my-alias







 Required parameters 



* KEY_ID

The ID of the key that you want to modify. To retrieve a list of your available keys, run the [kp keys](https://cloud.ibm.com/docs/key-protect-cli-plugin?topic=key-protect-cli-plugin-key-protect-cli-referencekp-keys) command.
* KEY_ALIAS

The alias, or alternate identifier, of the key that you want to modify. The identifier must be: alphanumeric, and no spaces or special characters other than '-' or '_', and can not be a version 4 UUID.
* -i, --instance-ID

The IBM Cloud instance ID that identifies your Key Protect instance.

You can set an environment variable instead of specifying -i with the following command: $ export KP_INSTANCE_ID=<INSTANCE_ID>.







 Optional parameters 



* -o, --output

Set the CLI output format. By default, all commands print in table format. To change the output format to JSON, use --output json.









 kp key cancel-delete 

A key with a dual-auth-delete policy requires authorization from two administrative users to delete the key.

This command (kp key cancel-delete) cancels, or removes, a prior authorization.

The [kp key schedule-delete](https://cloud.ibm.com/docs/key-protect-cli-plugin?topic=key-protect-cli-plugin-key-protect-cli-referencekp-key-schedule-delete) command is the "authorization" to delete the key.

Follow this process to delete a key with a dual-auth-delete policy.
You can only restore root keys that were created with a key material, using kp key create with the -k, --key-material option. You cannot restore a root key if the --key-material option was not specified.

If you want to restore a deleted root key then you must save the key material that was used to create the root key. You cannot restore a deleted key without provided the original key material.

ibmcloud kp key restore KEY_ID_OR_ALIAS
-i, --instance-id INSTANCE_ID
-k, --key-material KEY_MATERIAL
[--key-ring KEY_RING_ID]
[-n, --encrypted-nonce ENCRYPTED_NONCE]
[-v, --iv IV]



 Examples 

These are examples of kp key restore.



 Example 1 

This example creates a root key using a key material, deletes the key, then restores the key.

 create a random, base64-encoded, 32-byte key material
$ KEY_MATERIAL=$(openssl rand -base64 32)

$ echo $KEY_MATERIAL

4EZBMBMkZ87z4nvYsQH21DC5+wslgWhHRiU8bmqJ4CY=

 create a root key from a base64-encoded value
$ KEY_ID=$(ibmcloud kp key create my-base64-root-key -k $KEY_MATERIAL --output json | jq -r '.["id"]')

$ echo $KEY_ID

62ad0cd5-70a4-4c4d-9d87-5f4db620b120

 delete the root key
$ ibmcloud kp key delete $KEY_ID

Deleting key: 62ad0cd5-70a4-4c4d-9d87-5f4db620b120, from instance: a192d603-0b8d-452f-aac3-f9e1f95e7411...
OK
Deleted Key
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/keystores/f6a5ccc1-7fc3-435e-9637-482e470ba8e8",
"ibm_api_endpoint": "https://us-south.kms.cloud.ibm.com",
"ibm_iam_endpoint": "https://iam.bluemix.net/identity/token",
"ibm_api_key": "",
"ibm_instance_id": "d139ea58-a073-441b-ba4e-dcc8bae58be4",
"ibm_variant": "hpcs",
"ibm_key_ring": "IBM-Cloud-KMS-Internal"
}







 hpcs uko keystore-delete 

Delete an internal keystore or remove a connection to an external keystore. The external keystore on the remote platform still exists after you remove the connection.

ibmcloud hpcs uko keystore-delete --id ID --uko-vault UKO-VAULT --if-match IF-MATCH



* Command options

--id (string)
: Required. The UUID of the keystore. You can use the ibmcloud hpcs uko keystores command to retrieve the UUID.

--uko-vault (string)
: Required. The UUID of the vault where the update is to take place. You can use the ibmcloud hpcs uko keystores command to retrieve the UUID.

