vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Creating key: 'my-root-key', in instance: '390086ac-76fa-4094-8cf3-c0829bd69526'...
OK
Key ID Key Alias
24203f96-b134-440e-981a-a24f2d432256 my-alias







 Required parameters 



* KEY_ID

The ID of the key that you want to modify. To retrieve a list of your available keys, run the [kp keys](https://cloud.ibm.com/docs/cli?topic=cli-key-protect-cli-referencekp-keys) command.
* KEY_ALIAS

The alias, or alternate identifier, of the key that you want to modify. The identifier must be: alphanumeric, and no spaces or special characters other than '-' or '_', and can not be a version 4 UUID.
* -i, --instance-ID

The IBM Cloud instance ID that identifies your Key Protect instance.

You can set an environment variable instead of specifying -i with the following command: $ export KP_INSTANCE_ID=<INSTANCE_ID>.







 Optional parameters 



* -o, --output

Set the CLI output format. By default, all commands print in table format. To change the output format to JSON, use --output json.









 kp key cancel-delete 

A key with a dual-auth-delete policy requires authorization from two administrative users to delete the key.

This command (kp key cancel-delete) cancels, or removes, a prior authorization.

The [kp key schedule-delete](https://cloud.ibm.com/docs/cli?topic=cli-key-protect-cli-referencekp-key-schedule-delete) command is the "authorization" to delete the key.

Follow this process to delete a key with a dual-auth-delete policy.



1. Create a key and enable the dual-auth-delete policy
2.
You must use the force option to delete a root key that is registered with another cloud resource.

Registrations are associations between root keys and other cloud resources, such as Cloud Object Storage (COS) buckets or Cloud Databases deployments.

For more information about Registrations, see [viewing associations between root keys and encrypted IBM Cloud resources](https://cloud.ibm.com/docs/key-protect?topic=key-protect-view-protected-resources).

[See this explanation](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-delete) of deleting keys that are registered with another cloud resource (look at the force option).

 this CLI request fails because the registration was not deleted
$ ibmcloud kp key delete $KEY_ID -i $KP_INSTANCE_ID

Deleting key: 52a9d772-8982-4620-bfb4-b070dd812a0c, from instance: b0d84b32-09d0-4314-8049-da78e3b9ab6f...
FAILED
kp.Error:
correlation_id='c27b7948-4a1f-4cbd-8770-cb3616888e27',
msg='Conflict:
Key could not be deleted.
Please see "reasons" for more details.',
reasons='[PROTECTED_RESOURCE_ERR:
Key is protecting one or more cloud resources -
FOR_MORE_INFO_REFER: https://cloud.ibm.com/docs/key-protect?topic=key-protect-troubleshootingunable-to-delete-keys]'

 this CLI request succeeds when using the --force option
 the registration between Key Protect and the cloud resource exists
$ ibmcloud kp key delete $KEY_ID -i $KP_INSTANCE_ID --force --output json

{
For more information about deleting root keys, see the following topics.



* [Key Protect - Deleting keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-keys)
* [Hyper Protect Crypto Services - Deleting keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-keys)



For more information about how to see the list of deleted root keys and possibly restore imported root keys, see [Restoring deleted root keys](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managingbyok-restore-root-key).





 Restoring deleted root keys 

Restoring an imported root key returns the key to an active state, and reestablishes access to the key. (Root keys that were generated by the KMS can't be restored.) You can restore access to all resources that were previously protected by the root key. You can resume regular actions, such as restarting an instance and attaching data volumes.

To see a list of deleted root keys for a KMS instance, you can filter by key state. For example, to filter a list of deleted root keys in a Key Protect instance in the UI:



1. Go to the [IBM Cloud console](https://cloud.ibm.com/vpc) > Resource List > Security,
2. Locate, and click the KMS instance.
3. On the Keys page, the list of root keys that are stored in this instance is displayed.
4. Click the Filter icon![Filter icon](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc//images/filter-icon.png) to see more information.
5. Under States, click the down arrow to display all key states.
6. Select Deleted.
* hs-crypto.keystore.deletekeystore



For instructions on creating custom roles, see [Creating custom roles](https://cloud.ibm.com/docs/account?topic=account-custom-roles).

