vania-janet/multiturn-rag-retrieval-data huggingface dataset:
For more information about deleting user data, see [Labeling and deleting data](https://cloud.ibm.com/docs/assistant?topic=assistant-information-securityinformation-security-gdpr-wa).
* exp: Represents the expiration time on or after which the JWT cannot be accepted for processing. Many libraries set this value for you automatically. Set a short-lived exp claim with whatever library you use.



For more information about JSON Web Tokens, see the [RFC7519](https://tools.ietf.org/html/rfc7519) and [OpenID Connect 1.0](https://openid.net/specs/openid-connect-core-1_0.html) specifications.

Most programming languages offer JWT libraries that you can use to generate a token. The following NodeJS code sample illustrates how to generate a JWT token.

// Sample NodeJS code on your server.
const jwt = require('jsonwebtoken');

/
* Returns a signed JWT generated by RS256 algorithm.
/
function mockLogin() {
const payload = {
/
* Even if this is an unauthenticated user, add a userID in the sub claim that can be used
* for billing purposes.
* This ID will help us keep track "unique users". For unauthenticated users, drop a
* cookie in the browser so you can make sure the user is counted uniquely across visits.
/
sub: 'some-user-id', // Required
iss: 'yourdomain.com' // Required
};
// The "expiresIn" option adds an "exp" claim to the payload.
return jwt.sign(payload, process.env.YOUR_PRIVATE_RSA_KEY, { algorithm: 'RS256', expiresIn: '10000ms' });
}
Show more







 Enable security 

To enable security, complete the following steps:



1.
You will not be billed for any associated storage for objects once they are deleted.
* In [versioning enabled or suspended buckets](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-versioning), a regular rule retains the current version and creates a delete marker rather than permanently deleting data.
* The expiration time of non-current versions is determined by its successor's last modified time, rounded to the next day at midnight UTC.
* If versions are manually deleted from an object that has versions expected to be expired the next day, those expirations may not occur.



Policies specifying a date in the past may take up to a few days to complete.

Without caution, data might be permanently lost with when using [expiration rules on a versioned bucket](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-versioning). In cases where versioning is suspended and there is a null version present for the expired object, data might be permanently lost. In this case, a null delete marker is overwritten, permanently deleting the object.

Objects that are subject to a bucket's Immutable Object Storage retention policy will have any expiration actions deferred until the retention policy is no longer enforced.



 Attributes of expiration rules 

Each expiration rule has the following attributes:



 ID 

A rule's ID must be unique within the bucket's lifecycle configuration.





 Expiration 

The expiration block contains the details that govern the automatic deletion of objects. This could be a specific date in the future, or a period of time after new objects are written.





 NoncurrentVersionExpiration 

The number of days after which non-current versions of objects are automatically deleted.





 Prefix 

An optional string that will be matched to the prefix of the object name in the bucket. A rule with a prefix will only apply to the objects that match. You can use multiple rules for different expiration actions for different prefixes within the same bucket.
For zero downtime and to ensure nodes are still available to process transactions, it is recommended that the updates are performed on one node at a time.

Because the console only shows CA TLS certificate expiration dates if they are within five years, it is possible that the expiration date of the CA TLS certificate is not visible when you open the CA tile. If you've just successfully renewed the certificate, the expiration date is no longer visible on the page.





 Renew Peer enrollment and TLS Certificates 

When the peer enrollment certificate expires, the peer can no longer communicate with orderers or other peers in the organization. Likewise, when the peer TLS certificate expires, client applications that use the Fabric SDK are no longer able to send transaction proposals to the peer. The automatic certificate renewal process attempts to re-enroll the peer enrollment and TLS certificates 30 days before they expire, and when successful, no further action is required on your part. But if the automatic certificate renewal fails because the CA is down or unreachable when the renewal attempt is made, or if the associated CA TLS certificate is expired, you have to manually update these certificates. When automatic renewal fails, a warning is displayed on the peer tile.

