vania-janet/multiturn-rag-retrieval-data huggingface dataset:
You can also [disable a root key](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managingbyok-disable-root-keys), which suspends the key and temporarily revokes access to it.







 Viewing events in the IBM Cloud Activity Tracker 

Use the Activity Tracker to verify user-initiated activities that change the state of your keys in the key management service.

Due to the sensitivity of the information, when an event is generated as a result of an API call to the KMS, the event doesn't include detailed information about the key. Instead, it includes a correlation ID that you can use to identify the key internally in your cloud environment. The correlation ID is a field that is returned as part of the correlationId field.



 Activity Tracker events for key rotation 

When you initiate activity in the KMS to rotate and manage your root keys, Activity Tracker events are generated. These events are particular to Key Protect, but similar events are generated for Hyper Protect Crypto Services, too.



* When you list keys, a kms.secrets.list event is generated.
* When you rotate a root key, a kms.secrets.rotate event is generated.
* When you manually rewrap a data encryption key (DEK) with new key material, a kms.secrets.rewrap event is generated.
* If you initially imported a root key by using an import token and use the import token to rotate a key, a kms.secrets.ack-rotate event is generated.
* When you retrieve a key, the requestData.keyType field includes the type of key that was retrieved.
* The responseData.keyState field includes the integer that correlates to the state of the key. The integers correlate with these key state values: Pre-activation = 0, Active = 1, Suspended = 2, Deactivated = 3, and Destroyed = 5. For more information about key states, see [Key states and transitions](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-stateskey-transitions).
Securing your API with Client ID and Client Secret using IBM Cloud 

Duration: 10 mins
Skill level: Beginner



 Objective 

This tutorial guides you through securing your API in API Connect V5 with a Client ID and a Client Secret. When applications are registered in your Developer Portal, a Client ID is generated to identify the application. Optionally, a Client Secret (which serves as a password) can also be generated. Applications need to supply the Client ID and Client Secret keys when they call your API.





 Prerequisites 

Before you begin, complete one of the following tutorials:



* [Import an OpenAPI2.0 spec and proxy an existing REST service](https://cloud.ibm.com/docs/apiconnect/tutorials?topic=apiconnect-tut_rest_landing).
* [Add a New API Spec and Invoke an Existing REST Service](https://cloud.ibm.com/docs/apiconnect/tutorials?topic=apiconnect-tut_rest_landing).







 Set the identification mechanism of your API 



1. Navigate to your API's Design view:
a. Click Drafts in the navigation panel. b. Click the APIs tab. c. Click the Weather Provider API that you created in a previous tutorial. The API opens to the Design view.
![1_goto_drafts_api.png](https://cloud.ibm.com/docs-content/v1/content/78bb71851d95d7580503eb9ba10cf3ae31490ade/apiconnect/tutorials/images/1_goto_drafts_api.png)
2. In the Design view: a. In the Security Definitions section, click Add Security Definitions (the + icon), and then click API Key.
b. Add the following two API keys: For both keys, ensure that the "Located In" field is set to "Header".



* Name: Client ID; Parameter name: X-IBM-Client-Id
* If the credentials are correct, the Save and exit button becomes clickable.



Click Save and exit.



The connection between your assistant and NICE CXone is complete.



 Configuring the NICE CXone script 

NICE CXone provides a scripting tool that allows workflow developers to define routing flows for their contact centers in CXone.

The following actions and settings in the workflow are necessary for integration to work properly.



 Connecting a caller to your assistant 

Use the [Sipputheader](https://help.nice-incontact.com/content/studio/actions/sipputheader/sipputheader.htm) action. In the headerName property, enter the name of the SIP header field that will contain the Contact ID. This header field is included in outgoing SIP INVITE messages to Watson Assistant.



* headerName X-Contact-ID
* headerValue {ContactId}



Sipputheader must be executed before Placecall.

Use a [Placecall](https://help.nice-incontact.com/content/studio/actions/placecall/placecall.htm) action to initiate an outbound call to Watson Assistant. In the PhoneNumber property, enter the phone number you allocated for this integration.

The phone number must match the number you configured in Use an existing phone number with an external provider in the Watson Assistant user interface.

![Image of the outbound call flow](https://cloud.ibm.com/docs-content/v1/content/ca9232b3702768f24bb897f48f10778fcda28718/watson-assistant/images/cxone-placecall.png)





 Transferring a caller to a live agent 

You can configure your assistant to transfer a customer to a NICE CXone live agent.

The phone integration uses the [signal](https://developer.niceincontact.com/API/AdminAPI/Contacts/Signal%20a%20Contact) REST API. The p1 attribute is preserved for the session history key.
VPN server limitations 

The limitations for this release are as follows:



*  Currently, only 2000 maximum active client connections are supported per server.
*  MFA support is provided by IAM.
*  Currently, SDK and Terraform support is not available.
*  Features not supported:



*  Integration with other identity providers, such as Active Directory and RADIUS
*  IPsec client-to-site VPN
*  More than two VPN appliances per VPN server
*  VPN server auto scaling
*  In-house, customized OpenVPN client
*  VPN client user self-service portal
* CLI
* API







 Increasing account limits 

Default maximum limits are set on entities in your account such as access policies, service IDs, trusted profiles, identity providers (IdPs), and API keys. However, specific use cases can require an extended limit and you must request an increase for your chosen entity. You must be the account owner or administrator for all account management services to check how many policies exist in the account.

To review the default limits for your account, see [Known issues and limitations](https://cloud.ibm.com/docs/account?topic=account-known-issuesiam_limits).



 Increasing limits for IAM identity entities 

When your account approaches the maximum limit of one of the entities, you receive a warning in the Activity Tracker event for creating an entity. These events show you the current limits. See the following example:

Nov 26 16:46:01 iamid-6-11-12270-af4d601-cd77fd6bd-86gp7 at.log INFO IAM Identity Service: create account-serviceid 12345678-90ab-cdef-0123-456789abcdef -failure Warning: You have reached 100% of the maximum number of allowed Service IDs in account 11112222333344445555666677778888. Your current count is 3000, and the limit is 3000.

A limit increase can be requested for the following types of entities:



* API keys per identity
* Service IDs
* Identity providers (IdPs)
* Trusted profiles
* Dynamic rules



You can request a limit increase for the chosen entities only if the following criteria is met:



* You must be the account owner or an administrator on all account management services.
* You have taken efforts to clean up and reduce the number of entities in the account.
* You must have a specific, reasonable use case for requesting an increase.





 Requesting a limit increase for different entities
A context-based restriction rule that includes multiple network zones can have a maximum of 1000 IP addresses indirectly associated with it. For example, in a rule that includes two network zones, one of the zones could have 800 IP addresses and the other could have a maximum of 200 IP addresses.

If you want to check the number of rules in your account, see [Viewing the total number of rules per account](https://cloud.ibm.com/docs/account?topic=account-account-limits&interface=clitotal-number-rules-cli). To request an increase in the account limit, see [Requesting a policy and rule shared limit increase](https://cloud.ibm.com/docs/account?topic=account-account-limits&interface=clilimit-increase).



 Eventual consistency 

Context-based restrictions follow an [eventually consistent](https://en.wikipedia.org/wiki/Eventual_consistency) pattern that is common to many cloud-native services. As a result, Context-based restrictions remain highly available and performant across multiple global regions. Changes that are made to Context-based restrictions rules and network zones are recorded and propagated worldwide. Access changes might not take effect until the propagation process is complete, usually within a few minutes.







 Access policy version limitations 

As of 25 January 2023, IAM supports two versions of the IAM Policy Management API: /v2/policies and /v1/policies. v1/polices allows for string comparisons against attributes in the subject and resources of a policy. v2/polices introduces a new schema that provides backwards functional compatibility while allowing for more complex comparisons and operators.



 String comparisons 

The following table lists the string comparison operators that you can use to build access policies with /v2/policies syntax. For more information about each version, see [Comparing /v1/policies and /v2/policies syntax](https://cloud.ibm.com/docs/account?topic=account-known-issuescompare-syntax).



Table 3. The string comparison operators available for conditions in access policies.

 Operator Description 

 stringEquals Case-sensitive string comparison. Boolean or number values are converted into a string before comparison.
To request an increase in the account limit, see [Requesting a policy and rule shared limit increase](https://cloud.ibm.com/docs/account?topic=account-account-limits&interface=clilimit-increase).



 Policy limitations based on attributes 

Access management tags are only available when you create an access policy that is scoped for all IAM-enabled services. In this case, when you enable the access based on tags, no other attributes can be added. And, when you base your policy on a specific location or resource group, no tag can be added to the access policy.





 Trusted profile limitations 

Users can't use the Support Center when they log in to IBM Cloud by applying a trusted profile.







 Context-based restrictions limits 

The following table lists the maximum limits for context-based restrictions. These limits apply to any user who can create context-based restrictions rules or network zones. For more information, see [What are context-based restrictions?](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-whatis).

If you have a specific use case that requires an extended limit, you can request an increase. For more information, see [Increasing account limits](https://cloud.ibm.com/docs/account?topic=account-account-limits).



Table 2. Context-based restrictions limits

 Resource Max 

 Context-based restriction rules per account <br><br>[2] 4020 
 Network zones per account 500 
 IP addresses per network zone 1000 
 IP addresses per rule 1000 



A context-based restriction rule that includes multiple network zones can have a maximum of 1000 IP addresses indirectly associated with it. For example, in a rule that includes two network zones, one of the zones could have 800 IP addresses and the other could have a maximum of 200 IP addresses.

If you want to check the number of rules in your account, see [Viewing the total number of rules per account](https://cloud.ibm.com/docs/account?topic=account-account-limits&interface=clitotal-number-rules-cli).
* Identity providers (IdPs)
* Trusted profiles
* Dynamic rules



You can request a limit increase for the chosen entities only if the following criteria is met:



* You must be the account owner or an administrator on all account management services.
* You have taken efforts to clean up and reduce the number of entities in the account.
* You must have a specific, reasonable use case for requesting an increase.





 Requesting a limit increase for different entities 

If you meet all of the previously listed criteria, you can request a limit increase for the chosen entities by submitting a support case in the [console](https://cloud.ibm.com/unifiedsupport/cases/add). In the case, provide all of the following information. Each piece of information is required for the processing and approval of your request.



* Case title of Request to increase account <entity> limit
* The use case for the limit increase
* Information on all efforts taken to reduce the number of <entities> on the account
* Account ID
* Note how many extra <entities> in the account are required



When the request is approved, the limits for your account are changed.

You are notified of the update to your entity limits through the case.







 Managing policy limits 

If you aren't sure how many policies are in your account, and you want to ensure that you avoid reaching the limit, you can check how many policies are in your account and work to reduce policies as you approach the limit. You must be the account owner or administrator for All Account Management services and All Identity and Access enabled services to check how many policies exist in the account.



 Viewing the total number of policies per account by using the API 

To get the total number of policies per account, you can use the [IAM Policy Management API](https://cloud.ibm.com/apidocs/iam-policy-managementget-policies-by-attributes):



1. Log in to IBM Cloud® CLI. If you have multiple accounts, you are prompted to select which account to use. If you do not specify a region with the -r flag, you must also select a region.

ibmcloud login
However, don't configure your instance to use the absolute maximum number allowed. If one or more additional data sources are added subsequently to a project in this service instance, it will impact the number of starting URLs that the instance can crawl successfully.





 Troubleshooting crawler issues 

A 403 Forbidden error is returned
: The website that you want to crawl might block requests from all but a specific set of named entities. If possible, add the crawler to the allowlist for the site. The identifying header for the crawler is User-Agent: IBM-AppConnect/V1.
* Postal code cannot exceed 15 characters.
* Only the following are valid for this field: a-z A-Z 0-9 - and space.







 Country 



* Country is required.
* Country code must equal 2 characters, in compliance with [ISO 3166-1](https://www.nro.net/list-of-country-codes-and-rirs-ordered-by-country-code).







 State 



* State is required for certain locales.







 Phone 



* Phone is required.
* Only the following are valid for this field: a-z A-Z 0-9 ()+.- and space.
* Contact telephone number. Can take one of the forms:



* +<integer-list>



* Examples - +012-3456, +12345689457920



* +<integer-list> (<integer-list> )<integer-list>



* Example - +01 (234)567-8901



* +<integer-list> ext.<integer-list>



* Example - +012-345-6789 ext.123



* +<integer-list> ( integer-list ) <integer-list> ext. <integer-list>



* Example - +012 (345) 678-9012 ext. 123











 Email 



* A valid email address is required.
By adding phone numbers, you represent on behalf of yourself and your company that you have properly informed the individuals, to whom the added phone numbers pertain, of their addition to this recipient list and purpose thereof, and have the required consents to do so.







 SMS segment 

SMS segments are character batches (of length 160 characters) of an SMS message, used by carriers to measure the message size.

If a message contains less than 160 characters, then it is considered as one SMS segment. If a message contains over 160 characters, for example, of 200 characters, then it is considered as 2 segments, first segment has 160 character and the second segment has 40 characters.





 SMS charges 

Because SMS delivery rates vary widely with location, SMS text messages are charged in terms of SMS Units. An SMS unit is a fixed unit of cost. Therefore, the number of units that are consumed by a message varies based on the destination country, and Event Notifications service charges vary. Table 1 shows the current SMS Units by country.



Table 1. Destination country and unit per segment

 Supported Country Code SMS Units 

 +1 (United States and Canada) 1 unit 
 +55 (Brazil) 5 units 
 +33 (France) 4 units 
 +44 (UK) 3 units 
 +81 (Japan) 4 units 
 +49 (Germany) 5 units 
 +52 (Mexico) 3 units 
 +39 (Italy) 5 units 
 +91 (India) 1 unit 
 +61 (Australia) 3 units 
 +34 (Spain) 5 units 



Longer notifications (notifications greater than 160 characters) might be split into multiple segments. Each segment is considered a message, as is each recipient phone number. For example, if an incoming notification is split into three SMS segments, and the message is sent to five subscribed phone numbers, then the total consumed SMS units for the incoming message is as follows:

Total SMS units = (Number of Segments) x (Number of phone numbers) x (SMS Unit for the country)

In the example, the total SMS units for messages that are sent to destination numbers in the United States is:

3 x 5 x 1 = 15 SMS units
Why am I receiving an error about too many requests? 

You receive an error about too many requests.

  What’s happening 

You attempt to view the home page of your app but receive the following error:

{"error_code":"too many requests","error_description":"too many requests"}

  Why it’s happening 

You might receive a too many requests error if you are performing automated testing with only one virtual user. Sign-in attempts are limited to prevent brute force DDoS and other types of similar attacks. For more information, see [App ID limits](https://cloud.ibm.com/docs/appid?topic=appid-known-issues-limitsgeneral-limits).

  How to fix it 

To resolve the issue, you might want to use multiple virtual users when you perform testing.
This must be a positive integer no larger than 100. Required if termintation_key, or minimum_count and maximum_count, are not defined n/a 
 minimum_count The minimum number of DTMF digits to collect. This property is used along with maximum_count to define a range for the number of digits to collect. This value must be a positive integer with a minimum value of 1 and a maximum value less than maximum_count. Required if terminatation_key and count are not defined. n/a 
 maximum_count The maximum number of DTMF digits to collect. This property is used along with minimum_count to define a range for the number of digits to collect. When this number of digits is collected, a conversation turn is initiated. This value must be a positive integer no greater than 100. Required if termintation_key and count are not defined. n/a 
 inter_digit_timeout_count The amount of time (in milliseconds) to wait for a new DTMF digit after a DTMF digit is received. During an active DTMF collection, this timeout activates when the first DTMF collection is received. When the inter-digit timeout is active, it deactivates the post-response timeout timer. If the inter_digit_timeout_count parameter is not specified, the post-response timer resets after receiving each DTMF digit, and it stays active until either the post-response timeout count is met or the collection completes. This value is a positive integer no higher than 100,000 (or 100 seconds). no n/a 
 ignore_speech Whether to disable speech recognition during collection of DTMF digits, until either the collection completes or a timeout occurs. If this parameter is true, speech recognition is disabled automatically when the first DTMF signal is received. no false 
 stop_after_collection Whether to stop DTMF input when the DTMF collection completes. After this command, all DTMF input is ignored until it is reenabled using the start response type. no false 







 command_info.type : disable_barge_in
In addition to the digits 0 through 9, you can specify the following codes:<br><br><br><br> * 10: <br> * 11: <br> * 12: A<br> * 13: B<br> * 14: C<br> * 15: D<br><br><br> yes n/a 
 digits[].duration The duration (in milliseconds) of the event. no 200 
 digits[].volume The power level of the tone, in dBm0. The supported range is 0 to -63 dBm0. no 0 
 send_interval An interval (in milliseconds) to wait before sending the next DTMF tone in the list. no 200 







 Examples 

This example shows the dtmf response type with the collect command, used to collect DTMF input.

{
"output": {
"generic": [
{
"response_type": "dtmf",
"command_info": {
"type": "collect",
"parameters": {
"termination_key": "",
"count": 16,
"ignore_speech": true
}
},
"channels":
{
"channel": "voice_telephony"
}
]
}
]
}
}
Show more

This example shows the dtmf response type with the send command, used to send DTMF signals.

{
"output": {
"generic": [
{
"response_type": "dtmf",
"command_info": {
"type": "send",
"parameters": {
"digits":
{
"code": "9",
"volume": -8
},
{
"code": "11"
}
],
"send_interval": 100
}
},
"channels":
{
"channel": "voice_telephony"
no 200 
 digits[].volume The power level of the tone, in dBm0. The supported range is 0 to -63 dBm0. no 0 
 send_interval An interval (in milliseconds) to wait before sending the next DTMF tone in the list. no 200 







 Examples 

This example shows the dtmf response type with the collect command, used to collect DTMF input.

{
"generic": [
{
"response_type": "dtmf",
"command_info": {
"type": "collect",
"parameters": {
"termination_key": "",
"count": 16,
"ignore_speech": true
}
},
"channels":
{
"channel": "voice_telephony"
}
]
}
]
}
Show more

This example shows the dtmf response type with the send command, used to send DTMF signals.

{
"generic": [
{
"response_type": "dtmf",
"command_info": {
"type": "send",
"parameters": {
"digits":
{
"code": "9",
"volume": -8
},
{
"code": "11"
}
],
"send_interval": 100
}
},
"channels":
{
"channel": "voice_telephony"
}
]
}
]
}
Show more







 Transferring the conversation to the web chat integration 

You can transfer the caller from the current phone call to a [web chat](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-deploy-web-chat) session by using the channel_transfer response type.