vania-janet/multiturn-rag-retrieval-data huggingface dataset:
For more information, see [enable-cors.org](https://enable-cors.org/).





 Signed URLs 

Signed URLs provide authentication information as a query string. Although signed URLs provide access for a limited time and with limited permissions, they allow any user with such a URL to access the service, regardless of whether that user has an account. The Text to Speech service does not support signed URLs.





 FISMA support 

IBM Cloud Pak for Data

Federal Information Security Management Act (FISMA) support is available for Text to Speech for IBM Cloud Pak for Data offerings purchased on or after 30 August 2019 (version 1.0.1). Text to Speech for IBM Cloud Pak for Data is FISMA High Ready.





 FIPS support 

IBM Cloud Pak for Data

Text to Speech for IBM Cloud Pak for Data supports running on Federal Information Processing Standard (FIPS)-enabled clusters as of version 4.5.1.
A secure connection between the visitor and CIS, and secure and authenticated connection between CIS and your web server. You must have your server configured to answer HTTPS connections, with a valid TLS certificate. This certificate must be signed by a certificate authority, have an expiration date in the future, and respond for the request domain name (hostname). It is recommended that you keep using this TLS mode for best security practices, unless you understand the potential security threats of changing to one of the less strict modes.

Zoom

![Diagram of End to end CA signed TLS](https://cloud.ibm.com/docs-content/v1/content/cb1eb27836421578019401fa7556779109430b29/cis/images/end-to-end-ca-signed.png)

Figure 4. A diagram of End to end CA signed TLS





 HTTPS Only Origin Pull 

Enterprise only. This mode has the same certificate requirements as End-to-End CA Signed and also upgrades all connections between CIS and your origin webserver from HTTP to HTTPS, even if the original content requested is over HTTP.







 Traffic encryption - Minimum TLS version 

Set the minimum TLS version for traffic trying to connect to your site by selecting one of the versions from the list.

By default, this is set to 1.2. Higher TLS versions provide additional security, but might not be supported by all browsers. This could result in some customers being unable to connect to your site.





 Edge cipher suites 

The following ciphers are supported at the cloud edge. You can restrict the ciphers used for your domain using the CIS CLI plugin to the IBM Cloud CLI. See the ciphers option on the [domain settings command](https://cloud.ibm.com/docs/cis?topic=cis-cis-clidomain-settings).



Table 1. Edge cipher suites

 OpenSSL Name TLS 1.0 TLS 1.1 TLS 1.2 TLS 1.3 

 ECDHE-ECDSA-AES128-GCM-SHA256 !
Data security 

The IBM Watson® Text to Speech service provides the following security features to help you protect your user data.



 Authenticating to IBM Cloud 

IBM Cloud

You authenticate to the service by using IBM Cloud Identity and Access Management (IAM). You can pass either an API key or a bearer token in an Authorization header. For more information, see [Authenticating to IBM Cloud](https://cloud.ibm.com/docs/watson?topic=watson-iamgs-credential-cloud).





 Authenticating to IBM Cloud Pak for Data 

IBM Cloud Pak for Data

You authenticate to the service by passing an access token with each request. You pass a bearer token in an Authorization header to authenticate. Several methods exist to generate the token, including by using an API key or by username. For more information, see [Authenticating to IBM Cloud Pak for Data](https://cloud.ibm.com/docs/watson?topic=watson-iamgs-credential-cpd).

Text to Speech for IBM Cloud Pak for Data is a multi-tenant cloud solution. Your credentials provide access to your data only, and your data is isolated from other users.





 Basic data security 

The service provides security for all user data both in motion and at rest:



* Transport Layer Security (TLS) 1.2 is used to secure data in transit.
* Advanced Encryption Standard (AES)-256 with Secure Hash Algorithm (SHA)-256 is used to secure data at rest.



For more information about data security for cloud applications, see [Security architecture for cloud applications](https://www.ibm.com/cloud/architecture/architectures/securityArchitecture/security-for-data).





 Information security 

The service supports the European Union General Data Protection Regulation (GDPR) to manage user data. You can pass the X-Watson-Metadata header with a request to associate a customer ID with data that the request passes to the service. If necessary, you can then delete the data by using the DELETE /v1/user_data method.
For more information, see [The <prosody> element](https://cloud.ibm.com/docs/text-to-speech?topic=text-to-speech-elementsprosody_element).

