vania-janet/multiturn-rag-retrieval-data huggingface dataset:
const params = {
accountId: accountId,
name: serviceIdName,
description: 'Example ServiceId',
};

iamIdentityService.createServiceId(params)
.then(res => {
svcId = res.result.id;
console.log(JSON.stringify(res.result, null, 2));
})
.catch(err => {
console.warn(err);
});

For more informatiion, see the [IAM Identity Services API](https://cloud.ibm.com/apidocs/iam-identity-token-apicreate-service-id).





 Updating a service ID 

You can update a service ID by changing the name and description at any time. You can also delete and create new API keys as needed or update the assigned access policies. Hover on the row of a service ID to click the Actions icon ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/action-menu-icon.svg) to manage your service ID.

Any changes that you make to an existing service ID, such as changing the assigned policies or deleting an API key that is used, might cause service interruptions to applications that use that service ID.





 Updating a service ID by using the API 

To update a service ID, call the [IAM Identity Services API](https://cloud.ibm.com/apidocs/iam-identity-token-apiupdate-service-id) as shown in the following example:



* Curl
* Java
* Python
* Go
* Node
[the Settings icon](https://cloud.ibm.com/docs-content/v1/content/50eddb8fd81f33092880335ff107a78ff5cd0f65/watson-knowledge-studio/images/settings.png), then click Manage service details.
3. In the Manage users section, enter the IBMid for the user you want to add.
4. Select the role you want to give to the user. For more information about roles, see [User roles in Knowledge Studio](https://cloud.ibm.com/docs/watson-knowledge-studio?topic=watson-knowledge-studio-roles).

You can't downgrade user roles after assigning them, so be sure that you understand the tasks each role can perform when assigning the admin role and project manager role.
5. Click Add.







 Upgrading user roles 

After you add users to Knowledge Studio, you can upgrade lower roles to higher roles. Users must be assigned the roles described below to be able to perform the respective tasks.

Only Standard plans and Premium plans can have more than one user. Lite plans are limited to one user who already has the highest role, admin.

Downgrading from a higher role to a lower role is not permitted.

To upgrade roles for Knowledge Studio users:



1. [Launch the Knowledge Studio application](https://cloud.ibm.com/docs/watson-knowledge-studio?topic=watson-knowledge-studio-wks_tutintrolaunching-the-knowledge-studio-application).
2. From the top right navigation menu, click the Settings icon ![the Settings icon](https://cloud.ibm.com/docs-content/v1/content/50eddb8fd81f33092880335ff107a78ff5cd0f65/watson-knowledge-studio/images/settings.png) and then click Manage service details.
3. In the Manage users section of the Service Details page, click the Edit link next to a user.
4.
Storing and accessing attributes 

With IBM Cloud® App ID, you can compile information about the individual users of your application into a profile. The information in the profile can be learned about your users by the way that they interact with your app or added by you on their behalf. By storing the information, you can access it to help create personalized experiences of your app for your users.



 Understanding profiles 

A user profile is all the information that is known about a specific user - compiled into one JSON object and stored by App ID. There are two types of information, or attributes, that can be obtained and stored in a profile: predefined and custom. Predefined attributes are specific to the identity of your user and are returned by an identity provider when your user signs in to your app and can include information such as their name or age. Custom attributes are used to store additional information about your users. They can be set by you or learned about the user as they interact with your app. Custom attributes might include an assigned role, a food preference, or a preferred aisle seat on an airplane.

Zoom

![App ID user profiles](https://cloud.ibm.com/docs-content/v1/content/27ecaa7a29890634603881a8e64789974a29916b/appid/images/user-profile-makeup.png)

Figure 1. User profile information flow

You can store up to 100 KB of information for each user.



 How do I get the user profile information? 

Several different ways exist in which you can access user information, and several different reasons why you would want to. The endpoint that you choose to call can vary depending on your use case.

Not sure which one works best? Join our [Slack channel](https://www.ibm.com/cloud/blog/announcements/get-help-with-ibm-cloud-app-id-related-questions-on-slack) and get advice directly from our development team.

If you need to work with an API, check out the following image and corresponding information to see how the information is pulled.

