---
name: hs-crypto-uko-sync-key
title: Syncing keys in keystores with managed keys manually
description: If the key state in some keystores is different from the managed key state, you receive a **Key out of sync** warning message. You can sync the key state by using Unified Key Orchestrator with the UI, or programmatically with the Unified Key Orchestrator API.
last-updated: 2026-07-01
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/hs-crypto?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Syncing keys in keystores with managed keys manually
{: #uko-sync-keys}

IBM Cloud® Hyper Protect Crypto Services is deprecated. As of 28 March 2026, you can't create new instances, and access to free instances will be removed. Existing premium plan instances are supported until 28 March 2027. Any instances that still exist on that date will be deleted.
{: deprecated}

If the key state in some keystores is different from the managed key state, you receive a **Key out of sync** warning message. You can sync the key state by using Unified Key Orchestrator with the UI, or programmatically with the Unified Key Orchestrator API.
{: shortdesc}

An `Out of sync` flag is also displayed in the corresponding keystore card or the key list. There can be multiple reasons why the key is out of sync. For example, there is an issue in relinking the key in the keystore, the key is failed to be destroyed in some of the distributed keystores, or the key is modified in the target keystore outside of Unified Key Orchestrator. Take the following steps to munually sync the state of keys in keystores with the managed key.


## Syncing keys with the UI
{: #uko-sync-managed-key-gui}
{: ui}

To sync the key in keystores with managed keys manually, you need to verify the key state first and then sync keys. Complete the following steps to sync a managed key:

### Step 1: Verify key state
{: #verify-key-state-gui}

1. [Log in to the UI](https://cloud.ibm.com/login){: external}.
2. Go to **Menu** > **Resource list** to view a list of your resources.
3. Select your provisioned instance of Hyper Protect Crypto Services with Unified Key Orchestrator from your IBM Cloud resource list.
4. Click **Managed keys** from the navigation to view all the available keys.
5. Select the key that you want to verify the key state and click the **Actions** icon ![Actions icon](../icons/action-menu-icon.svg "Actions") to open a list of options for the key.
6. Click **Verify sync** from the options menu. 

### Step 2: Sync key state
{: #sync-key-state-gui}

After you verify the key state, if an **Out of sync** flag is displayed next to the key state, you can sync the key state by performing the following steps:

1. Select the key that you want to sync and click the **Actions** icon ![Actions icon](../icons/action-menu-icon.svg "Actions") to open a list of options for the key.
2. Click **Sync key** from the options menu. Alternatively, you can sync keys by selecting **Show details** on the Actions ![Actions icon](../icons/action-menu-icon.svg "Actions") menu and clicking **Sync key** in the key details page. 
3. Confirm the keystores where you want to sync the key and click **Sync key**.


## Syncing with the API
{: #uko-sync-managed-key-api}
{: api}

To sync a managed key through the API, follow these steps:

1. [Retrieve your service and authentication credentials to work with keys in the service](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-uko-api&format=markdown).
   
2. Sync a managed key by making a `POST` call based on the following example:

     

    ```
    curl --location --request POST 'https://<instance_ID>.uko.<region>.hs-crypto.appdomain.cloud/api/v4/managed_keys/<id>/sync_status_in_keystores' 
    --header 'Authorization: Bearer <IAM_token>' \
    --header 'Accept: application/json' \
    --header 'If-Match: <ETag>'
    ```
    {: codeblock}

    Replace the variables in the example request according to the following table.

    | Variable | Description |
    | --- | --- |
    | `region` | **Required.** The prefix that represents the geographic area where your service instance resides. For more information, see [Regions and locations](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regions&format=markdown). |
    | `port` | **Required.** The port number of the API endpoint. |
    | `id` | **Required.** The unique identifier for the managed key that you want to sync. |
    | `IAM_token` | **Required.** Your IBM Cloud IAM access token that you retrieve in step 1. Include the full contents of the `IAM` token, including the Bearer value. |
    | `ETag` | **Required.** The precondition of the update, which is the value of ETag from the header on a GET request. |
    {: caption="Variables needed to sync a managed key" caption-side="bottom"}

    For detailed instructions and code examples about using the API method, check out the [Hyper Protect Crypto Services Unified Key Orchestrator API reference doc](https://cloud.ibm.com/apidocs/uko#sync-managed-key){: external}.

## What's next
{: #uko-sync-keys-next}

- To find out more about managing your keys, check out [Filtering and searching keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-search-key-list&format=markdown) or [Editing key details](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-edit-kms-keys&format=markdown).
- To find out more about programmatically managing your keys, check out the [Hyper Protect Crypto Services Unified Key Orchestrator API reference doc](https://cloud.ibm.com/apidocs/uko){: external}.