Security vulnerabilities addressed
: The following security vulnerabilities have been fixed:



* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a buffer over-read flaw in Linux Kernel (CVE-2020-28915)](https://www.ibm.com/support/pages/node/6829133)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security bypass in GNU Gzip (CVE-2022-1271)](https://www.ibm.com/support/pages/node/6829139)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to elevated privileges in Apple macOS Monterey and macOS Big Sur (CVE-2022-26691)](https://www.ibm.com/support/pages/node/6829141)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to elevated privileges in Linux Kernel (CVE-2022-27666)](https://www.ibm.com/support/pages/node/6829143)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to cross-site scripting in Apache Tomcat (CVE-2022-34305)](https://www.ibm.com/support/pages/node/6829145)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass in GNU C Library (CVE-2019-19126)](https://www.ibm.com/support/pages/node/6829149)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in GNU C Library ( CVE-2020-10029)](https://www.ibm.com/support/pages/node/6829151)
You do not need to follow the steps to create a JWT. The Assistant service generates a JSON Web Token for you.
4. Copy the shared secret from Zendesk.



To secure the Zendesk connection, complete the following steps:



1. In the Authenticate users section, set the switch to On.
2. Paste the secret that you copied from the Zendesk setup page into the Zendesk shared secret field.
3. Decide whether to allow unidentified users to access Zendesk.

The web chat integration allows anonymous users to initiate chats. However, as soon as you enable visitor authentication, Zendesk requires that the name and email of each user be provided. If you try to connect without passing the required information, the connection will be refused.

If you want to allow anonymous users to connect to Zendesk, you can provide fictitious name and email data. Write a function to populate the two fields with fictitious name and email values.

For example, your function must check whether you know the name and email of the current user, and if not, add canned values for them:

const userPayload = {
"name" : "Jane Doe1",
"email" : "jdoe1@example.com",
}

After writing a function that ensures that name and email values are always provided, set the Authenticate anonymous user chat transfers switch to On.







 Adding transfer support to your actions 

Update an action to make sure it understands when users request to speak to a person, and can transfer the conversation properly.



 Routing based on browser information 

When a customer interacts with the web chat, information about the current web browser session is collected. For example, the URL of the current page is collected.

You can use this information to add custom routing rules to your actions. For example, if the customer is on the Products page when a transfer to a human is requested, you might want to route the chat transfer to agents who are experts in your product portfolio.

If the customer is on the Returns page, you might want to route the chat transfer to agents who know how to help customers return merchandise.
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in FasterXML jackson-databind (CVE-2022-42003)](https://www.ibm.com/support/pages/node/6988087)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary code execution in Perl (CVE-2020-10878)](https://www.ibm.com/support/pages/node/6988089)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass in Apache Tomcat (CVE-2022-45143)](https://www.ibm.com/support/pages/node/6988091)
* CVE-2020-10543: Publication of the security bulletin is pending.







 29 March 2023 (Version 4.6.4) 

Version 4.6.4 is now available
: Text to Speech for IBM Cloud Pak for Data version 4.6.4 is now available. This version supports IBM Cloud Pak for Data version 4.6.x and Red Hat OpenShift versions 4.10 and 4.12. For more information, see [Watson Speech services on IBM Cloud Pak for Data](https://www.ibm.com/docs/en/cloud-paks/cp-data/4.6.x?topic=services-watson-speech).

Important: Back up your data before upgrading to version 4.6.3 or 4.6.4
: Important: Before upgrading to Watson Speech services version 4.6.3 or 4.6.4, you must make a backup of your data. Preserve the backup in a safe location. For more information about backing up your Watson Speech services data, see Backing up and restoring Watson Speech services data in [Administering Watson Speech services](https://www.ibm.com/docs/en/cloud-paks/cp-data/4.6.x?topic=services-administering). That topic also includes information about restoring your data if that becomes necessary.
In the Secret field, add a token to pass with the request that can be used to authenticate with the external service.

The secret must be specified as a text string, such as purple unicorn. The maximum length is 1,024 characters. You cannot specify a context variable.

It is the responsibility of the external service to check for and verify the secret. If the external service does not require a token, specify any string you want. You cannot leave this field empty.

If you want to see the secret as you enter it, click on the Show password icon ![view icon](https://cloud.ibm.com/docs-content/v1/content/icons/view.svg) before you start typing. After you save the secret, the string is replaced by asterisks and can't be viewed again.
7. Click the appropriate checkboxes to select which kinds of activity you want to log:



* To log messages and responses, select Subscribe to conversation logs.
* To log CDR events for the phone integration, select Subscribe to CDR (Call Detail Records).



8. In the Headers section, add any headers that you want to pass to the service one at a time by clicking Add header.

The service automatically sends an Authorization header with a JWT; you do not need to add one. If you want to handle authorization yourself, add your own authorization header and it will be used instead.

After you save the header value, the string is replaced by asterisks and can't be viewed again.



Your webhook details are saved automatically.





