vania-janet/multiturn-rag-retrieval-data huggingface dataset:
$ curl -X POST "https://<region>.kms.cloud.ibm.com/api/v2/keys/<keyID_or_alias>/actions/setKeyForDeletion" -H "accept: application/vnd.ibm.kms.key_action+json" -H "authorization: Bearer <IAM_token>" -H "bluemix-instance: <instance_ID>" -H "content-type: application/vnd.ibm.kms.key_action+json"

Replace the variables in the example request according to the following table.





Table 1. Describes the variables that are needed to set a key for deletion.

 Variable Description 

 region Required. The region abbreviation, such as us-south or eu-gb, that represents the geographic area where your Key Protectinstance resides. <br> <br>For more information, see [Regional service endpoints](https://cloud.ibm.com/docs/key-protect?topic=key-protect-regionsservice-endpoints). 
 key_ID_or_alias Required. The unique identifier or alias for the root key that you want to rotate. 
 IAM_token Required. Your IBM Cloud access token. Include the full contents of the IAM token, including the Bearer value, in the curl request. <br> <br>For more information, see [Retrieving an access token](https://cloud.ibm.com/docs/key-protect?topic=key-protect-retrieve-access-token). 
 instance_ID Required. The unique identifier that is assigned to your Key Protect service instance. <br>For more information, see [Retrieving an instance ID](https://cloud.ibm.com/docs/key-protect?topic=key-protect-retrieve-instance-ID). 



A successful request returns an HTTP 204 No Content response, which indicates that your key was authorized for deletion.
https://<region>.kms.cloud.ibm.com/api/v2/keys/<keyID_or_alias>/purge
-H 'accept: application/vnd.ibm.kms.key+json'
-H 'authorization: Bearer <IAM_token>'
-H 'bluemix-instance: <instance_ID>'

Replace the variables in the example request according to the following table.



Table 2. Describes the variables that are needed to purge a key with the Key Protect API.

 Variable Description 

 region Required. The region abbreviation, such as us-south or eu-gb, that represents the geographic area where your Key Protect instance resides. For more information, see [Regional service endpoints](https://cloud.ibm.com/docs/key-protect?topic=key-protect-regionsservice-endpoints). 
 keyID_or_alias Required. The unique identifier or alias for the key that you would like to purge. 
 IAM_token Required. Your IBM Cloud access token. Include the full contents of the IAM token, including the Bearer value, in the curl request. For more information, see [Retrieving an access token](https://cloud.ibm.com/docs/key-protect?topic=key-protect-retrieve-access-token). 
 instance_ID Required. The unique identifier that is assigned to your Key Protect service instance. For more information, see [Retrieving an instance ID](https://cloud.ibm.com/docs/key-protect?topic=key-protect-retrieve-instance-ID). 



For a detailed description of the request, see the Key Protect [REST API reference doc](https://cloud.ibm.com/apidocs/key-protect).





 What's next 

To learn how to delete and purge a key using the UI, check out [Deleting keys using a single authorization](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-keys).
Your IBM Cloud access token. Include the full contents of the IAM token, including the Bearer value, in the cURL request. For more information, see [Retrieving an access token](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-access-token). 
 instance_ID Required. The unique identifier that is assigned to your Hyper Protect Crypto Services instance. For more information, see [Retrieving an instance ID](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-instance-ID). 
 key_ring_ID Optional. The unique identifier of the key ring that the key belongs to. If it is not specified, Hyper Protect Crypto Services searches for the key in every key ring that is associated with the specified instance. Therefore, it is suggested to specify the key ring ID for a more optimized request. The key ring ID of keys that are created without an x-kms-key-ring header is default. For more information, see [Managing key rings](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-managing-key-rings). 
 return_preference A header that alters server behavior for POST and DELETE operations. When you set the return_preference variable to return=minimal, the service returns a successful deletion response. When you set the variable to return=representation, the service returns both the key material and the key metadata. 



