vania-janet/multiturn-rag-retrieval-data huggingface dataset:
"secret_id": "12345678-9012-3456-7890-123456789012",
"secret_name": "test_secret_name"
}
],
"source_instance_api_private_url": "https://<your_instance_id>.private.us-south.secrets-manager.appdomain.cloud/api",
"source_instance_api_public_url": "https://<your_instance_id>.us-south.secrets-manager.appdomain.cloud/api",
"source_instance_crn": "crn:v1:bluemix:public:secrets-manager:us-south:a/<your_account_id>:<your_instance_id>::",
"source_instance_dashboard_url": "https://cloud.ibm.com/services/secrets-manager/crn%3Av1%3Abluemix%3Apublic%3Asecrets-manager%3Aus-south%3Aa%<your_account_id>%3A<your_instance_id>%3A%3A",
"source_service": "SecretsManager"
}
}

For more information about the properties that are sent as part of notification payload, see [Notification payload details](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-event-notificationsevent-notifications-payload).







 Next steps 

Great job! In part 1 of this tutorial series, you learned how to set up Secrets Manager and Event Notifications to route events to a test webhook URL. In part 2, you replace your test webhook with a Cloud Function webhook URL, and more.



* [Part 2: Create a GitHub issue when a secret is about to expire](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-tutorial-expiring-secrets-part-2)
You can get the owner, group, user, and VPC IDs from your AWS provider resources.

The following example is a security group that you might create for AWS.

{
"Description": "Security group for IBM Cloud Satellite hosts",
"GroupName": "Satellite",
"IpPermissions": [{
"FromPort": 80,
"IpProtocol": "tcp",
"IpRanges": {
"CidrIp": "0.0.0.0/0"
}],
"Ipv6Ranges": ],
"PrefixListIds": ],
"ToPort": 80,
"UserIdGroupPairs": ]
},
{
"FromPort": 30000,
"IpProtocol": "tcp",
"IpRanges": {
"CidrIp": "0.0.0.0/0"
}],
"Ipv6Ranges": {
"CidrIpv6": "::/0"
}],
"PrefixListIds": ],
"ToPort": 32767,
"UserIdGroupPairs": ]
},
{
"IpProtocol": "-1",
"IpRanges": ],
"Ipv6Ranges": ],
"PrefixListIds": ],
"UserIdGroupPairs": {
"GroupId": "<group_ID>",
"UserId": "<user_ID>"
}]
},
{
"FromPort": 22,
"IpProtocol": "tcp",
"IpRanges": {
"CidrIp": "0.0.0.0/0"
}],
"Ipv6Ranges": ],
"PrefixListIds": ],
"ToPort": 22,
"UserIdGroupPairs": ]
},
"id": "b7246cdf-892a-4a6c-8fa9-491a5f585bd0",
"created_on": "2019-09-11 13:46:51.68793557 +0000 UTC",
"modified_on": "2019-09-11 13:46:51.68793557 +0000 UTC",
"permitted_network": {
"vpc_crn": "crn:v1:staging:public:is:us-east:a/0821fa9f9ebcc7b7c9a0d6e9bf9442a4::vpc:b7246cdf-892a-4a6c-8fa9-491a5f585bd0"
},
"type": "vpc",
"state": "ACTIVE"
}

For future requests, the ID in the response is referenced as PERMITTED_NETWORK_ID.







 Retrieve a permitted network 

Retrieve a specific permitted network from your instance using the permitted network ID.



 Request 

curl -X GET $DNSSVCS_ENDPOINT/v1/instances/$INSTANCE_ID/dnszones/$DNSZONE_ID/permitted_networks/$PERMITTED_NETWORK_ID -H "Authorization: $TOKEN"





 Response 

{
"id": "b7246cdf-892a-4a6c-8fa9-491a5f585bd0",
"created_on": "2019-09-11 13:46:51.68793557 +0000 UTC",
"modified_on": "2019-09-11 13:46:51.68793557 +0000 UTC",
"permitted_network": {
},
"secret_type": "username_password",
"state": 1,
"state_description": "Active",
"versions": [
{
"auto_rotated": false,
"created_by": "iam-ServiceId-c0c7cfa4-b24e-4917-ad74-278f2fee5ba0",
"creation_date": "2020-12-15T22:43:36Z",
"id": "ae4b3afd-5e63-5951-790b-f1892e8c5267"
}
]
},
"wrap_info": null,
"warnings": null,
"auth": null
}