While you can use the following steps to renew certificates before or after they expire, to avoid an interruption of service, it is best to renew the certificates before they expire. Check the expiration date of your peer enrollment and TLS certificates by opening the peer node.

Zoom

![Peer enrollment and TLS certificate expiration](https://cloud.ibm.com/docs-content/v1/content/c5288bed34c3820e3a5251d820ee91adcd2591a3/blockchain/images/peer-cert-expiry.png)

Figure 6. Peer enrollment and TLS certificate expiration



1. Open the peer and click the Settings icon.
2. Click Update certificates. You can renew either the Enrollment certificate or the TLS certificate or both, based on their expiration dates.
3.
correlation_id='3d941968-c599-43b3-b681-306422079412',
msg='Conflict:
Action could not be performed on key.
Please see reasons for more details.',
reasons='[NOT_DUAL_AUTH_ERR:
The key is not dual auth enabled and cannot be set for deletion -
FOR_MORE_INFO_REFER: https://cloud.ibm.com/apidocs/key-protect]'

 this request fails because the key DOES NOT have a dual authorization policy
$ ibmcloud kp key cancel-delete $KEY_ID

Cancelling key for deletion...
FAILED
kp.Error:
correlation_id='5b04a667-573c-44d1-82d5-39730af56a75',
msg='Conflict:
Action could not be performed on key.
Please see reasons for more details.',
reasons='[NOT_DUAL_AUTH_ERR:
The key is not dual auth enabled and cannot be set for deletion -
FOR_MORE_INFO_REFER: https://cloud.ibm.com/apidocs/key-protect]'
Show more









 26 - The key was updated recently 



 Message 

The key was updated recently: Please wait and try again

Reason code: REQ_TOO_EARLY_ERR





 HTTP status code 

409 - Conflict

The HTTP 409 Conflict response status code indicates a request conflict with current state of the server.

Conflicts are most likely to occur in response to a PUT request. For example, you may get a 409 response when uploading a file which is older than the one already on the server resulting in a version control conflict.





 Context 

This error occurs when you enable or restore a key within 30 seconds of the last action.

You must wait at least 30 seconds between the last "action" and enabling or restoring a key.

This example fails because the key was enabled too soon after disabling a key.

 create a root key
High 
 Secret expires in 60 days com.ibm.cloud.secrets-manager.secret_about_to_expire in_60_days An event is sent when a secret is 60 days from expiration. High 
 Secret expires in 30 days com.ibm.cloud.secrets-manager.secret_about_to_expire in_30_days An event is sent when a secret is 30 days from expiration. High 
 Secret expires in 10 days com.ibm.cloud.secrets-manager.secret_about_to_expire in_10_days An event is sent when a secret is 10 days from expiration. High 
 Secret expires in 1 day com.ibm.cloud.secrets-manager.secret_about_to_expire in_1_days An event is sent when a secret is 1 day from expiration. High 
 Secret expires in less than 1 day com.ibm.cloud.secrets-manager.secret_about_to_expire in_0_days An event is sent when a secret is less than 1 day from expiration. High 
 Secret expired com.ibm.cloud.secrets-manager.secret_expired An event is sent when a secret reaches its expiration date and time. High 
 Secret revoked com.ibm.cloud.secrets-manager.secret_revoked An event is sent when a version of a secret is revoked before it is scheduled to expire. Low 
 Secret deleted com.ibm.cloud.secrets-manager.secret_deleted An event is sent when a secret is deleted from a Secrets Manager instance. Low 
 Secret deletion blocked com.ibm.cloud.secrets-manager.secret_deletion_blocked An event is sent when a secret is unable to be deleted because it is locked. Low 
 Secret revocation blocked com.ibm.cloud.secrets-manager.secret_revocation_blocked An event is sent when a secret is unable to be revoked because it is locked. Low 
 Secret rotation blocked com.ibm.cloud.secrets-manager.secret_rotation_blocked An event is sent when a secret is unable to be rotated because it is locked. Low
For example, if a user signs in with Facebook and later signs in by using Google, they are considered two separate authorized users. The total number of your authorized users includes future users that you preregistered to your app because you already know who they are going to be. You are charged for each future user at the time of registration. For example, you work at a company and recently hired a team lead. When you preregister them to your application, they become an authorized user and count toward your total. As an authorized user, they can sign in for the first time without needing to interact with you. [Learn more](https://cloud.ibm.com/docs/appid?topic=appid-preregister).





