Remove references safely
Step 5 of 5 in Connect Azure KMS with BYOK and BYOC.
Check the record's controlMode before deleting it. An externally_managed record, which is a
registered BYOK key or BYOC certificate, is removed from EDK only and the Azure object stays in the
vault. Deleting a platform_managed key that EDK created can also delete the provider key.
Before deleting, check which issuer credential configurations, status lists and verifier signing
settings still select the alias; a removed reference makes those fail at signing time.
- Overview
- Request
- Response
Delete the certificate reference
Endpoint: DELETE /api/kms/v1/certificate-chains/customer-tenant-signing-chain
Captured response: 204 No Content
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
- Overview
- Request
- Response
Delete the tenant-wide key
Endpoint: DELETE /api/kms/v1/keys/customer-tenant-signing-key
Captured response: 204 No Content
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
Both deletes answer 204 with no body. The captured key was generated by EDK, so its delete follows
the managed-key rules; deleting a registered BYOK reference leaves the Azure key in place.
To stop using a whole provider, detach or retire the KMS resource through Platform Config rather than
deleting keys one by one. The captures below take a tenant-owned Azure resource out of service. Detach
is conditional on the current resourceVersion, moves the resource to DETACHED, clears its
credential and leaves RETIRE as the only available action. health keeps the last probe result,
so read the state to know whether the resource is in service.
- Overview
- Request
- Response
Tenant detaches its own Azure resource
Endpoint: POST /api/platform/config/v1/tenants/00000000-0000-4000-8000-000000000000/kms/resources/krh_%3Copaque%3E/detach
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
Retirement is final for that handle: the resource ends RETIRED with no available actions, and the
vault itself is untouched. Retire takes the resourceVersion returned by detach as
expectedResourceVersion.
- Overview
- Request
- Response
Tenant retires its own Azure resource
Endpoint: POST /api/platform/config/v1/tenants/00000000-0000-4000-8000-000000000000/kms/resources/krh_%3Copaque%3E/retire
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
Next
This completes the journey. Continue with Configure the authorization server.