vania-janet/multiturn-rag-retrieval-data huggingface dataset:
"id": "264fadc3-7667-4b25-916e-5825fe70de0b",
"name": "my-root-key",
"type": "application/vnd.ibm.kms.key+json",
"algorithmType": "AES",
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-06-09T21:21:55Z",
"lastUpdateDate": "2020-06-09T21:31:44Z",
"keyVersion": {
"id": "264fadc3-7667-4b25-916e-5825fe70de0b",
"creationDate": "2020-06-09T21:21:55Z"
},
"extractable": false,
"state": 1,
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:390086ac-76fa-4094-8cf3-c0829bd69526:key:264fadc3-7667-4b25-916e-5825fe70de0b"
}





 Required parameters 



* KEY_ID_OR_ALIAS

The v4 UUID or alias of the key that you want to delete. To retrieve a list of your available keys, run the [kp keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-keys) command.
* -i, --instance-id

The IBM Cloud instance ID that identifies your Key Protect instance.

You can set an environment variable instead of specifying -i with the following command: $ export KP_INSTANCE_ID=<INSTANCE_ID>.







 Optional parameters 



* --key-ring
ibmcloud resource service-instance INSTANCE-NAME --output JSON
4. Remove any service key associated with the instance.

Find the service keys that are associated with an instance:

ibmcloud resource service-keys --instance-id INSTANCE-GUID

Run the following command to delete 1 service key. You must delete all.

ibmcloud resource service-key-delete SERVICE-KEY-NAME
5. Remove the instance. Run the [ibmcloud resource service-instance-delete](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_resourceibmcloud_resource_service_instance_delete) command:

ibmcloud resource service-instance-delete NAME

Where NAME is the name of the instance.

For example, to remove an instance, run the following command:

ibmcloud resource service-instance-delete logging-instance-01
You can delete any skill that you can access, unless it is being used by an assistant. If it is in use, you must remove it from the assistant that is using it before you can delete it.

Be sure to check with anyone else who might be using the skill before you delete it.

To delete a skill, complete the following steps:



1. Find out whether the skill is being used by any assistants. From the Skills page, find the tile for the skill that you want to delete. The Assistants field lists the assistants that currently use the skill.
2. If the skill you want to delete is associated with an assistant, then remove it from the assistant by completing the following steps:



* Check with the owner of the assistant that is using the skill before you remove the skill from it.
* Open the Assistants page, and then click to open the assistant tile.
* Find the tile for the skill that you want to delete. Click the ![open and close list of options](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/kebab.png) icon, and then choose Remove.
* Repeat the previous steps for any other assistants that use the skill.
* Return to the Skills page and find the tile for the skill that you want to delete.



3. Click the ![open and close list of options](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/kebab.png) icon, and then choose Delete. Confirm the deletion.







 Downloading a skill 

You can download a dialog or actions skill in JSON format. You might want to download a skill if you want to use the same skill in a different instance of the Watson Assistant service.
For detailed instructions and code examples about using the API method, check out the [Hyper Protect Crypto Services Unified Key Orchestrator API reference doc](https://cloud.ibm.com/apidocs/ukolist-managed-keys).







 What's next 



* To find out instructions on creating a managed key, check out [Creating managed keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-managed-keys).
* To find out more about managing your keys, check out [Filtering and searching keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-search-key-list) or [Editing key details](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-edit-kms-keys).
* To find out instructions on deleting a managed key, check out [Deleting managed keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-managed-keys).
By default, all commands print in table format. To change the output format to JSON, use --output json.
* --key-ring

A unique, human readable name for the key-ring. Required if the user doesn't have permissions on the default key ring.









 kp key disable 

The kp key disable command disables a root key and temporarily revokes access to the key's associated data in the cloud.

As an admin, you might need to temporarily [disable a root key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-disable-keys) if you suspect a possible security exposure, compromise, or breach with your data.

