vania-janet/multiturn-rag-retrieval-data huggingface dataset:
[After you create or import your existing keys into the service](https://cloud.ibm.com/docs/key-protect?topic=key-protect-create-root-keys), complete the following steps to disable a key:



1. [Log in to the IBM Cloud console](https://cloud.ibm.com/login/).
2. Go to Menu > Resource List to view a list of your resources.
3. From your IBM Cloud resource list, select your provisioned instance of Key Protect.
4. On the application details page, use the Keys table to browse the keys in your Key Protect instance.
5. Click the ⋯ icon to open a list of options for the key that you want to disable.
6. From the options menu, click Disable key and confirm the key was disabled in the updated Keys table.







 Enabling a root key in the console 

[After you create or import your existing keys into the service](https://cloud.ibm.com/docs/key-protect?topic=key-protect-create-root-keys) and [disable](https://cloud.ibm.com/docs/key-protect?topic=key-protect-disable-keysdisable-ui) a root key, complete the following steps to enable the key:



1. [Log in to the IBM Cloud console](https://cloud.ibm.com/login/).
2. Go to Menu > Resource List to view a list of your resources.
3. From your IBM Cloud resource list, select your provisioned instance of Key Protect.
4. On the application details page, use the Keys table to browse the keys in your service.
5. Click the ⋯ icon to open a list of options for the key that you want to enable.
6. From the options menu, click Enable key and confirm the key was enabled in the updated Keys table.



Keys cannot be enabled immediately after being disabled. If a key was disabled in error, wait at least 30 seconds before attempting to re-enable it.







 Disabling and enabling root keys with the API
To rotate a key, complete the following steps:



1. Get the details of the key that you want to rotate.

You can list all service keys to obtain the ID of the key that you want to rotate. For more information, see [Listing all service keys](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-service_keysservice_keys_api_list).

If you know the Key ID, skip to the next step.
2. Create a new key. For more information, see [Creating an service key](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-service_keysservice_keys_api_create).
3. Delete the old key. Make sure you use the ID of the key that you identified previously. For more information, see [Deleting a key](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-service_keysservice_keys_api_delete).
4. After you rotate the service key, you must update any operation processes where the service key is used with the new value.
Any and all types of keys (standard or root, imported or created) can be restored. It is no longer required to pass in key material when restoring a key. For more information, check out [Restoring keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-restore-keys). Rotating keys and re-wrapping encrypted content with a new DEK is fundamental to security. Quickly retrieve keys having extractable content with [this search feature](https://cloud.ibm.com/docs/key-protect?topic=key-protect-view-keysfilter-keys-extractable-state-api).





 15 February 2021 

Key Protect announces UI enhancements
: Managing keys through the UI interface has been enhanced with new options presented in a simple and convenient selectable option menu within the context of each managed key. Simply click on the "overflow" icon (⋯) at the end of each row to access common features and UI enhancements.



* Note that "Associated Resources" are now accessible within the context of each key in the console, as well as having its own item in the menu. Also, setting a key's rotation policy is now possible in the same panel where a key can be manually rotated.
* Also, the list of endpoints in the console has grown with the addition of Osaka. You can now update your applications to reference the new endpoint.







 15 February 2021 

Key Protect supports additional UI features
: Now, users can [Wrap](https://cloud.ibm.com/docs/key-protect?topic=key-protect-wrap-keys) and [Unwrap](https://cloud.ibm.com/docs/key-protect?topic=key-protect-unwrap-keys) active root keys to provide envelope encryption. For more information, see Protecting data with [envelope encryption](https://cloud.ibm.com/docs/key-protect?topic=key-protect-envelope-encryption) for an overview.





 15 March 2021 

Key Protect supports key purge
: Beginning in April 2021, Key Protect will implement a key purge feature that will automatically purge any keys that have been deleted for more than 90 days.
For more information, see [Deleting a key](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-ingestion_keyingestion_key_api_delete).
4. After you rotate the ingestion key, you must update the ingestion key for any sources that you have configured to forward logs to this Activity Tracker instance.