 What are authentication events? 

An authentication event happens when you issue a new regular or anonymous access token. Tokens can be issued in response to a sign-in request that is initiated by the user, or by an app on behalf of the user. By default, your users' access tokens are valid for 1 hour and anonymous tokens are valid for 30 days. After the tokens expire, your users must create a new token to access protected resources. You can manage the expiration time of your App ID tokens on the Manage Authentication > Authentication Settings page of the service dashboard.





 What are advanced security features? 

You can strengthen the security of your application with advanced security features such as Multi-Factor authentication (MFA), runtime activity tracking, and password policy management. An advanced authentication event happens when you issue tokens for advanced security features.

By default, advanced features are disabled. You incur an extra charge when you enable them. For example, if you obtain 10,000 access tokens, then you turn on password policy management and obtain 10,000 more. You would pay for 20,000 authentication events and 10,000 advanced security events. If you disable all the advanced features, your account reverts to the original-cost policy.



Table 1. Description of the benefits that are gained with advanced authentication events

 Feature Benefit
Setting limits for IAM tokens 

As an account owner or user assigned the administrator role for the Identity service, you can meet your security requirements by setting custom expiration values for tokens. Identity and Access Management (IAM) access tokens and refresh tokens can both be customized for token limits.

Token expiration settings apply only when there is no connected login session. For more information, see [Determining when sessions are created](https://cloud.ibm.com/docs/account?topic=account-token-limitsessions-nonsessions).



 Before you begin 

If you have the following access, you can update the settings for token expiration:



* Account owner
* Operator or admin role on all account management services
* Operator or admin role on IAM Identity service



For more information about access, see [Actions and roles for account management services](https://cloud.ibm.com/docs/account?topic=account-account-services&interface=uiaccount-management-actions-roles).





 Managing access token expiration 

IAM access tokens can be used to invoke various IBM Cloud APIs. This is a temporary credential that is the result of an authentication. After the acquired access token expires, a refresh token is used to get a new access token so that you can continue calling IBM Cloud or service APIs.

To update your access token expiration setting, complete the following steps:



1. In the IBM Cloud® console, click Manage > Access (IAM), and select Settings.
2. From the Login session section, click the Edit icon ![Edit icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/edit-tagging.svg) on the Access token tile.
3. Enter the time limit in minutes. An access token can be valid for up to 60 minutes.
4. Click Save.







 Managing refresh token expiration
* The responseData.keyVersionCreationDate field includes the date that the current version of the key was created.
* The responseData.expirationDate includes the date that the key will expire on.







 List key versions 

The following field includes extra information:



* The responseData.totalResources field includes the total amount of key versions returned in the response.







 Set or Unset key for deletion 

The following fields include extra information:



* The responseData.initialValue.authID field includes the initiator ID of the person who set the dual authorization policy.
* The responseData.initialValue.authExpiration field includes the expiration date for the dual authorization policy.
* The responseData.newValue.authID field includes the initiator ID of the person who set the dual authorization policy.
* The responseData.newValue.authExpiration field includes the expiration date for the dual authorization policy.



initialValue is the initiatorID of the person who last set the dual authorization policy and newValue is the new initiatorID of the person who set the dual authorization policy.