A request to create user credentials in an existing secret group returns the following response:

{
"request_id": "4ccc9dd5-af3a-6865-293f-3f704d2866e1",
"lease_id": "",
"renewable": false,
"lease_duration": 0,
"data": {
"created_by": "iam-ServiceId-c0c7cfa4-b24e-4917-ad74-278f2fee5ba0",
"creation_date": "2020-12-15T22:46:41Z",
"crn": "crn:v1:bluemix:public:secrets-manager:us-south:a/a5ebf2570dcaedf18d7ed78e216c263a:0f4c764e-dc3d-44d1-bd60-a2f7cd91e0c0:secret:be4a0846-4cb5-3bfa-bab5-10a44dfc3e85",
"description": "Extended description for my secret.",
"id":"MYid-111100P9W2",
"name":"john.doe@mycompany.com",
"typeURI":"service/security/account/user",
"credential":{
"type":"token"
},
"host":{
"address": "192.0.2.0"
}
},
"target":{
"id":"crn:v1:bluemix:public:kms:us-south:a/a12333e9bd28461a8c92385628efac9f:fd692647-43d0-4699-9f83-f39a54b1327b:key:76c2c9cb-9095-5a24-811b-0ef4b24ac4d5",
"name":"my-secret-key1",
"typeURI":"kms/secrets"
},
"observer":{
"name":"ActivityTracker"
},
"reason":{
"reasonCode":204,
"reasonType":"No Content"
},
"severity":"warning",
"requestData":{
"requestURI":"/api/v2/keys/76c2c9cb-9095-5a24-811b-0ef4b24ac4d5?action=rotateu0026include_resource=true",
"instanceId":"fd692647-43d0-4699-9f83-f39a54b1327b"
},
"dataEvent":true,
"saveServiceCopy":true,
"correlationId":"ef56e7ed-abf5-4da4-bbf1-ac0d381891fd",
"crn": "crn:v1:bluemix:public:secrets-manager:us-south:a/791f5fb10986423e97aa8512f18b7e65:e415e570-f073-423a-abdc-55de9b58f54e:secret:1cf95413-4c10-a5fa-e824-b5106375b129",
"expiration_date": "2020-12-31T23:59:59Z",
"id": "1cf95413-4c10-a5fa-e824-b5106375b129",
"labels": ],
"last_update_date": "2020-10-06T05:31:05Z",
"name": "my-test-arbitrary-secret",
"secret_group_id": "9ab2250f-a369-4e07-ade7-d417d63ad587",
"secret_type": "ARBITRARY",
"state": 1,
"state_description": "Active"
},
{
"created_by": "iam-ServiceId-b7ebcf90-c7a9-495b-8ce8-bbf33cb95ca0",
"creation_date": "2020-10-06T03:54:26Z",
"crn": "crn:v1:bluemix:public:secrets-manager:us-south:a/791f5fb10986423e97aa8512f18b7e65:e415e570-f073-423a-abdc-55de9b58f54e:secret:285d83ce-4a26-c5c3-8e58-48d3140a2415",
"vault_api": "https://927fb8ae-1ddd-4483-a21f-7d3c0fc845f5.us-south.secrets-manager.appdomain.cloud"
},
"private_endpoints": {
"service_api": "https://927fb8ae-1ddd-4483-a21f-7d3c0fc845f5.private.us-south.secrets-manager.appdomain.cloud/api",
"vault_api": "https://927fb8ae-1ddd-4483-a21f-7d3c0fc845f5.private.us-south.secrets-manager.appdomain.cloud"
}
}

To try this API, you can interact with the following Swagger UI from your browser: https://{region}.secrets-manager.cloud.ibm.com/swagger-ui.