For example, if you have configured streaming to an Activity Tracker instance, and you rotate the service key of the destinaltion Activity Tracker instance, you need to reconfigure streaming to continue streaming data. For more info, see [Configuring streaming to a Activity Tracker instance through the UI](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-streaming-configure-l2l).
After you set the crypto units to imprint mode, you can choose to delete your service instance through the IBM Cloud console resources page, the instance details page, or the CLI.



 Deleting instances from the IBM Cloud console resources page 

You can delete an instance of Hyper Protect Crypto Services from the IBM Cloud console resources page by completing the following steps:



1. From the IBM Cloud console, click Resource list from the navigation.
2. Find the Hyper Protect Crypto Services service instance that you want to delete under the Services section.
3. Click the Actions icon ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/action-menu-icon.svg) to open the actions menu.
4. Click Delete.







 Deleting instances from the IBM Cloud console instance details page 

You can delete an instance of Hyper Protect Crypto Services from the IBM Cloud console instance details page by completing the following steps:



1. From the IBM Cloud console, click Resource list from the navigation.
2. Find the Hyper Protect Crypto Services service instance that you want to delete under the Services section and click the instance name to open the instance details page.
3. Click the Actions icon ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/action-menu-icon.svg) to open the service instance actions menu.
4. Click Delete service.







 Deleting instances from the IBM Cloud CLI 

You can delete an instance of Hyper Protect Crypto Services from the IBM Cloud CLI by running the following command:

ibmcloud resource service-instance-delete <instance_name|instance_ID>
Deleting secrets with the API 

You can delete secrets by calling the Secrets Manager API.

The following example request deletes a secret and its contents. When you call the API, replace the ID variables and IAM token with the values that are specific to your Secrets Manager instance.

curl -X DELETE
--H "Authorization: Bearer {iam_token}" 
"https://{instance_ID}.{region}.secrets-manager.appdomain.cloud/api/v2/secrets/{id}"

After you delete a secret, the secret transitions to the Destroyed state. Secrets in this state are no longer recoverable. Metadata that is associated with the secret, such as the secret's deletion date, is kept in the Secrets Manager database.
"description": "The description of the created keystore.",
"groups": [
"IBM Keystore Name"
],
"type": "ibm_cloud_kms",
"created_at": "2022-03-09T11:00:11Z",
"updated_at": "2022-03-09T11:00:11Z",
"created_by": "IBMid-1308197YB4",
"updated_by": "IBMid-1308197YB4",
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/keystores/f6a5ccc1-7fc3-435e-9637-482e470ba8e8",
"ibm_api_endpoint": "https://us-south.kms.cloud.ibm.com",
"ibm_iam_endpoint": "https://iam.bluemix.net/identity/token",
"ibm_api_key": "",
"ibm_instance_id": "d139ea58-a073-441b-ba4e-dcc8bae58be4",
"ibm_variant": "hpcs",
"ibm_key_ring": "IBM-Cloud-KMS-Internal"
}







 hpcs uko keystore-delete 

Delete an internal keystore or remove a connection to an external keystore. The external keystore on the remote platform still exists after you remove the connection.

ibmcloud hpcs uko keystore-delete --id ID --uko-vault UKO-VAULT --if-match IF-MATCH



* Command options

--id (string)
: Required. The UUID of the keystore. You can use the ibmcloud hpcs uko keystores command to retrieve the UUID.

--uko-vault (string)
On the application details page, use the Keys table to browse the keys in your service.
5. Click the ⋯ icon to open a list of options for the key that you want to enable.
6. From the options menu, click Enable key and confirm the key was enabled in the updated Keys table.



Keys cannot be enabled immediately after being disabled. If a key was disabled in error, wait at least 30 seconds before attempting to re-enable it.







 Disabling and enabling root keys with the API 



 Disabling a root key with the API 

You can disable a root key that's in the Active key state by making a POST call to the following endpoint.

https://<region>.kms.cloud.ibm.com/api/v2/keys/<keyID_or_alias>/actions/disable



1. [Retrieve your authentication credentials to work with keys in the service](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-up-apiretrieve-credentials).