If the return_preference variable is set to return=representation, the details of the DELETE request are returned in the response entity-body.

The following JSON object shows a sample returned value.

{
"metadata": {
"collectionType": "application/vnd.ibm.kms.key+json",
"collectionTotal": 1
},
"resources": [
{
"type": "application/vnd.ibm.kms.key+json",
"id": "...",
name"]')
if $KEY_NAME == "my-test-key-" ]] ! ! ! ! ! ! ! ! ; then
echo "Deleting... $KEY_NAME $KEY_ID"
ibmcloud kp key delete $KEY_ID
fi
done

(output not shown)
<-- </section "id="section-kp-keys-example-5" "> --><-- </section "id="section-kp-keys-examples" "> --><-- <section "id="section-kp-keys-required" "> --> Required parameters -i, --instance-id: The IBM Cloud instance ID that identifies your Key Protect instance.
You can set an environment variable instead of specifying -i with the following command.

$ export KP_INSTANCE_ID=INSTANCE_ID
<-- </section "id="section-kp-keys-required" "> --><-- <section "id="section-kp-keys-optional" "> --> Optional parameters -c, --crn: Include the cloud resource name (CRN) in the output.<-- </section "id="section-kp-keys-optional" "> --><-- </section "id="section-kp-keys" "> --><-- <section "id="section-kp-region-set" "> --> kp region-set Target a different Key Protect regional endpoint. ibmcloud kp region-set REGION
-i, --instance-id INSTANCE_ID
-u, --unset] ! ! ! ! ! ! ! ! ! ! ! ! ! !
],
"activation_date": "2027-04-18",
"expiration_date": "2028-06-29",
"tags": [
{
"name": "first-tag",
"value": "for-ibm"
}
],
"created_at": "2022-03-09T11:26:01Z",
"updated_at": "2022-03-09T11:26:04Z",
"created_by": "IBMid-1308197YB4",
"updated_by": "IBMid-1308197YB4",
"referenced_keystores": [],
"instances": [
{
"id": "ea7b6b27-d71b-4fe9-bbfe-309c7ca713a6",
"label_in_keystore": "IBM CLOUD KEY",
"type": "secret_key",
"keystore": {
"group": "Production",
"type": "ibm_cloud_kms"
}
}
],
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/managed_keys/3dab42dc-6941-4841-8d27-4dabcc5aa09e"
}







 hpcs uko managed-key-destroy 

Destroy a managed key and perform key destruction operations on keystores in the keystore group associated with the managed key. This operation cannot be undone. Make sure that the managed key is in a deactivated state before you run this command.

ibmcloud hpcs uko managed-key-destroy --id ID --uko-vault UKO-VAULT --if-match IF-MATCH



* Command options

--id (string)
: Required. The UUID of the key.
}
],
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/templates/ada4293c-07ed-4903-b3ee-419bd1a05fde"
}







 hpcs uko key-template-delete 

Delete a key template from the vault. Make sure that no managed key is associated with the key template before you run this command.

ibmcloud hpcs uko key-template-delete --id ID --uko-vault UKO-VAULT --if-match IF-MATCH



* Command options

--id (string)
: Required. The UUID of the template. You can use the ibmcloud hpcs uko key-templates command to retrieve the UUID.

--uko-vault (string)
: Required. The UUID of the vault where the update is to take place. You can use the ibmcloud hpcs uko key-templates command to retrieve the UUID.

--if-match (string)
: Required. The precondition of the update, which is the value of the ETag from the header on a GET request. You can use the ibmcloud hpcs uko key-template command to retrieve the ETag.
* Example

ibmcloud hpcs uko key-template-delete 
--id=07b62c12-75a2-46c9-9259-0cecde3985d2 
--uko-vault=5295ad47-2ce9-43c3-b9e7-e5a9482c362b 
--if-match=2022-05-11T14:58:26Z
* Output

The command returns the output similar to the following example:

...
OK







 ibmcloud hpcs uko key-template 

Retrieve a key template and its details by specifying the ID.
* -n, --encrypted-nonce

Used with import tokens. The encrypted nonce value that verifies your request to import a key to Key Protect. This value must be encrypted by using the key material that you import into the service. See ibmcloud kp import-token --help.

