vania-janet/multiturn-rag-retrieval-data huggingface dataset:
[Check mark icon](https://cloud.ibm.com/docs-content/v1/content/0bc8db34a3d90b2a5103c9c71b08a96de9525bbc/icons/checkmark-icon.svg) 
 Enable key ![Check mark icon](https://cloud.ibm.com/docs-content/v1/content/0bc8db34a3d90b2a5103c9c71b08a96de9525bbc/icons/checkmark-icon.svg) 
 Delete key ![Check mark icon](https://cloud.ibm.com/docs-content/v1/content/0bc8db34a3d90b2a5103c9c71b08a96de9525bbc/icons/checkmark-icon.svg) ![Check mark icon](https://cloud.ibm.com/docs-content/v1/content/0bc8db34a3d90b2a5103c9c71b08a96de9525bbc/icons/checkmark-icon.svg) ![Check mark icon](https://cloud.ibm.com/docs-content/v1/content/0bc8db34a3d90b2a5103c9c71b08a96de9525bbc/icons/checkmark-icon.svg) 
 Restore key ![Check mark icon](https://cloud.ibm.com/docs-content/v1/content/0bc8db34a3d90b2a5103c9c71b08a96de9525bbc/icons/checkmark-icon.svg) 





 Cryptoperiods, originator-usage periods, and recipient-usage periods 

If you're familiar with NIST standard terms and key management systems, then you're probably aware of the concepts of a "cryptoperiod", an "originator-usage period", and a "recepient-usage period".
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:a192d603-0b8d-452f-aac3-f9e1f95e7411:key:d887bfe8-5166-4dad-af32-7e3055ca1873"
}

 enable the dual authorization policy
$ ibmcloud kp key policy-update dual-auth-delete $KEY_ID --enable --output json

{
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-06-19T16:08:59Z",
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:a192d603-0b8d-452f-aac3-f9e1f95e7411:policy:0aab763d-b650-43a2-86ad-bdfe2c35c94c",
"lastUpdateDate": "2020-06-19T16:08:59Z",
"updatedBy": "user id ...<redacted>...",
"dualAuthDelete": {
"enabled": true
}
}

 list the policies
$ ibmcloud kp key policies $KEY_ID --output json

[
{
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-06-19T16:08:59Z",
region Required. The region abbreviation, such as us-south or eu-gb, that represents the geographic area where your Key Protect instance resides. <br> <br>For more information, see [Regional service endpoints](https://cloud.ibm.com/docs/key-protect?topic=key-protect-regionsservice-endpoints). 
 IAM_token Required. Your IBM Cloud access token. Include the full contents of the IAM token, including the Bearer value, in the curl request. <br> <br>For more information, see [Retrieving an access token](https://cloud.ibm.com/docs/key-protect?topic=key-protect-retrieve-access-token). 
 instance_ID Required. The unique identifier that is assigned to your Key Protect service instance. <br> <br>For more information, see [Retrieving an instance ID](https://cloud.ibm.com/docs/key-protect?topic=key-protect-retrieve-instance-ID). 
 key_ring_ID Optional. The unique identifier of the key ring that the key is a part of. <br>If unspecified, Key Protect will search for the key in every key ring associated with the specified instance. It is recommended to specify the key ring ID for a more optimized request. <br> <br>Note: The key ring ID of keys that are created without an x-kms-key-ring header is: default. <br> <br>For more information, see [Grouping keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-grouping-keys). 



A successful request returns an HTTP 204 No Content response, which indicates that the dual authorization policy was updated for your service instance. Keys that you create or import to the service now require only one authorization before they can be deleted. For more information, see [Deleting keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-keys).





 Optional: Verify dual auth policy disablement
Your IBM Cloud access token. Include the full contents of the IAM token, including the Bearer value, in the cURL request. For more information, see [Retrieving an access token](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-access-token). 
 instance_ID Required. The unique identifier that is assigned to your Hyper Protect Crypto Services service instance. For more information, see [Retrieving an instance ID](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-instance-ID). 
 key_ring_ID Optional. The unique identifier of the key ring that the key belongs to. If unspecified, Hyper Protect Crypto Services will search for the key in every key ring that is associated with the specified instance. Therefore, it is suggested to specify the key ring ID for a more optimized request.<br><br>Note: The key ring ID of keys that are created without an x-kms-key-ring header is: default. For more information, see [Managing key rings](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-managing-key-rings). 