 Policy events 



 Set instance policies 



 Allowed Network Policies 

The following fields include extra information:



* The requestData.initialValue.policyAllowedNetworkEnabled field includes if your allowed network policy was previously enabled or disabled.
* The requestData.initialValue.policyAllowedNetworkAttribute field includes if your allowed network policy was previously only for public networks or both public and private networks.
* The requestData.newValue.policyAllowedNetworkEnabled field includes if your allowed network policy is currently enabled or disabled.
* The requestData.newValue.policyAllowedNetworkAttribute field includes if your allowed network policy is currently only for public networks or both public and private networks.







 Dual Auth Delete Policies 

The following fields include extra information:



* The requestData.initialValue.policyDualAuthDeleteEnabled field includes if your dual auth delete policy was previously enabled or disabled.
For more information, see the [Terraform documentation](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/iam_account_settingsallowed_ip_addresses).



 Setting session duration for trusted profiles 

For more information, see [Updating trusted profiles](https://cloud.ibm.com/docs/account?topic=account-trusted-profile-updatesession-limit-tp).







 Setting the sign out due to inactivity duration 

An inactive session is when the user hasn't completed any requests that send a token for validation for the duration selected. If the sign out due to inactivity duration is 1 hour, then the user will be signed out after an hour if they haven't done anything in their account in that time. To update your user's sign out due to inactivity settings, complete the following steps.



1. In the IBM Cloud console, click Manage > Access (IAM), and select Settings.
2. From the Login session section, click the Edit icon ![Edit icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/icon_write.svg) from the Sign out due to inactivity tile.
3. Enter the time limit. The longest an inactive session can last is 24 hours.
4. Click Save.







 Setting the sign out due to inactivity duration by using Terraform 

An inactive session is when the user hasn't completed any requests that send a token for validation for the duration selected. If the sign out due to inactivity duration is 1 hour, then the user will be signed out after an hour if they haven't done anything in their account in that time. To update your user's sign out due to inactivity settings, complete the following steps.

To update your user's sign out due to inactivity duration by using terraform, complete the following steps:



1. Create an argument in your main.tf file.
Deleting stale data with expiration rules 

An expiration rule deletes objects after a defined period (from the object creation date).

You can set the lifecycle for objects by using the web console, REST API, and third-party tools that are integrated with IBM Cloud Object Storage.



* An expiration rule can be added to a new or existing bucket.
* An existing expiration rule can be modified or disabled.
* A newly added or modified Expiration rule applies to all new and existing objects in the bucket.
* Adding or modifying lifecycle policies requires the Writer role.
* Up to 1000 lifecycle rules (archive + expiration) can be defined per bucket.
* Allow up to 24 hours for any changes in Expiration rules to take effect.
* The scope of each expiration rule can be limited by defining an optional prefix filter to apply to only a subset of objects with names that match the prefix.
* An expiration rule without a prefix filter will apply to all objects in the bucket.
* The expiration period for an object, specified in number(s) of days, is calculated from the time the object was created, and is rounded off to the next day's midnight UTC. For example, if you have an expiration rule for a bucket to expire a set of objects ten days after the creation date, an object that was created on 15 April 2019 05:10 UTC will expire on 26 April 2019 00:00 UTC.
* The expiration rules for each bucket are evaluated once every 24 hours. Any object that qualifies for expiration (based on the objects' expiration date) will be queued for deletion. The deletion of expired objects begins the following day and will typically take less than 24 hours. You will not be billed for any associated storage for objects once they are deleted.
* In [versioning enabled or suspended buckets](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-versioning), a regular rule retains the current version and creates a delete marker rather than permanently deleting data.
* The expiration time of non-current versions is determined by its successor's last modified time, rounded to the next day at midnight UTC.
After inviting new users to join your account, IBM Cloud requires all except VPN-only users to accept the invitation to become an active user in your account.

The invitation expires after 30 days. New users to IBM Cloud can accept an invitation only by using the invitation link that they received through email.