To retrieve a nonce, use ibmcloud kp import-token show. Then, encrypt the value by running ibmcloud kp import-token nonce-encrypt.
* -o, --output

Set the CLI output format. By default, all commands print in table format. To change the output format to JSON, use --output json.
* -m, --rotation-interval-month



Specify the rotation time interval (in months) for a key. The default value is -1.



* -s, --standard-key

Set the parameter only if you want to create a [standard key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-envelope-encryptionkey-types). To create a root key, omit the --standard-key parameter.
* -v, --iv

Used with import tokens. The initialization vector (IV) that is generated when you encrypt a nonce. The IV value is required to decrypt the encrypted nonce value that you provide when you make a key import request to the service.

To generate an IV, encrypt the nonce by running ibmcloud kp import-token nonce-encrypt.
* --key-ring

A unique, human readable name for the key-ring. Required if the user doesn't have permissions on the default key ring.









 kp key delete 

[Delete a key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-keys) that is stored in your Key Protect service.

ibmcloud kp key delete KEY_ID_OR_ALIAS
"activation_date": "P5Y1M1W2D",
"expiration_date": "P1Y2M1W4D",
"state": "active"
},
"description": "IBM CLOUD key template description",
"created_at": "2022-03-09T15:40:52Z",
"updated_at": "2022-03-09T15:40:52Z",
"created_by": "IBMid-1308197YB4",
"updated_by": "IBMid-1308197YB4",
"keystores": [
{
"group": "Production",
"type": "ibm_cloud_kms"
}
],
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/templates/ada4293c-07ed-4903-b3ee-419bd1a05fde"
}







 hpcs uko key-template-delete 

Delete a key template from the vault. Make sure that no managed key is associated with the key template before you run this command.

ibmcloud hpcs uko key-template-delete --id ID --uko-vault UKO-VAULT --if-match IF-MATCH



* Command options

--id (string)
: Required. The UUID of the template. You can use the ibmcloud hpcs uko key-templates command to retrieve the UUID.

--uko-vault (string)
: Required. The UUID of the vault where the update is to take place. You can use the ibmcloud hpcs uko key-templates command to retrieve the UUID.

--if-match (string)
: Required. The precondition of the update, which is the value of the ETag from the header on a GET request.
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:a192d603-0b8d-452f-aac3-f9e1f95e7411:policy:0aab763d-b650-43a2-86ad-bdfe2c35c94c",
"lastUpdateDate": "2020-06-19T16:08:59Z",
"updatedBy": "user id ...<redacted>...",
"dualAuthDelete": {
"enabled": true
}
}

 list the policies
$ ibmcloud kp key policies $KEY_ID --output json

[
{
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-06-19T16:08:59Z",
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:a192d603-0b8d-452f-aac3-f9e1f95e7411:policy:0aab763d-b650-43a2-86ad-bdfe2c35c94c",
"lastUpdateDate": "2020-06-19T16:08:59Z",
"updatedBy": "user id ...<redacted>...",
"dualAuthDelete": { "enabled": true
}
}
]

 this should fail (the key has a dual authorization policy)
$ ibmcloud kp key delete $KEY_ID_OR_ALIAS
curl -X DELETE -H 'Authorization: Bearer API_TOKEN' -H "IBMInstanceID: GUID" https://ENDPOINT/api/customer/accessKeys/ACCESS_KEY

Where



* ENDPOINT is the URL for the region where the monitoring instance is available. For more information, see [monitoring endpoints](https://cloud.ibm.com/docs/monitoring?topic=monitoring-endpointsendpoints).
* API_TOKEN is the API Token retrieved in Step 1.
* GUID is the GUID of the monitoring instance associated with the access key. See [headers for IAM tokens](https://cloud.ibm.com/docs/monitoring?topic=monitoring-mon-curlmon-curl-headers-iam).
* ACCESS_KEY is the access key to be deleted. You can [view a list of all access keys](https://cloud.ibm.com/docs/monitoring?topic=monitoring-access_keyaccess_key_view) to obtain the access key values.
-i, --instance-id INSTANCE_ID
-k, --key-material KEY_MATERIAL
[-n, --encrypted-nonce ENCRYPTED_NONCE]
[-v, --iv IV]



 Examples 

These are examples of kp key restore.