To disable a root key, you must be assigned a Manager service access role for the instance or key. To learn how IAM roles map to Key Protect service actions, check out [Service access roles](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-accessmanage-access-roles).
2. Retrieve the ID of the root key that you want to disable.

You can retrieve the ID for a specified key by making a GET /v2/keys[request](https://cloud.ibm.com/apidocs/key-protectlist-keys), or by viewing your keys in the Key Protect dashboard.
3. Run the following curl command to disable the root key and suspend its encrypt and decrypt operations.
hs-crypto.secrets.setkeyfordeletion Authorize deletion for a key with Dual Authorization policy. 
 hs-crypto.secrets.unsetkeyfordeletion Cancel deletion for a key with Dual Authorization policy. 
 hs-crypto.secrets.unwrap Unwrap a key. 









 Key Ring events 

The following table lists the key ring actions that generate an event:



Table 3. Key ring actions

 Action Description 

 hs-crypto.key-rings.create Create a key ring. 
 hs-crypto.key-rings.delete Delete a key ring. 
 hs-crypto.key-rings.list List key rings in an instance. 
 hs-crypto.key-rings.request Invalid key ring request. 





 Policy events 

The following table lists the policy actions that generate an event:



Table 4. Policy actions

 Action Description 

 hs-crypto.policies.read List key policies. 
 hs-crypto.policies.write Set key policies. 
 hs-crypto.instance-policies.read List instance policies. 
 hs-crypto.instance-policies.write Set instance policies. 
 hs-crypto.policies.default Invalid policy request event. 
 hs-crypto.instance-policies.request Invalid policy request event. 







 Import token events 

The following table lists the import token actions that generate an event:



Table 5. Import token actions

 Action Description 

 hs-crypto.import-token.create Create an import token. 
 hs-crypto.import-token.read Retrieve an import token. 
 hs-crypto.import-token.request Invalid import token request event. 







 Registration events 

The following table lists the registration actions that generate an event:



Table 6. Registration actions

 Action Description 

 hs-crypto.registrations.list List registrations for any key. 
 hs-crypto.registrations.default Invalid registration request event. 







 Trusted Key Entry events 

The following table lists the Trusted Key Entry (TKE) actions that generate an event:



Table 7. Trusted Key Entry actions

 Action Description
[Purging keys manually](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-purge-keyspurge-keys)



* [Purging keys in the console](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-purge-keyspurge-keys-gui)
* [Purging keys with the API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-purge-keyspurge-keys-api)
* [What's next](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-purge-keyspurge-keys-next)



[Restoring keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-restore-keysrestore-keys)



* [How do I know whether a key can be restored?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-restore-keysrestore-keys-eligibility)
* [Restoring a deleted key with the console](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-restore-keysrestore-keys-ui)
* [Restoring a deleted key with the API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-restore-keysrestore-keys-api)



[Viewing associations between root keys and encrypted IBM Cloud resources](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-protected-resourcesview-protected-resources)



* [Viewing protected resources with the console](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-protected-resourcesview-protected-resources-gui)
FOR_MORE_INFO_REFER: https://cloud.ibm.com/docs/key-protect?topic=key-protect-troubleshootingunable-to-delete-keys]'

 this CLI request succeeds when using the --force option
 the registration between Key Protect and the cloud resource exists
$ ibmcloud kp key delete $KEY_ID -i $KP_INSTANCE_ID --force --output json

{
"id": "52a9d772-8982-4620-bfb4-b070dd812a0c"
}
Show more







 10 - Key metadata became corrupted... 



 Message 

Key metadata became corrupted: Please delete this key

Reason code: INCOMPLETE_METADATA_ERR





 HTTP status code 

500 - Internal Server Error

The HTTP 500 Internal Server server error response code indicates that the server encountered an unexpected condition that prevented it from fulfilling the request.

This error response is a generic "catch-all" response. Usually, this indicates the server cannot find a better 5xx error code to response. Sometimes, server administrators log error responses like the 500 status code with more details about the request to prevent the error from happening again in the future.