--if-match (string)
: Required. The precondition of the update, which is the value of the ETag from the header on a GET request. You can use the ibmcloud hpcs uko keystore command to retrieve the ETag.
* Example

ibmcloud hpcs uko keystore-delete
As a result, [destroying resources](https://cloud.ibm.com/docs/key-protect?topic=key-protect-security-and-compliancedata-deletion) is not recommended for production environments unless absolutely necessary.

The following table lists the time frames in which you can view, restore, and purge a key after it has been deleted.



Table 1. Lists how users can interact with keys during certain time intervals after a key has been deleted

 Time from key deletion Name of key state Can view/access key data? Can restore? Can user initiate purge? 

 One second - Four hours Destroyed Yes Yes No 
 4 hours - 30 days Destroyed Yes Yes Yes 
 30-90 days Destroyed Yes No Yes 
 After 90 days Purged * No No Yes 



* Note: because purged keys are completely inaccessible and "destroyed" in the common usage of the word, there is technically no "purged" key state. Purged keys no longer exist and therefore don't have a "state" one way or another. However, it can be useful to think of "purged" as being a state as nonexistence is part of the lifecycle of a key.

Once a key has been purged, any API calls that use the Key ID of a purged key will result in a 404 HTTP Not Found error. If you are required to retain any data related to a purged key (key metadata, registrations, policies, etc) for an extended period of time, it is recommended to perform the necessary API or CLI calls to retrieve and store that data in your own storage device.



 Considerations before deleting and purging a key 

Key Protect blocks the deletion of any key that's actively protecting any registered cloud resources. Before you delete a key:



1. [Review the registered IBM resources](https://cloud.ibm.com/docs/key-protect?topic=key-protect-view-protected-resources) that are associated with the key.
view resources (COS and KMS should no longer exist)
$ ibmcloud resource service-instances

Retrieving instances with type service_instance in resource group Default in all locations under account <account name> as <email address>...
OK
No service instance found.







 Required parameters 



* KEY_ID_OR_ALIAS

The v4 UUID or alias of the key that you want to delete. To retrieve a list of your available keys, run the [kp keys](https://cloud.ibm.com/docs/cli?topic=cli-key-protect-cli-referencekp-keys) command.
* -i, --instance-id

The IBM Cloud instance ID that identifies your Key Protect instance.

You can set an environment variable instead of specifying -i with the following command: $ export KP_INSTANCE_ID=<INSTANCE_ID>.







 Optional parameters 



* -f, --force

Delete a key, with force, which is used to delete a key that has "registrations." Registrations are associations between root keys and other cloud resources, such as Cloud Object Storage (COS) buckets or Cloud Databases deployments.

For more information, see [kp registrations](https://cloud.ibm.com/docs/cli?topic=cli-key-protect-cli-referencekp-registrations)
* -o, --output

Set the CLI output format. By default, all commands print in table format. To change the output format to JSON, use --output json.
* --key-ring

A unique, human readable name for the key-ring. Required if the user doesn't have permissions on the default key ring.









 kp key disable 

The kp key disable command disables a root key and temporarily revokes access to the key's associated data in the cloud.
Retrieve the ID of the key ring that you want to delete.

You can find the ID for a key ring in your Hyper Protect Crypto Services instance by [retrieving a list of your key rings](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-managing-key-ringslist-key-ring).
3. Run the following curl command to delete the key ring.

$ curl -X DELETE "https://api.<region>.hs-crypto.cloud.ibm.com:<port>/api/v2/key_rings/<key_ring_id>" -H "authorization: Bearer <IAM_token>" -H "bluemix-instance: <instance_ID>" -H "prefer: <return_preference>"

Replace the variables in the example request according to the following table.



