---
title: "Encryption Key Lifecycle Changed"
description: "Sent when an encryption key is registered, validated, fails validation, is scheduled for deletion, or is deleted. Event ID: vdc.org_v0.kmskey_v0.lifecycle_v0 Event message details: Sent with data.lifecycle.action set to REGISTERED, VALIDATED..."
canonical: "https://helpcenter.veeam.com/docs/vdc/events/vdc_events_encryption_key_lifecycle_changed.html"
breadcrumb: "Event Reference > Encryption Key Management > Encryption Key Lifecycle Changed"
dateModified: "2026-11-02"
---

# Encryption Key Lifecycle Changed

Sent when an encryption key is registered, validated, fails validation, is scheduled for deletion, or is deleted.

## General Information

**Event ID**: `vdc.org_v0.kmskey_v0.lifecycle_v0`

**Event message details**: Sent with `data.lifecycle.action` set to `REGISTERED`, `VALIDATED`, `VALIDATION_FAILED`, `DELETION_SCHEDULED` or `DELETED`.

**Severity**: Varies depending on `data.lifecycle.action`.

<table class="Blue_Table">
  <tr style="vertical-align:top">
    <th>
      <p>data.lifecycle.action</p>
    </th>
    <th>
      <p>Severity</p>
    </th>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">REGISTERED</span></p>
    </td>
    <td>
      <p>Info</p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">VALIDATED</span></p>
    </td>
    <td>
      <p>Info</p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">VALIDATION_FAILED</span></p>
    </td>
    <td>
      <p>High</p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">DELETION_SCHEDULED</span></p>
    </td>
    <td>
      <p>High</p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">DELETED</span></p>
    </td>
    <td>
      <p>High</p>
    </td>
  </tr>
</table>