 Context 

This error is returned when there is an internal error.

If you get this error please contact [IBM support](https://cloud.ibm.com/unifiedsupport/supportcenter)







 11 - Key restoration has expired 



 Message 

Key restoration has expired

Reason code: KEY_RESTORE_EXPIRED





 HTTP status code 

400 - Bad Request

The HTTP 400 Bad Request response status code indicates that the server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing).

The client should not repeat this request without modification.





 Context 

This error occurs when you try to restore a key that was deleted more than 30 days ago.







 12 - KeyCreateImportAccess instance policy... 



 Message 

KeyCreateImportAccess instance policy does not allow this action
[purge](https://cloud.ibm.com/docs/key-protect-cli-pluginkp-key-purge) Purge a deleted key 
 [restore](https://cloud.ibm.com/docs/key-protect-cli-pluginkp-key-restore) Restore a root key that was previously deleted 
 [rotate](https://cloud.ibm.com/docs/key-protect-cli-pluginkp-key-rotate) Rotate a root key 
 [schedule-delete](https://cloud.ibm.com/docs/key-protect-cli-pluginkp-key-schedule-delete) Authorize a key, with a dual-auth-delete policy, to be deleted 
 [show](https://cloud.ibm.com/docs/key-protect-cli-pluginkp-key-show) Retrieve a key 
 [sync](https://cloud.ibm.com/docs/key-protect-cli-pluginkp-key-sync) Synchronize a key's associated resources 
 [unwrap](https://cloud.ibm.com/docs/key-protect-cli-pluginkp-key-unwrap) Unwrap a data encryption key 
 [update](https://cloud.ibm.com/docs/key-protect-cli-pluginkp-key-update) Update a key, transferring it to a new key ring 
 [versions](https://cloud.ibm.com/docs/key-protect-cli-pluginkp-key-versions) updated List all key versions 
 [wrap](https://cloud.ibm.com/docs/key-protect-cli-pluginkp-key-wrap) Wrap a data encryption key 







 kp key-ring command 

Key Ring support allows for managing groups of keys for best practices using kp key-ring.



Table 4. Sub-commands for managing key-rings

 Sub-command Status v0.8 Description
* UI
* API







 Restoring keys 

You can use IBM Cloud® Hyper Protect Crypto Services to restore a previously deleted key and access the associated data on the cloud.

When a key is deleted, it is moved to a Destroyed state. However, information about the key (such as the metadata) can still be viewed and you have 30 days to restore the key to an Active state. For this reason, a key deletion is considered a Soft deletion where the key still exists but can no longer be used to access the data that is encrypted by the key. This topic describes the process to restore a key and the limitations of the key restoration process.

This soft deletion period, in which a key has been deleted but can still be restored, lasts for 30 days. Between 30 days and 90 days, the key data can still be accessed, but the key can no longer be restored. After 90 days, the key becomes eligible to be automatically purged, which can occur at any time after 90 days. Purged keys, unlike destroyed keys, are gone forever.



Table 1. Ties key states to the time from a key's deletion to what actions are possible with the key.

 Time from key deletion Name of key state Can view or access key data? Can restore? 

 1–30 days Destroyed Yes Yes 
 30–90 days Destroyed Yes No 
 After 90 days Purged (not a key state technically) No No 



Because purged keys are inaccessible and destroyed, there is technically no Purged key state. However, it can be useful to think of Purged as being a state because nonexistence is part of the lifecycle of a key.

All root keys and standard keys, whether generated by Hyper Protect Crypto Services or imported by you, can be restored.



 How do I know whether a key can be restored? 

To see whether a destroyed key can be restored:



1. Navigate to your Hyper Protect Crypto Services instance in the IBM Cloud console.
2. In the navigation, make sure you are on the KMS keys page.
3. Find the key that you want to restore and make sure that the key is in a Destroyed state.
4.
$ ibmcloud kp key delete $MY_COS_KEY_ID --force --output json

{
"id": "52a9d772-8982-4620-bfb4-b070dd812a0c"
}

 delete the KMS instance
$ ibmcloud resource service-instance-delete $KMS_NAME --force

 delete the COS instance
$ ibmcloud resource service-instance-delete $COS_NAME --force

 view resources (COS and KMS should no longer exist)
$ ibmcloud resource service-instances

Retrieving instances with type service_instance in resource group Default in all locations under account <account name> as <email address>...
OK
No service instance found.