If you want to delete an EP11 keystore, complete the following steps:

After you delete a keystore, you are not able to access any EP11 keys that are stored in the keystore. This action cannot be undone.



1. Select the EP11 keystores tab in the side menu, and find the keystore that you want to delete in the list.
2. Click the Actions icon ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/action-menu-icon.svg), and then select Delete keystore.
3. Verify the ID of the keystore to be deleted, and check the box to confirm the deletion.
4. Click Delete keystore.







 What's next 

Start to create an EP11 key [through the console UI](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-ep11-key-uicreate-ep11-key-ui) or

[through the PKCS #11 API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-pkcs-api).
If no action is taken by another user and the seven-day period expires, you must [restart the dual authorization process](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-dual-auth-keysdelete-dual-auth-keys-set-key-deletion-api) to delete the key.

Delete a key and its contents by making a DELETE call to the following endpoint.

https://<region>.kms.cloud.ibm.com/api/v2/keys/<keyID_or_alias>



1. [Retrieve your authentication credentials to work with keys in the service](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-up-api).
2. Retrieve the ID of the key that you would like to delete.

You can retrieve the ID for a specified key by making a GET /v2/keys request, or by viewing your keys in the Key Protect dashboard.
3. Run the following curl command to delete the key and its contents.

$ curl -X DELETE "https://<region>.kms.cloud.ibm.com/api/v2/keys/<keyID_or_alias>" -H "authorization: Bearer <IAM_token>" -H "bluemix-instance: <instance_ID>" -H "prefer: <return_preference>"

Replace the variables in the example request according to the following table.





Table 2. Describes the variables that are needed to delete a key.

 Variable Description 

 region Required. The region abbreviation, such as us-south or eu-gb, that represents the geographic area where your Key Protect instance resides. <br> <br>For more information, see [Regional service endpoints](https://cloud.ibm.com/docs/key-protect?topic=key-protect-regionsservice-endpoints). 
 key_ID_or_alias Required. The unique identifier or alias for the key that you would like to delete. 
 IAM_token Required.
"algorithmMode": "Deprecated",
"lastUpdateDate": "2020-03-16T20:41:27Z",
"dualAuthDelete": {
"enabled": false
},
"deleted": true,
"deletionDate": "2020-03-16T21:46:53Z",
"deletedBy": "..."
}
]
}

For a detailed description of the available parameters, see the Key Protect [REST API reference doc](https://cloud.ibm.com/apidocs/key-protect).



 Using the force query parameter 

Key Protect blocks the deletion of a key that's protecting a cloud resource, such as a Cloud Object Storage bucket. You can force delete a key and its contents by making a DELETE call to the following endpoint.

https://<region>.kms.cloud.ibm.com/api/v2/keys/<keyID_or_alias>?force=true

When you delete a key that has registrations associated with it, you immediately deactivate its key material and the data encrypted by the key. Any data that is encrypted by the key becomes inaccessible. Thirty days after a key is deleted, the key can no longer be restored and the key material will be destroyed after 90 days.

Force deletion on a key won't succeed if the key is protecting a registered IBM Cloud resource that's non-erasable due to a [retention policy](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-immutableimmutable-terminology-policy), which is a Write Once Read Many (WORM) policy set on the your IBM Cloud resource. You can verify whether a key is associated with a non-erasable resource by checking the 'preventKeyDeletion" field in the [registration details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-view-protected-resources) for the key.
Creating key: 'my-root-key', in instance: '390086ac-76fa-4094-8cf3-c0829bd69526'...
OK
Key ID Key Alias
24203f96-b134-440e-981a-a24f2d432256 my-alias







 Required parameters 



* KEY_ID

The ID of the key that you want to modify. To retrieve a list of your available keys, run the [kp keys](https://cloud.ibm.com/docs/key-protect-cli-pluginkp-keys) command.
* KEY_ALIAS

The alias, or alternate identifier, of the key that you want to modify. The identifier must be: alphanumeric, and no spaces or special characters other than '-' or '_', and can not be a version 4 UUID.
* -i, --instance-ID

The IBM Cloud instance ID that identifies your Key Protect instance.