You can cancel an invitation for any users that are shown in a Processing or Pending state in the Status column of the [Users page](https://cloud.ibm.com/iam/users). If an invited user did not receive an invitation, you can resend the invitation to any user in a Pending state.



1. Go to the [Users page](https://cloud.ibm.com/iam/users).
2. Locate the row for the user in Processing or Pending state.
3. Click the Actions icon ![More Actions icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/action-menu-icon.svg), then choose to Resend invite or Cancel invite.







 Accepting invitations in the console 

If the invited user is already a member of IBM Cloud, they receive an invitation link in their notifications and by email. On the [Notifications page](https://cloud.ibm.com/user/notifications), users can use the search field to locate an invitation or filter by the notification type called account. For more information, see [Managing invitation notifications](https://cloud.ibm.com/docs/account?topic=account-email-prefsmanaging-invitation-notifications) and [Viewing notifications](https://cloud.ibm.com/docs/get-support?topic=get-support-viewing-notifications).





 Accepting invitations by using the CLI 

If the invited user is already a member of IBM Cloud, they can accept invitations by using the CLI.
"version": "0.0.1",
"subject": "user@email.com",
"activationId": "c2b36969fbe94562b36969fbe9856215",
"start": 1532456307768,
"end": 1532456309838,
"duration": 2070,
"response": {
"status": "success",
"statusCode": 0,
"success": true,
"result": {
"done": true
}
},
"logs": [],
"annotations": [
{
"key": "path",
"value": "<namespace_ID>/hello"
},
{
"key": "waitTime",
"value": 50
},
{
"key": "kind",
"value": "nodejs:6"
},
{
"key": "limits",
"value": {
"logs": 10,
"memory": 256,
"timeout": 60000
}
},
{
"key": "initTime",
"value": 53
}
],
"publish": false
}

| namespace | The namespace ID that this activation is in. This namespace might be different than the namespace that the action is in. | | name | The name of the action. | | version | The semantic version of the action. | | subject | The user account that activated the item. | | activationId | ID of this activation record. | | start | Time when the activation began. | | end | Time when the activation completed. | | duration | Time, in milliseconds, that it took for the activation to complete. | | response | - status: The exit status of the activation. \n - statusCode: The status code.
For example, you might have a view that does not get any events for 2 days. Therefore, this view is not active. You have an absence alert attached to this view that is configured to send a notification after 30 minutes. Because the view is not active, the absence alert is muted and you do not get notifications. To make the view active and get notifications for the absence condition, events need to start flowing into the view.





 Alert conditions 

You can configure any of the following conditions for an alert:



* Time frequency: You set this condition to specify how often to trigger an alert. Valid values are: 30 seconds, 1 minute, 5 minutes, 15 minutes, 30 minutes, 1 hour, 6 hours, 12 hours, 24 hours
* Event lines counter: You set this condition to specify the number of event lines that match the view's filtering and search criteria. When the number of event lines is reached, an alert is triggered.



You can decide whether both conditions are checked or only one. If both conditions are set, an alert is triggered when any of the thresholds is reached.

If you set the Event lines counter to be the only condition that triggers an alert, the time frequency that is set when you configure the condition determines the time that it takes for the alert condition to be reset after the alert is triggered.

For example, you can configure an alert that is triggered after 30 seconds, or when a 100 event lines that match the view's filtering and search criteria are collected.





 Mute alert notifications 

By default, the feature that controls the ability of a user to mute notifications is enabled when you configure an alert on a custom view. The Muteable feature applies to email notifications only.

When the mutable feature is enabled on an alert, a user can pause notifications for a period of time. A user can choose to mute an alert for a period of 1 hour, 6 hours, 12 hours, or 1 day.







 Exporting events 

You might need access to a set of events outside the web UI to investigate an issue in more detail.

You can export data in JSONL format from an IBM Cloud Activity Tracker instance into a local file.