 Removing the webhook 

If you decide you do not want to log messages with a webhook, complete the following steps:



1. In your assistant, go to Environments and open the environment where you want to remove the webhook.
2. On the Environments page, click the !
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary command execution in Git (CVE-2018-1000021)](https://www.ibm.com/support/pages/node/6610349)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to cross-site scripting in jQuery (CVE-2015-9251)](https://www.ibm.com/support/pages/node/6610351)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to cross-site scripting in jQuery (CVE-2019-11358)](https://www.ibm.com/support/pages/node/6610361)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to cross-site scripting in jQuery (CVE-2020-11022)](https://www.ibm.com/support/pages/node/6610363)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to cross-site scripting in jQuery (CVE-2020-11023)](https://www.ibm.com/support/pages/node/6610365)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a data binding rules security weakness in Spring Framework (CVE-2022-22968)](https://www.ibm.com/support/pages/node/6610371)







 29 June 2022 (Version 4.5.0) 

Version 4.5.0 is now available
: Text to Speech for IBM Cloud Pak for Data version 4.5.0 is now available. This version supports IBM Cloud Pak for Data version 4.5.x and Red Hat OpenShift versions 4.6, 4.8, and 4.10.
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary command execution in Git (CVE-2018-1000021)](https://www.ibm.com/support/pages/node/6610349)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to cross-site scripting in jQuery (CVE-2015-9251)](https://www.ibm.com/support/pages/node/6610351)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to cross-site scripting in jQuery (CVE-2019-11358)](https://www.ibm.com/support/pages/node/6610361)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to cross-site scripting in jQuery (CVE-2020-11022)](https://www.ibm.com/support/pages/node/6610363)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to cross-site scripting in jQuery (CVE-2020-11023)](https://www.ibm.com/support/pages/node/6610365)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a data binding rules security weakness in Spring Framework (CVE-2022-22968)](https://www.ibm.com/support/pages/node/6610371)







 29 June 2022 (Version 4.5.0) 

Version 4.5.0 is now available
: Speech to Text for IBM Cloud Pak for Data version 4.5.0 is now available. This version supports IBM Cloud Pak for Data version 4.5.x and Red Hat OpenShift versions 4.6, 4.8, and 4.10.
To validate signed JWTs, the web chat integration uses the [jsonwebtoken](https://www.npmjs.com/package/jsonwebtoken) library with the RS256 algorithm.

The JWT payload must specify the following claims:



* sub: A unique user ID that identifies the customer who is interacting with the web chat. This can be either a generated unique identifier (for anonymous users) or an authenticated user ID. For more information about how the sub value is used, see [Authenticating users](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-web-chat-security-authenticate).

To ensure security, the JWT should be specific to each user. Use either the user's authenticated login information, or a unique generated ID. Do not reuse the same JWT, or the same sub value, for more than one user.
* exp: The expiration time after which the JWT is no longer valid. Many JWT libraries set this value for you automatically. Set a short-lived exp claim (for example, 1h).

Do not create a JWT without an exp claim. Although this claim is not formally required, omitting it represents a security exposure because anyone with access to the JWT could copy it and use it later to access your assistant. Setting an expiration time limits this exposure.



The following JavaScript example shows how you might generate a JWT using the jsonwebtoken library:

// Sample NodeJS code on your server.
const jwt = require('jsonwebtoken');

// Returns a signed JWT signed with the RS256 algorithm.
function createJWT() {
const payload = {
sub: 'some-user-id', // Identifies user for billing purposes
};
// The "expiresIn" option adds an "exp" claim to the payload.
return jwt.sign(payload,
process.env.YOUR_PRIVATE_RSA_KEY,
return new Promise(function(resolve, reject) {
// And then pass the new JWT into the callback and the service will resume processing messages.
event.identityToken = 'YOUR NEW JWT';
resolve();
});
}});
instance.render();
}
};
setTimeout(function(){
const t=document.createElement('script');
t.src="https://web-chat.global.assistant.watson.appdomain.cloud/loadWatsonAssistantChat.js";
document.head.appendChild(t);
});
</script>
Show more





 Passing sensitive data 

You can optionally copy the public key that is provided by IBM, and use it to add an additional level of encryption to support passing sensitive data from the web chat.

Use this method to send sensitive information in messages that come from your website, such as a information about a customer's loyalty level, a user ID, or security tokens to use in webhooks that you call from your dialog. Information that is passed to your assistant in this way is stored in a private variable in your assistant. Private variables cannot be seen by customers and are never sent back to the web chat.