You can set an environment variable instead of specifying -i with the following command: $ export KP_INSTANCE_ID=<INSTANCE_ID>.







 Optional parameters 



* -o, --output

Set the CLI output format. By default, all commands print in table format. To change the output format to JSON, use --output json.









 kp key cancel-delete 

A key with a dual-auth-delete policy requires authorization from two administrative users to delete the key.

This command (kp key cancel-delete) cancels, or removes, a prior authorization.

The [kp key schedule-delete](https://cloud.ibm.com/docs/key-protect-cli-pluginkp-key-schedule-delete) command is the "authorization" to delete the key.

Follow this process to delete a key with a dual-auth-delete policy.



1. Create a key and enable the dual-auth-delete policy
2.
"type": "application/vnd.ibm.kms.key+json",
"aliases":
"alias-1",
"alias-2"
],
"name": "test-root-key",
"description": "...",
"state": 5,
"expirationDate": "2020-03-15T20:41:27Z",
"crn": "crn:v1:bluemix:public:kms:us-south:a/f047b55a3362ac06afad8a3f2f5586ea:30372f20-d9f1-40b3-b486-a709e1932c9c:key:2291e4ae-a14c-4af9-88f0-27c0cb2739e2",
"deleted": true,
"algorithmType": "AES",
"createdBy": "...",
"deletedBy": "...",
"creationDate": "2020-03-10T20:41:27Z",
"deletionDate": "2020-03-16T21:46:53Z",
"lastUpdateDate": "2020-03-16T20:41:27Z",
"extractable": true
}
]
}

For a detailed description of the available parameters, see the Key Protect [REST API reference doc](https://cloud.ibm.com/apidocs/key-protect).







 Key purge 

When you delete a key, you immediately deactivate its key material and move it to a backstore in the Key Protect service. Four hours after a key is deleted, the key becomes available to be manually purged. Thirty days after a key is deleted, the key becomes non-restorable and the key material is destroyed.
Make sure that the vault does not contain any keys or keystores, and then click Delete.
5. Click Delete vault to confirm the deletion.



The vault has been deleted and removed from the vault list. Access groups that are assigned to this vault no longer have access to the vault.





 Deleting vaults with the API 

To delete a vault through the API, follow these steps:



1. [Retrieve your service and authentication credentials to work with vaults in the service](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-uko-api).
2. Delete a vault by making a DELETE call to the following endpoint.

https://uko.<region>.hs-crypto.cloud.ibm.com:<port>/api/v4/vaults/<vault_id>

Replace <vault_id> with the ID of your vault.

For detailed instructions and code examples about using the API method, check out the [Hyper Protect Crypto Services Unified Key Orchestrator API reference doc](https://cloud.ibm.com/apidocs/ukodelete-vault).







 What's next 



* To find out how to create a vault, check out [Creating vaults](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-vaults).
* To find out instructions on editing a vault, check out [Editing vault details](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-edit-vaults).
* To find out how to grant access to vaults, see [Granting access to vaults](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-grant-access-vaults).
[cancel-delete](https://cloud.ibm.com/docs/key-protect-cli-plugin?topic=key-protect-cli-plugin-key-protect-cli-referencekp-key-cancel-delete) Cancel a previously scheduled request to delete a key 
 [create](https://cloud.ibm.com/docs/key-protect-cli-plugin?topic=key-protect-cli-plugin-key-protect-cli-referencekp-key-create) Create a key or import your own key 
 [delete](https://cloud.ibm.com/docs/key-protect-cli-plugin?topic=key-protect-cli-plugin-key-protect-cli-referencekp-key-delete) Delete a key 
 [disable](https://cloud.ibm.com/docs/key-protect-cli-plugin?topic=key-protect-cli-plugin-key-protect-cli-referencekp-key-disable) Disable a key 
 [enable](https://cloud.ibm.com/docs/key-protect-cli-plugin?topic=key-protect-cli-plugin-key-protect-cli-referencekp-key-enable) Enable a key 
 [policies](https://cloud.ibm.com/docs/key-protect-cli-plugin?topic=key-protect-cli-plugin-key-protect-cli-referencekp-key-policies) Retrieve a list of policies 
 policy-update [dual-auth-delete](https://cloud.ibm.com/docs/key-protect-cli-plugin?topic=key-protect-cli-plugin-key-protect-cli-referencekp-key-policy-update-dual) Update the key policy for "dual auth delete"
Deleting secrets from the console 



1. To delete a secret from the console,



1. Go to the Secrets and configmaps page from your [Code Engine Projects page](https://cloud.ibm.com/codeengine/projects).
2. Click the secret that you want to delete to open its page.
3. From the page for the specific secret, click Actions > Delete secret.



