vania-janet/multiturn-rag-retrieval-data huggingface dataset:
How does App ID calculate pricing? 

When you work with App ID, you are charged based on the number of authentication events, the number of authorized users, and the number of advanced security events.

For the most up-to-date pricing information, you can create a cost estimate by clicking Add to estimate in the App ID section of the [IBM Cloud catalog](https://cloud.ibm.com/catalog/services/app-id).



 Pricing plans 

The service offers two pricing plans.

Lite
: Each month, your first 1000 authentication events and 1000 authorized users per service instance are free, except for any advanced security events. You incur an extra charge for any advanced security events. In this plan, you can issue access and anonymous tokens when a user or an app initiates a sign-in request.

Graduated tier
: In the graduated tier plan, you are charged each month after you reach the limits of the lite plan. The cost is based on the summary of three parts: the number of authentication events, the number of authorized users, and the number of advanced security events.

For example, if these quantities are in the 1 - 10,000 tier, the charge for each authentication event, authorized user, and advanced security event is assessed by multiplying each quantity by the unit price that is set for that tier. Then, the total price is calculated by combining the charges for authentication events, authorized users, and advanced security events.





 What are authorized users? 

An authorized user is a unique user that signs in with your service whether directly or indirectly, including anonymous users. You are charged for one authorized user each time a new user signs in to your application, including anonymous users. For example, if a user signs in with Facebook and later signs in by using Google, they are considered two separate authorized users. The total number of your authorized users includes future users that you preregistered to your app because you already know who they are going to be. You are charged for each future user at the time of registration. For example, you work at a company and recently hired a team lead. When you preregister them to your application, they become an authorized user and count toward your total.
(https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-what-is-enterprise) for more information.





 Can an existing enterprise be a child of another enterprise? 

No, an existing IBM Cloud enterprise account can't be imported into another enterprise.





 How do I add child accounts to my enterprise? 

You can use the enterprise dashboard to import an existing account to your enterprise or create a new account within your enterprise. For more information, see [Import existing accounts](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-enterprise-tutorial&interface=uiexisting_accounts_tutorial) and [Create new accounts](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-enterprise-tutorial&interface=uicreate-accounts_tutorial).





 Can I import a Lite account into an enterprise? 

Yes, but your Lite account is automatically upgraded to a Pay-As-You-Go account. Billing for the account is then managed at the enterprise level. For more information, see [Centrally managing billing and usage with enterprises](https://cloud.ibm.com/docs/billing-usage?topic=billing-usage-enterprise).





 Can I remove my account from an enterprise? 

After you import your account into an enterprise, you can't remove it.





 Can I move an account within an enterprise? 

Yes, you can move your account anywhere within an enterprise. For example, you can move your account directly under the enterprise or from one account group to another. For more information, see [Moving accounts within the enterprise](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-enterprise-organize).





 Can I move an account group? 

No, it’s not possible to move an account group within the enterprise.





 Can I edit an account name from within the enterprise? 

No, you can't edit the name of an account from within your enterprise. To edit the name of an account, go to Manage > Account in the IBM Cloud console, and select Account settings.
Service plans are scoped to the specific registry instance (one of the regional registries or the global registry) that you're currently working with. Plan settings must all be managed separately for your account in each registry instance. For more information, see [Regions](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewregistry_regions).

The following table shows available IBM Cloud Container Registry service plans and their characteristics. For more information about how billing works and what happens when you exceed service plan limits, see [Quota limits and billing](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewregistry_plan_billing).