For example, you might start a business process for a VIP customer that is different from the process you start for less important customers. You likely do not want non-VIPs to know that they are categorized as such. But you must pass this informataion to your dialog because it changes the route of the conversation. You can pass the customer MVP status as an encrypted variable. This private context variable will be available for use by the dialog, but not by anything else.



1. From the web chat configuration page, copy the public key from the IBM provided public key field.
2. From your website, write a function that signs a JSON Web Token.

For example, the following NodeJS code snippet shows a function that accepts a userID and payload content and sends it to the web chat.
return new Promise(function(resolve, reject) {
// And then pass the new JWT into the callback and the service will resume processing messages.
event.identityToken = 'YOUR NEW JWT';
resolve();
});
}});
instance.render();
}
};
setTimeout(function(){
const t=document.createElement('script');
t.src="https://web-chat.global.assistant.watson.appdomain.cloud/loadWatsonAssistantChat.js";
document.head.appendChild(t);
});
</script>
Show more







 Passing sensitive data 

You can optionally copy the public key that is provided by IBM, and use it to add an additional level of encryption to support passing sensitive data from the web chat.

Use this method to send sensitive information in messages that come from your website, such as a information about a customer's loyalty level, a user ID, or security tokens to use in webhooks that you call from your dialog. Information that is passed to your assistant in this way is stored in a private variable in your assistant. Private variables cannot be seen by customers and are never sent back to the web chat.

For example, you might start a business process for a VIP customer that is different from the process you start for less important customers. You likely do not want non-VIPs to know that they are categorized as such. But you must pass this informataion to your dialog because it changes the route of the conversation. You can pass the customer MVP status as an encrypted variable. This private context variable will be available for use by the dialog, but not by anything else.



1. From the web chat configuration page, copy the public key from the IBM provided public key field.
2. From your website, write a function that signs a JSON Web Token.

For example, the following NodeJS code snippet shows a function that accepts a userID and payload content and sends it to the web chat.
For more information about data security for cloud applications, see [Security architecture for cloud applications](https://www.ibm.com/cloud/architecture/architectures/securityArchitecture/security-for-data).





 Information security 

The service supports the European Union General Data Protection Regulation (GDPR) to manage user data. You can pass the X-Watson-Metadata header with a request to associate a customer ID with data that the request passes to the service. If necessary, you can then delete the data by using the DELETE /v1/user_data method. For more information about these features and their use, see [Information security](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-information-security).

IBM Cloud

For Premium plans, the service also offers US Health Insurance Portability and Accountability Act (HIPAA) readiness in the Washington, DC, (us-east) and Dallas (us-south) regions.





 Request logging 

IBM Cloud

The service lets you control the default request logging that is performed for all Watson services. The service logs request and response data only to improve the service for future users. The logged data is never shared or made public. No data can be exported from the service. For example, users must retain the data that they use for training custom models because it cannot be retrieved from the service.

If you are concerned about the privacy of users' personal information or otherwise do not want your requests to be logged by IBM, you can opt out of the default logging to prevent the service from logging your request and response data. If you opt out, the service logs no user data from your requests:



* Results from synchronous HTTP and WebSocket requests are never stored to disk.
* Results from asynchronous HTTP requests are deleted as soon as their time to live expires. For more information, see [Asynchronous job retention](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-data-securitydata-security-async).



You can choose to opt out of logging at either the account level or the API request level.
For more information, see [Authenticating users](https://cloud.ibm.com/docs/assistant-data?topic=assistant-data-deploy-web-chatdeploy-web-chat-security-authenticate).

Choose a non-human-identifiable ID. For example, do not use a person's email address as the user_id.

User information is used in the following ways:



* The user_id is used to measure the number of monthly active users who interact with the web chat integration.
* The ability to delete any data created by someone who requests to be forgotten requires that a customer_id be associated with the user input. When a user_id is defined, the product can reuse it to pass a customer_id parameter. See [Labeling and deleting data](https://cloud.ibm.com/docs/assistant-data?topic=assistant-data-information-securityinformation-security-gdpr-wa).



Because the user_id value that you submit is included in the customer_id value that is added to the X-Watson-Metadata header in each message request, the user_id syntax must meet the requirements for header fields as defined in [RFC 7230](https://tools.ietf.org/html/rfc7230section-3.2).

To support these user-based capabilities, add the updateUserID() method in the code snippet before you paste it into your web page.

In the following example, the user ID L12345 is added to the script.

<script>
window.watsonAssistantChatOptions = {
integrationID: 'YOUR_INTEGRATION_ID',
region: 'YOUR_REGION',
serviceInstanceID: 'YOUR_SERVICE_INSTANCE',
onLoad: function(instance) {
instance.updateUserID(L12345);
instance.render();
}
};
setTimeout(function(){
const t=document.createElement('script');