Disabling a root key suspends its encrypt and decrypt operations. After confirming that a security risk is no longer active, you can restore access to your data by [enabling](https://cloud.ibm.com/docs/cli?topic=cli-key-protect-cli-referencekp-key-enable) the disabled root key.

When you disable a root key that was previously enabled, the key transitions from the Active (value is 1) to the Suspended (value is 2) key state.

To disable a root key, you must be assigned a Manager service access role for the instance or key. To learn how IAM roles map to Key Protect service actions, check out [Service access roles](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-accessmanage-access-roles).

If you're using an integrated Cloud Service that supports revoking access to a disabled root key, the service may take up to a maximum of 4 hours before access to the root key's associated data is revoked.

After access to the associated data is revoked, a corresponding disable event is displayed in the IBM Cloud Activity Tracker web UI. The disable event indicates the key has been revoked (and is now disabled) and the key can not be used for encrypt and decrypt operations.

ibmcloud kp key disable KEY_ID_OR_ALIAS
For more information, search for [Removing an authorization](https://cloud.ibm.com/docs/account?topic=account-serviceauthremove-auth) in "Using authorizations to grant access between services".





 Restore temporary access 

To restore access after you temporarily remove it, follow these steps:



1. Re-create the authorization between your Watson service and Key Protect instance as shown in [Step 3. Grant service access](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-keyserviceserviceauth-key).
2. Tell your IBM Client Success Manager (CSM) that you want to restore access through Key Protect.



After you re-create the authorization and your CSM confirms Watson that any delegated authorizations are reconnected, the Watson instance starts accepting connections again.





 Permanently prevent access to your data 

To delete your data securely, delete both the encrypted Watson service instance and the Key Protect key.

When you delete a data encryption key, it is not recoverable and you cannot decrypt the key. You prevent further access to the data, but you also cannot recover the data.

For more information about deleting keys, see [Deleting keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-keys) in the Key Protect docs.





 Rotating keys 

Key rotation is an important part of mitigating the risk of a data breach. Periodically changing keys reduces the potential data loss if the key is lost or compromised. For more information, see [Setting a rotation policy](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-rotation-policy) in the Key Protect docs.





 Identify which key is encrypting your service instance 

To see which Key Protect instance is used to encrypt the data, use the link in the service details.



1. Go to your [resource list](https://cloud.ibm.com/resources).
2. Click the name of the Watson service instance.
Disabling key: '69332...<redacted>...5dbf', in instance: 'a192...<redacted>...7411'...
FAILED
kp.Error:
correlation_id='aca1...<redacted>...66e9',
msg='Conflict:
Key is not in active state:
Key could not be disabled.
Please see reasons for more details.',
reasons='[KEY_ACTION_INVALID_STATE_ERR:
Key is not in a valid state -
FOR_MORE_INFO_REFER: https://cloud.ibm.com/apidocs/key-protect]'

 this API request fails because the key is deleted a third time
$ curl -X POST "https://us-south.kms.cloud.ibm.com/api/v2/keys/$KEY_ID/actions/disable" -H "authorization: Bearer $ACCESS_TOKEN" -H "bluemix-instance: $KP_INSTANCE_ID" -H "content-type: application/vnd.ibm.kms.key_action+json"
Show more



 JSON response 

{
"metadata": {
"collectionType": "application/vnd.ibm.kms.error+json",
"collectionTotal": 1
},
"resources": [
{
"errorMsg": "Conflict: Key is not in active state: Key could not be disabled. Please see reasons for more details.",
"reasons":
{
"code": "KEY_ACTION_INVALID_STATE_ERR",
"message": "Key is not in a valid state",
"status": 409,
"moreInfo": "https://cloud.ibm.com/apidocs/key-protect"
}
]
}
]
}







 Example 2
Scheduling key for deletion...
OK

 this key has a dual-auth-delete policy
$ ibmcloud kp key policies $KEY_ID --output json