Table 2. Container Registry plans

 Characteristics Free Standard 

 Description. Try out Container Registry to store and share your Docker images. This plan is the default service plan when you set up your first namespace in Container Registry. Benefit from unlimited storage and pull traffic usage to manage the Docker images for all namespaces in your IBM Cloud account. 
 Amount of storage for images. 500 MB Unlimited 
 Pull traffic. 5 GB per month Unlimited 
 Billing. If you exceed your storage or pull traffic limits, you cannot push or pull images to and from your namespace. For more information, see [Quota limits and billing](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewregistry_plan_billing). Storage. You are charged by Gigabyte-Months of usage. The first 0.5 GB-Months are free. Then, you are charged as stated in the offering details page, see [Container Registry](https://cloud.ibm.com/registry/catalog).<br><br>Pull traffic. You are charged by Gigabyte usage per month. The first 5 GB are free. Then, you are charged as stated in the offering details page, see [Container Registry](https://cloud.ibm.com/registry/catalog). If you exceed your storage or pull traffic limits, you can't push or pull images to and from your namespace.
For more information, see [Support subscriptions](https://cloud.ibm.com/docs/account?topic=account-accountssupport-subscriptions).

You can also now view your support subscriptions in the IBM Cloud console so you can keep track of your available credit. For more information, see [Viewing your support costs](https://cloud.ibm.com/docs/billing-usage?topic=billing-usage-support).





 12 September 2019 

Redirecting SoftLayer to IBM Cloud
: SoftLayer account owners who previously didn't have access to the IBM Cloud platform can now manage their infrastructure, services, and applications from one location: [cloud.ibm.com](https://cloud.ibm.com).







 July 2019 



 25 July 2019 

IBM Cloud enterprises for centrally managing multiple accounts
: You can now centrally manage billing and usage for multiple accounts by creating an IBM Cloud enterprise. With an enterprise, you can create a multitiered hierarchy of accounts by organizing related accounts into account groups. Enterprises simplify management of multiple accounts with the following key features:



* Consolidated billing means that you can manage billing, invoicing, and payment for all accounts from a single place, the enterprise account.
* Subscription credit is aggregated into a credit pool and shared with all accounts in the enterprise. Not only is tracking your subscriptions easier, but you can get fewer, larger subscriptions for a better discount because the credit is shared.
* Top-down usage reporting gives you a unified view of usage costs from all accounts, organized according to your enterprise hierarchy.



If you have multiple accounts, at least one of which is a Subscription account, you can create an enterprise. See [What is an enterprise?](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-what-is-enterprise) and [Introducing IBM Cloud Enterprises](https://www.ibm.com/cloud/blog/announcements/introducing-ibm-cloud-enterprises) for more information.

Subscriptions page for tracking subscription credit spending
: If you have a Subscription account, you can now view all of your subscriptions and analyze your credit spending on the Subscriptions page.
4. Enable virtual routing and forwarding (VRF) and service endpoints by creating a support case. Follow the instructions in [enabling VRF and service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint&interface=uivrf).









 Set the IAM permissions 

Set up account access (Cloud Identity and Access Management (IAM)):



* Create an IBM Cloud [API key](https://cloud.ibm.com/docs/account?topic=account-userapikeycreate_user_key). The user who owns this key must have the Administrator role.

Service ID API keys are not supported for the Red Hat OpenShift Container Platform on VPC landing zone deployable architecture.
* For compliance with IBM Cloud Framework for Financial Services, users in your account are required to use [multi-factor authentication (MFA)](https://cloud.ibm.com/docs/account?topic=account-account-getting-startedaccount-gs-mfa).
* [Set up access groups](https://cloud.ibm.com/docs/account?topic=account-accoungetting-startedaccount-gs-accessgroups).

User access to IBM Cloud resources is controlled by using the access policies that are assigned to access groups. For IBM Cloud Financial Services validation, do not assign direct IAM access to any IBM Cloud resources.

Select All Identity and Access enabled services when you assign access to the group.





 Verify access roles 

IAM access roles are required to install this deployable architecture and create all the required elements.

