ORA-46688
cannot move a master key
Cause
The master key could not be moved out of the keystore.
Action
Check whether the specified master key identifiers are valid, and if they are in the V$ENCRYPTION_KEYS view. Container keys can be moved from the CDB$ROOT only when the container is unplugged and dropped from the multitenant container database (CDB). Check the trace file for additional errors, if needed. Retry the command. If an attempt is made to move keys of a database that has only one key, the current and the only key cannot be moved.