vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* Create a new instance - to create a new instance of the selected service. This will take you to the respective provisioning page of the service selected.
* Choose existing instance - select this option if you already have a Key Protect or Hyper Protect Crypto Services instance. Select the Service instance and Root key from the drop-down list.



5. Click Save to apply the changes.



The updated Key Management information is listed in the Integrations dashboard.

By default customer data is encrypted. You can user APIs, CLI, or User Interface to provide your own KMS details for data encryption. If you are using CLI or APIs then you need to get default KMS integration ID through [List all integrations](https://cloud.ibm.com/apidocs/event-notificationslist-integrations) API. In case of default KMS integrations except integration ID all other values are empty. You need to use the integration ID to update the integration details with your own KMS details.





 Using authorizations to grant access between services 

Use IBM Cloud Identity and Access Management (IAM) to create or remove an authorization that grants one service access to another service. Use authorization delegation to automatically create access policies that grant access to dependent services.



 Creating an authorization in the console 



1. In the IBM Cloud console, click Manage > Access (IAM), and select Authorizations.
2. Click Create.
3. Select a source account.



* If the source service that needs access to the target service is in this account, select This account.
* If the source service that needs access to the target service is in a different account, select Other account. Then, enter the Account ID of the source account.



4. Select a Source service as Event Notifications.
5. Specify whether you want the authorization to be for all resources or Resources based on selected attributes, If you selected Resources based on selected attributes, then specify the Add attributes only source resource group or only source service instance.
6. Select a Target service as per your requirement (Key Protect or Hyper Protect Crypto Services).
7.
To support disaster recovery, the service provider may need to configure two separate SIP trunks, one for each region, and only when all the zones in a single region fail should the call be switched to the backup region. It's important to set the SIP INVITE failure timeouts at the SIP trunking provider low enough to avoid long call setup latencies when a failover is occurring.





 Partial service outage 

The second type of failure is a partial service outage within the region. This is much harder to detect and manage because of the large number of variations in service failures that can occur within a region. In some cases, these may be small issues that affect the performance characteristics of the call but not cause the call to fail.

For issues like this that ultimately cause a call to fail, there are two ways Watson Assistant can handle the call. The first is to accept the call and then transfer it to a configured default SIP URI. This can be configured in the Watson Assistant phone integration settings and is also used if there is a mid-call failure. The default transfer target SIP URI is defined in the SIP target when a call fails field located on the Advanced tab of the phone integration configuration panel.

The phone integration can also be configured to respond to a SIP INVITE with a SIP 500 (service unavailable) message if an outage is detected during call setup instead of transferring a call to a live agent. A SIP 500 can then be used to redirect the call to another zone, or if many SIP 500s are received, to another region. Using a SIP 500 INVITE error is a better way to signal a failure to an upstream SIP trunking provider because it gives the provider a way to reroute the call. Using only the default transfer target to handle call failures is acceptable for low call volume scenarios but can result in large numbers of calls being directed to a customer contact center when bigger call volumes are handled by Watson Assistant. To enable this 500 error response capability for a specific Watson Assistant instance, you need to make a request to IBM.

You should plan for both full and partial service outages. A good first step is to plan for a manual failover between regions before enabling automation. This requires a complete replica of Watson Assistant in both regions, including all custom speech model training.
You can use the same SIP account and phone number that you configured for use with Voice Agent with Watson in the phone integration.

The phone integration provides a more seamless integration with your assistant. However, the integration currently does not support the following functions:



* Outbound calling
* Configuring backup locations
* Event forwarding to save call detail reports in the IBM Cloudant for IBM Cloud database service
* Reviewing the usage summary page. Use IBM Log Analysis instead. For more information, see [Viewing logs](https://cloud.ibm.com/docs/assistant?topic=assistant-deploy-phonedeploy-phone-logs).



