Suspend or reactivate a key

Put a key on hold while something is investigated, for example a suspected compromise, and lift the hold when the investigation clears it. Unlike revocation, a suspension can be undone.

Who can do it

A tenant administrator, a tenant key manager, or a platform super administrator working inside the tenant. On a SaaS deployment the server refuses a platform administrator. The console offers Suspend and Reactivate only where the server says you may take that action on that key.

Before you start

Only an active key can be suspended, including one that reads expired because it reached its expiry or its usage limit. Only a suspended key can be reactivated.
Choose the cause carefully. It is not a label: it decides what still works while the key is on hold.
- Security compromise stops every operation on the key, decrypting and verifying included, whatever your tenant's lifecycle policy says.
- Any other cause (algorithm deprecated, administrative, policy violation or regulatory requirement) leaves historical decrypting and verifying to your tenant's lifecycle policy, exactly as before the hold.
A suspended key no longer encrypts or signs under either shipped lifecycle policy, and cannot be rotated. Its material versions and the grants that name it are untouched.
If a compromise is confirmed, revoke the key instead of reactivating it.

Steps

To suspend a key:

Open Key Inventory.
Select Suspend on the key's row, or open the key with View Details and select Suspend at the bottom of its details.
In Suspend Key, choose the Cause. The dialog then shows, version by version, which reads stop and which continue under that cause. The server computes that statement for this key under your tenant's lifecycle policy.
Write the Reason. It is recorded in the audit trail against your account and read by whoever decides later whether the hold can be lifted.
Select Suspend Key.

To reactivate a key:

Open Key Inventory.
Select Reactivate on the key's row, or in the key's details.
Read what lifting the hold does. Reactivate Key asks for no cause and no reason: reactivation records no cause and clears the one the suspension carried.
Select Reactivate Key.

What you see when it worked

The console says the key has been suspended, or reactivated, and the key's status changes. The change is recorded in the audit trail.

A suspended key reads suspended, with its cause and your reason in its details. A reactivated key returns to the status it held before the suspension: active, or expired again while its limit stays reached. Encryption and signing come back with that status; reads follow the server's verdict shown in the dialog, which can still stop on a version that was revoked for a security compromise.

If it fails

What you see	Cause	What to do
Choose a cause to enable this action.	No cause is selected; there is no default cause	Choose the cause
Write a reason to enable this action.	The reason is empty	Write the reason
The server verdict for this key has not loaded; the action stays unavailable until it does.	The console could not read what the cause does to this key	Wait, or select retry in the dialog
Key cannot be suspended in its current state	The key is not active, or you lack the permission; the dialog shows the server's own reason when it gives one	Check the key's state
Key cannot be reactivated in its current state	The key is not suspended, or you lack the permission	Check the key's state

Without the console

Surface	How
Key management CLI	`ankasecure-km keys suspend --kid <id> --cause <cause> --reason <text>`; `ankasecure-km keys reactivate --kid <id>`
Admin SDK	`KeyOperations.suspend(String kid, SuspendKeyRequest request)`; `KeyOperations.reactivate(String kid)`
API	`POST /api/v3/admin/tenants/{tenantId}/keys/{kid}/suspend` (operation `suspendKey`); `POST /api/v3/admin/tenants/{tenantId}/keys/{kid}/reactivate` (operation `reactivateKey`)

Key Inventory: what the screen shows and every decision you make on it.
Key Lifecycle: the tenant policy that decides what a suspended key may still do.