2. To delete a key-value pair for a specific secret from the console,



1. Go to the Secrets and configmaps page from your [Code Engine Projects page](https://cloud.ibm.com/codeengine/projects).
2. Click the secret that you want to change to open its page.
3. From the page for the specific secret, delete the key-value pair that you want to remove.





You can also delete defined environment variables that reference secrets and configmaps. To delete a defined environment variable, from the Environment variables tab of your job or app and delete the environment variable that you want to delete. After you delete a defined environment variable, be sure to click Save to save the changes to your app or job. For more information, see [Delete an environment variable](https://cloud.ibm.com/docs/codeengine?topic=codeengine-envvarenvvar-delete-ui).





 Deleting secrets with the CLI 

To delete a secret with the CLI, use the [secret delete](https://cloud.ibm.com/docs/codeengine?topic=codeengine-clicli-secret-delete) command; for example,

ibmcloud ce secret delete --name myliteralsecret -f

Example output

Deleting secret myliteralsecret...
OK
Table 5. Undelete a version of a key-value secret request parameters

 Request parameter Description 

 instance_id The ID of the Secrets Manager instance. 
 region The region in which the Secrets Manager instance was created. 
 secret_name The name of the key-value secret. 
 Vault-Token The authentication token that is retrieved from Vault. 
 versions The versions of the key-value secret you want to delete. 







 Example response 

A request to restore a version of a key-value secret in the default secret group returns a blank response with a 204 status code to confirm that the specified versions were restored.







 Destroy versions of a secret 

Destroy specified versions of a key-value secret permanently. To soft delete versions of a secret instead, use the [delete specified versions](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-vault-manage-kv&interface=apikv-version-delete-multiple) API endpoint.



 Example request 

curl -X POST 'https://{instance_id}.{region}.secrets-manager.test.appdomain.cloud/v1/ibmcloud/kv/destroy/{secret_name}' -H 'Accept: application/json'  -H 'X-Vault-Token: {Vault-Token}' -H 'Content-Type: application/json' -d '{
"versions": [1, 3]
}'



Table 6. Destroy versions of a key-value secret request parameters

 Request parameter Description 

 instance_id The ID of the Secrets Manager instance. 
 region The region in which the Secrets Manager instance was created. 
 secret_name The name of the key-value secret. 
 Vault-Token The authentication token that is retrieved from Vault. 
 versions The versions of the key-value secret you want to permanently destroy. 







 Example response 

A request to permanently destroy versions of a key-value secret in the default secret group returns a blank response with a 204 status code to confirm that the secret's versions were destroyed.







 Create or update key-value secret metadata 

Create or update the metadata of a key-value secret, such as the maximum number of versions or other custom values.
bc459a2f-56cb-445e-b4ee-9d1866b57560 my-test-key-11

 list the last group of keys
$ list_keys 5 15

cc7faf46-43cf-43b2-be98-7d1815371639 my-test-key-8
cf0a3d8b-4856-4aa5-be6a-88cca465eab0 my-test-key-20
df530c55-39c0-44e8-b7db-397593f70d90 my-test-key-3
e9b08526-3227-406c-b83f-c28844bd952b my-test-key-9
f141be88-5a34-4290-8513-4f01d934e75a my-test-key-5

 delete the test keys
$ KEYS=$(ibmcloud kp keys --output json | jq -r '.] | .id')

$ for KEY_ID in $(echo "${KEYS}"); do
KEY_NAME=$(ibmcloud kp key show $KEY_ID --output json | jq -r '."name"]')
if $KEY_NAME == "my-test-key-" ]] ! ! ! ! ! ! ! ! ; then
echo "Deleting... $KEY_NAME $KEY_ID"
ibmcloud kp key delete $KEY_ID
fi
done

(output not shown)
[Restoring a deleted key with the GUI](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-restore-keysrestore-ui). 