 Example 1 

This example creates a root key using a key material, deletes the key, then restores the key.

 create a random, base64-encoded, 32-byte key material
$ KEY_MATERIAL=$(openssl rand -base64 32)

$ echo $KEY_MATERIAL

4EZBMBMkZ87z4nvYsQH21DC5+wslgWhHRiU8bmqJ4CY=

 create a root key from a base64-encoded value
$ KEY_ID=$(ibmcloud kp key create my-base64-root-key -k $KEY_MATERIAL --output json | jq -r '.["id"]')

$ echo $KEY_ID

62ad0cd5-70a4-4c4d-9d87-5f4db620b120

 delete the root key
$ ibmcloud kp key delete $KEY_ID

Deleting key: 62ad0cd5-70a4-4c4d-9d87-5f4db620b120, from instance: a192d603-0b8d-452f-aac3-f9e1f95e7411...
OK
Deleted Key
62ad0cd5-70a4-4c4d-9d87-5f4db620b120

 list keys - verify the key was deleted
$ ibmcloud kp keys

Retrieving keys...
OK
Key ID Key Name

 restore the deleted key
$ ibmcloud kp key restore $KEY_ID -k $KEY_MATERIAL --output json

{
[Check mark icon](https://cloud.ibm.com/docs-content/v1/content/0bc8db34a3d90b2a5103c9c71b08a96de9525bbc/icons/checkmark-icon.svg) ![Check mark icon](https://cloud.ibm.com/docs-content/v1/content/0bc8db34a3d90b2a5103c9c71b08a96de9525bbc/icons/checkmark-icon.svg) 
 Delete a key ![Check mark icon](https://cloud.ibm.com/docs-content/v1/content/0bc8db34a3d90b2a5103c9c71b08a96de9525bbc/icons/checkmark-icon.svg) 
 Restore a key ![Check mark icon](https://cloud.ibm.com/docs-content/v1/content/0bc8db34a3d90b2a5103c9c71b08a96de9525bbc/icons/checkmark-icon.svg) 
 Patch a key ![Check mark icon](https://cloud.ibm.com/docs-content/v1/content/0bc8db34a3d90b2a5103c9c71b08a96de9525bbc/icons/checkmark-icon.svg) 
 Sync keys ![Check mark icon](https://cloud.ibm.com/docs-content/v1/content/0bc8db34a3d90b2a5103c9c71b08a96de9525bbc/icons/checkmark-icon.svg) !
Your IBM Cloud access token. Include the full contents of the IAM token, including the Bearer value, in the curl request. For more information, see [Retrieving an access token](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-access-token). 
 instance_ID Required. The unique identifier that is assigned to your Hyper Protect Crypto Services service instance. For more information, see [Retrieving an instance ID](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-instance-ID). 



A successful request returns an HTTP 204 No Content response, which indicates that the key ring is successfully deleted.
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:390086ac-76fa-4094-8cf3-c0829bd69526:key:264fadc3-7667-4b25-916e-5825fe70de0b"
}





 Required parameters 



* KEY_ID_OR_ALIAS

The v4 UUID or alias of the key that you want to delete. To retrieve a list of your available keys, run the [kp keys](https://cloud.ibm.com/docs/key-protect-cli-pluginkp-keys) command.
* -i, --instance-id

The IBM Cloud instance ID that identifies your Key Protect instance.

You can set an environment variable instead of specifying -i with the following command: $ export KP_INSTANCE_ID=<INSTANCE_ID>.