To migrate from Voice Agent with Watson to the Watson Assistant phone integration, complete the following steps:



1. From the Voice Agent with Watson page, copy the phone number or numbers that you used for your SIP account.
2. When you set up the Watson Assistant phone integration, add the phone number or set of numbers that you copied in the previous step.
3. From the phone integration setup page, copy the SIP uniform resource identifier (URI).
4. In your SIP trunk account, replace the Voice Agent with Watson URI that you specified previously with the URI that you copied from the phone integration setup page in the previous step.

For example, if you use a Twilio SIP trunk, you would add the assistant's SIP uniform resource identifier (URI) to the Twilio Origination SIP URI field.







 Call routing details 

Incoming calls to your assistant follow this path:



1. A customer calls the customer support phone number that is managed by your Session Initiation Protocol (SIP) trunk provider.
2. The SIP trunk service sends a SIP INVITE HTTP request to your assistant's phone integration to establish a connection.
3. The phone integration connects to the speech services that are required to support the interaction.
4. After the services are ready, the connection is established, and audio is sent over the Real-time Transport Protocol (RTP).

RTP is a network protocol for delivering audio and video over IP networks.
5. The welcome node of the dialog is processed.
Securing your API with Client ID and Client Secret 

These tutorials provide procedures for how you can secure your APIs in API Connect V5.

To secure an API with a Client ID and Client Secret, you must select a method for your process.



  IBM Cloud 



*  [Securing your API with Client ID and Client Secret by using IBM Cloud](https://cloud.ibm.com/docs/apiconnect/tutorials?topic=apiconnect-tut_secure_id_secret_bm)







  Developer Toolkit 



*  [Securing your API with Client ID and Client Secret by using the Developer Toolkit](https://cloud.ibm.com/docs/apiconnect/tutorials?topic=apiconnect-tut_secure_id_secret_tk)
London public.0001.voip.eu-gb.assistant.watson.cloud.ibm.com 
 London public.0002.voip.eu-gb.assistant.watson.cloud.ibm.com 
 London public.0003.voip.eu-gb.assistant.watson.cloud.ibm.com 
 Seoul public.0001.voip.kr-seo.assistant.watson.cloud.ibm.com 
 Sydney public.0001.voip.au-syd.assistant.watson.cloud.ibm.com 
 Sydney public.0002.voip.au-syd.assistant.watson.cloud.ibm.com 
 Sydney public.0003.voip.au-syd.assistant.watson.cloud.ibm.com 
 Tokyo public.0001.voip.jp-tok.assistant.watson.cloud.ibm.com 
 Tokyo public.0002.voip.jp-tok.assistant.watson.cloud.ibm.com 
 Tokyo public.0003.voip.jp-tok.assistant.watson.cloud.ibm.com 
 Washington, DC public.0001.voip.us-east.assistant.watson.cloud.ibm.com 
 Washington, DC public.0002.voip.us-east.assistant.watson.cloud.ibm.com 
 Washington, DC public.0003.voip.us-east.assistant.watson.cloud.ibm.com 







 Migrating from Voice Agent with Watson 

If you created an IBM® Voice Agent with Watson service instance in IBM Cloud to enable customers to connect to an assistant over the phone, use the phone integration instead. You can use the same SIP account and phone number that you configured for use with Voice Agent with Watson in the phone integration.

The phone integration provides a more seamless integration with your assistant. However, the integration currently does not support the following functions:



* Outbound calling
* Configuring backup locations
* Event forwarding to save call detail reports in the IBM Cloudant for IBM Cloud database service
* Reviewing the usage summary page. Use IBM Log Analysis instead.
Binding the secure service to the Liberty app causes the runtime to connect to the service over a secure connection. That secure connection is established by using the default SSL settings. Because the default SSL settings are specified in the Liberty server.xml file, the configured trust store might not trust the certificate that is used by the secure service.

 How to fix it 

Modify configuration to use the JVM's trust store with one of the options that follow. Be sure to restage your app after making the change.