 Manage root keys with the API 

You can use the API to disable, enable, delete, or restore your root keys. Table 6 describes each action and links to detailed steps for the Key Protect or Hyper Protect Crypto Services API. For more information about the relationship of user actions and key states, see [Root key states and user actions](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managing&interface=uibyok-root-key-states).

Because deleting a root key makes all resources that are protected by it unusable (status = unusable), program your applications to check the status of the resource (such as a volume, snapshot, or image) before it attempts to use it. If the root key is restorable, restore it for use, or create and use a different root key.



Table 6. API procedures for managing root keys

 User action Key Protect API procedure Hyper Protect Crypto Services API procedure 

 Disable key [Disabling a root key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-disable-keysdisable-api) [Disabling a root key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-disable-keysdisable-api) 
 Enable key [Enabling a disabled root key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-disable-keysenable-api) [Enabling a disabled root key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-disable-keysenable-api)
When you delete a root key, the key is no longer available to decrypt passphrases that are used to protect your resources. Deleting a root key places it in a destroyed or deleted state in the KMS. Volume, snapshot, and image resources that are protected by the deleted root key have an unusable status and can't be used for normal operations. File Storage for VPC shares show a suspended status. The storage system is offline, and data cannot be accessed.

Your data still exists. You have a 30-day grace period to [restore the deleted key](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managing&interface=uibyok-restore-root-key). Otherwise, your encrypted resources become inaccessible. After 30 days, your root key can't be restored, and your resources are unrecoverable.

By default, the KMS prevents you from deleting a root key that's actively protecting a resource. You can force delete a root key in Key Protect and Hyper Protect Crypto Services. When you force delete a root key, the following actions happen automatically:



* If the deleted root key is protecting boot volumes, the associated virtual server instance is stopped.
* If the deleted root key is protecting data volumes, the associated virtual server instance is stopped.
* If the deleted root key is protecting file shares, the file share is suspended.
* Deleting a root key purges usage of the key for all resources in the VPC.
* Events are logged in the Activity Tracker.



To force the deletion of a root key in Hyper Protect Crypto Services, use the API. Hyper Protect Crypto Services requires that you delete all resources before you delete a root key that is protecting those resources. If you can't delete the key, see [troubleshooting key management service](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-troubleshoot-unable-to-delete-keys).
* To find out instructions on creating a managed key, check out [Creating managed keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-managed-keys).
* To find out how to delete an internal keystore, check out [Deleting internal keystores](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-internal-keystores).
* To find out how to delete a vault, check out [Deleting vaults](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-vaults).
"algorithmType": "Deprecated",
"algorithmMetadata": {
"bitLength": "256",
"mode": "Deprecated"
},
"algorithmBitSize": 256,
"algorithmMode": "Deprecated",
"lastUpdateDate": "2020-03-16T20:41:27Z",
"dualAuthDelete": {
"enabled": false
},
"deleted": true,
"deletionDate": "2020-03-16T21:46:53Z",
"deletedBy": "..."
}
]
}

For a detailed description of the available parameters, see the Key Protect [REST API reference doc](https://cloud.ibm.com/apidocs/key-protect).





 Key purge 

When you delete a key, you immediately deactivate its key material and move it to a backstore in the Key Protect service. Four hours after a key is deleted, the key becomes available to be manually purged. Thirty days after a key is deleted, the key becomes non-restorable and the key material is destroyed. After a key has been deleted for 90 days, if not manually purged, the key becomes eligible to be automatically purged and all its associated data will be permanently removed, or "hard deleted", from the Key Protect service.

For more information about deleting and purging keys, check out [About deleting and purging keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-purge-keys).

The following table lists which APIs you can use to retrieve data related to a deleted key.



Table 4. Lists the API that users can use to view details about a key and its registrations.

 API Description 

 [Get key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-retrieve-key) Retrieve key details