vania-janet/multiturn-rag-retrieval-data huggingface dataset:
If you're the account owner, or if you have the required access, you can remove users. For more information, see [Removing users from an account](https://cloud.ibm.com/docs/account?topic=account-remove).
* Can I view my assigned roles and permissions?

Yes, go to Manage > Access (IAM) in the console, and select your name on the Users page. Then, depending on the access you're looking for, select the different tabs:



* To determine what access you have through the access groups you are assigned, select Access groups.
* To see IAM access policies that are assigned to you, select the Access policies.



* How long does it take to onboard a product?

The complete onboarding process for software takes approximately 7 days.
* What if my product isn't approved for publishing in the catalog?

If your product is not approved, we'll send you an email with details about what items require updates. After you address the feedback, you can submit another publishing request.
* Why does Partner Center keep logging me out?

Your session timed out. Make sure to frequently save your updates to maintain your current progress.
* Why can't I find the product that I'm onboarding?



* If you can't find your product, make sure that you are in the correct account.
* If you are in the correct account and your product is not listed on the My Products, your product might have been deleted. You will need to start the onboarding process again.



* How soon is my product approved for publishing?

You can expect your product to be reviewed and approved for publishing in 1 to 2 business days.
* Can I share my virtual server image with other users as a developer?

Yes, you can share your virtual server image with other users. To share with users in your personal or enterprise account, see [Onboarding software to your account](https://cloud.ibm.com/docs/account?topic=account-create-private-catalog&interface=ui).
* You have 5 public certificate secrets that expire in 10 days.
* You have 100 imported certificate secrets that expire in 30 days.



100 is the maximum number of secrets that you can be notified of in a single event notification.





 Events for Secrets Manager 

The following table lists the Secrets Manager actions that generate an event.

Depending on the type of secret that you're working with in the service, an event might not be generated by Secrets Manager. For example, you don't receive a notification if a certificate is set to expire in less than 24 hours. For more information, refer to [Events by secret type](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-event-notificationsevent-notifications-by-secret-type).



Table 1. Actions that generate event notifications

 Event name Event type Subtype Description Severity level 

 Secret created com.ibm.cloud.secrets-manager.secret_created An event is sent when a secret is added to the instance. Low 
 Secret creation failed com.ibm.cloud.secrets-manager.secret_creation_failed An event is sent when a request to create a secret fails. Low 
 Secret rotated com.ibm.cloud.secrets-manager.secret_rotated An event is sent when a secret is rotated and a new version becomes available. Low 
 Secret rotation failed com.ibm.cloud.secrets-manager.secret_rotation_failed An event is sent when a request to rotate a secret fails. High 
 Secret expires in 90 days com.ibm.cloud.secrets-manager.secret_about_to_expire in_90_days An event is sent when a secret is 90 days from expiration. High 
 Secret expires in 60 days com.ibm.cloud.secrets-manager.secret_about_to_expire in_60_days An event is sent when a secret is 60 days from expiration. High 
 Secret expires in 30 days com.ibm.cloud.secrets-manager.secret_about_to_expire in_30_days An event is sent when a secret is 30 days from expiration. High
You have an allowlist of approved users that don't need to provide the second factor every time. Configure your extension to validate that the username or user_id is in the allowlist. 
 You don't want users who access your app on a desktop to provide the second factor every time. Configure your extension to validate that device_type is set to web. 



2. When you know your criteria, configure an extension that can listen for a POST request. The endpoint must be able to read the payload that comes from App ID. The body that is sent by App ID before the MFA flow starts is in the format: {"jws": "jws-format-string"}. Your extension might also [decode and validate](https://cloud.ibm.com/docs/appid?topic=appid-token-validationlocal-validation) the payload, the content is a JSON object and return a JSON response with the following schema: {"skipMfa": Boolean }. For example,: {'skipMfa': true}.



Table 4. The information that App ID forwards to your extension point.

 Information Description 

 correlation_id A random number that is generated for each MFA session. If you have both a pre-mfa and a post-mfa extension, the number is the same for each for the same session. For example, 3bb9236c-792f-4cca-8ae1-ada754cc4555. 
 extension The name of your extension. For this use case, the extension is named premfa. 
 device_type The type of device with which your user is accessing your application. Options include: web and mobile. 
 source_ip The IP address of the device that makes the request to your app. For example, 127.0.0.1. 
 headers The information that is returned by the browser when a user attempts to sign in to your app.
* You have 5 public certificate secrets that expire in 10 days.
* You have 100 imported certificate secrets that expire in 30 days.



100 is the maximum number of secrets that you can be notified of in a single event notification.





 Events for Secrets Manager 

The following table lists the Secrets Manager actions that generate an event.

Depending on the type of secret that you're working with in the service, an event might not be generated by Secrets Manager. For example, you don't receive a notification if a certificate is set to expire in less than 24 hours. For more information, refer to [Events by secret type](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-event-notifications&interface=uievent-notifications-by-secret-type).