A successful request returns an HTTP 204 No Content response, which indicates that the dual authorization policy was updated for your service instance. Keys that you create or import to the service now require only one authorization before they can be deleted. For more information, see [Deleting keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-keys).
3. Optional: Verify that the dual authorization policy was updated by browsing the policies that are available for your Hyper Protect Crypto Services instance.

curl -X GET 
'https://api.<region>.hs-crypto.cloud.ibm.com:<port>/api/v2/instance/policies?policy=dualAuthDelete' 
  -H 'authorization: Bearer <IAM_token>'
)

response, err := iamPolicyManagementService.DeletePolicy(options)
if err != nil {
panic(err)
}

const params = {
policyId: examplePolicyId,
};

iamPolicyManagementService.deletePolicy(params)
.then(res => {
console.log(JSON.stringify(res, null, 2));
})
.catch(err => {
console.warn(err)
});

If the source service is removed from the account, any policies that are created by that service for its dependent services are deleted automatically. Similarly, if the dependent service is removed from the account, any access policies that are delegated to that service are also deleted.





 Removing an authorization by using Terraform 

If you want to remove an authorization by using Terraform, you need to delete the argument from the main.tf file. After you delete the argument, provision your file by using the following steps:



1. Run terraform plan to generate a Terraform execution plan to preview the proposed actions.

terraform plan
2. Run terraform apply to create the resources that are defined in the plan.

terraform apply
"description": "IBM CLOUD key template description",
"label": "IBM CLOUD KEY",
"state": "active",
"size": "256",
"algorithm": "aes",
"verification_patterns": [
{
"method": "enc-zero",
"value": "DDFA4A"
}
],
"activation_date": "2027-04-18",
"expiration_date": "2028-06-29",
"tags": [
{
"name": "first-tag",
"value": "for-ibm"
}
],
"created_at": "2022-03-09T11:26:01Z",
"updated_at": "2022-03-09T11:26:04Z",
"created_by": "IBMid-1308197YB4",
"updated_by": "IBMid-1308197YB4",
"referenced_keystores": [],
"instances": [
{
"id": "ea7b6b27-d71b-4fe9-bbfe-309c7ca713a6",
"label_in_keystore": "IBM CLOUD KEY",
"type": "secret_key",
"keystore": {
"group": "Production",
"type": "ibm_cloud_kms"
}
}
],
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/managed_keys/3dab42dc-6941-4841-8d27-4dabcc5aa09e"
}







 hpcs uko managed-key-destroy 

Destroy a managed key and perform key destruction operations on keystores in the keystore group associated with the managed key. This operation cannot be undone.
Using dual authorization 

After you set up your IBM® Key Protect service instance, you can manage dual authorization by using the service API.



 Managing dual authorization settings 

Dual authorization for Key Protect service instances is an extra policy that helps to prevent accidental or malicious deletion of keys. When you enable this policy at the instance level, Key Protect requires an authorization from two users to delete any keys that are created after the policy is enabled.

The dual authorization capability is available only through the Key Protect API. To find out more about accessing the Key Protect APIs, check out [Setting up the API](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-up-api).

Before you enable dual authorization for your Key Protect instance, keep in mind the following considerations:



* When you enable dual authorization for your Key Protect instance, the policy is applicable only for new keys. By enabling dual authorization at the instance level, any new keys that you add to the instance will automatically inherit a dual authorization policy. Your existing keys are not affected by the policy change and will still require a single authorization for deletion.
* You can always disable a dual authorization policy for your Key Protect instance. If you want to [disable an existing dual authorization policy](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-dual-authdisable-dual-auth-instance-policy-ui) to allow for single authorization, keep in mind that the change is applicable only for future keys that you add to the instance. Any existing keys that were created under a dual authorization policy will continue to require actions from two users before the keys can be deleted. After a key inherits a dual authorization policy, the policy cannot be reverted.