 Update the Liberty server.xml file 

Update the server.xml file to use the JVM cacerts file as the trust store. Add the following to your server.xml file:

<ssl id="defaultSSLConfig" trustStoreRef="defaultTrustStore"/>
<keyStore id="defaultTrustStoretore" location="${java.home}/lib/security/cacerts"/>





 Update the configured trust store 

Modify the configured trust store to trust the DigiCert ROOT CA.



1. Download the DigiCert Root CA from https://cacerts.digicert.com/DigiCertGlobalRootCA.crt.
2. Assuming the resources/security/key.jks is used as the trust store, import the CA into the key using the Java keytool utility:

keytool -importcert --storepass <keyStorePassword> -keystore <path>/resources/security/key.jks -file DigiCertGlobalRootCA.crt











 SDK for Node.js 



 App fails to start: General troubleshooting 

For the SDK for Node.js buildpack V3.23 or later, try packaging the dependencies in the same source files as your app. This can resolve various errors that can occur when dependencies assume that they are in the same base directory as the app.



1. From your app root directory, install dependencies by running the following command.

npm install
2. Ensure that your .cfignore file does not include the following line:

node_modules/
To connect to an on-premises data source, you first need to download, install, and configure IBM® Secure Gateway for IBM Cloud®. After you install IBM® Secure Gateway for IBM Cloud® for your first on-premises data source, you won't need to repeat this process.



1. From the Manage data page of the Discovery tooling, select Connect a data source.
2. Select the data source that you want to connect to. When you select an on-premises data source, go to the Connect to your on-premise network section and click the Make connection button.
3. On the Download and install the Secure Gateway Client screen, download the appropriate version of IBM® Secure Gateway for IBM Cloud®.
4. After you complete the download, click Download Secure Gateway and Continue. When prompted, enter the Gateway ID and Token that are displayed. For more information about installation, see [Installing the client](https://cloud.ibm.com/docs/SecureGateway?topic=SecureGateway-client-install).
5. On the machine running the Secure Gateway Client, open the Secure Gateway dashboard at http://localhost:9003.
6. Click add ACL on the dashboard. Add the endpoint URL of each SharePoint collection to the Allow access list. For example, Hostname: mycompany.sharepoint.com and port: 80.
7. Return to the Discovery tooling and click Continue. If the connection is successful, a Connection successful message displays. If the connection was not successful, open the IBM® Secure Gateway for IBM Cloud® dashboard, and verify that the endpoints on the Allow access list are correct.



After the connection is successful you can begin entering the credentials for your on-premises data source.





 Data source connection and data isolation 

[Connecting to external data sources](https://cloud.ibm.com/docs/discovery?topic=discovery-sources) reduces the data isolation of your service instance because data in transit between the source and the service cannot be isolated. All other isolation (at-rest, administration, query) remains in full.
7. Retrieve Huawei credentials (Client ID and Client secret) for your application. For more information, see [Retrieving Huawei credentials](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-push-huaweien-retrieve-huawei-credentials).
8. Add Client ID and Client secret.
9. Click Add.







 Retrieving Huawei Credentials 

To complete the Huawei Push Notification setup, you need a Client ID and Client secret. Obtain these from the Huawei AppGallery Connect portal.



1. Sign into the Huawei [AppGallery Connect](https://developer.huawei.com/consumer/en/service/josp/agc/index.html/).
2. Click My projects. Select an existing project or click on Add project to create one.
3. Click Add app, if there are no applications created in the project or select the existing application.
4. Enable Push Kit to see the app details. For more information, see [Enabling Push Kit](https://developer.huawei.com/consumer/en/doc/development/HMSCore-Guides/android-config-agc-0000001050170137section9471122085218).
5. Go to the App information section, where you can find OAuth 2.0 Client ID. Copy the Client ID and Client secret values into the respective fields.







 Upgrading a Pre-production Destination to Production Destination 

You can upgrade a Pre-production destination to Production destination after creating the destination by using the Edit option from the overflow menu.

To understand the billing impact of upgrading a Pre-production destination to Production destination, see [here](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-destinations-pushen-destinations-push-charge-preprod-to-prod).