Zoom

!
Once the network operator provides the enroll ID and secret of the application identity and the network connection profile, an application developer can use the Fabric SDKs or the Fabric CA client to generate client-side certificates. You can use the following steps to enroll an application identity by using the [Fabric SDK for Node.js](https://hyperledger.github.io/fabric-sdk-node/release-2.2/index.html).



1. Save the connection profile to your local system and rename it connection.json.
2. Save the following code block as enrollUser.js in the same directory as your connection profile:

'use strict';

const FabricCAServices = require('fabric-ca-client');
const { FileSystemWallet, X509WalletMixin } = require('fabric-network');
const fs = require('fs');
const path = require('path');

const ccpPath = path.resolve(__dirname, 'connection.json');
const ccpJSON = fs.readFileSync(ccpPath, 'utf8');
const ccp = JSON.parse(ccpJSON);

async function main() {
try {

// Create a new CA client for interacting with the CA.
const caURL = ccp.certificateAuthorities['<CA_Name>'].url;
const ca = new FabricCAServices(caURL);

// Create a new file system based wallet for managing identities.
const walletPath = path.join(process.cwd(), 'wallet');
const wallet = new FileSystemWallet(walletPath);
console.log(Wallet path: ${walletPath});

// Check to see if we've already enrolled the admin user.
const userExists = await wallet.exists('user1');
if (userExists) {
curl -X PATCH "$vpc_api_endpoint/v1/shares/50fda9c3-eecd-4152-b473-a98018ccfb10?version=2023-07-11&generation=2&maturity=beta&maturity=beta" -H "Authorization: Bearer" -H "If-Match: W/xxxyyyzzz123" -d {
"user_tags": [
"env:test2",
"env:prod2"
]
}'











 Add access management tags to a file share 

Access management tags are metadata that you can add to your file shares to help organize access control resource relationships. You first create the tag and then add it to an existing file share or when you create a file share. You can apply the same access management tag to multiple file shares. You can assign access to the tag in Cloud Identity and Access Management (IAM). Optionally, you can create an IAM access group and manage users.



 Step 1 - Create an access management tag in IAM 

In the console:



1. Go to Manage > Account, and then select Tags.
2. Click the Access management tags tab. Add a tag name in the field. Access management tags require a key:value format.
3. Click Create Tags.



From the [Global Search and Tagging API](https://cloud.ibm.com/docs/account?topic=account-tag&interface=apicreate-access-api):

Make a POST/ tags call to [create an access management tag](https://cloud.ibm.com/apidocs/taggingcreate-tag) and specify the tag in the tag_names property. For an example, see [Creating access management tags with the API](https://cloud.ibm.com/docs/account?topic=account-tag&interface=apicreate-access-api).





 Step 2 - Add an access management tag to a file share
// Retrieve user info and validate against the given identity token
userProfileManager.getUserInfo(accessToken, identityToken).then(function (profile) {
// retrieved user info successfully
});

// Retrieve user info without validation
userProfileManager.getUserInfo(accessToken).then(function (profile) {
// retrieved user info successfully
});

// iOS Swift example

AppID.sharedInstance.userProfileManager.getUserInfo(accessToken: String, identityToken: String?) { (error: Error?, userInfo: [String: Any]?) in guard
let userInfo = userInfo, err == nil {
return // an error has occurred
}
// retrieved user info successfully
}

// Server-side Swift example

let userProfileManager = UserProfileManager(options: options)
let accessToken = "<accessToken>"
let identityToken = "<identityToken>"

// If identity token is provided (recommended approach), response is validated against the identity token

userProfileManager.getUserInfo(accessToken: accessToken, identityToken: identityToken) { (err, userInfo) in guard
let userInfo = userInfo, err == nil {
return
}
}

// Retrieve the UserInfo without any validation

userProfileManager.getUserInfo(accessToken: accessToken) { (err, userInfo) in guard
let userInfo = userInfo, err == nil {
return
}
}

Example output:

"sub": "cad9f1d4-e23b-3683-b81b-d1c4c4fd7d4c",
"name": "John Doe",
"email": "john.doe@gmail.com",
In the Service section, select IBM Cloud Security and Compliance Center Workload Protection. Then, click Next.
5. In the Resources section, choose one of the following options:

Select All resources to define the scope of the policy to include all instances.