[
{
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-06-22T19:13:00Z",
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:a192d603-0b8d-452f-aac3-f9e1f95e7411:policy:2427dbde-6cff-41eb-8b5a-ff26b038cafc",
"lastUpdateDate": "2020-06-22T21:36:16Z",
"updatedBy": "user id ...<redacted>...",
"dualAuthDelete": {
"enabled": true
}
}
]





 Required parameters 

KEY_ID
: The ID of the key that you want to delete. To retrieve a list of your available keys, run the [kp keys](#kp-keys) command.







 kp key show 

Retrieve details about a key, such as the key metadata and key material.

If the key was designated as a root key, the system cannot return the key material for that key.

ibmcloud kp key show KEY_ID
-i, --instance-id INSTANCE_ID
[-o, --output OUTPUT]



 Examples 

These are examples of kp key show.



 Example 1 

Create a root key and show the details.

 create a root key
$ ibmcloud kp key create my-root-key
If you need to control the encryption keys, you can integrate Key Protect. This process is commonly referred to as Bring your own keys (BYOK). With Key Protect you can create, import, and manage encryption keys. You can assign access policies to the keys, assign users or service IDs to the keys, or give the key access only to a specific service. The first 20 keys are free.



 Enabling customer-managed keys for Data Engine 

Follow the steps to [set up Key Protect encryption](https://cloud.ibm.com/docs/sql-query?topic=sql-query-keyprotectencryption) when you create your instance.







 Deleting your data in Data Engine 

Your data is deleted 30 days after you delete an instance. If you use Key Protect integration, you can destroy your data immediately by destroying the key in Key Protect.



 Deleting Data Engine instances 

Deleting a key or the containing Key Protect instance from the system will shred its contents and any data still encrypted with that key. When it is removed, it cannot be undone or reversed. A Data Engine instance that is associated with a deleted key cannot be used for any further queries. You need to create a new Data Engine instance for future queries.

The Data Engine data retention policy describes how long your data is stored after you delete the service. The data retention policy is included in the Data Engine service description, which you can find in the [IBM Cloud Terms and Notices](https://cloud.ibm.com/docs/overview?topic=overview-terms).
Deleting KMIP for VMware instances 

Use this procedure to delete the KMIP™ for VMware® instances that you ordered for stand-alone use.



 Before you begin 

You must remove encryption and configuration in the following sequence:



1. Decrypt all virtual machines or vSAN™ datastores that are protected by this KMIP for VMware instance, or rekey these resources by using a new Key Management Server (KMS).
2. Disable host encryption mode for your VMware vSphere® cluster, or rekey your hosts by using a new KMS.
3. Remove the KMS configuration for all VMware vCenter Server® instances that are connected to this KMIP for VMware instance.
4. Remove the KMIP for VMware instance.
5. In your Key Protect or Hyper Protect Crypto Services (HPCS) instance, remove all standard keys that were in use by this KMIP for VMware instance.
6. (Optional) In your Key Protect or HPCS service instance, remove the customer root key (CRK) that was in use by this KMIP for VMware instance. First, ensure that no other users are using the CRK.
7. (Optional) Remove the Key Protect or HPCS service instance that was in use by this KMIP for VMware instance. First, ensure that no other users are using the Key Protect or HPCS service instance.







 Procedure to delete KMIP for VMware instances 



1. From the IBM Cloud® for VMware Solutions console, click Resources > KMIP for VMware from the left navigation pane.
2. In the KMIP for VMware table, find the instance to delete.
3. In the Actions column, click the Delete icon ![Delete icon](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/icons/delete.svg).
4. In the Delete instance window, click OK.
kp key command 

The kp key command manages individual keys.