**Workloads**: Control Plane

## Parameters

<table class="Blue_Table">
  <tr style="vertical-align:top">
    <th>
      <p>Parameter Name</p>
    </th>
    <th>
      <p>Description</p>
    </th>
    <th>
      <p>Example</p>
    </th>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">specversion</span></p>
    </td>
    <td>
      Event schema version.
    </td>
    <td>
      <p><span class="T_Filenames">ev20260814</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">source</span></p>
    </td>
    <td>
      System that sent the event. Possible values: `CONTROLPLANE`, `M365`, `AZURE`.
    </td>
    <td>
      <p><span class="T_Filenames">CONTROLPLANE</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">timestamp</span></p>
    </td>
    <td>
      Time when the event happened, in RFC3339Nano format and the UTC time zone.
    </td>
    <td>
      <p><span class="T_Filenames">2026-08-04T09:18:42Z</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">type</span></p>
    </td>
    <td>
      Event ID.
    </td>
    <td>
      <p><span class="T_Filenames">vdc.org_v0.kmskey_v0.lifecycle_v0</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">severity</span></p>
    </td>
    <td>
      Event severity. Possible values: `INFO`, `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`.
    </td>
    <td>
      <p><span class="T_Filenames">INFO</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">visibility</span></p>
    </td>
    <td>
      Intended visibility scope of the event. Only events with the `CUSTOMER_ACCESSIBLE` value are forwarded to SIEM platforms, so a forwarded event always carries this value.
    </td>
    <td>
      <p><span class="T_Filenames">CUSTOMER_ACCESSIBLE</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">category</span></p>
    </td>
    <td>
      Event category. Possible values: `BACKUP`, `RESTORE`, `LOGIN`, `USER_MANAGEMENT`, `TENANT_MANAGEMENT`, `ORGANIZATION_MANAGEMENT`, `SUBSCRIPTION_MANAGEMENT`, `SECURITY_ALERT`, `INTERNAL`.
    </td>
    <td>
      <p><span class="T_Filenames">ORGANIZATION_MANAGEMENT</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">actor.identifier</span></p>
    </td>
    <td>
      Actor identifier.
    </td>
    <td>
      <p><span class="T_Filenames">admin@bob.networking</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">actor.kind</span></p>
    </td>
    <td>
      Actor type that triggered the event. Possible values: `user`, `system`, `service_account`.
    </td>
    <td>
      <p><span class="T_Filenames">user</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">organizationReference.organizationId</span></p>
    </td>
    <td>
      ID of the Veeam Data Cloud organization.
    </td>
    <td>
      <p><span class="T_Filenames">org_12345</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">orgId</span></p>
    </td>
    <td>
      ID of the Veeam Data Cloud organization that the event belongs to. Resolved during event processing, so it is present even when the event references only a workload tenant.
    </td>
    <td>
      <p><span class="T_Filenames">org_12345</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">triage.code</span></p>
    </td>
    <td>
      Fault type. Present only when the event reports a fault. Possible values: `CLIENT_INVALID_INPUT`, `CLIENT_UNAUTHORIZED`, `CLIENT_ACCESS_DENIED`, `CLIENT_RESOURCE_NOT_FOUND`, `CLIENT_QUOTA_EXCEEDED`, `EXTERNAL_THROTTLED`, `EXTERNAL_ERROR`, `EXTERNAL_UNAVAILABLE`, `SYSTEM_ERROR`, `SYSTEM_UNAVAILABLE`, `SYSTEM_TIMEOUT`.
    </td>
    <td>
      <p><span class="T_Filenames">CLIENT_RESOURCE_NOT_FOUND</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">triage.message</span></p>
    </td>
    <td>
      Fault details. Present only when the event reports a fault.
    </td>
    <td>
      <p><span class="T_Filenames">KEY_NOT_FOUND/KEY_DOES_NOT_EXIST: key not found in Azure Key Vault</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.kmskey.keyId</span></p>
    </td>
    <td>
      <p>Control-plane-derived key ID.</p>
    </td>
    <td>
      <p><span class="T_Filenames">b3f1c2a4-0000-0000-0000-000000000000</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.kmskey.keyDisplayName</span></p>
    </td>
    <td>
      <p>Display name of the key. Used as the audit target, so the action reads against a human-readable name.</p>
    </td>
    <td>
      <p><span class="T_Filenames">Finance Org CMK Key</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.kmskey.provider</span></p>
    </td>
    <td>
      <p>Key Management Service (KMS) provider backing the key. Possible values:<span class="T_Filenames">AZURE_KEY_VAULT</span>.</p>
    </td>
    <td>
      <p><span class="T_Filenames">AZURE_KEY_VAULT</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.lifecycle.action</span></p>
    </td>
    <td>
      <p>Key-level lifecycle transition that occurred. Possible values: <span class="T_Filenames">REGISTERED</span>, <span class="T_Filenames">VALIDATED</span>, <span class="T_Filenames">VALIDATION_FAILED</span>, <span class="T_Filenames">DELETION_SCHEDULED</span>, <span class="T_Filenames">DELETED</span>.</p>
    </td>
    <td>
      <p><span class="T_Filenames">REGISTERED</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.lifecycle.status</span></p>
    </td>
    <td>
      <p>Resulting key state after the transition. Omitted for a <span class="T_Filenames">DELETED</span> transition, which leaves no resulting key state. Possible values: <span class="T_Filenames">PENDING_CUSTOMER_SETUP</span>, <span class="T_Filenames">READY_TO_USE</span>, <span class="T_Filenames">ACTIVE</span>, <span class="T_Filenames">VALIDATION_FAILED</span>, <span class="T_Filenames">PENDING_DELETION</span>.</p>
    </td>
    <td>
      <p><span class="T_Filenames">PENDING_CUSTOMER_SETUP</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.lifecycle.previousStatus</span></p>
    </td>
    <td>
      <p>Key state immediately before the transition. Possible values: <span class="T_Filenames">PENDING_CUSTOMER_SETUP</span>, <span class="T_Filenames">READY_TO_USE</span>, <span class="T_Filenames">ACTIVE</span>, <span class="T_Filenames">VALIDATION_FAILED</span>, <span class="T_Filenames">PENDING_DELETION</span>.</p>
    </td>
    <td>
      <p><span class="T_Filenames">ACTIVE</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.lifecycle.failureReason</span></p>
    </td>
    <td>
      <p>Human-readable cause of a <span class="T_Filenames">VALIDATION_FAILED</span> transition. Never contains secrets or key material.</p>
    </td>
    <td>
      <p><span class="T_Filenames">Wrap/unwrap denied: caller lacks Key Vault Crypto User role.</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.lifecycle.failureSource</span></p>
    </td>
    <td>
      <p>What triggered a <span class="T_Filenames">VALIDATION_FAILED</span> transition. Possible values: <span class="T_Filenames">CUSTOMER_VALIDATE</span>, <span class="T_Filenames">MONITOR</span>.</p>
    </td>
    <td>
      <p><span class="T_Filenames">MONITOR</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.lifecycle.keyIdentifier</span></p>
    </td>
    <td>
      <p>Uniform Resource Identifier (URI) of the provider key, including the key name. Never includes key material.</p>
    </td>
    <td>
      <p><span class="T_Filenames">https://myvault.vault.azure.net/keys/prod-cmk</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.lifecycle.keyVersion</span></p>
    </td>
    <td>
      <p>Current key version.</p>
    </td>
    <td>
      <p><span class="T_Filenames">a1b2c3d4e5f6</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.lifecycle.scheduledDeletionAt</span></p>
    </td>
    <td>
      <p>Hard-delete time for a <span class="T_Filenames">DELETION_SCHEDULED</span> transition, 30 days out.</p>
    </td>
    <td>
      <p><span class="T_Filenames">2026-07-16T00:00:00Z</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.org.id</span></p>
    </td>
    <td>
      <p>ID of the Veeam Data Cloud organization.</p>
    </td>
    <td>
      <p><span class="T_Filenames">org_12345</span></p>
    </td>
  </tr>
  <tr style="vertical-align:top">
    <td>
      <p><span class="T_Filenames">data.org.name</span></p>
    </td>
    <td>
      <p>Name of the Veeam Data Cloud organization.</p>
    </td>
    <td>
      <p><span class="T_Filenames">Alice and Bob's Networking</span></p>
    </td>
  </tr>
</table>