Select Specific resources to refine the scope of the policy. Then, configure the Instance and the Sysdig Team attribute.

Then, click Next.
6. Choose roles and actions to define the levels of access do you want to assign. You must choose a platform role and a service role.

Select manager to grant admin permissions for the service.

Select reader to grant permissions to view data only.

[Learn more about the roles that you need](https://cloud.ibm.com/docs/monitoring?topic=monitoring-iam).
7. Click Review > Add > Assign.









 Step 4. Add a user or service ID to the access group 

You can add users or service IDs to an existing access group.



 Add a user to the access group 

Complete the following steps to add a user:



1. From the menu bar, click Manage > Access (IAM), and select Access Groups.
2. Select the name of the group that you want to assign access to.
3. Click Add users on the Users tab.
4. Select the users that you want to add from the list, and click Add to group.







 Add a service ID to the access group 

Complete the following steps to add a service ID:



1. From the menu bar, click Manage > Access (IAM), and select Access Groups.
2. Select the name of the group that you want to assign access to.
3. Click the Service IDs tab, and click Add service ID.
4. Select the IDs that you want to add from the list, and click Add to group.
* UI
* CLI
* API
* Terraform







 Inviting users to an account 

Use IBM Cloud® Identity and Access Management (IAM) to invite users, cancel invitations, or resend a pending invitation. You can invite a single user or multiple users.

All users must accept an invitation to become an active user within a new account. [Learn more.](https://cloud.ibm.com/docs/account?topic=account-iamuserinvpending-invitations)



 Watch and learn 



* Video transcript

Welcome back to another installment of the IBM Cloud Console Guide. In this video, we’ll be talking about how to invite users to your IBM Cloud account.

Inviting users to your IBM Cloud account is simple. Click on “Manage”, and then click “Access (IAM).” Then, click on the “Users” tab on the left menu, and click on the blue “Invite Users” button.

Once you are on the “Invite Users” page, you can invite users to your account by typing in their email address in the text box (Cursor moves to Enter email addresses text box).

On this page, you can also add users to access groups. In the “Add users to access groups” section, you will see the access groups that you have created. To add a user to one or more access groups, click the “Add” button to the right of the appropriate access group.

If you need to assign access to classic infrastructure permissions or Cloud Foundry resources, you can do this in the “Assign users additional access section”, which is found just below the access group section. Click on the additional access you would like to assign (clicks Classic infrastructure tile, selects Super user radio button), and then click on the blue “Add” button (then, clicks "Invite" button).

You can manage existing users and their access from the users menu. Click on “Users” in the Access (IAM) left menu. From here, you can see all of the users in your account.

To manage access for existing users, simply click on the user’s name and you will have access to their user details, access groups, access policies, classic infrastructure, and Cloud Foundry access.
However, if you have access to only a single user ID, you can still simulate most parts of the process.

For information about user roles, see [User roles in Knowledge Studio](https://cloud.ibm.com/docs/watson-knowledge-studio-data?topic=watson-knowledge-studio-data-roles).







 Results 

After completing this tutorial, you will have a custom machine learning model that you can use with other Watson services.





 Lesson 1: Adding documents for annotation 

In this lesson, you will learn how to add documents to a workspace in Knowledge Studio that can be annotated by human annotators.



 About this task 

For more information about adding documents, see [Adding documents to a workspace](https://cloud.ibm.com/docs/watson-knowledge-studio-data?topic=watson-knowledge-studio-data-documents-for-annotationwks_projadd).





 Procedure 



1. Download the [documents-new.csv![External link icon](https://cloud.ibm.com/docs-content/v1/content/icons/launch-glyph.svg)](https://watson-developer-cloud.github.io/doc-tutorial-downloads/knowledge-studio/documents-new.csv) file to your computer. This file contains example documents suitable for uploading.
2. Within your workspace, click Assets > Documents.
3. On the Documents page, click Upload Document Sets.
4. Upload the documents-new.csv file from your computer. The uploaded file is displayed in the table.







 What to do next 

You can now divide the corpus into multiple document sets and assign the document sets to human annotators.







 Lesson 2: Pre-annotating with a dictionary-based annotator 

In this lesson, you will learn how to use a dictionary-based annotator to pre-annotate documents in Knowledge Studio.