Table 3. Sub-commands for managing keys

 Sub-command Status v0.8 Description 

 [alias-create](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-alias-create) Create an alias for a unique and convenient reference to a key 
 [cancel-delete](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-cancel-delete) Cancel a previously scheduled request to delete a key 
 [create](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-create) Create a key or import your own key 
 [delete](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-delete) Delete a key 
 [disable](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-disable) Disable a key 
 [enable](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-enable) Enable a key 
 [policies](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-policies) Retrieve a list of policies 
 policy-update [dual-auth-delete](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-policy-update-dual) Update the key policy for "dual auth delete"
* kp key [schedule-delete](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-schedule-delete) : authorize a key, with a "dual-auth-delete" policy, to be deleted







 kp registrations 



* kp [registrations](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-registrations) : list registrations, which are associations between keys and other cloud resources such as Cloud Object Storage (COS) buckets or Cloud Databases deployments









 Update these commands 



 kp import-token 



* kp import-token [key-encrypt](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-import-token-key-encrypt) : add the -a (--hash) option; encrypt keys using the SHA-1 algorithm for Hyper Protect Crypto Services (HPCS)
* kp import-token [nonce-encrypt](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-import-token-nonce-encrypt) : add the -c (--cbc) option; encrypt the nonce using the AES-CBC encryption algorithm; only supported for HPCS







 kp key 



* kp key [delete](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-delete) : add the -f (--force) option to delete a key, with force, which is used to delete a key that has existing "registrations"







 kp keys
$ NEWCIPHERTEXT=eyJjaXBoZXJ0ZXh0IjoiS0FITEFRWjdh ...<redacted>... NWEyMTQwNjdlIn0=

 unwrap the ciphertext and reveal the original DEK (plaintext)
$ ibmcloud kp key unwrap $KEY_ID $NEWCIPHERTEXT --output json

{
"Plaintext": "UPJ4YDwbQMjQG/aqlHsPhHV1CBkpIXngLHFS5+i4UZ4=",
"Rewrapped Plaintext": ""
}







 Required parameters 



* KEY_ID_OR_ALIAS

The v4 UUID or alias of the root key that you want to rotate.
* -i, --instance-id

The IBM Cloud instance ID that identifies your Key Protect instance.

You can set an environment variable instead of specifying -i with the following command: $ export KP_INSTANCE_ID=<INSTANCE_ID>.







 Optional parameters 



* -k, --key-material

To rotate a key that was initially generated without a --key-material parameter, that is kp key create my-key, omit the --key-material parameter.

If a key was created with the --key-material parameter then specify the new base64-encoded key material that you use for rotating an existing root key.

To rotate a key that was initially imported into the service, provide a new 32-byte (256-bit) key.
* --key-ring

A unique, human readable name for the key-ring. Required if the user doesn't have permissions on the default key ring.









 kp key schedule-delete 

A key with a dual-auth-delete policy requires authorization from two administrative users to delete the key.

Follow this process to delete a key with a dual-auth-delete policy.



1. Create a key and enable the dual-auth-delete policy
2.
Dual authorization enabled The status of a dual authorization policy on the key.<br><br><br><br> * True: Dual authorization is required to delete the key.<br> * False: No prior authorization is required to delete the key.<br><br><br> 
 Set for deletion Indicates whether a delete authorization is issued for a key.<br><br><br><br> * True: An authorization to delete this key is issued by the first user. A second user with a Manager access policy can safely delete the key.<br> * False: The key is not set for deletion. No further action is needed.<br><br><br> 
 Deletion expiration The date that an authorization for deletion expires for the key. If this date passes, the authorization is no longer valid. If False is the value for the Dual authorization enabled or Set for deletion column of the key, the Deletion expiration column is left empty. 



Not all key characteristics are displayed by default. To customize how the Keys table is to be presented, click the Settings icon![Settings icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/settings.svg) and check the columns to be displayed.

Not seeing the full list of keys that are stored in your service instance? Verify with your administrator that you are assigned the correct role for the applicable service instance or individual key. For more information about roles, see [Roles and permissions](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-accessroles).