Table 5. Describes the variables needed to delete keys with the key management service API

 Variable Description 

 region Required. The region abbreviation, such as us-south, that represents the geographic area where your Hyper Protect Crypto Services instance resides. For more information, see [Regional service endpoints](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regionsservice-endpoints). 
 port Required. The port number of the API endpoint. 
 key_ring_id Required. The unique identifier for the key ring that you would like to delete. 
 IAM_token Required. Your IBM Cloud access token. Include the full contents of the IAM token, including the Bearer value, in the curl request. For more information, see [Retrieving an access token](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-access-token). 
 instance_ID Required. The unique identifier that is assigned to your Hyper Protect Crypto Services service instance.
* To find out more about managing your key list, check out [Viewing a list of keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-key-list) or [Filtering and searching keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-search-key-list).
* To find out instructions on deleting a managed key, check out [Deleting managed keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-managed-keys).
* To find out more about the UKO API, see [Unified Key Orchestrator API reference](https://cloud.ibm.com/apidocs/uko).
* [Considerations before you delete and purge a key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-purge-keysdelete-purge-keys-considerations)
* [What's next](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-purge-keysdelete-purge-keys-next)



[Deleting keys by using a single authorization](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-keysdelete-keys)



* [Deleting keys with the console](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-keysdelete-keys-gui)
* [Deleting keys with the API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-keysdelete-keys-api)
* [What's next](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-keysdelete-key-next)



[Deleting keys by using dual authorization](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-dual-auth-keysdelete-dual-auth-keys)



* [Considerations for deleting a key using dual authorization](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-dual-auth-keysdual-auth-deletion-considerations)
* [Authorize deletion for a key with the IBM Cloud console](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-dual-auth-keysset-key-deletion-console)
To soft delete versions of a secret instead, use the [delete specified versions](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-vault-manage-kv-cli&interface=uikv-delete-versions-cli) command.

vault kv destroy [-versions=VERSIONS] [-format=FORMAT] ibmcloud/kv/SECRET_NAME

Destroy the specified versions of a key-value secret in a custom group.

vault kv destroy [-versions=VERSIONS] [-format=FORMAT] ibmcloud/kv/GROUP_ID/SECRET_NAME



 Prerequisites 

You need the [Manager service role](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam) to delete secrets.





 Command options 

-versions
: The versions that you want to destroy.

-format
: Prints the output in the format that you specify. Valid formats are table, json, and yaml. The default is table. You can also set the output format by using the VAULT_FORMAT environment variable.





 Example 

Delete permanently specified versions of a key-value secret.

vault kv destroy -versions=2 ibmcloud/kv/my-test-kv-secret

Delete permanently specified versions of a key-value secret in a custom group.

vault kv destroy -versions=2 ibmcloud/kv/9426e546-83de-4da5-9631-d70c993186c8/my-test-kv-secret





 Output 

The command to destroy versions of a kv secret returns the following output:

Success! Data written to: ibmcloud/kv/undelete/my-test-kv-secret







 Create or update metadata key-value secret 

Create or update metadata of a key-value secret.

vault kv metadata put [-format=FORMAT] [METADATA_KEY_VALUE_PAIRS] ibmcloud/kv/SECRET_NAME

Create or update metadata of a key-value secret in a custom group.
delete<br><br>hs-crypto.secrets.ack-restore<br><br>hs-crypto.secrets.ack-rotate<br><br>hs-crypto.secrets.ack-enable<br><br>hs-crypto.secrets.ack-disable<br><br>hs-crypto.mtlscert-cert.read<br><br>hs-crypto.mtlscert-cert.list<br><br>hs-crypto.mtlscert-admin-key.read<br><br>hs-crypto.keystore.createkeystore<br><br>hs-crypto.keystore.listkeysbyattributes<br><br>hs-crypto.keystore.listkeysbyids<br><br>hs-crypto.keystore.listkeystoresbyattributes<br><br>hs-crypto.keystore.listkeystoresbyids<br><br>hs-crypto.keystore.storenewkey<br><br>hs-crypto.ep11.use 



The following table lists the status codes that are associated with each severity level:



Table 21z. Severity level for Hyper Protect Crypto Services response status codes

 Severity Status code 

 Critical 400 (For TKE events only), 401, 403, 500, 503, 507 
 Warning 400, 409, 424, 502, 504, 505
<br> <br>For more information, see [Retrieving an access token](https://cloud.ibm.com/docs/key-protect?topic=key-protect-retrieve-access-token). 
 instance_ID Required. The unique identifier that is assigned to your Key Protect service instance. <br>For more information, see [Retrieving an instance ID](https://cloud.ibm.com/docs/key-protect?topic=key-protect-retrieve-instance-ID). 



