Skip to content

Destroy a key, or cancel its destruction

Request that the platform destroy an archived key after a cooling-off period, or stop a scheduled destruction before it runs. No single person can destroy a key: the request always waits for another person's approval.

Who can do it

A tenant administrator, a tenant key manager, or a platform super administrator working inside the tenant. Requesting a destruction and cancelling one are separate permissions, and the console offers Mark for destruction and Cancel destruction only where the server says you may take that action on that key. The approval is given by a person other than the requester.

Before you start

  • Only an archived key can be marked for destruction. Revoke and archive it first.
  • When the destruction runs, every material version of the key is destroyed, so data protected only by this key can no longer be decrypted. Its identifier is never used again in your tenant.
  • Destroying the key ends every authorization that names it: cryptographic exchanges not yet ended and internal use cases that use the key are revoked, and capability grants that name it are retired.
  • Decide the cooling-off period: 7 to 365 days, counted from the approval. Leave it empty to use your tenant's lifecycle policy default.

Steps

To request the destruction:

  1. Open Key Inventory.
  2. Select Mark for destruction on the key's row, or open the key with View Details and select Mark for destruction at the bottom of its details.
  3. In Mark for Destruction, read what happens. If anything still references the key, the dialog says how many internal use cases and cryptographic exchanges will be revoked and that the capability grants naming it are retired. The counts are a reading; they do not stop you.
  4. Optionally set the Cooling-off period (days).
  5. Write the Reason. It is required and recorded in the audit trail.
  6. Select Mark for Destruction.

To cancel a scheduled destruction:

  1. Open Key Inventory.
  2. Select Cancel destruction on the key's row, or in the key's details. It is offered on a key pending destruction.
  3. In Cancel Destruction, read what happens after cancellation, then select Cancel Destruction.

A request still waiting for approval is not cancelled this way. The person who sent it withdraws it:

  1. Open Key Inventory and open the key with View Details.
  2. Under Destruction, select Open the quorum request on the request marked Waiting for approval.
  3. Select Withdraw.

What you see when it worked

After the request, the dialog shows Waiting for approval with a link to the quorum request. Nothing about the key changes until another person approves it. The key's details show the request under Destruction, with the approvals given and needed.

Once it is approved, the key reads pending destruction, the cooling-off period starts, and the key's row and details show when the destruction runs. Under Destruction, the key's details list every destruction order the key has had, newest first: what it destroys, its cooling-off period, when it was approved and from when the key is destroyed, and its status, Scheduled, Destroyed, Cancelled or Failed, with the date of that outcome. When the period ends, the platform destroys the key on its own. The key then leaves the list; the deleted view shows it read-only, with its cause and dates.

After a withdrawal, the console says Request withdrawn, and the request leaves Destruction, which lists only the requests still waiting. After a cancellation, the console says Destruction cancelled and the order reads Cancelled. The key reads archived again, and each version returns to the status it had before the approval: a version revoked for a security compromise is revoked for it again. A later destruction needs a new request and a new approval. Both acts are recorded in the audit trail.

If it fails

What you see Cause What to do
Cannot mark for destruction, with the server's reason The key is not archived, or you lack the permission Archive the key first
Enter a whole number of days from 7 to 365. The cooling-off period is outside its bounds Correct it, or leave it empty
The request is refused because no other approver is eligible Your tenant has no eligible approver other than you Ask a tenant administrator to make another person eligible to approve
The request is refused because one is already waiting A destruction request for this key is already waiting for approval Follow the existing request
The approved request ends FAILED A version of the key was restored, added or destroyed before the approval Send a new request
Cannot cancel destruction The key is not pending destruction: its request still waits for approval, no destruction is scheduled, or it has already run Withdraw a waiting request from its quorum request; a destruction that ran cannot be cancelled

Without the console

Surface How
Key management CLI ankasecure-km destruction request-key --kid <id> --reason <text> [--cooling-off-days <7..365>]; ankasecure-km destruction cancel-key --kid <id> cancels a scheduled destruction only, after its approval and before it runs; a request the workload sent that still waits for approval is withdrawn with ankasecure-km quorum-requests cancel --id <uuid>; the orders with ankasecure-km destruction orders --kid <id>
Admin SDK DestructionOperations.requestKey(String kid, MarkForDestructionRequest request); DestructionOperations.cancelKey(String kid); QuorumRequestOperations.cancel(UUID requestId) to withdraw a waiting request
API POST /api/v3/admin/tenants/{tenantId}/keys/{kid}/mark-for-destruction (operation markKeyForDestruction), answered 202 with the quorum request; POST /api/v3/admin/tenants/{tenantId}/keys/{kid}/cancel-destruction (operation cancelKeyDestruction)

Approving or rejecting a destruction request is done in the console only.