 Enabling dual authorization for your Key Protect instance with the console 

If you prefer to disable a dual authorization policy on your instance by using a graphical interface, you can use the IBM Cloud console.

After creating a Key Protect instance, complete the following steps to create a dual authorization policy:



1. [Log in to the IBM Cloud console](https://cloud.ibm.com/login/).
2.
[checkmark icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/checkmark-icon.svg) 
 Disable key. ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/checkmark-icon.svg) 
 Enable key. ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/checkmark-icon.svg) 
 Delete key. ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/checkmark-icon.svg) ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/checkmark-icon.svg) ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/checkmark-icon.svg) 
 Restore key. ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/checkmark-icon.svg) 







 Monitoring for lifecycle changes
The following JSON object shows an example response for a key that has an existing dual authorization policy.

{
"metadata": {
"collectionTotal": 1,
"collectionType": "application/vnd.ibm.kms.policy+json"
},
"resources": [
{
"id": "02fd6835-6001-4482-a892-13bd2085f75d",
"crn": "crn:v1:bluemix:public:kms:us-south:a/f047b55a3362ac06afad8a3f2f5586ea:12e8c9c2-a162-472d-b7d6-8b9a86b815a6:key:02fd6835-6001-4482-a892-13bd2085f75d",
"dualAuthDelete": {
"enabled": true
},
"createdBy": "...",
"creationDate": "2020-03-10T20:41:27Z",
"updatedBy": "...",
"lastUpdateDate": "2020-03-16T20:41:27Z"
}
]
}

For keys that do not have an existing dual authorization policy, the following JSON shows an example response.

{
"metadata": {
"collectionTotal": 0,
"collectionType": "application/vnd.ibm.kms.policy+json"
}
}





 Creating a dual authorization policy for a key 

Create a dual authorization policy for single key by making a PUT call to the following endpoint.

https://<region>.kms.cloud.ibm.com/api/v2/keys/<keyID_or_alias>/policies?policy=dualAuthDelete

After you enable a dual authorization policy for a single key, the policy cannot be reverted.



1.
* UI
* API







 Managing dual authorization of your service instance 

After you set up your IBM Cloud® Hyper Protect Crypto Services instance, you can manage dual authorization by using the key management service API.

This policy only applies to key management service keys and related operations.



 Understanding dual authorization of your service instance 

Dual authorization for Hyper Protect Crypto Services instances is an extra policy that helps to prevent accidental or malicious deletion of keys. When you enable this policy at the instance level, Hyper Protect Crypto Services requires an authorization from two users to delete any keys that are created after the policy is enabled.

Before you enable dual authorization for your service instance, keep in mind the following considerations:



* When you enable dual authorization for your service instance, the policy is applicable only for new keys. By enabling dual authorization at the instance level, any new keys that you add to the instance will automatically inherit a dual authorization policy. Your existing keys are not affected by the policy change and will still require a single authorization for deletion.
* You can always disable a dual authorization policy for your service instance. If you want to disable an existing dual authorization policy to allow for single authorization, keep in mind that the change is applicable only for future keys that you add to the instance. Any existing keys that were created under a dual authorization policy will continue to require actions from two users before the keys can be deleted. After a key inherits a dual authorization policy, the policy cannot be reverted.







 Enabling dual authorization for your service instance with the console 

As an instance manager, if you prefer to enable a dual authorization policy on your instance by using a graphical interface, you can use the IBM Cloud console.

After creating a service instance, complete the following steps to create a dual authorization policy:



1. [Log in to the IBM Cloud console](https://cloud.ibm.com/).
2. Go to Menu > Resource list to view a list of your resources.
3. From your IBM Cloud resource list, select your provisioned instance of Hyper Protect Crypto Services.
4. In the UI of the selected service instance, select the Instance policies tab in the side menu.
5.
[Edit icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/edit-tagging.svg).
2. To add more attributes, click Add attributes. For a list of supported attributes, see [supported attributes table](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-pkcs11-api-refpkcs-attribute-list).
3. (Optional) You can delete more attributes by clicking the Trash can icon ![Trash can icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/icon_trash.svg). The required attributes cannot be deleted.
4. Click Next to continue.





