# Schedule the deletion of a KMS Key This guide explains how to schedule and cancel the deletion of Exoscale Key Management Service (KMS) keys using the Exoscale CLI and API. > [!WARNING] > Deleting a KMS key is a destructive and irreversible action. Proceed only if you are absolutely certain that the key is no longer needed to decrypt any existing data, now or in the future. If you are unsure, you should **disable** the KMS key instead of deleting it. Key deletion is a two-step process that enforces a mandatory waiting period (between 7 and 30 days) to protect against accidental or premature deletion. During this `pending-deletion` period, all cryptographic operations using the key are disabled. Once the delay expires, the key and its cryptographic material are permanently destroyed and cannot be recovered. --- ## Using the Exoscale CLI When running these commands, ensure your CLI is configured for the zone where your key is located. **Schedule a key deletion:** ```bash exo kms key schedule-deletion --delay-days 7 ``` Cancel a deletion (before the delay expires): ```bash exo kms key cancel-deletion ``` ## Using the Exoscale API You can also interact directly with the API using the exo api command. Be sure to specify the correct zone flag. Schedule a deletion: ```bash exo api schedule-kms-key-deletion --zone <<< '{"delay-days": 7}' ``` Cancel a deletion (before the delay expires): ```bash exo api cancel-kms-key-deletion --zone ``` > [!NOTE] > Post-Cancellation State: When you cancel a scheduled key deletion, the key is reverted to a disabled state. To resume using it for cryptographic operations, you must manually re-enable the KMS key. > [!TIP] > You can also schedule and cancel the deletion of your KMS keys directly from the Exoscale Console.