You can also search for a specific key by using the search bar, or filter keys based on your needs by clicking the Filter icon !
* When you authorize the deletion of a key, a kms.secrets.setkeyfordeletion event is generated. The responseData.keyState field includes the integer that correlates to deleted state (5).
* The responseData.totalResources field includes the total number of key versions that are associated with the key.
* The responseData.eventAckData.newKeyVersionId field includes the unique identifier of the latest key version.



For more information about key rotation events that indicate a successful rotation, see these [key rotation events](https://cloud.ibm.com/docs/key-protect?topic=key-protect-at-eventsrotate-key-registrations-success). For more information about all Activity Tracker events in Key Protect, see [IBM Cloud Activity Tracker events](https://cloud.ibm.com/docs/vpc?topic=vpc-at-events).





 Example key rotation event 

The following JSON example shows a kms.secrets.rotate event when a root key is rotated.

{
"eventTime":"2020-06-22T15:36:16.7+0000",
"outcome":"success",
"message":"Key Protect: rotate secret my-secret-key1",
"action":"kms.secrets.rotate",
"initiator":{
"id":"MYid-111100P9W2",
"name":"john.doe@mycompany.com",
"typeURI":"service/security/account/user",
"credential":{
"type":"token"
},
"host":{
"address": "192.0.2.0"
}
},
"target":{
To use dual authorization, be sure to identify a user who can set the key for deletion, and another user who can delete the key. Users with a Writer or Manager access policy can set keys for deletion. Users with a Manager access policy can delete keys.
* Plan to delete the key within a 7-day waiting period. When the first user authorizes a key for deletion, Hyper Protect Crypto Services sets a 7-day waiting period on the key. During this period, the key remains in the [Active state](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-key-states) and all key operations are allowed on the key. To complete the deletion, the second user with a Manager access policy can use the IBM Cloud console or API to delete the key.
* The key and its associated data become inaccessible 90 days after the key is deleted. When you delete a key, the key can be restored within 30 days after the deletion. You are able to retrieve associated data such as key metadata, registrations, and policies for up to 90 days. After 90 days, the key becomes eligible to be automatically purged and its associated data will be permanently removed from your instance.







 Authorize deletion for a key with the IBM Cloud console 



 Step 1. Authorize deletion for a key 

After you [enable dual authorization for an instance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-dual-auth) or [for a key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-dual-auth-key-policy), you can provide the first authorization to delete a key by using the IBM Cloud console.



1. [Log in to the IBM Cloud console](https://cloud.ibm.com/).
2. Go to Menu > Resource list to view a list of your resources.
3. From your IBM Cloud resource list, select your provisioned instance of Hyper Protect Crypto Services.
4.
To protect the confidentiality of your personal data, avoid entering personally identifiable information (PII), such as your name or location, when you add keys to the service.

If the expirationDate is provided in your create key request, the key will transition to the deactivated state within one hour past the key's expiration date.

A successful POST api/v2/keys response returns the ID value for your key, along with other metadata. The ID is a unique identifier that is assigned to your key and is used for subsequent calls to the Key Protect API.

{
"metadata": {
"collectionType": "application/vnd.ibm.kms.key+json",
"collectionTotal": 1
},
"resources": [
{
"type": "application/vnd.ibm.kms.key+json",
"id": "02fd6835-6001-4482-a892-13bd2085f75d",
"name": "test-root-key",
"aliases":
"alias-1",
"alias-2"
],
"description": "A test root key",
"state": 1,
"extractable": false,
"crn": "crn:v1:bluemix:public:kms:us-south:a/f047b55a3362ac06afad8a3f2f5586ea:12e8c9c2-a162-472d-b7d6-8b9a86b815a6:key:02fd6835-6001-4482-a892-13bd2085f75d",
"imported": false,
"creationDate": "2020-03-12T03:37:32Z",
"createdBy": "...",
"algorithmType": "Deprecated",
"algorithmMetadata": {
"bitLength": "256",