A successful request returns an HTTP 204 No Content response, which indicates that your key was authorized for deletion. Another user with a Manager access policy can now [delete the key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-keys) by using the Key Protect GUI or API.

If you need to prevent the deletion of a key that's already authorized for deletion, you can remove the existing authorization by calling POST /api/v2/keys/<keyID_or_alias>/actions/unsetKeyForDeletion.



 Delete the key 

After you set a key for deletion, another user with a Manager access policy can safely delete the key by using the Key Protect GUI or API.

Key Protect sets a seven-day authorization period that starts after you provide the first authorization to delete the key. During this seven-day period, the key remains in the [Active state](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-states) and all key operations are allowed on the key. If no action is taken by another user and the seven-day period expires, you must [restart the dual authorization process](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-dual-auth-keysdelete-dual-auth-keys-set-key-deletion-api) to delete the key.

Delete a key and its contents by making a DELETE call to the following endpoint.
$ curl -X DELETE "$KP_API_URL/api/v2/keys/$ROOT_KEY_ID" -H "accept: application/vnd.ibm.collection+json" -H "authorization: $ACCESS_TOKEN" -H "bluemix-instance: $INSTANCE_ID" | jq .
3. Remove the all the local files associated with this tutorial.

rm .json .bin .pem
4. Delete the test directory that you created for this tutorial.

cd .. && rm -r key-protect-test
5. Optional: Remove your Key Protect service instance.

ibmcloud resource service-instance-delete import-keys-demo

If you created more test keys in your Key Protect instance, be sure to [remove all encryption keys from your instance](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-keys) before you delete or deprovision the instance.







 Next steps 

In this tutorial, you learned how to set up the Key Protect API, create an encryption key, and securely import an encrypted key into your Key Protect instance.



* Learn more about [using your root key to protect data at rest](https://cloud.ibm.com/docs/key-protect?topic=key-protect-envelope-encryption).
* Deploy your root key across [supported cloud services](https://cloud.ibm.com/docs/key-protect?topic=key-protect-integrate-services).
* Learn more about the [Key Protect API](https://cloud.ibm.com/apidocs/key-protect).
If it is in use, you must remove it from the assistant that is using it before you can delete it.

Be sure to check with anyone else who might be using the skill before you delete it.

To delete a skill, complete the following steps:



1. Find out whether the skill is being used by any assistants. From the Skills page, find the tile for the skill that you want to delete. The Assistants field lists the assistants that currently use the skill.
2. If the skill you want to delete is associated with an assistant, then remove it from the assistant by completing the following steps:



* Check with the owner of the assistant that is using the skill before you remove the skill from it.
* Open the Assistants page, and then click to open the assistant tile.
* Find the tile for the skill that you want to delete. Click the ![open and close list of options](https://cloud.ibm.com/docs-content/v1/content/a2b18c153837bce00a5b4de496e4b4ca64bbf56e/assistant-data/images/kabob-beta.png) icon, and then choose Remove.
* Repeat the previous steps for any other assistants that use the skill.
* Return to the Skills page, and then find the tile for the skill that you want to delete.



3. Click the ![open and close list of options](https://cloud.ibm.com/docs-content/v1/content/a2b18c153837bce00a5b4de496e4b4ca64bbf56e/assistant-data/images/kabob-beta.png) icon, and then choose Delete. Confirm the deletion.
* The key is not dual auth enabled and cannot be set for deletion - [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-not-dual-auth-err)
* The key was updated recently: Please wait and try again - [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-req-too-early-err)
* This root key has been rotated within the last hour: Only one 'rotate' action per hour is permitted - [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-key-rotation-not-permitted)







 HTTP 410 - Gone 



* Key has already been deleted: Please delete references to this key - [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-key-deleted-err)







 HTTP 422 - Unprocessable Entity 



* Key is not in a valid state - [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-key-invalid-state-err)
* Requested action can only be completed with a root key - [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-key-root-req-reg-err)
* Signature is invalid [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-invalid-sig-exp-err-message)
* The provided ciphertext is invalid or corrupted - [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-unprocessable-ciphertext-err)
From the page for the specific configmap, click Actions > Delete configmap.