If your instance is configured with the Private only option, this API returns only the private_endpoints object in the response.
resource_group_id = data.ibm_resource_group.group.id
}

resource "ibm_cd_toolchain_tool_privateworker" "my_private_worker" {
parameters {
name = "terraform-private-worker"
worker_queue_credentials = "{my_sid_apikey}"
}
toolchain_id = ibm_cd_toolchain.my_toolchain.id
}
2. Remove the ibm_cd_toolchain_privateworkerresource block from your terraform file.
3. Initialize the Terraform CLI, if required.

terraform init
4. Create a Terraform execution plan. This plan summarizes all of the actions that must run to create a toolchain with a private worker.

terraform plan
5. Apply the Terraform execution plan. Terraform takes all of the required actions to remove the private worker from your toolchain.

terraform apply



Because the private worker agent might be used in other toolchains, it remains on your clusters until you delete it.





 Viewing the Delivery Pipeline Private Worker status 

You can view the private worker status on a cluster to verify that the private worker is registered, and that it uses a valid API key. Private worker registration and API key assignment is set up during the initial private worker registration. These settings allow the private worker to communicate with the IBM Cloud® Continuous Delivery framework and be considered Active.

Complete the following steps to view the private worker status on the cluster where it is installed:



1. Log in as an authorized user to the cluster that hosts the worker.
2. Run the following command to list all of the agents that are registered on the cluster:

kubectl get workeragents

The following information is listed for each agent:



* Name: The name that is registered for this worker.
* ServiceID: The serviceId of this worker.
* Agent: Indicates whether the worker agent is operating correctly on the cluster by specifying OK, or displaying an error message.
* Registered: The registration state of the worker, such as Succeeded or Unregistered.
: This change improves the group names for unrecognized requests. For groups with examples phrased in the form of question, the group name can be more indicative of a question rather than a request. For more information, see [Use unrecognized requests to get action recommendations](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-analytics-recognition).





 23 February 2023 

Private variables excluded from logs
: Private context variables are no longer saved in logs or sent to external services using log webhooks. Private variables are any values stored inside the following objects:



* context.integrations..private (accessible from actions as system_integrations..private)
* context.integrations..$private
* context.skills..user_defined.private
* context.skills..user_defined.$private
* context.private
* context.$private







 16 February 2023 

Improvements to setting variable values
: When you use Set variable values on an action step:



* The available choices now match by type. For example, if you want to set a date variable, the choices are limited to other date variables. Previously, all variables of all types were listed as choices.
* You can set a scalar value for each variable type. For example, you can set a specific date for a date variable or set a specific number for a number variable.



For more information, see [Storing a value in a session variable](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-manage-infostore-session-variable).

Confirmation and free text response types setting default
: The Confirmation and Free text response types are now set to Always ask for this information by default. For more information, see [Skipping steps, always asking steps, or never asking steps](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-collect-infocollect-info-skip-step).





 13 February 2023 

Response variations
: In actions, you can add response variations so that your assistant can respond to the same request in different ways.
However, the user might have copied the API key that contains a functional ID's credentials, which contain the necessary IAM permissions for your cluster. That user can still use those credentials and the private cloud service endpoint address to access your cluster from a different subnet, such as from a different IBM Cloud account. If you create an allowlist that includes only the subnets for your VPN tunnel in your organization's IBM Cloud account, the user's attempted access from another IBM Cloud account is denied.

Worker node subnets are automatically added to and removed from your allowlist so that worker nodes can always access the master through the private cloud service endpoint.

By default, private cloud service endpoint allowlists are limited to 20 subnets. If you need more than 20 subnets in your allowlist, you can [open a support ticket](https://cloud.ibm.com/docs/containers?topic=containers-get-helphelp-support) to increase the limit to 75.

If the public cloud service endpoint is enabled for your cluster, authorized requests are still permitted through the public cloud service endpoint. Therefore, the private cloud service endpoint allowlist is most effective for controlling access to clusters that have only the private cloud service endpoint enabled.