To modify the destination,



* Select the pre-production destination from the list of destinations
* Click the three vertical dots in the selected pre-production destination to access the overflow menu
If you are using Event Notifications CLI or API to integrate with a key management service (KMS), ensure that you have enabled authorization to grant access between services before integrating with a KMS service. For more information, see [Using authorizations to grant access between services](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-integrationsen-using-auth-access-between-services).

You can create and bring keys that are created by using Key Protect or Hyper Protect Crypto Services. To get started, you need [Key Protect](https://cloud.ibm.com/catalog/key-protect) or [Hyper Protect Crypto Services](https://cloud.ibm.com/catalog/services/hyper-protect-crypto-services) provisioned on your IBM Cloud account. For more information, see [provisioning a key protect instance](https://cloud.ibm.com/docs/key-protect?topic=key-protect-provision) or see [provisioning a Hyper Protect Crypto Services instance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-get-started).



1. From your Event Notifications service instance dashboard, click Integrations. By default, a Key Protect entry is listed, that can be edited to configure the Key Management option of your choice, connecting to your Event Notifications instance.
2. From Overflow menu of the default entry, click Edit. This displays the Key Management side panel.
3. Select Key Protect or Hyper Protect Crypto Services from the Service drop-down list, as per your requirement.
4. For the Instance, select one of these options:



* Create a new instance - to create a new instance of the selected service. This will take you to the respective provisioning page of the service selected.
* Choose existing instance - select this option if you already have a Key Protect or Hyper Protect Crypto Services instance. Select the Service instance and Root key from the drop-down list.



5. Click Save to apply the changes.



The updated Key Management information is listed in the Integrations dashboard.
Procedure to enable internet connectivity for Entrust DataControl 



1. Complete steps 1 - 3 in the previous procedure.
2. Click Settings and then Interfaces. Note the IP address for the private uplink. This address becomes the new default gateway.
3. Click Home > Hosts and Clusters and find the Entrust VMs. Right-click one of the VMs and click Open Console.
4. Log in to the console by using the console credentials that you can find on the Entrust DataControl service details page on the IBM Cloud for VMware Solutions console.
5. To get the current default gateway IP address from the VM, click Manage Network Settings > Show Current Network Configuration. Note the IP address that is listed for Gateway. This address becomes the gateway that is used for the static route.
6. To set a static route for the VM, click Manage Network Settings > Manage Static Routes > Add Static Route. Set Network address to 10.0.0.0/8 and Gateway to the IP address noted in the previous step.
7. To set the default gateway IP for the VM, click Manage Network Settings > Change Current Network Configuration. If you get a warning message, click OK, then click Custom Configuration. Set the Gateway field to the private uplink IP address noted in step 2 and click OK. Wait until the new network configuration is installed and the network services are restarted.
8. If you see a message that requests Entrust SecureOS reauthentication, click OK and enter the IP address of the other Entrust VM for this installation. If you are asked for a 16-character passphrase, press Enter to return to the main menu. Verify the current network configuration to ensure that your changes are applied.
9. To confirm that the VM has access to the internet, ping a public IP address or website. Click Manage Network Settings > Network Diagnostic Tools > Test Inbound Ports of Another Server. Type a public website address. For example, www.ibm.com, click OK, type 80 443 for the ports (or any other ports you want to test).
If this test did not work as expected, double check your phone number configuration to make sure its attached to your flow.







 Creating a Twilio function to handle incoming calls 

Now we need to configure the call flow to direct inbound calls to the assistant using a Twilio function. Follow these steps:



1. In the navigation menu, click the All Products & Services icon.
2. Click Services.
3. Click Create Service. Specify a service name and then click Next.
4. Click Add > Add Function to add a new function to your service. Name the new function /receive-call.
5. Replace the template in your /receive-call function with the following code:

exports.handler = function(context, event, callback) {
const VoiceResponse = require('twilio').twiml.VoiceResponse;
const response = new VoiceResponse();
const dial = response.dial({
answerOnBridge: "true",
referUrl: "/refer-handler"
});
const calledPhoneNumber = event.Called;
dial.sip(sip:${calledPhoneNumber}@{sip_uri_hostname};secure=true);
return callback(null, response);
}



* Replace {sip_uri_hostname} with the hostname portion of your assistant's phone integration SIP URI (everything that comes after sips:).. Note that Twilio does not support SIPS URIs, but does support secure SIP trunking by appending ;secure=true to the SIP URI.