You need the following permissions for this deployable architecture:



* Create services from IBM Cloud catalog.
* Create and modify IBM Cloud VPC services, virtual server instances, networks, network prefixes, storage volumes, SSH keys, and security groups of this VPC.
* Create and modify Power® Systems Virtual Server services, virtual server instances, networks, storage volumes, ssh keys of this Power® Systems Virtual Server.
* Create and modify IBM Cloud direct links and IBM Cloud Transit Gateway.
* Access existing Object Storage services.
Workload accounts 

The workload accounts contain the shared application hosting infrastructure, including a VPC, Red Hat OpenShift on IBM Cloud cluster or virtual server instances, observability services, and more. This application hosting infrastructure should be selected from one of the compliant deployable architectures that are supported by IBM or a custom extension of such an architecture. A good example is the [VPC landing zone](https://cloud.ibm.com/catalog/architecture/deploy-arch-ibm-slz-vpc-9fc0fa64-27af-4fed-9dce-47b3640ba739-global), but others can be found in the [IBM Cloud catalog](https://cloud.ibm.com/catalogreference_architecture) and in the [IBM Cloud Framework for Financial Services](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-reference-architecture-overview) documentation.

Zoom

![Prod workload diagram. All of the information is conveyed in the surrounding text.](https://cloud.ibm.com/docs-content/v1/content/f18e964848e0337fedc42d43e246fa446f4b9646/enterprise-account-architecture/images/prod-workload.svg)

Figure 1. Production workload account

A single workload account contains a single VPC with one or more subnets, but a single address prefix. Limiting the number of VPCs and address prefixes is required to ensure that the transit gateway routing table size stays within limits as we scale the number of workload accounts.

Users in this account should not have access to modify resources as all resource configuration is performed as code from the BU administration account. In general, the production workload account should be configured for limited user access. The primary user is a shared operations team that supports the infrastructure for all of the applications that run on it.
Secure Gateway Service Plans 

With the release of v1.7.0, a new tiered plan pricing model was introduced that allows Secure Gateway to scale to the needs of any company. The table below provides the limitations associated with each of the publicly available plans:

![Tiered Plan Model](https://cloud.ibm.com/docs-content/v1/content/690bf9a59650e0582967be8899e39840589532f7/SecureGateway/images/planDetails.png?raw=true)



*  Dedicated IP: Dedicated hostname and static IP address on the cloud side for connecting to on-premises destinations





  Changing Plans 

When you change plans, your new plan will be considered to be either an upgrade or a downgrade. This is determined by the default number of gateways allowed by each plan (e.g., Professional (5) to Enterprise (25) is an upgrade). When upgrading, there will be no service interruption; however, a downgrade will update all gateways to be [inactive](https://cloud.ibm.com/docs/services/SecureGateway?topic=SecureGateway-sg-faqfaq-states) which will require you to reactivate your gateways and destinations (up to your new plan limit) before service is restored.

Note: When transitioning from the Standard plan to any of the new plans, this will be considered a downgrade.





  Notification for limit exceeded 

When you create the maximum allowed amount of gateway/destination, there will be a warning level log shown in the dashboard of the gateway/destination.

When the amount of client is reached, and there is a new client attempt to connect to the gateway, there will be an error level log shown in the client log, and the new client will be exited by the gateway.

When the data usage exceeds the data transfer allowance, there will be an error level log shown in the client log, and the client will be exited by the gateway.
Advanced rules models are not counted as custom models.

Discovery entity extractor models that are trained and published as an enrichment count toward the model limit for the plan. The entity extractor enrichment is what incurs charges, not the workspace or model. The entity extractor enrichment incurs charges whether or not it is applied to a collection.





 Premium 

Premium plans offer developers and organizations a single tenant instance of one or more Watson services for better isolation and security. These plans offer compute-level isolation on the existing shared platform, as well as end-to-end encrypted data while in transit and at rest.

For more information, or to purchase a Premium plan, contact [Sales](https://ibm.biz/contact-wdc-premium).





 Other plans 

Features and limitations are similar between instances that you deploy on installed deployments in IBM Cloud Pak for Data and Premium plan instances that are managed by IBM Cloud.





