> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nebius.com/llms.txt
> Use this file to discover all available pages before exploring further.
# How to delete and restore keys in Key Management Service
After you delete a key in Key Management Service (KMS), you can no longer use it for [cryptographic operations](/kms/types-operations#cryptographic-operations-and-use-cases). A deleted key is retained for 30 days. During that period, you can restore the key. Otherwise, the key is permanently removed after 30 days.
## Prerequisites
Make sure you are in a [group](/iam/authorization/groups/index) that has at least the `editor` role within your tenant or project; for example, the default `editors` group. Alternatively, you can have an [access permit](/iam/authorization/groups/manage#setting-up-custom-groups) with the `editor` role assigned to the required key. To check your access rights, go to the [Administration → IAM](https://console.nebius.com/iam) section in the web console.
## How to delete a key
1. In the [web console](https://console.nebius.com), go to **Cryptography** → **KMS**.
2. Select filters:
* **Active**
* **Symmetric keys** or **Asymmetric keys**
3. In the line of the required key, click → **Delete**.
4. In the window that opens, confirm the deletion.
5. Click **Delete key**.
The key appears in the list of deleted keys.
To delete a key, run the `delete` command for your key type:
* Symmetric key:
```bash theme={null}
nebius kms symmetric-key delete --id kmssymkey-e0***
```
* Asymmetric key:
```bash theme={null}
nebius kms asymmetric-key delete --id kmsasymkey-e0***
```
The command output shows that the key is deleted: `status: {}`.
* Symmetric key:
```bash theme={null}
nebius kms symmetric-key list
```
* Asymmetric key:
```bash theme={null}
nebius kms asymmetric-key list
```
## How to restore a key
You can restore keys up to 30 days after their deletion.
1. In the [web console](https://console.nebius.com), go to **Cryptography** → **KMS**.
2. Select filters:
* **Deleted**
* **Symmetric keys** or **Asymmetric keys**
3. In the line of the required key, click **Restore**.
4. In the window that opens, confirm the restoration.
The key appears in the list of active keys and becomes available for cryptographic operations.
To restore a key, run the `undelete` command for your key type:
* Symmetric key:
```bash theme={null}
nebius kms symmetric-key undelete --id kmssymkey-e0*** --name
```
* Asymmetric key:
```bash theme={null}
nebius kms asymmetric-key undelete --id kmsasymkey-e0*** --name
```
Use the `--show-scheduled-for-deletion` parameter in the `list` command to see keys scheduled for deletion:
* Symmetric key:
```bash theme={null}
nebius kms symmetric-key list --show-scheduled-for-deletion
```
* Asymmetric key:
```bash theme={null}
nebius kms asymmetric-key list --show-scheduled-for-deletion
```
In the `undelete` command, use the `--name` parameter to restore the key with a new name. This is needed when you have another key that reserves the original name. The parameter allows you to have different keys with unique names.
The command output shows that the key is active again: `status.state: ACTIVE`.