 Optional parameters 



* --key-ring

A unique, human readable name for the key-ring. Required if the user doesn't have permissions on the default key ring.









 kp key policies 

Retrieve details about a key policy, such as the key's automatic rotation interval.

ibmcloud kp key policies KEY_ID_OR_ALIAS
-i, --instance-id INSTANCE_ID
[--key-ring KEY_RING_ID]
[-d, --dual-auth]
[-o, --output OUTPUT]
[-r, --rotation]



 Example 

This example lists the policies for a root key.

Key policies are [dual authorization delete](https://cloud.ibm.com/docs/key-protect-cli-pluginkp-key-policy-update-dual) and [rotation](https://cloud.ibm.com/docs/key-protect-cli-pluginkp-key-policy-update-rotation).

 create a root key
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb145:390086ac-76fa-4094-8cf3-c0829bd69526:key:9cca88c9-019e-4f0a-9e76-8e657c6b9720"
}

 show key details
$ ibmcloud kp key show 9cca88c9-019e-4f0a-9e76-8e657c6b9720 --output json

{
"id": "9cca88c9-019e-4f0a-9e76-8e657c6b9720",
"name": "my-root-key",
"type": "application/vnd.ibm.kms.key+json",
"algorithmType": "AES",
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-05-05T20:03:00Z",
"lastUpdateDate": "2020-05-05T20:03:00Z",
"extractable": false,
"state": 1,
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb145:390086ac-76fa-4094-8cf3-c0829bd69526:key:9cca88c9-019e-4f0a-9e76-8e657c6b9720"
}

 delete the key
If you supply AAD, save the data to a secure location to ensure that you can access and provide the same AAD during subsequent unwrap requests.







 kp rotate 

[Rotate a root key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-wrap-keys) that is stored in your Key Protect service.

ibmcloud kp rotate KEY_ID -i $INSTANCE_ID
[-k, --key-material KEY_MATERIAL]

$ ibmcloud kp rotate 3df42bc2-a991-41cb-acc2-3f9eab64a63f -i $KP_INSTANCE_ID
Rotating root key...

SUCCESS



 Required parameters 

KEY_ID
: The ID of the root key that you want to rotate.





 Optional parameters 

-k, --key-material
: The base64 encoded key material that you want to use for rotating an existing root key. To rotate a key that was initially imported into the service, provide a new 256-bit key. To rotate a key that was initially generated in Key Protect, omit the --key-material parameter.







 kp delete 

[Delete a key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-keys) that is stored in your Key Protect service.

ibmcloud kp delete KEY_ID -i $INSTANCE_ID

$ ibmcloud kp delete 584fb0d9-dec2-47b8-bde5-50f05fd66261 -i $KP_INSTANCE_ID
Deleting key: 584fb0d9-dec2-47b8-bde5-50f05fd66261, from instance: 98d39ab8-cf44-4517-9583-2ad05c7e9bd5...

SUCCESS

Deleted Key
584fb0d9-dec2-47b8-bde5-50f05fd66261



 Required parameters 

KEY_ID
The external keystore on the remote platform still exists after you remove the connection.

ibmcloud hpcs uko keystore-delete --id ID --uko-vault UKO-VAULT --if-match IF-MATCH



* Command options

--id (string)
: Required. The UUID of the keystore. You can use the ibmcloud hpcs uko keystores command to retrieve the UUID.

--uko-vault (string)
: Required. The UUID of the vault where the update is to take place. You can use the ibmcloud hpcs uko keystores command to retrieve the UUID.

--if-match (string)
: Required. The precondition of the update, which is the value of the ETag from the header on a GET request. You can use the ibmcloud hpcs uko keystore command to retrieve the ETag.
* Example

ibmcloud hpcs uko keystore-delete 
--id=0325e05e-2b25-4f13-85b2-2d7f85e54359 
--uko-vault=5295ad47-2ce9-43c3-b9e7-e5a9482c362b 
--if-match=2022-05-11T14:58:26Z
* Output

The command returns the output similar to the following example:

...
OK







 hpcs uko keystore 

Retrieve a target internal keystore or external keystore connection and its details by specifying the ID.

ibmcloud hpcs uko keystore --id ID --uko-vault UKO-VAULT



* Command options

--id (string)
: Required. The UUID of the keystore. You can use the ibmcloud hpcs uko keystores command to retrieve the UUID.

--uko-vault (string)
: Required. The UUID of the vault where the update is to take place.
[] | .id')

$ for KEY_ID in $(echo "${KEYS}"); do
KEY_NAME=$(ibmcloud kp key show $KEY_ID --output json | jq -r '.["name"]')
if [ $KEY_NAME == "my-test-key-" ]]; then
echo "Deleting... $KEY_NAME $KEY_ID"
ibmcloud kp key delete $KEY_ID
fi
done

(output not shown)





 Example 6 

Lists the keys based on key states (Active, Suspended) in the Key Protect instance.

 list active and suspended keys
$ ibmcloud kp keys --key-states active,suspended

Retrieving keys...
OK
Key ID Key Name
ef2cc155-fe56-492c-845c-4d1f0688c7ba my-active-key
636e9f3a-feaf-4033-8603-687754dc7e51 my-suspended-key





 Example 7 

Lists the keys based on key type (root) in the Key Protect instance.

 list root keys
$ ibmcloud kp keys -t root

Retrieving keys...
OK
Key ID Key Name
2f1cb135-fa16-40dc-815c-4d1f0ee8c7ba my-root-key





 Example 8 

Lists the keys in the Key Protect instance with the key name or alias exactly matching the characters in the string "TEST" without quotation marks.

 list keys with identifiers exactly matching TEST
$ ibmcloud kp keys -l exact:TEST

Retrieving keys...
OK
Key ID Key Name
636e9f3a-feaf-4033-8603-687754dc7e51 TEST





 Example 9
[policies](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-policies) Retrieve a list of policies 
 policy-update [dual-auth-delete](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-policy-update-dual) Update the key policy for "dual auth delete" 
 policy-update [rotation](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-policy-update-rotation) Update the key policy for "rotation" 
 [purge](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-purge) Purge a deleted key 
 [restore](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-restore) Restore a root key that was previously deleted 
 [rotate](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-rotate) Rotate a root key 
 [schedule-delete](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-schedule-delete) Authorize a key, with a dual-auth-delete policy, to be deleted 
 [show](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-show) Retrieve a key 
 [sync](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-sync) Synchronize a key's associated resources
kp key command 

The kp key command manages individual keys.



Table 3. Sub-commands for managing keys

 Sub-command Status v0.7.0 Description 

 [alias-create](https://cloud.ibm.com/docs/cli?topic=cli-key-protect-cli-referencekp-key-alias-create) Create an alias for a unique and convenient reference to a key 
 [cancel-delete](https://cloud.ibm.com/docs/cli?topic=cli-key-protect-cli-referencekp-key-cancel-delete) Cancel a previously scheduled request to delete a key 
 [create](https://cloud.ibm.com/docs/cli?topic=cli-key-protect-cli-referencekp-key-create) Create a key or import your own key 
 [delete](https://cloud.ibm.com/docs/cli?topic=cli-key-protect-cli-referencekp-key-delete) Delete a key 
 [disable](https://cloud.ibm.com/docs/cli?topic=cli-key-protect-cli-referencekp-key-disable) Disable a key 
 [enable](https://cloud.ibm.com/docs/cli?topic=cli-key-protect-cli-referencekp-key-enable) Enable a key 
 [policies](https://cloud.ibm.com/docs/cli?topic=cli-key-protect-cli-referencekp-key-policies) Retrieve a list of policies 
 policy-update [dual-auth-delete](https://cloud.ibm.com/docs/cli?topic=cli-key-protect-cli-referencekp-key-policy-update-dual) Update the key policy for "dual auth delete"