 About this task 

Pre-annotating documents is an optional step. However, it is a worthwhile step because it makes the job of human annotators easier later.
* DEPTA for the owner of the STEVEH user profile
* R3I5VQX for the initial password
* Steve H. for the user's name



Steve H. does not require any of the user profile segments except TSO. The TSO segment values that you want to set to start with are 123456 for the account number and PROC01 for the logon procedure.

To create a user profile with these values, you can run the following commands:

ADDUSER STEVEH DFLTGRP(DEPTA) OWNER(DEPTA) NAME('Steve H.')
PASSWORD(R315VQX) TSO(ACCTNUM(123456) PROC(PROC01))
2. Then, you can use one of the following options to add new SSH public keys into the authorized_keys file.



* Use the linux command such as ssh-copy-id -i <new-ssh-public-key-file> ibmuser@<vsi ip address> to upload new SSH public keys on your local file system into the z/OS virtual server instance. For more information, see [ssh-copy-id for copying SSH keys to servers](https://www.ssh.com/academy/ssh/copy-id).
* Log in to the z/OS virtual server instance, use the z/OS Unix System shell command such as cat <new-ssh-public-key-file> >> /.ssh/authorized_keys to concatenate the new SSH public key into the authorized_keys file. For more information, see [cat - Concatenate or display files](https://www.ibm.com/docs/en/zos/2.5.0?topic=descriptions-cat-concatenate-display-files).
* Use the [Zowe CLI](https://docs.zowe.org/stable/user-guide/cli-installcli.html) to connect to the z/OS virtual server instance, then create a CLI profile and add new SSH public keys into the authorized_keys file.
Add the following parameter section into the main.tf file.

resource "ibm_resource_instance" "resource_instance" {
name = "My Data Engine Instance"
service = "sql-query"
plan = "standard"
location = "us-south"
resource_group_id = data.ibm_resource_group.group.id
parameters = {
customerKeyEncrypted: true,
kms_instance_id: jsonencode({ "guid" = "<kms_instance_guid>", "url" = "https://us-south.kms.cloud.ibm.com" }),
kms_rootkey_id: "<kms_rootkey_id>"
}
}

For user-managed key encryption, you need a Standard plan. You cannot change the encryption parameters once the instance is created.

Next, give the new Data Engine instance [access](https://cloud.ibm.com/docs/account?topic=account-serviceauth) to your Key Protect key.

resource "ibm_iam_authorization_policy" "iam_authorization_policy" {
source_service_name = "sql-query"
source_resource_instance_id = ibm_resource_instance.resource_instance.id
target_service_name = "kms"
target_resource_instance_id = "<kms_instance_id>"
roles = ["Reader"]
description = "Service-to-service authorization: Data Engine access to Key Protect"
}
"name": "iam_id",
"value": "IBMid-123453user"
}
]
}'
],
"roles":[
{
"role_id": "crn:v1:bluemix:public:iam::::role:Administrator"
}
],
"resources":[
{
"attributes":
{
"name": "accountId",
"value": "$ACCOUNT_ID"
},
{
"name": "serviceName",
"value": "$SERVICE_NAME"
},
{
"name": "resource",
"value": "$RESOURCE_NAME",
"operator": "stringEquals"
}
]
}
]
}'

SubjectAttribute subjectAttribute = new SubjectAttribute.Builder()
.name("iam_id")
.value("EXAMPLE_USER_ID")
.build();

PolicySubject policySubjects = new PolicySubject.Builder()
.addAttributes(subjectAttribute)
.build();

PolicyRole policyRoles = new PolicyRole.Builder()
.roleId("crn:v1:bluemix:public:iam::::role:Administrator")
.build();

ResourceAttribute accountIdResourceAttribute = new ResourceAttribute.Builder()
.name("accountId")
.value(exampleAccountId)
.operator("stringEquals")
.build();

ResourceAttribute serviceNameResourceAttribute = new ResourceAttribute.Builder()
.name("serviceName")
.value("service")
.operator("stringEquals")
.build();
To specify the customer ID for any messages sent using the /message API, include the X-Watson-Metadata: customer_id property in your header. For example:

curl -X POST -u "apikey:3Df... ...Y7Pc9"
--header
'Content-Type: application/json'
'X-Watson-Metadata: customer_id=abc'
--data
'{"input":{"text":"hello"}}'
'{url}/v2/assistants/{assistant_id}/sessions/{session_id}/message?version=2019-02-28'

where {url} is the appropriate URL for your instance. For more details, see [Service endpoint](https://cloud.ibm.com/apidocs/assistant/assistant-v2service-endpoint).