## Event Example

### Key Registered

```json
{
  "specversion": "ev20260814",
  "source": "CONTROLPLANE",
  "timestamp": "2026-08-04T09:18:42Z",
  "type": "vdc.org_v0.kmskey_v0.lifecycle_v0",
  "severity": "INFO",
  "visibility": "CUSTOMER_ACCESSIBLE",
  "category": "ORGANIZATION_MANAGEMENT",
  "actor": {
    "identifier": "admin@bob.networking",
    "kind": "user"
  },
  "organizationReference": {
    "organizationId": "org_12345"
  },
  "orgId": "org_12345",
  "data": {
    "kmskey": {
      "keyId": "b3f1c2a4-0000-0000-0000-000000000000",
      "keyDisplayName": "Finance Org CMK Key",
      "provider": "AZURE_KEY_VAULT"
    },
    "lifecycle": {
      "action": "REGISTERED",
      "status": "PENDING_CUSTOMER_SETUP"
    },
    "org": {
      "id": "org_12345",
      "name": "Alice and Bob's Networking"
    }
  }
}
```

### Key Validation Failed

```json
{
  "specversion": "ev20260814",
  "source": "CONTROLPLANE",
  "timestamp": "2026-08-04T09:25:10Z",
  "type": "vdc.org_v0.kmskey_v0.lifecycle_v0",
  "severity": "HIGH",
  "visibility": "CUSTOMER_ACCESSIBLE",
  "category": "ORGANIZATION_MANAGEMENT",
  "actor": {
    "identifier": "admin@bob.networking",
    "kind": "user"
  },
  "organizationReference": {
    "organizationId": "org_12345"
  },
  "orgId": "org_12345",
  "triage": {
    "code": "CLIENT_RESOURCE_NOT_FOUND",
    "message": "KEY_NOT_FOUND/KEY_DOES_NOT_EXIST: key not found in Azure Key Vault"
  },
  "data": {
    "kmskey": {
      "keyId": "b3f1c2a4-0000-0000-0000-000000000000",
      "keyDisplayName": "Finance Org CMK Key",
      "provider": "AZURE_KEY_VAULT"
    },
    "lifecycle": {
      "action": "VALIDATION_FAILED",
      "status": "VALIDATION_FAILED",
      "failureReason": "key not found in Azure Key Vault",
      "failureSource": "CUSTOMER_VALIDATE"
    },
    "org": {
      "id": "org_12345",
      "name": "Alice and Bob's Networking"
    }
  }
}
```