Before you begin:



* [Access your cluster through the private cloud service endpoint](https://cloud.ibm.com/docs/openshift?topic=openshift-access_clusteraccess_private_se).
* [Grant users access to your cluster through IBM Cloud IAM](https://cloud.ibm.com/docs/openshift?topic=openshift-userschecking-perms).



To create a private cloud service endpoint allowlist:



1. Get the subnets that you want to add to the allowlist. For example, you might get the subnet for the connection through your VPN or Direct Link tunnel to your IBM Cloud private network.
2. Enable the subnet allowlist feature for a cluster's private cloud service endpoint. Now, access to the cluster via the private cloud service endpoint is blocked for any requests that originate from a subnet that is not in the allowlist.
For more information, see [New system entities](https://cloud.ibm.com/docs/assistant?topic=assistant-system-entities).





 22 May 2020 

Spelling correction in v2 API
: The v2 message API now supports spelling correction options. For more information see the [API Reference](https://cloud.ibm.com/apidocs/assistant/assistant-v2message).





 21 May 2020 

Preview link URL change
: The URL for the preview link was changed. If you previously shared the link with teammates, provide them with the new URL.





 15 May 2020 

Private endpoints support is available in Plus plan
: You can use private endpoints to route services over the IBM Cloud private network instead of the public network. For more information, see [Private network endpoints](https://cloud.ibm.com/docs/assistant?topic=assistant-securitysecurity-private-endpoints). This feature was previously available to users of Premium plans only.





 14 May 2020 

Get skill owner information
: The email address of the person who owns the service instance that you are using is displayed from the User account menu. This information is especially helpful if you want to contact the instance owner to request access changes. For more information about access control, see [Managing access to resources](https://cloud.ibm.com/docs/assistant?topic=assistant-access-control).

System entity deprecation
: As stated in the [March deprecation notice](https://cloud.ibm.com/docs/assistant?topic=assistant-release-notesMarch2020-deprecation), the @sys-location and @sys-person system entities that were available as a beta feature are deprecated. If you are using one of these system entities in your dialog, a toggle is displayed for the entity on the System entities page. You can [search your dialog](https://cloud.ibm.com/docs/assistant?topic=assistant-dialog-tasksdialog-tasks-search) to find out where you are currently using the entity, and remove it.
],
"last_update_date": "2020-12-16T22:07:20Z",
"name": "test-iam-credentials-in-group",
"secret_group_id": "714e070d-8122-6270-198c-fef9166729e3",
"secret_type": "iam_credentials",
"service_id": "ServiceId-d1a99978-2108-4eec-9dae-bdf5691e7136",
"state": 1,
"state_description": "Active",
"ttl": 1800
},
"wrap_info": null,
"warnings": null,
"auth": null
}

A request to retrieve a key-value secret returns the following response:

{
"request_id": "1e0000-7100-cb00b-d00a-b350000f5a",
"lease_id": "",
"renewable": false,
"lease_duration": 0,
"data": {
"created_by": "iam-ServiceId-9c00000-00d-000e-8000-ed6b40000",
"creation_date": "2022-01-25T19:22:04Z",
"crn": "crn:v1:bluemix:public:secrets-manager:eu-gb:a/4b85000004a6be3700000f5:5f1000-5f00-4000-8bfc-5e0000f66:secret:0000ea8e-7d00-69ce-c000a-0a00000b3ee",
"description": "Extended description for my secret.",
"downloaded": true,
"id": "00002ea8e-7lk90-00ce-c200a-00004b3ee",
"last_update_date": "2020-12-16T21:57:13Z",
"name": "test-iam-credentials-in-group",
"secret_group_id": "714e070d-8122-6270-198c-fef9166729e3",
"secret_type": "iam_credentials",
"state": 1,
"state_description": "Active",
"ttl": 1800
},
"wrap_info": null,
"warnings": null,
"auth": null
}

A request to create key-value secrets in the default secret group returns the following response:

{
"request_id": "6e0000-60c0-d0ef-bc00-000c0a000b00",
"lease_id": "",
"renewable": false,
"lease_duration": 0,
"data": {
"created_by": "iam-ServiceId-9ca407-f38d-000e-0b02-ed6b41",
"creation_date": "2022-01-25T19:22:59Z",
"crn": "crn:v1:bluemix:public:secrets-manager:eu-gb:a/0000000be376647f5f961f5:50004-5f59-4164-8bfc-5000cf66:secret:43f000f-4085-000c-c028-6ff00004dbd",
"description": "Extended description for my secret.",
"downloaded": false,
"id": "40000df-4000-300c-c01028-6ff20000dbd",
"labels": [
"dev",
"us-south"
],
"last_update_date": "2022-01-25T19:22:59Z",
Due to the sensitivity of secrets, when an IBM Cloud Activity Tracker event is generated as a result of an API call to the Secrets Manager service, the generated event does not include the actual contents of a secret. Sensitive data, such as an API key or password, is replaced with identifying information about the secret only, or it is omitted from generated events altogether.

You can create views and alerts from all of your Secrets Manager instances, or from a specific instance.
To target a specific instance, replace host:secrets-manager with app:{INSTANCE_CRN}.



 Query for finding all create secret actions: 

Run the following query to find all create secret actions.

host:secrets-manager action:secrets-manager.secret.create

The action value can be replaced with any other applicable action.





 Query for finding unauthorized access attempts 

To see unauthorized access attempts, run the following query.

host:secrets-manager reason.reasonType:Unauthorized

To learn more about creating [views](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-create_alert_uicreate_alert_ui_step1) and [alerts](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-create_alert_uialerts_create_alert), see the IBM Cloud Activity Tracker documentation.
requestData.RequestParameters.includeIBM String When set to true, the returned list contains IBM public images and the account images. If not set, or set to false, the list contains only the account images. 
 requestData.RequestParameters.includePrivate String When set to false, the returned list does not contain the private account images. If not set, or set to true, the list contains the private account images. 



For more information about the action container-registry.account-vulnerability-status.list, see [Get vulnerability assessment status for all images](https://cloud.ibm.com/apidocs/container-registry/vaaccountstatusquerypath) in the API documentation.





 Request and response data for the vulnerability report 

Get the vulnerability assessment (container-registry.image-vulnerability-report.read) for a registry image.

The following table lists the fields that are available through the requestData and responseData fields in events with the action container-registry.image-vulnerability-report.read.



Table 20. Custom event fields for Container Registry image vulnerability reports read

 Custom Event Fields Type Description 

 requestData.RequestParameters.name String The name of the image. For example, us.icr.io/namespace/repository:tag.<br><br>The following constraint applies: The value must match the regular expression .. 
 responseData.id String The unique ID of the report. 
 responseData.status String The following values for the overall vulnerability assessment status are available:<br><br>OK<br><br>WARN<br><br>FAIL<br><br>UNSUPPORTED<br><br>INCOMPLETE<br><br>UNSCANNED<br><br>For more information about these status codes, see [Vulnerability report status codes](https://cloud.ibm.com/apidocs/container-registry/vavulnerability-report-status-codes) in the API documentation. 



For more information, see [Get vulnerability assessment status](https://cloud.ibm.com/apidocs/container-registry/vaimagereportquerypath) in the API documentation.
Project Name: myproject
Project ID: 01234567-abcd-abcd-abcd-abcdabcd1111
Age: 66s
Created: 2023-03-07 20:00:45 +0000 UTC

Data:
---
email: ""
password: REDACTED
server: dXMuaWNyLmlv
username: aWFtYXBpa2V5

Notice that the value of the username and server keys for this registry secret is encoded, and the value of password is redacted. To display the secret data as decoded, use the --decode option with the secret get command.





 Creating an SSH secret with the CLI 

An SSH secret stores credentials to authenticate to a service with an SSH key; for example, authenticating to a Git repository, such as GitHub or GitLab.