 Additional information 



* For more information about how queries are counted, see [Query limits](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-query-conceptsquery-limits).
* For more information about pricing or to create a service instance, see the [IBM Cloud catalog](https://cloud.ibm.com/catalog/services/watson-discovery).



IBM Cloud resources:



* [How you're charged](https://cloud.ibm.com/docs/billing-usage?topic=billing-usage-charges).
* [IBM Cloud Cost estimator](https://cloud.ibm.com/estimator/review)
* [IBM Cloud Services terms](https://www-03.ibm.com/software/sla/sladb.nsf/sla/saas?OpenDocument)
* For more information about IBM Cloud security, see [IBM terms](https://www.ibm.com/support/customer/csol/terms/).
* UI
* CLI
* API







 Customizing the IBM Cloud catalog for an enterprise 

As the account owner or administrator, you can manage which products in the IBM Cloud® catalog are available for your enterprise. You can choose to include all products, a set of products, or only certain products. You can also specify what level of the enterprise hierarchy the filters apply to. And, you can further restrict which products are available for a specific account group or account.



 Before you begin 



* [Set up your enterprise](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-enterprise-tutorial).
* Make sure that you have the [administrator role on the catalog management service](https://cloud.ibm.com/docs/account?topic=account-account-servicescatalog-management-account-management).







 Managing products at the enterprise level 

Centrally manage what's available in the catalog for your entire enterprise hierarchy by setting filters at the enterprise level. The filters automatically apply to all child account groups and accounts.

Let's say your organization is tasked with implementing a development and deployment model that's focused on improved speed, quality, and control. You might choose to restrict the catalog to IBM products only that are related to DevOps technologies for all members in your enterprise.



1. Go to Manage > Catalogs > Settings in the IBM Cloud console.
2. Select Exclude all products in the IBM Cloud catalog.
3. Select one or more filters to customize which products are available. In the case of our example, select the following filters:



* Category > Developer tools
* Provider > IBM



4. Review the Preview table to confirm your selections, and click Update.
5. Verify your updates in the catalog by going to Catalog > Services.
6. Expand the list of accounts in the console menu bar and select a child account to verify that the catalog includes only the products you selected.







 Managing products for child account groups and accounts 

To build on the example in the previous section, all account groups and accounts in your enterprise have access to Developer tools products provided by IBM.
For more information, check out [Using Hyper Protect Crypto Services (HPCS) and Key Protect for AIX](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-integrate-hpcsAIX-hpcs).

The Power Systems Virtual Server for Linux integration prevents Linux Unified Key Setup (LUKS) encryption keys from being compromised using Key Protect as a single point of control to enable or disable access to data across the enterprise. This is done by successively wrapping encryption keys, with the ultimate control being a master key that resides in a hardware security module (HSM). For more information, check out [Using Hyper Protect Crypto Services (HPCS) or Key Protect for Linux](https://cloud.ibm.com/docs/power-iaas?topic=power-iaas-integrate-hpcsLinux-hpcs) and [Protect LUKS encryption keys with IBM Cloud Hyper Protect Crypto Services and Key Protect](https://developer.ibm.com/tutorials/protect-luks-encryption-keys-with-ibm-cloud-hyper-protect-crypto-services/).







 April 2023 



 14 April 2023 

The IBM® Key Protect for IBM Cloud® on Satellite [Pricing plan](https://cloud.ibm.com/docs/key-protect?topic=key-protect-pricing-plan-satellite) is now active. Unlike the [pricing for Key Protect on IBM Cloud](https://cloud.ibm.com/docs/key-protect?topic=key-protect-pricing-plan), the pricing for Key Protect on Satellite is not based on key versions. Instead, reflecting the different use cases and infrastructure maintenance requirements for Satellite-based deployments, users are charged a flat rate for each location where they want Key Protect installed and then an additional rate depending on the quota of keys they select at deployment time.

For more information about IBM® Key Protect for IBM Cloud® on Satellite, check out [About IBM® Key Protect for IBM Cloud® on Satellite](https://cloud.ibm.com/docs/key-protect?topic=key-protect-satellite-about).







 March 2023 



 24 March 2023
Known issues and limitations 

IBM Cloud® Security and Compliance Center includes the following known issues and limits that might impact your experience.



 Limits 

Rate limiting is used to control the amount of traffic that is coming and going through your instance of IBM Cloud® App ID. By limiting requests or resources, you can protect your applications.



 App ID lite plan 

Review the following table to see the maximum limits that are in place for lite instances of App ID.

You can have 1 lite instance of App ID per account at a time.



Table 1. Limits for lite instances

 Resource Limit 

 Users 1000 
 Authentications 1000 per month 
 Size of profile attributes 100 KB 







 General 

The following table lists the maximum per user limits for App ID resources and the blocking period when the limits are exceeded. These limits apply to any user who can create App ID resources.



Table 2. General rate limits

 Action Limit When exceeded 

 Sign in attempts by one user 11 per minute User unable to sign in for 1 minute. 
 Update user profile attributes 5 per minute User unable to update profile for 1 minute. 
 Delete user profile attributes 5 per minute User unable to update profile for 1 minute. 
 Roles per App ID instance 50 
 Scopes per application 50 
 Applications per App ID instance 200 
 Changes to instance by users within 24 hours 10,000 
 Users per instance 100,000 
 Management APIs requests per second 50 per second Requests are blocked for 30 seconds 
 All other APIs requests per second 200 per second Requests are blocked for 30 seconds 







 Cloud Directory 

Review the following table to see limits that are associated with Cloud Directory.



Table 3. Cloud Directory limits

 API Configurable Limit When exceeded 

 Sign in attempts per account Yes 200 per second All sign-in attempts for the instance are blocked for 1 minute. 
 Sign up attempts per account Yes 200 per second All sign-up attempts for the instance are blocked for 1 minute. 
 Email sending request No 10 emails in 5 minutes per user Email requests for the user are blocked for 30 minutes. 
 SMS sending request No 10 SMS in 5 minutes per user SMS requests for the user are blocked for 30 minutes. 
 MFA code characters No 6 numeric characters The code automatically has 6 characters that must be input by the user.
FAQs 

You can use the following FAQs to help you with IBM® Key Protect.



 How does pricing work for Key Protect? 

Key Protect has a value-based pricing model that counts the total number of key versions in your account, whether keys are created or imported, root or standard. In this plan the first five key versions are free, after which the price is $1 per key version per month. Only non-deleted keys, which include all active and disabled keys, are counted for pricing purposes. This price model covers the value Key Protect provides by managing all versions of the key so they can be used to decrypt older ciphertexts.





 How is one user's information partitioned from other users' data? 

Key Protect allows you to have one or more instances which are only accessible to you. Access within these instances (or at the account level), can be controlled by the account owner or a designated admin of that account, allowing the application of the principle of least privilege. One way this is possible is by grouping keys into "key rings", allowing an account owner to assign access to a particular group of keys to a particular group of users. For more information, check out [Grouping keys together using key rings](https://cloud.ibm.com/docs/key-protect?topic=key-protect-grouping-keys).





 How are instance keys secured? 

Each Key Protect instance gets a randomly-generated "instance key-encrypted-key" (IKEK) which is wrapped by the HSM master key, producing a wrapped instance key (WIKEK). No user has access to the WIKEK or the IKEK, and even IBM does not have access to the IKEK. There is no direct or explicit access to the WIKEK by IBM, and it is encrypted by the master key.





 What is an active encryption key? 

When you import encryption keys into Key Protect, or when you use Key Protect to generate keys from its HSMs, those keys become Active keys. Pricing is based on all active keys within an IBM Cloud account.





 How should I group and manage my keys?