Table 1. Actions that generate event notifications

 Event name Event type Subtype Description Severity level 

 Secret created com.ibm.cloud.secrets-manager.secret_created An event is sent when a secret is added to the instance. Low 
 Secret creation failed com.ibm.cloud.secrets-manager.secret_creation_failed An event is sent when a request to create a secret fails. Low 
 Secret rotated com.ibm.cloud.secrets-manager.secret_rotated An event is sent when a secret is rotated and a new version becomes available. Low 
 Secret rotation failed com.ibm.cloud.secrets-manager.secret_rotation_failed An event is sent when a request to rotate a secret fails. High 
 Secret expires in 90 days com.ibm.cloud.secrets-manager.secret_about_to_expire in_90_days An event is sent when a secret is 90 days from expiration. High 
 Secret expires in 60 days com.ibm.cloud.secrets-manager.secret_about_to_expire in_60_days An event is sent when a secret is 60 days from expiration. High 
 Secret expires in 30 days com.ibm.cloud.secrets-manager.secret_about_to_expire in_30_days An event is sent when a secret is 30 days from expiration. High
This condition is triggered if the user provides input that matches the slot handler conditions at any time during the dialog node flow up until the node-level response is displayed. See [Handling requests to exit a process](https://cloud.ibm.com/docs/assistant?topic=assistant-dialog-slotsdialog-slots-node-level-handler) for more ways to use the slot handler.
8. Add a node-level response. The node-level response is not executed until after all of the required slots are filled. You can add a response that summarizes the information you collected. For example, A $size pizza is scheduled for delivery at $time. Enjoy!

You can alternatively show an image or list of options as a response instead of a text response. See [Response type options](https://cloud.ibm.com/docs/assistant?topic=assistant-dialog-slotsdialog-slots-response-types).

If you want to define different responses based on certain conditions, click Customize, and then set the Multiple responses switch to On. For information about conditional responses, see [Conditional responses](https://cloud.ibm.com/docs/assistant?topic=assistant-dialog-overviewdialog-overview-multiple).
9. Add logic that resets the slot context variables. As you collect answers from the user per slot, they are saved in context variables. You can use the context variables to pass the information to another node or to an application or external service for use. However, after passing the information, you must set the context variables to null to reset the node so it can start collecting information again. You cannot null the context variables within the current node because your assistant will not exit the node until the required slots are filled. Instead, consider using one of the following methods:



* Add processing to the external application that nulls the variables.
* Add a child node that nulls the variables.
* Insert a parent node that nulls the variables, and then jumps to the node with slots.





Give it a try!
With a pre-mfa extension, you can define the criteria that allows users to avoid having to enter a second form of authentication when they interact with your application.

Zoom

![pre-MFA flow](https://cloud.ibm.com/docs-content/v1/content/27ecaa7a29890634603881a8e64789974a29916b/appid/images/mfa-pre.png)

Figure 2. Cloud Directory pre-MFA flow



1. When a user successfully signs in to your application, App ID sends a POST request to your extension.
2. Your extension uses the information from the POST request to determine whether that particular user can skip the second authentication factor requirement based on the criteria that you defined.
3. Your configuration returns a JSON response to App ID that looks similar to {'skipMfa': true}.
4. Based on the response from your configuration, App ID either proceeds with the MFA flow or grants access to your application.



By default, if an error occurs during the request to your extension point, App ID requires that the user completes MFA.

To configure a pre-MFA extension:



1. Define the criteria that you want a user to meet before them being able to skip the second factor of authentication. Check out the following examples to get some ideas if you're unsure.



Table 3. Example criteria for skipping MFA

 Example use case Example validation 

 You want users to provide a second authentication factor only once a day. Configure your extension to validate the last_successful_first_factor is within the same day. 
 You have an allowlist of approved users that don't need to provide the second factor every time. Configure your extension to validate that the username or user_id is in the allowlist. 
 You don't want users who access your app on a desktop to provide the second factor every time. Configure your extension to validate that device_type is set to web. 



2. When you know your criteria, configure an extension that can listen for a POST request.
causedBy This annotation is only present for actions that are contained in a sequence. 
 waitTime The time that is spent waiting in the internal Cloud Functions system. This time is roughly the time that is spent between the receipt of the activation request and when the invoker provisioned a container for the action. This value is only present for non-sequence related activations. For sequences, this information can be derived from the topmost sequence activation record. 
 initTime The time that is spent initializing the function. If this value is present, the action required initialization and represents a cold start. A warm activation skips initialization, and in this case, the annotation is not generated. 