 Required parameters 



* KEY_ID_OR_ALIAS

The v4 UUID or alias of the key that you want to delete. To retrieve a list of your available keys, run the [kp keys](https://cloud.ibm.com/docs/key-protect-cli-plugin?topic=key-protect-cli-plugin-key-protect-cli-referencekp-keys) command.
* -i, --instance-id

The IBM Cloud instance ID that identifies your Key Protect instance.

You can set an environment variable instead of specifying -i with the following command: $ export KP_INSTANCE_ID=<INSTANCE_ID>.







 Optional parameters 



* -f, --force

Delete a key, with force, which is used to delete a key that has "registrations." Registrations are associations between root keys and other cloud resources, such as Cloud Object Storage (COS) buckets or Cloud Databases deployments.

For more information, see [kp registrations](https://cloud.ibm.com/docs/key-protect-cli-plugin?topic=key-protect-cli-plugin-key-protect-cli-referencekp-registrations)
* -o, --output

Set the CLI output format.
ibmcloud is key-delete 

Delete one or more keys.

ibmcloud is key-delete (KEY1 KEY2 ...) [--output JSON] [-f, --force] [-q, --quiet]



 Command examples 



* ibmcloud is key-delete e9e7655e-0000-0000-0000-0000001a957a --output JSON
* ibmcloud is key-delete e9e7655e-0000-0000-0000-0000001a957a -f







 Command options 



* KEY1: ID or name of the key.
* KEY2: ID or name of the key.
* --output: Specify output format, only JSON is supported. One of: JSON.
* --force, -f: Force the operation without confirmation.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is key-update 

Update the name of a key.

ibmcloud is key-update KEY --name NEW_NAME [--output JSON] [-q, --quiet]



 Command examples 



* ibmcloud is key-update e9e7655e-0000-0000-0000-0000001a957a --name my-new-name
* ibmcloud is key-update e9e7655e-0000-0000-0000-0000001a957a --name my-new-name --output JSON







 Command options 



* KEY: ID or name of the key.
* --name: New name for the key.
* --output: Specify output format, only JSON is supported. One of: JSON.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is keys 

List all keys.
Optional: Attach JSON attributes to your lock.

You can include a JSON object with each lock to hold any information that you might need for an automated flow. For example, a key-value pair that identifies the resource that you want to associate with this lock.
8. Click Create.

A new lock is created for your selected secret version.









 Creating locks from the CLI 

You can create up to 1000 locks on a secret by using the Secrets Manager CLI. Each lock can be used to represent a single application or service that uses your secret.

A secret is considered locked after you attach one or more locks to it. A lock can be applied only on a secret version that contains active payload, or secret data.

To help you to create a new lock and remove older locks in a single operation, you can also specify an optional mode at lock creation.



Table 1. Optional lock modes and their descriptions

 Mode Description 

 Remove previous locks Removes any other locks that match the name that you specify. If any matching locks are found in the previous version of the secret, those locks are deleted when your new lock is created.<br><br>For example, suppose that the previous version of your secret contains a lock lock-x. Creating a lock on the current version of your secret and enabling the Delete matching locks option results in removing lock-x from the previous version. 
 Remve previous locks and delete previous version data Same as the previous option, but also permanently deletes the data of the previous secret version if it doesn't have any locks that are associated with it.<br><br>Suppose that the previous version of your secret contains a lock lock-z. Creating a lock on the current version of your secret with both the Delete matching locks and Delete previous version data options results in removing lock-z from the previous version. Additionally, because the previous version doesn't have any other locks that are attached to it, the secret data that is associated with the previous version is also deleted. 





 Creating a lock on the current secret version 

You can lock the current version of a secret by using the Secrets Manager CLI.