Skip to content

Archive a key

File a revoked key away for compliance: its metadata is kept, it is removed from active operations for good, and it becomes eligible for destruction.

Who can do it

A tenant administrator, a tenant key manager, or a platform super administrator working inside the tenant. On a SaaS deployment the server refuses a platform administrator. The console offers Archive only to a person who holds the permission to archive keys, and only on a key the server says can be archived.

Before you start

  • Only a revoked key can be archived. Revoke the key first.
  • Archiving records no cause of its own. The key keeps the cause it was revoked for: a key revoked for a security compromise stays unreadable after it is archived, and a key revoked for any other cause is judged by your tenant's lifecycle policy, as before.
  • Archiving is the first step towards destroying the key. Nothing is destroyed until someone requests the destruction and another person approves it.

Steps

  1. Open Key Inventory.
  2. Select Archive on the key's row, or open the key with View Details and select Archive at the bottom of its details.
  3. In Archive Key for Compliance, read what archiving will do, and the cause the key keeps.
  4. Answer Why is this key being archived? The reason is required and recorded in the audit trail.
  5. Type the key's identifier exactly as shown, including capitalization, to confirm.
  6. Select Archive Key.

What you see when it worked

The console says the key has been archived. The key reads archived, and its details show when it was archived, together with the cause and reason it was revoked for. The archive is recorded in the audit trail. The key now offers Mark for destruction.

If it fails

What you see Cause What to do
Cannot archive key, with the key's current status The key is not revoked, or you lack the permission Revoke the key first
Does not match. Type it exactly as shown, including capitalization. The identifier you typed differs from the key's Type the identifier exactly
Archive Key stays disabled The reason is empty, or the console has not loaded the server's verdict on what archiving does to reads Write the reason, or wait for the verdict

Without the console

Surface How
Key management CLI ankasecure-km keys archive --kid <id> --reason <text>
Admin SDK KeyOperations.archive(String kid, ArchiveKeyRequest request)
API POST /api/v3/admin/tenants/{tenantId}/keys/{kid}/archive (operation archiveKey)
  • Key Inventory: what the screen shows and every decision you make on it.