The following example shows these annotations as they might appear in an activation record:

"annotations": [
{
"key": "path",
"value": "guest/echo"
},
{
"key": "waitTime",
"value": 66
},
{
"key": "kind",
"value": "nodejs:6"
},
{
"key": "initTime",
"value": 50
},
{
"key": "limits",
"value": {
"logs": 10,
"memory": 256,
"timeout": 60000
}
}
]
Show more
Unrouted secondary subnets are billed the same as routed secondary subnets, and re-routing by you has no effect on billing.





 How long can unrouted subnets remain unused on my account? 

Starting November 30, 2022, secondary subnets that remain unrouted on your account for 60 days or more are subject to automatic cancellation of billing and reclaim of the subnet in order to maintain sufficient subnet availability for all customers.





 Can I re-route static or portable secondary subnets on my account? 

Yes. Unrouted, static, and portable secondary subnets on your account can be re-routed by you. See [Re-routing secondary subnets](https://cloud.ibm.com/docs/subnets?topic=subnets-re-routing-secondary-subnets) for more information on how to re-route your secondary subnets, and the limitations that exist when doing so.





 How long does it take for my new global IP to appear on my account after it's ordered? 

It takes approximately five minutes for a global IP to appear after it is ordered.





 Can I convert one of my pre-existing static IP addresses to a global IP? 

No. IBM Cloud requires all global IP addresses to be newly provisioned IP addresses, so we don’t allow pre-existing IP addresses to be converted into global IP addresses.





 How long does it take for my global IP to associate to an instance? 

The time that it takes for your global IP to associate depends on if you are associating a global IP for the first time, or if you are transferring it to a new instance. For new global IP addresses, it takes approximately five minutes before the address can be linked to an instance. When transferring an existing global IP between instances, it takes less than one minute.





 What types of subnets are available with global IP addresses? 

We currently offer global IP addresses as both IPv4 addresses and IPv6 addresses. Our global IPv4 addresses are available as single /32 addresses, while our global IPv6 addresses are available as single /64 addresses.





 Can IPv4 and IPv6 global IP addresses be used interchangeably? 

Because of incompatibility between IP address styles, you cannot use IPv4 and IPv6 global IP addresses interchangeably.
If responseData.totalResources is 0, query for keys in the deleted state by using the state parameter or adjust the offset and limit parameters in your request.





 Lifecycle action on a key with registrations did not complete 

The responseData.reasonForFailure and responseData.resourceCRN fields contain information about why the action wasn't able to be completed.

If the event has a reason.reasonCode of 409, the action cannot be completed due to the adopting service's key state conflicting with the key state that Hyper Protect Crypto Services has.

If the event has a reason.reasonCode of 408, the action cannot be completed because Hyper Protect Crypto Services was not notified that all appropriate actions were taken within 4 hours of the action request.





 Unable to perform Trusted Key Entry actions 

Failed TKE events have an outcome of failure. The reason.reasonType and reason.reasonForFailure fields contain information about why the action wasn't able to be completed.

If the event has a reason.reasonCode of 400, the action cannot be completed because the operation to the crypto units is not supported or is not valid. Check whether the TKE command that you use is valid by referring to the [TKE CLI reference](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-cli-plugin-hpcs-cli-plugintke-cli-plugin).

If the event has a reason.reasonCode of 401 or 403, the action cannot be completed because your access token is not valid or does not have the necessary permissions to access this instance. [Refresh your access token](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-access-token) and check whether you have [appropriate permissions](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-access) to perform the corresponding actions.

If the event has a reason.reasonCode of 500, check out the value of reason.reasonForFailure to identify the reasons of failure and the corresponding actions that you need to take.







 Event severity
The responseData.reasonForFailure and responseData.resourceCRN fields contain information on why the action wasn't able to be completed.

If the event has a reason.reasonCode of 409, the action could not be completed due to the adopting service's key state conflicting with the key state that Key Protect has.

If the event has a reason.reasonCode of 408, the action could not be completed because Key Protect was not notified that all appropriate actions were taken within 4 hours of the action request.







 Event Severity 

The severity for all IBM Cloud Activity Tracker events with Key Protect are based on the type of request that was made, then status code. For example, if you make a create key request with an invalid key, but you are also unauthenticated for the Key Protect instance that you included in the request, the unauthentication will take precedence and the event will be evaluated as a 401 bad request call with a severity of critical.

Key Protect returns a 401 reason.resasonCode for unauthorized/forbidden Key Protect service requests.

The following table lists the actions associated with each severity level:



Table 10. Describes the severity level for Key Protect service actions.

 Severity Actions 

 Critical kms.secrets.delete <br>kms.registrations.delete 
 Warning kms.secrets.rotate, kms.secrets.restore <br>kms.secrets.enable, kms.secrets.disable <br>kms.secrets.setkeyfordeletion, kms.secrets.unsetkeyfordeletion <br>kms.policies.write, kms.instance-policies.write
Sub type: expiring-in-15-days





 Example 2 

type:com.acmebank.password-changed
Type: com.acmebank.password-changed
Sub type: N/A









 CE optional attributes 

Following attributes are optional but highly recommended to take full advantage of Event Notifications.



 time (timestamp) 

UTC timestamp when the event occurred. Must be in the RFC 3339 format.