2. To delete a key-value pair for a specific configmap from the console,



1. Go to the Secrets and configmaps page from your [Code Engine Projects page](https://cloud.ibm.com/codeengine/projects).
2. Click the configmap that you want to change to open its page.
3. From the page for the specific configmap, delete the key-value pair that you want to remove.





You can also delete defined environment variables that reference secrets and configmaps. To delete a defined environment variable, from the Environment variables tab of your job or app and delete the environment variable that you want to delete. After you delete a defined environment variable, be sure to click Save to save the changes to your app or job. For more information, see [Delete an environment variable](https://cloud.ibm.com/docs/codeengine?topic=codeengine-envvarenvvar-delete-ui).





 Deleting configmaps with the CLI 



* To delete a configmap with the CLI, use the [configmap delete](https://cloud.ibm.com/docs/codeengine?topic=codeengine-clicli-configmap-delete) command; for example,

ibmcloud ce configmap delete --name myliteralconfigmap -f

Example output

Deleting configmap 'myliteralconfigmap'...
OK



You can also [delete environment variables](https://cloud.ibm.com/docs/codeengine?topic=codeengine-envvarenvvar-delete-cli) that reference secrets and configmaps from the CLI.
-i, --instance-id INSTANCE_ID
[--key-ring KEY_RING_ID]



 Example 

This is an example of scheduleing a key to be deleted.

 schedule this key to be deleted
$ ibmcloud kp key schedule-delete $KEY_ID_OR_ALIAS

Scheduling key for deletion...
OK

 this key has a dual-auth-delete policy
$ ibmcloud kp key policies $KEY_ID_OR_ALIAS --output json

[
{
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-06-22T19:13:00Z",
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:a192d603-0b8d-452f-aac3-f9e1f95e7411:policy:2427dbde-6cff-41eb-8b5a-ff26b038cafc",
"lastUpdateDate": "2020-06-22T21:36:16Z",
"updatedBy": "user id ...<redacted>...",
"dualAuthDelete": { "enabled": true
}
}
]





 Required parameters 



* KEY_ID_OR_ALIAS

The v4 UUID or alias of the key that you want to delete. To retrieve a list of your available keys, run the [kp keys](https://cloud.ibm.com/docs/key-protect-cli-plugin?topic=key-protect-cli-plugin-key-protect-cli-referencekp-keys) command.







 Optional parameters 



* --key-ring

A unique, human readable name for the key-ring.
Destroy a managed key and perform key destruction operations on keystores in the keystore group associated with the managed key. This operation cannot be undone. Make sure that the managed key is in a deactivated state before you run this command.

ibmcloud hpcs uko managed-key-destroy --id ID --uko-vault UKO-VAULT --if-match IF-MATCH



* Command options

--id (string)
: Required. The UUID of the key. You can use the ibmcloud hpcs uko managed-keys command to retrieve the key UUID.

--uko-vault (string)
: Required. The UUID of the vault where the update is to take place. You can use the ibmcloud hpcs uko vaults command to retrieve the vault UUID.

--if-match (string)
: Required. The precondition of the update, which is the value of the ETag from the header on a GET request. You can use the ibmcloud hpcs uko managed-key command to retrieve the ETag.
* Example

ibmcloud hpcs uko managed-key-destroy 
--id=21a7498e-2ae4-47ee-85ac-a19bf64e92fa 
--uko-vault=eb66ebbd-7230-4cde-89bf-17282cda5faa 
--if-match=2022-05-27T10:14:13Z 
--output json
* Output

The command returns the output similar to the following example:

ETag
2022-05-27T10:15:38Z
{
"id": "3dab42dc-6941-4841-8d27-4dabcc5aa09e",
"vault": {
"id": "5295ad47-2ce9-43c3-b9e7-e5a9482c362b",
"name": "Test Vault Name",