Skip to content

Change a key's expiry or usage limits

Change when a key stops protecting data, how many uses it allows, whether it can be exported, or its name and description.

Who can do it

A tenant administrator, a tenant key manager, or a platform super administrator working inside the tenant. On a SaaS deployment the server refuses a platform administrator. The console offers Edit Metadata only when the server says you may edit this key's metadata.

Before you start

  • The expiry, the usage limits and the export setting belong to the key's current material version. An active, expired or suspended key has one. A revoked, archived or pending-destruction key has none, so only its name and description can change.
  • A limit the key has already reached is final. Once the expiry has passed, the expiry date can no longer be changed or cleared; once the maximum number of uses is used up, the maximum cannot either. Rotate the key to give it a new expiry and usage limit.
  • A new maximum must be above the uses the key has already recorded. A maximum of 0, or an empty field, means unlimited. Uses count encrypt and sign operations; decrypt and verify are not counted.
  • If your tenant has a quorum approval policy, a change that weakens the key waits for approval: making it exportable, moving its expiry later or removing it, or raising or removing a usage limit. Shortening a lifetime, lowering a limit, adding a limit and making a key not exportable run at once.

Steps

  1. Open Key Inventory and select View Details on the key.
  2. Select Edit Metadata at the bottom of the key's details. It is not offered on the key's row.
  3. In Edit metadata, change what you need:
    • Name and Description. Leave a field empty to remove it.
    • Under Current key material: Exportable, Expiry date (or Remove date), Warning date, Max usage limit and Soft usage limit.
  4. Check the Changes the dialog lists, then select Save Changes.

The identifier, algorithm and type are shown read-only: they cannot be changed after creation.

What you see when it worked

The console says Key metadata updated, and the key's details show the new values. The change is recorded in the audit trail, where the Audit History tab lists each field before and after.

A key that had stopped protecting only because of a soft limit is unaffected: the warning date and the soft usage limit only warn. If the change waits for a quorum approval, the console shows Waiting for approval with a link to the quorum request, and the key keeps its current values until the approvals are given.

If it fails

What you see Cause What to do
Key protection limit reached The key's expiry has passed, or its usage limit is used up, and the change names that field Close the dialog and use Rotate on the key: rotation gives it a new current material with its own expiry and usage limit
This key has no current key material, so only its name and description can be changed. The key is revoked, archived or pending destruction Only the name and description can change
The metadata was not updated, naming the limit A positive maximum at or below the uses already recorded, a soft usage limit not below the maximum, or a warning date not before the expiry date Correct the values and save again
The metadata was not updated, naming the expiry The expiry date is in the past Choose a future date
Edit Metadata is not offered You do not hold the permission to edit key metadata Ask a tenant administrator

Without the console

Surface How
Key management CLI ankasecure-km keys update --kid <id> --body-file <json>, where the file is a JSON merge patch
Admin SDK KeyOperations.update(String kid, AdminKeyMergePatchRequest patch)
API PATCH /api/v3/admin/tenants/{tenantId}/keys/{kid} (operation patchKeyMetadata), with a JSON merge patch