 Example 

time: 2022-02-10T10:51:37+00:00







 subject (String) 

This is the subject of the event in the event producer (source). So, this can be the account ID of the password that’s about to expire.



 Example 

subject:ajay@accts.acmebank.com







 datacontenttype 

Defines the MIME type of the data content. Currently, only "application/json" is supported.



 Example 

datacontenttype: application/json







 data 

The payload of the event. This can contain information that can be passed along to destinations like webhooks. Make sure that you are not sending any sensitive information. This must be a valid JSON object.



 Example 

data: { "lastchanged-days": "74", "reason":"time-based"}

Binary mode – this is part of the HTTP body N/A.









 Event Notifications extension mandatory attributes 

These are mandatory attributes for every event sent to Event Notifications.



 ibmensourceid (string) 

This is the ID of the source that is created in Event Notifications. This is available in the Event Notifications UI in the "Sources" section.



 Example 

ibmensourceid: 121313123:api









 Event Notifications extension optional attributes 

These are optional attributes.



 ibmenseverity(String) 

Some sources can have the concept of an Event severity. Hence a handy way is provided to specify a severity of the event.



 Example 

ibmenseverity:LOW







 ibmendefaultshort(String)
Users in a child account can't access billing and payment information, such as invoices, payments, or subscriptions, even if they previously had access in the account. To view or manage billing, users need to be invited to the enterprise account and given access to the Billing service in that account.
* Usage is invoiced to the enterprise account for the entire month when the account was added. For example, if you add an account to the enterprise on 15 June, all of the usage for the month of June is reflected in the July invoice.







 Shared credit pool 

The enterprise credit pool consolidates credit from all accounts in the enterprise and shares it with the accounts. The pool includes credit from all sources, including platform subscription credit, promotional credit, and support credit. When accounts in the enterprise create and use resources, the cost for this usage is deducted from the credit pool.

When existing subscriptions are added to the enterprise, each individual subscription term is re-created within the credit pool, including characteristics such as the remaining credit balance, start dates, and end dates. As credit is used, the subscription terms burn down individually according to when they expire. For example, you imported two accounts with existing subscriptions in August 2019. One subscription, 32100456, is for $1,000 for 18 months that began in January 2019. Because it spans multiple years, the subscription is divided into terms of up to one year each. The other subscription, 55543210 is for $500 a month for two years that began in April 2019, which is also divided into multiple terms. Then, you purchased a new one-year subscription, 00012345, through your enterprise for $1,500 a month that starts in July 2020. As enterprise users use resources, credit is deducted from the first term from subscription 32100456 because it expires the soonest, then the first term from subscription 55543210 because it expires next, and so on. This behavior ensures optimum usage of your purchased subscription credit.



Table 1. Subscriptions in an enterprise credit pool
This table has column headers and a summary row. The row headers identify the subscription and attributes.
[Calling an action from another action](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-tutorial_action)Calling an action from another action

In this tutorial, learn how to call an action from another action by creating a custom sequence in IBM Cloud® Functions. This tutorial uses Node.js 10, but the general principles can be applied to other runtimes.

Functions



* 10 minutes
* 2022-06-29



[Manage ID provider users with IBM Cloud](https://cloud.ibm.com/docs/quantum-computing?topic=quantum-computing-appid-cloud-org)Manage ID provider users with IBM Cloud

App ID creates an ID provider so you can add users directly in App ID or connect to other external ID providers. This tutorial describes how to set up your ID provider to work with IBM Cloud users, and gives instructions for users to access the environment.

Qiskit Runtime



* 15 minutes
* 2022-07-26



[Manage ID provider users with the ID provider](https://cloud.ibm.com/docs/quantum-computing?topic=quantum-computing-appid-org)Manage ID provider users with the ID provider

App ID creates an ID provider so you can add users directly in App ID or connect to other external ID providers. This tutorial describes how to set up your ID provider to work with users that do not have IBM Cloud accounts.

Qiskit Runtime



* 15 minutes
* 2022-07-26



[Manage IBM Cloud users](https://cloud.ibm.com/docs/quantum-computing?topic=quantum-computing-cloud-provider-org)Manage IBM Cloud users

This tutorial how to use IBM Cloud to enable users who have IBM Cloud accounts and gives instructions for users to access the environment.

Qiskit Runtime



* 15 minutes
* 2022-07-26



[Considerations for using Qiskit Runtime in an organization](https://cloud.ibm.com/docs/quantum-computing?topic=quantum-computing-considerations-org)Considerations for using Qiskit Runtime in an organization