The customer_id string cannot include the semicolon (;) or equal sign (=) characters. You are responsible for ensuring that each customer ID property is unique across your customers.

Only the first customer ID value that is passed in the X-Watson-Metadata header is used as the customer_id string for the message log. This customer ID value can be deleted with DELETE /user_data v1 API calls.

If you add search to an assistant, user input that is submitted to the assistant is passed to the Discovery service as a search query. If the Watson Assistant integration provides a customer ID, then the resulting /message API request includes the customer ID in the header, and the ID is passed through to the Discovery /query API request. To delete any query data that is associated with a specific customer, you must send a separate delete request directly to the Discovery service instance that is linked your the assistant. See the Discovery [information security](https://cloud.ibm.com/docs/discovery/information-security?topic=discovery-information-security) topic for details.





 Querying user data 

Use the v1 /logs method filter parameter to search an application log for specific user data.
Look through the table or search by using an email address to find the user that you want to see the information for. The search term must be exact.
3. In the overflow menu of the user's row, click Delete. A confirmation screen opens.
4. Verify that you're deleting the correct user by checking their email against the one displayed. If it is the correct user, click Delete. This action cannot be undone. The user can be re-added but their profile shows that they are a new user as of the date that they're re-added.







 Deleting a profile with the API 

As an administrator, you can remove someone as a user of your application by deleting their profile.



1. Obtain your tenant ID from your instance of the service. You can find the ID in your service or application credentials.
2. Search your App ID users with an identifying query, such as an email address, to find the user ID.

curl -X GET "https://<region>.appid.cloud.ibm.com/management/v4/<tenantID>/Users?query=<identifyingSearchQuery>" -H "accept: application/json" -H "authorization: Bearer <token>"

Example:

curl -X GET https://us-south.appid.cloud.ibm.com/management/v4/e19a2778-3262-4986-8875-8khjafsdkhjsdafkjh/cloud_directory/Users?query=example@domain.com -H "accept: application/json" -H "authorization: Bearer eyJraWQiOiIyMDE3MTEyOSIsImFsZ...."
3. By using the ID that you obtained in the previous step, make a DELETE request to the /users endpoint to delete the profile.

curl -X DELETE "https://<region>.appid.cloud.ibm.com/management/v4/<tenantID>/users/<userID>/profile" -H "accept: application/json" -H "authorization: Bearer <token>"
The role ID must begin with a capital letter and use alphanumeric characters only; for example, KeystoreOperator
5. Optional: Enter a succinct and helpful description that helps the users who are assigning access know what level of access this role assignment gives a user. This description also shows in the console when a user assigns access to the service.
6. From the list of services, select Hyper Protect Crypto Services.
7. Select Add for the following actions:



* hs-crypto.keystore.createkeystore
* hs-crypto.keystore.deletekeystore
* hs-crypto.keystore.listkeystoresbyattributes
* hs-crypto.keystore.listkeystoresbyids



8. Click Create when you're done adding actions.



For more information about how to create custom roles, see [Creating custom roles](https://cloud.ibm.com/docs/account?topic=account-custom-roles).







 Step 2: Create service IDs and API keys for the SO user, normal user, and anonymous user 



 1. Create service IDs and API keys for the SO user 

To create a service ID for the SO user and the corresponding API key, complete the following steps:



1. In the IBM Cloud console, go to Manage > Access (IAM), and select Service IDs.
2. To create the service ID for the SO user, follow these steps:



1. Click Create.
2. Create a name SO user and description for the SO user service ID.
3. Click Create.



3. To create an API key for the service ID, follow these steps:



1. Click the API keys tab on the SO user service ID page.
2. Click Create.
3. Add a name and description to easily identify the API key, for example, SO user API key.
4. Click Create.
5. Save your API key by copying or downloading it to secure location.