The following example creates an SSH secret that is named mysecret-ssh to access a host that is included in the known_hosts file by authenticating with an unencrypted SSH private key file that is located at /<filepath>/.ssh/<key_name>, where <filepath> is the path on your local workstation. This command requires a name and a key path, and also allows other optional arguments such as the path to the known hosts file.

ibmcloud ce secret create --name mysecret-ssh --format ssh --key-path /.ssh/<key_name> --known-hosts-path /.ssh/known_hosts

To display the details of this secret,

ibmcloud ce secret get --name mysecret-ssh

Example output

Getting secret 'mysecret-ssh'...
OK

Name: mysecret-ssh'
ID: abcdefgh-abcd-abcd-abcd-1a2b3c4d5e6f
Format: ssh
Project Name: myproject
Project ID: 01234567-abcd-abcd-abcd-abcdabcd1111
When you call the API, replace the ID variables and IAM token with the values that are specific to your Secrets Manager instance.

You can store metadata that are relevant to the needs of your organization with the custom_metadata and version_custom_metadata request parameters. Values of the version_custom_metadata are returned only for the versions of a secret. The custom metadata of your secret is stored as all other metadata, for up to 50 versions, and you must not include confidential data.

When you order a certificate, domain validation takes place to verify the ownership of your selected domains. This process can take a few minutes to complete.

curl -X POST
-H "Authorization: Bearer {iam_token}" -H "Accept: application/json" -H "Content-Type: application/json" -d '{
"name": "example-public-certificate",
"description": "Description of my public certificate",
"secret_type": "public_cert",
"secret_group_id": "bfc0a4a9-3d58-4fda-945b-76756af516aa",
"labels": [
"dev",
"us-south"
],
"common_name": "example.com",
"alt_names": [
"s1.example.com",
".s2.example.com"
],
"ca": "lets-encrypt-config",
"dns": "cloud-internet-services-config",
"rotation": {
"auto_rotate": true,
"rotate_keys": true
},
"bundle_certs": true,
"custom_metadata": {
"metadata_custom_key": "metadata_custom_value"
},
"version_custom_metadata": {
"custom_version_key": "custom_version_value"
}
}' 
"https://{instance_ID}.
$ ibmcloud kp instance policies

Retrieving policy details for instance: a192d603-0b8d-452f-aac3-f9e1f95e7411...
OK
Created By user id ...<redacted>...
Creation Date 2020-06-22T16:17:52Z
Last Updated 2020-06-22T16:20:08Z
Updated By user id ...<redacted>...
Policy Type allowedNetwork
Enabled false
Network Allowed public-and-private

 list the instance policies and show the output as JSON
$ ibmcloud kp instance policies --output json

[
{
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-06-22T16:17:52Z",
"lastUpdated": "2020-06-22T16:20:08Z",
"updatedBy": "user id ...<redacted>...",
"policy_type": "allowedNetwork",
"policy_data": { "enabled": false, "attributes": { "allowed_network": "public-and-private" }
}
}
]





 Required parameters 



* -i, --instance-ID

The IBM Cloud instance ID that identifies your Key Protect instance.

You can set an environment variable instead of specifying -i with the following command: $ export KP_INSTANCE_ID=<INSTANCE_ID>.







 Optional parameters 



* -p, --allowed-ip

Show the instance policy for "allowed ip".
* -a, --allowed-network

Show the instance policy for "allowed network".
* -d, --dual-auth-delete

Show the instance policy for "dual authorization delete".
* -k, --key-create-import-access

Retrieves the key create import access policy details of the instance.
* -m, --metrics
"algorithmType": "AES",
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-05-10T18:04:01Z",
"lastUpdateDate": "2020-05-10T18:04:01Z",
"extractable": false,
"state": 1,
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:390086ac-76fa-4094-8cf3-c0829bd69526:key:5f2cc155-fe16-492c-845c-4d1f0688c7ba"
},
{
"id": "c36e9f3a-feaf-4033-8603-687784dc7e51",
"name": "my-root-key",
"type": "application/vnd.ibm.kms.key+json",
"algorithmType": "AES",
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-05-10T17:56:37Z",
"lastUpdateDate": "2020-05-10T17:56:37Z",
"extractable": false,
"state": 1,
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:390086ac-76fa-4094-8cf3-c0829bd69526:key:c36e9f3a-feaf-4033-8603-687784dc7e51"
}
]