6. Click Save.
7. Click Deploy All.







 Redirecting to the incoming call handler 

In this section you will use a TwiML Redirect** widget in your Studio Flow editor to call out to the /call-recieve function created in the previous section.



1. Add a TwiML Redirect widget to your Studio Flow canvas.
2.
To upgrade the auto-negotiation policy by using the SDK, follow these Go language example steps:



1. Store the VPN gateway ID and VPN connection ID variables to be used in your SDK, for example:

gatewayID - Find the VPN gateway ID by using the [get VPN gateways](https://cloud.ibm.com/apidocs/vpc/latest?code=golist-vpn-gateways) command, and then populate the variable:

connID - Find the VPN gateway connection ID by using the [get VPN gateway connections](https://cloud.ibm.com/apidocs/vpc/latest?code=golist-vpn-gateway-connections) command, and then populate the variable:

gatewayID := <your_vpn_gateway_id>
connID := <your_vpn_gateway_connection_id>
2. Perform an update to set the AdminStateUp parameter to false to disable the VPN connection, then wait for the Status to change to down. If your AdminStateUp is already set to false, skip this step.

// set the AdminStateUp parameter to false to disable the VPN connection
options := &vpcv1.UpdateVPNGatewayConnectionOptions {
ID: &connID,
VpnGatewayID: &gatewayID,
AdminStateUp: false
}
vpnGatewayConnection, response, err := vpcService.UpdateVPNGatewayConnection(options)

// check the VPN connection status to be changed to down
vpcService.GetVPNGatewayConnection(options)
3. Perform an update to set the AdminStateUp parameter to true to re-enable the VPN connection, then wait for the Status to change to up.

// set the AdminStateUp parameter to true to re-enable the VPN connection
options = &vpcv1.UpdateVPNGatewayConnectionOptions {
ID: &connID,
VpnGatewayID: &gatewayID,
MAS-SaaS Integrations 

IBM Maximo Application Suite as a Service supports integration to / from external systems. There are different options available to provide secure integration connections such as SSL, VPN, and Cloud Object Storage integration. HTTPS (SSL) is the standard encryption method and is supported for XML based interfaces using HTTP Post and Web Service endpoints. In addition, the REST API is available over HTTPS. All these integration methods can also be implemented with authentication. Cloud Object Storage is available for integrations that require file based transfers. A Site-to-Site IPsec VPN Tunnel can also be established between the client network and the IBM cloud environment using IBM's firewall in order to support other integration transport methods.

Integration options include, but are not limited to:



* Support for synchronous and asynchronous exchange of data with applications within the Suite
* Use of common protocols and format such as Web Services, HTTP, JMS, REST, OSLC, XML, JSON, XML and .csv files, DB tables
* Support of Create, Replace, Update, Delete and Query operation
* Support for customizing integration processing using Processing Rules and Scripting



For the MS-Manage Application:



* Maximo integration message generation and delivery based on application object events
* Support for implementation (batch) data loading
* Pre-defined (75+) interface components provided along with applications to configure new interfaces
* Support for customizing integration processing using Processing Rules and Scripting



For file based integrations, an AWS S3 Cloud Object Storage location will be allocated for each order. 5 API Keys will be generated for the client to use to move files in and out of the location. Additional keys can be ordered. To initiate this process, customers must submit a support case.

One Site-to-Site VPN is included in the order. To initiate the creation of this VPN, customers must submit a support case. At this time, the VPN is only available for LDAP integrations.

For clients wanting to use App Connect or File integration for other applications within the suite: