vania-janet/multiturn-rag-retrieval-data huggingface dataset:
For data volumes, you can add tags when you create and attach them to the instance, or add them to existing data volumes. Volume user tags are also used by [backup policies](https://cloud.ibm.com/docs/vpc?topic=vpc-backup-service-about) to create automatic backup snapshots of the volume. Create, view, and manage user tags from the UI, CLI, API, or Terraform, and remove then at any time.





 Access management tags for Block Storage for VPC volumes 

[Access management tags](https://cloud.ibm.com/docs/vpc?topic=vpc-iam-getting-started&interface=ui) help organize access control by creating flexible resource groupings, enabling your Block Storage for VPC resources to grow without requiring updates to IAM policies.

You can create access management tags and then apply them to new or existing volumes. Use the IAM UI or the Global Search and Tagging API to create the access management tag. Then, from the VPC UI or API, add access management when you create a volume or modify an existing volume. You can't add these tags to volumes that are created during instance provisioning. After you add the access management tags, you can manage access to them by using the IAM policies. For more information, see [Apply access management tags to a Block Storage for VPC volume](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-block-storage&interface=uistorage-add-access-mgt-tags).

For more information about managing tags for your account, see [Working with tags](https://cloud.ibm.com/docs/account?topic=account-tag&interface=ui).







 Managing security and compliance 

Block Storage for VPC is integrated with the Security and Compliance Center to help you manage security and compliance for your organization. You can set up goals that check whether volumes are encrypted by using customer-managed keys. By using the Security and Compliance Center to validate the Block Storage for VPC configurations in your account against a profile, you can identify potential issues as they arise.
If you have an existing Knowledge Studio instance, you can find it on the IBM Cloud [resources page](https://cloud.ibm.com/resources) under Services.
2. Click the Settings icon to open the Service Details page. The page lists all the user IDs that are registered as Knowledge Studio users. Each user ID has one of the following roles (in decreasing order of included permissions):



* Admin
* Project Manager
* Human Annotator



For information about user roles, see [User roles in Knowledge Studio](https://cloud.ibm.com/docs/watson-knowledge-studio?topic=watson-knowledge-studio-roles).
3. Verify that there is at least one user with the Admin role. A user ID with this role can create workspaces, and act as a project manager or human annotator.
4. If you have access to additional user IDs, verify that there are at least two users with the Human Annotator role.

Creating a real-life model typically involves multiple human annotators in addition to an administrator or project manager. However, for purposes of the tutorial, you can continue with a single user ID.
5. Optional: Change the role that is assigned to a user ID. From the Action column of the table, click the Edit link, an then change the assigned user role.

You can upgrade a user ID to a role with greater permissions, but you cannot downgrade a user with an Admin or Project Manager role to the Human Annotator role.









 Lesson 2: Creating a workspace 

In this lesson, you will learn how to create a workspace within Knowledge Studio.



 About this task 

A workspace defines all the resources that are required to create a machine learning model, including training documents, the type system, dictionaries, and annotations that are added by human annotators. For more information about workspace creation, see [Creating a workspace](https://cloud.ibm.com/docs/watson-knowledge-studio?topic=watson-knowledge-studio-create-project).





 Procedure 



1.
(https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/secrets-manager/images/classic-infra-creds.svg)

Figure 2. Viewing your classic infrastructure username and API key



1. In the console, go to Manage > Access (IAM) > Users, then select the user's name.
2. In the VPN password section, copy the Username value.

In most cases, your classic infrastructure username is your <account_id>_<email_address>. This username is also your VPN username for the account.
3. In the API keys section, [create a classic infrastructure API key](https://cloud.ibm.com/docs/account?topic=account-classic_keys) or find your existing key.
4. Click the Actions icon ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/actions-icon-vertical.svg)> Details to copy the API key value.
5. Assign your user permissions to manage DNS in the account.

For more information about managing classic infrastructure access, see [Classic infrastructure permissions](https://cloud.ibm.com/docs/account?topic=account-mngclassicinfrahow-classic-infra-permissions-work).



1. Click the Classic infrastructure tab to manage your classic infrastructure permissions.
2. In the Services section, ensure that the Manage DNS permission is selected.



6. Complete the steps to [add a DNS configuration](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-add-dns-provider) to your Secrets Manager instance.









 Next steps 

Now you're ready to add engine configurations to your instance.
Select Provide a JSON identity file from the IBM Blockchain Platform and then browse to the admin identity that you exported from your console. If the identity is the administrator of multiple nodes in your network, you can associate the identity with multiple nodes.



When you have associated an admin identity with your peers, CA, and an ordering node, you can connect to your network and use the extension to deploy smart contracts.







 Adding wallets and users 

Use the following steps to create a new wallet by using a certificate and private key:



1. Hover your mouse over the Fabric Wallets pane and click +.
2. Choose to Create a new wallet and add an identity from the options. Provide a name for your wallet and your identity.
3. Enter the MSP ID of your organization.
4. Choose to add a certificate and private key.
5. If you use a certificate and private key, browse to the certificate and private key.



You can also add new users to the wallets that have already been created:



1. In the Fabric Wallets pane, right-click a wallet and select Add Identity.
2. Provide a name for the identity and an MSP ID.
3. You can upload a JSON file, provide a certificate and private key, or provide an enrollment ID and secret.



* If you are connecting to a network on the IBM Blockchain Platform, you can download an identity from your IBM Blockchain console, either by exporting an identity from your wallet or by enrolling and then exporting an identity using your Certificate Authority. You can then upload the JSON file directly to VS Code.
* If you use a certificate and private key, browse to the certificate and private key.
* If you use an enrollment ID and secret, choose the gateway to enroll with and enter the enrollment ID and secret.
[Screen capture that shows adding a user example to an intent](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/intent-user-example.png)
7. Repeat the same process to add more examples.

Provide at least five examples for each intent.

![Plus or higher plans only](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/plus.png) To get help with user example creation, see [Get intent user example recommendations](https://cloud.ibm.com/docs/assistant?topic=assistant-intent-recommendationsintent-recommendations-get-example-recommendations-task).
8. When you are done adding examples, click ![Close arrow](https://cloud.ibm.com/docs-content/v1/content/417db917d18067d9dcc4cf2612564a9a87c3ddc8/assistant/images/close_arrow.png) to finish creating the intent.



The system begins to train itself on the intent and user examples you added.

Important:



* Intent example data should be representative and typical of data that your users provide. Examples can be collected from actual user data, or from people who are experts in your specific field. The representative and accurate nature of the data is important.
* Both training and test data (for evaluation purposes) should reflect the distribution of intents in real usage. Generally, more frequent intents have relatively more examples, and better response coverage.
* You can include punctuation in the example text, as long as it appears naturally. If you believe that some users express their intents with examples that include punctuation, and some users will not, include both versions. Generally, the more coverage for various patterns, the better the response.







 How entity references are treated
const walletPath = path.join(process.cwd(), 'wallet');
const wallet = new FileSystemWallet(walletPath);
console.log(Wallet path: ${walletPath});

// Check to see if we've already enrolled the admin user.
const userExists = await wallet.exists('user1');
if (userExists) {
console.log('An identity for "user1" already exists in the wallet');
return;
}

// Enroll the admin user, and import the new identity into the wallet.
const enrollment = await ca.enroll({ enrollmentID: '<app_enroll_id>', enrollmentSecret: '<app_enroll_secret>' });
const identity = X509WalletMixin.createIdentity('<msp_id>', enrollment.certificate, enrollment.key.toBytes());
await wallet.import('user1', identity);
console.log('Successfully enrolled client "user1" and imported it into the wallet');

} catch (error) {
console.error(Failed to enroll "user1": ${error});
process.exit(1);
}
}

main();
Show more
3. Edit enrollUser.js to replace the following values:



* Replace <CA_Name> with the name of your organizations CA. You can find your CA name in the "organizations" section of your connection profile under "Certificate Authorities". Do not use the "caName" in the "Certificate Authorities" section.
* Replace <app_enroll_id> with the application enroll ID provided by your network operator.
* Replace <app_enroll_secret> with the application enroll secret provided by your network operator.
* Replace <msp_id> with the MSP ID of your organization. You can find your MSP ID under the "organizations" section of your connection profile.



4. Navigate to enrollUser.js using a terminal and run node enrollUser.js.
To see it in action, check out the [web app sample](https://github.com/ibm-cloud-security/appid-serversdk-nodejs/blob/master/samples/web-app-sample.js).









 Branding your app with the API 

You can display your own customized screens and take advantage of the authentication and authorization capabilities of App ID. With Cloud Directory as your identity provider, your users are able to interact with your app with less help from you. They're able to sign in, sign up, reset their password, and more without asking for help.

To make this experience possible, App ID exposes REST APIs. You can use the REST APIs to build a backend server that serves your web apps, or to interact with a mobile app with your own custom screens.

The management API is secured with IBM Cloud Identity and Access Management generated tokens, which means that account owners can specify who on their team has which level of access for each service instance. For more information about how IAM and App ID work together, see [Service access management](https://cloud.ibm.com/docs/appid?topic=appid-service-access-management).

After you configure your [settings](https://cloud.ibm.com/docs/appid?topic=appid-cloud-directorycd-settings), you can call the following endpoints to display each screen.



 Sign up 

You can use the /sign_up endpoint to allow users to sign themselves up for your app. Supply the following data in the request body:



* Your tenantID.
* Cloud Directory user data with the following required attributes. See [SCIM Full User Representation](https://datatracker.ietf.org/doc/html/rfc7643section-8.2) for more details.



* A password attribute.
* An emails array with at least one email address and a primary attribute that is set to true.
Adding user credentials from the CLI 

To store a username and password by using the Secrets Manager CLI plug-in, run the [ibmcloud secrets-manager secret-create](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-cli-plugin-secrets-manager-clisecrets-manager-cli-secret-create-command) command.

ibmcloud secrets-manager secret-create 
--secret-prototype='{"name": "example-username-password-secret","description": "Description of my user credentials secret","secret_type": "username_password","secret_group_id": "bfc0a4a9-3d58-4fda-945b-76756af516aa","labels": ["dev","us-south"],"username": "example-username","password": "example-password","rotation": {"auto_rotate": true,"interval": 10,"unit": "day"},"custom_metadata": {"metadata_custom_key": "metadata_custom_value"},"version_custom_metadata": {"custom_version_key": "custom_version_value"}}'

The command outputs the ID value of the secret, along with other metadata. For more information about the command options, see [ibmcloud secrets-manager secret-create](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-cli-plugin-secrets-manager-clisecrets-manager-cli-secret-create-command).





 Adding user credentials with the API 

You can store a username and password programmatically by calling the Secrets Manager API.

The following example shows a query that you can use to create a username and password secret. When you call the API, replace the ID variables and IAM token with the values that are specific to your Secrets Manager instance.

You can store metadata that are relevant to the needs of your organization with the custom_metadata and version_custom_metadata request parameters.
After you create an instance of the service, add a root key.



1. If you're not already on the details page, click the name of the Key Protect instance in your [resource list](https://cloud.ibm.com/resources?groups=resource-instance).
2. Add a Key Protectroot key:



1. Click Manage from the left navigation pane of the service details and click Add key.
2. Select Create a key and the Root key[type](https://cloud.ibm.com/docs/key-protect?topic=key-protect-envelope-encryptionkey-types).
3. Give the key a name that you can recognize and click Create key. Make sure that the key name does not contain personal information, such as your name or location.









 Import a key 

If you need to generate keys with your own solution, you can use Key Protect to secure the keys.

After you create an instance of the service, add a root key.



1. Click the name of the Key Protect instance in your [resource list](https://cloud.ibm.com/resources?groups=resource-instance).
2. Import a root key:



1. Click Manage from the left navigation pane of the service details and click Add key.
2. Select Import your own key the Root key type.
3. In Key material, specify the base64 encoded key material, such as an existing key-wrapping key.



* The key must be 128, 192, or 256 bits.
* The bytes of data, for example 32 bytes for 256 bits, must be encoded by using base64 encoding.



4. Give the key a name that you can recognize and click Import key. Make sure that the key name does not contain personal information, such as your name or location.











 Step 3. Grant service access to Key Protect 

After you add a root key to Key Protect, you use Cloud Identity and Access Management (IAM) to authorize access between the Watson service and Key Protect.
For more information, see [Configuration](https://integrations.us-south.assistant.watson.cloud.ibm.com/web/developer-documentation/api-configuration).







 Labeling and deleting data in Watson Assistant 

Do not add personal data to the training data (actions and steps, including user examples) that you create. In particular, be sure to remove any personally-identifiable information from files that contain real user utterances that you upload to mine for user example recommendations.

Experimental and beta features are not intended for use with a production environment and therefore are not guaranteed to function as expected when labeling and deleting data. Experimental and beta features should not be used when implementing a solution that requires the labeling and deletion of data.

If you need to remove a customer's message data from a Watson Assistant instance, you can do so based on the customer ID of the client, as long as you associate the message with a customer ID when the message is sent to Watson Assistant.

Removing message data must be an occasional event only for individual customer IDs. To disable analytics logs, you can upgrade to an Enterprise with Data Isolation plan.



* The assistant preview and automatic Facebook integration do not support the labeling and therefore deletion of data based on customer ID. They should not be used in a solution that must support the ability to delete data based on a customer ID.
* For Intercom, the customer_id is the user_id prepended with intercom_. The Intercom user_id property is the id of the author message object in the Conversation Model that is defined by Intercom.



* To get the ID, open the channel from a web browser. Open the web developer tools to view the console. Look for author.



The full customer ID looks like this: customer_id=intercom_5c499e5535ddf5c7fa2d72b3.
* For Slack, the customer_id is the user_id prepended with slack_. The Slack user_id property is a concatenation of the team ID, such as T09LVDR7Y, and the member ID of the user, such has W4F8K9JNF.
* For classic infrastructure, you must have the Manage Users permission on the account.
* For IAM access, you must have the Administrator or Editor role on the user management account management service.



To add a VPN-only user, use the following steps:



1. On the Users page, click Add VPN-only user.
2. Enter the personal information details for the user.
3. Click Save.







 Inviting users by using the CLI 

To invite users by using the CLI, run the following command:

ibmcloud account user-invite USER_EMAIL [-o ORG --org-role ORG_ROLE] -s SPACE, --space-role SPACE_ROLE]]

By using the CLI, you can choose not to assign access and work on assigning access later. For more information about the command parameters, see [ibmcloud account user-invite](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_accountibmcloud_account_user_invite).





 Inviting users by using the API 

You can use the [API](https://cloud.ibm.com/apidocs/user-managementinvite-users) to invite users in bulk. All users that are included in a single invitation are assigned the same access. When you invite users by using the API, you enter emails in a comma-separated list with each entry that is surrounded by quotations. This example assigns access by adding the user to an access group.



* Curl
* Java
* Python
* Go
* Node



curl -X POST https://user-management.cloud.ibm.com/v2/accounts/987d4cfd77b04e9b9e1a6asdcc861234/users -H 'Authorization: Bearer <IAM_TOKEN>'
-H 'Content-Type: application/json' -d '{
"users": [
{
"email": "cloud_api_example_member@ibm.com",
"account_role": "Member"
}],
Enter a First name, Last name, Email, and Password. Be sure that the email that you try to register is not already taken by another user. To be sure that you typed your password correctly, confirm it by entering it in the Reenter Password field.
4. Click Save. A Cloud Directory user is created.







 Adding users with the API 



1. Obtain your tenant ID from your application or service credentials.
2. Obtain an IBM Cloud IAM token.

curl -X GET "https://iam.cloud.ibm.com/oidc/token" -H "accept: application/x-www-form-urlencoded"
3. Run the following command to create a new user and a profile at the same time.

curl -X POST "https://<region>.appid.cloud.ibm.com/management/v4/<tenantID>/cloud_directory/sign_up?shouldCreateProfile=true&language=en" -H "accept: application/json" -H "Content-Type: application/json" -H "authorization: Bearer <token>" -d "{ "active": true, "emails": [ { "value": "<user@domain.com>", "primary": true } ], "userName": "<userName>", "password": "<userPassword>"}"









 Deleting users 

If you want to remove a user from your directory, you can delete the user from the UI or by using the APIs.



 Deleting a single user with the UI 



1. Go to the Cloud Directory > Users tab of the App ID dashboard.
2. Click the checkbox next to the user that you want to delete. A box opens.
3. In the box, click Delete. A screen opens.
4. Confirm that you understand that deleting a user cannot be undone by clicking Delete. If the action was a mistake, you can add the user to your directory again, but any information about that user is no longer available.







 Deleting a single user with the API
<br><br> * hs-crypto.keystore.listkeystoresbyids<br> * hs-crypto.keystore.listkeysbyids<br> * hs-crypto.crypto.generatekey<br> * hs-crypto.crypto.generatekeypair<br> * hs-crypto.keystore.storenewkey<br><br><br> 
 View EP11 keys. <br><br> * hs-crypto.keystore.listkeystoresbyids<br> * hs-crypto.keystore.listkeysbyids<br> * hs-crypto.keystore.deletekey<br><br><br> 



8. Click Create after you select the appropriate actions for your custom role.







 Step 2: Assign IAM roles to users 

Before users can access EP11 keystores or keys with the IBM Cloud console, you need to grant users the appropriate IAM roles by completing the following steps:



1. From the menu bar, click Manage > Access (IAM), and select Users to browse the existing users in your account.
2. Select the user, and click the Actions icon ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/action-menu-icon.svg) to open a list of options for that user.

Click Invite users to add a user to your account if the user is not in the table. For more information, see [Inviting users to an account](https://cloud.ibm.com/docs/account?topic=account-iamuserinv).
3. From the options menu, click Assign access.
4. Click Access policy.
5. Under Service, select Hyper Protect Crypto Services and click Next.
6. Under Resources, select resources that you want to assign access to and click Next:



* If you want to assign the user access to all the Hyper Protect Crypto Services instances under your account, select All resources.