3. On the Confirmation page, verify the key details and click Create key.



1. Verify the key details that are displayed, especially the key type, keystore, and key attributes.

All the values cannot be modified through the console after the key is created.
2. Click Create key to confirm the creation.







If you are performing cryptographic operations using the PKCS #11 API, to load the created key from UI to your PKCS #11 application, reinitialize the PKCS #11 API by using the C_Finalize() and C_Initialize() functions.

You have successfully created an EP11 key. The created key is displayed as the first row in the Enterprise PKCS #11 keys table.





 Deleting EP11 keys 

For default service access roles that support deleting EP11 keys, see [service access roles](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-accessservice-access-roles). If you are to create custom roles, make sure to assign the following actions to the custom role:
[checkmark icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/checkmark-icon.svg) 
 Deactivate a key. ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/checkmark-icon.svg) 
 Reactivate a key. ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/checkmark-icon.svg) 
 Destroy a key. ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/checkmark-icon.svg) ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/checkmark-icon.svg) 
 Remove a key from vault. ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/checkmark-icon.svg) 







 Monitoring for lifecycle changes 

After you add a managed key to the service, use the IBM Cloud UI or the Unified Key Orchestrator API to view your key's transition history and configuration.
1. [Log in to the IBM Cloud console](https://cloud.ibm.com/).
2. Go to Menu > Resource list to view a list of your resources.
3. From your IBM Cloud resource list, select your provisioned instance of Hyper Protect Crypto Services.
4. In the UI of the selected service instance, select the Instance policies tab in the side menu.
5. In the Dual authorization deletion section, clear the box for Require two users to approve key deletions, and click Save policy.







 Disabling dual authorization for your service instance with the key management service API 

As an instance manager, disable an existing dual authorization policy for a Hyper Protect Crypto Services instance by making a PUT call to the following endpoint.

https://api.<region>.hs-crypto.cloud.ibm.com:<port>/api/v2/instance/policies?policy=dualAuthDelete



1. [Retrieve your authentication credentials to work with the API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-kms-api).

To enable and disable dual authorization policy, you must be assigned a Manager access policy for your service instance. To learn how IAM roles map to Hyper Protect Crypto Services service actions, check out [Service access roles](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-accessservice-access-roles).
2. Disable an existing dual authorization policy for your service instance by running the following cURL command.

curl -X PUT 
'https://api.<region>.hs-crypto.cloud.ibm.com:<port>/api/v2/instance/policies?policy=dualAuthDelete' 
-H 'accept: application/vnd.ibm.kms.policy+json' 
-H 'authorization: Bearer <IAM_token>' 
-H 'bluemix-instance: <instance_ID>'
d887bfe8-5166-4dad-af32-7e3055ca1873

 show key details
$ ibmcloud kp key show $KEY_ID --output json

{
"id": "d887bfe8-5166-4dad-af32-7e3055ca1873",
"name": "my-root-key",
"type": "application/vnd.ibm.kms.key+json",
"algorithmType": "AES",
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-06-19T16:07:50Z",
"lastUpdateDate": "2020-06-19T16:07:50Z",
"keyVersion": {
"id": "d887bfe8-5166-4dad-af32-7e3055ca1873",
"creationDate": "2020-06-19T16:07:50Z"
},
"extractable": false,
"state": 1,
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:a192d603-0b8d-452f-aac3-f9e1f95e7411:key:d887bfe8-5166-4dad-af32-7e3055ca1873"
}

 enable the dual authorization policy
$ ibmcloud kp key policy-update dual-auth-delete $KEY_ID --enable --output json

{
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-06-19T16:08:59Z",
[SSP-AM-Remove-User-Customer-3](https://cloud.ibm.com/docs-content/v1/content/bd177462727ef0a849ddcf8c842a6203b41f0625/mas-ms/images/SSP-AM-Remove-User-Customer-3.png)
5. A warning message will pop-up indicating that removing the user’s access to the customer will also remove all accesses under the customer for the user. If you are removing the last customer in the user’s Customer Access List, their account will be deactivated. If you want to continue with the removal process, select “Yes”.

![SSP-AM-Remove-User-Customer-4](https://cloud.ibm.com/docs-content/v1/content/bd177462727ef0a849ddcf8c842a6203b41f0625/mas-ms/images/SSP-AM-Remove-User-Customer-4.png)
6. Save the record and return to the List View.

The user will not be viewable in the List View because they no longer have access to the customer you are managing.

![SSP-AM-Remove-User-Customer-5](https://cloud.ibm.com/docs-content/v1/content/bd177462727ef0a849ddcf8c842a6203b41f0625/mas-ms/images/SSP-AM-Remove-User-Customer-5.png)







 How to Create a New User 

Managers in the Access Management application are able to create new users. These users can be another Manager or Standard User. When the new user is created they are granted access to submit access requests for the customer the Manager user is managing.

Only users that will be responsible for approving/rejecting access requests should be assigned the Manager role.

Follow these steps to create a new user if your user role is Manager.



1.
3. Select the user type:



* Business: A team member who can provide certain details, such as the product logo, description, and customer support experience.
* Technical: A team member who can import the product to your test environment, configure the deployment details, and validate it's ready for use.



4. Enter the email address of each user.
5. Click Invite.







 Next steps 

Now that you completed the getting started tasks, you're ready to [continue with the onboarding process](https://cloud.ibm.com/docs/sell?topic=sell-sw-partner-details).

To get an overview of all the tasks involved in the process, see [Checklist for selling software on IBM Cloud](https://cloud.ibm.com/docs/sell?topic=sell-checklist-software).
If the owner that you identified is not available or has left the company, find one or more other users with the administrator role. Consider who might be assigned the role, for example, a manager, team lead, or someone who works directly with IBM Cloud customers.

To locate a user with an administrator role, click the name link and review the information on the Access tab. Look for the following values:



* Service - VMware Solutions
* Resources - All
* Role - Administrator







 Assigning access 

After you find the account owner or another user with an administrator role, that person must perform the following steps to assign access:



1. Log in to [IBM Cloud](https://cloud.ibm.com) as the IBM Cloud account owner.
2. On the upper right of the window, select the IBM Cloud account that you want to use.
3. At the right side of the banner, click Manage > Access (IAM).
4. From the left navigation pane, click Users.
5. In the row for the user that you want to assign access, click the vertical overflow menu next to the Status column, and then click Assign access.
6. Select Access groups to add the user to one or more existing access groups. You can assign the user only to those access groups that you have access to manage.



1. Select one or more group names.
2. Click Add > Assign.



7. Select Access policy to assign individual access policies to the user.



1. Select VMware Solutions from the list of services, and then click Next.
2. Select Specific resources for the access scope. Select the attribute type as VMware Instance, the operator as string equals, and the value as All instances. Then, click Next.
3. From the Platform access list, select Administrator. Then, click Next.
4. Optionally, choose the time when you want the policy to grant access. Then, click Review.
5. Click Add > Assign.









 Related links
[Pending until edits are accepted or rejected](https://cloud.ibm.com/docs-content/v1/content/b698ea8660e1f51664f7479f870bbf8840335d06/dl//images/cologix11.png)

Pending until edits are accepted or rejected
11. Similarly, you must also confirm deletions in the IBM Cloud console.

Zoom

![Confirm deletions in the IBM Cloud console](https://cloud.ibm.com/docs-content/v1/content/b698ea8660e1f51664f7479f870bbf8840335d06/dl//images/cologix12.png)

Confirm deletions in the IBM Cloud console

After accepted, your edits are Active while the deletion is pending confirmation on the IBM Cloud console.

Zoom

![Active while deletion is pending confirmation](https://cloud.ibm.com/docs-content/v1/content/b698ea8660e1f51664f7479f870bbf8840335d06/dl//images/cologix13.png)

Active while deletion is pending confirmation