Skip to content

Key Management CLI — Usage Examples

Binary: ankasecure-km
Version: 3.4.1

Every example assumes init has run with the tenant's administrative workload (Installation).

1. Inventory

ankasecure-km view-session
ankasecure-km keys list --status active --format table
ankasecure-km keys get --kid payments-data-key
ankasecure-km keys supported-algorithms --category POST_QUANTUM --format table

2. Create a key and schedule its rotation

ankasecure-km keys create --kid payments-data-key --kty ML-KEM --algorithm ML-KEM-768 --purpose ENCRYPT_DECRYPT

ankasecure-km rotation replace-schedule --kid payments-data-key --body-file schedule.json
ankasecure-km rotation schedule --kid payments-data-key
ankasecure-km rotation executions --kid payments-data-key

A rotation now, retried safely:

ankasecure-km rotation rotate --kid payments-data-key --body-file rotation.json --idempotency-key rotation-2026-11-01

3. Retire and destroy a key

ankasecure-km keys revoke --kid old-archive-key --cause ADMINISTRATIVE --reason "replaced by payments-data-key"
ankasecure-km keys archive --kid old-archive-key --reason "replaced by payments-data-key"

ankasecure-km destruction request-key --kid old-archive-key --reason "retired after the PQC migration" --cooling-off-days 30
# {"status":"PENDING_APPROVAL","quorumRequestId":"8d2e4f60-...", ...}   exit 0

A person approves the request in the Admin Console. The destruction then runs on its own when the cooling-off period ends. Follow it, or stop it while it is scheduled:

ankasecure-km quorum-requests get --id 8d2e4f60-1a3b-4c5d-9e7f-0a1b2c3d4e5f
ankasecure-km destruction orders --kid old-archive-key
ankasecure-km destruction cancel-key --kid old-archive-key

Before the approval, withdraw the request instead:

ankasecure-km quorum-requests cancel --id 8d2e4f60-1a3b-4c5d-9e7f-0a1b2c3d4e5f

See Key Destruction.

4. Import a keystore

ankasecure-km keys analyze-keystore --keystore-file legacy.p12 --metadata-file import.json --password-prompt
printf '%s' "$KEYSTORE_PASSWORD" | ankasecure-km keys import-keystore --keystore-file legacy.p12 --metadata-file import.json --password-stdin

5. Govern an exchange

ankasecure-km directory list-applications --format table
ankasecure-km exchanges create --body-file exchange.json
ankasecure-km exchanges add-grant --id <EXCHANGE_ID> --actor-id <ACTOR_ID> --capability ENCRYPT --asset-kid payments-data-key
ankasecure-km exchanges validate --id <EXCHANGE_ID>
ankasecure-km exchanges preview-activation --id <EXCHANGE_ID>
ankasecure-km exchanges activate --id <EXCHANGE_ID> --expected-version 3
ankasecure-km capability-grants re-pin --id <GRANT_ID> --constraint-policy-version-id <VERSION_ID>
ankasecure-km exchanges revoke-grant --id <EXCHANGE_ID> --grant-id <GRANT_ID> --reason "actor moved to a new key pair"

6. Provision an internal cryptographic use case

ankasecure-km internal-crypto-use-cases create --body-file use-case.json | your-secret-store-import

The output carries the client secret once, in credential.clientSecret. Pipe it straight into your secret store rather than redirecting it to a file or leaving it in a terminal's scrollback.

7. Scripting on exit codes

ankasecure-km keys get --kid payments-data-key > /dev/null
case $? in
  0) echo "present" ;;
  2) echo "not authorized: check the workload's scopes" ;;
  3) echo "refused by the server (for example 404)" ;;
  4) echo "network failure: retry" ;;
esac

CLI Version: 3.4.1
Last updated: 2026-10-26