vania-janet/multiturn-rag-retrieval-data huggingface dataset:
"message": "CWSMR0070W: A request to the Watson Speech To Text service failed for the following reason = Unexpected server response: 403, response headers = {"strict-transport-security":"max-age=31536000; includeSubDomains;","content-length":"157","content-type":"application/json","x-dp-watson-tran-id":"23860083-88b6-41d7-9130-30bbfebe647e","x-request-id":"23860083-88b6-41d7-9130-30bbfebe647e","x-global-transaction-id":"6c764df3-81db-41bb-a14f-62384facffca","server":"watson-gateway","x-edgeconnect-midmile-rtt":"1","x-edgeconnect-origin-mex-latency":"28","date":"Thu, 13 May 2021 20:31:12 GMT","connection":"keep-alive"}, response body = {"code":403,"trace":"23860083-88b6-41d7-9130-30bbfebe647e","error":"Forbidden","more_info":"https://cloud.ibm.com/docs/watson?topic=watson-forbidden-error](https://cloud.ibm.com/docs/watson?topic=watson-forbidden-error)"}, x-global-transaction-id = 6c764df3-81db-41bb-a14f-62384facffca. The Media Relay will reattempt to send the request."
}
],
"realtime_transport_network_summary": {
"inbound_stream": {
"average_jitter": 4,
* [Authenticating to IBM Cloud](https://cloud.ibm.com/docs/watson?topic=watson-iamgs-credential-cloud)
* [Authenticating to IBM Cloud Pak for Data](https://cloud.ibm.com/docs/watson?topic=watson-iamgs-credential-cpd)



* What languages does the service support?

The Speech to Text service supports both previous-generation and next-generation languages and models. Most languages support both broadband/multimedia and narrowband/telephony models, which have minimum sampling rates of 16 kHz and 8 kHz, respectively. For more information about the available models and the features they support for all languages, see the following topics:



* [Previous-generation languages and models](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-models)
* [Next-generation languages and models](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-models-ng)



* What are the input audio formats?

The service supports many audio formats (MIME types). Different formats support different sampling rates and other characteristics. By using a format that supports compression, you can maximize the amount of audio data that you can send with a request. For more information about the supported audio formats, see the following topics:



* [Audio terminology and characteristics](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-audio-terminology)
* [Supported audio formats](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-audio-formats)



* How much audio data can I submit to the service?

The amount of audio that you can submit with a single speech recognition request depends on the interface that you are using:



* The WebSocket and synchronous HTTP interfaces accept a maximum of 100 MB of audio data.
* The asynchronous HTTP interface accepts a maximum of 1 GB of audio data.
Server Side Excludes Toggles server-side excludes on or off. Server-side excludes gives you the ability to hide sensitive content from suspicious visitors, but keep it visible to normal visitors. SSE only works with HTML. 
 TLS Controls which TLS mode is used. 
 WAF Toggles WAF rules on or off. Individual WAF rules cannot be turned on or off using page rules. 
 Automatic HTTPS Rewrites Toggles automatic HTTPS rewrites on or off. Automatic HTTPS rewrites safely rewrite HTML source links from HTTP to HTTPS. 
 Opportunistic Encryption Toggles opportunistic encryption on or off. Opportunistic encryption allows clients to use traditionally insecure protocols over secure channels. 
 Cache Deception Armor Toggles cache deception armor on or off. Cache deception armor protects from web cache deception attacks while still allowing static assets to be cached. This setting checks that the URL's extension matches the returned content type. 
 Always Use HTTPS Converts any http:// URL to an https:// URL by creating a 301 redirect. Using this setting disables all other setting configurations for the rule because CIS forces a redirect to HTTPS for the request, which becomes a new request that is then evaluated against page rules. 
 True Client IP Header CIS sends the user's IP address in the True-Client-IP header. Enterprise only 







 Reliability 



Table 2. Reliability rules

 Setting Behavior Considerations 

 Serve Stale Content Keeps a limited version of the site online if the server goes down. For more information, view [Managing your CIS deployment for optimal reliability](https://cloud.ibm.com/docs/cis?topic=cis-manage-your-ibm-cloud-internet-services-deployment-for-optimal-reliability). 
 Origin Cache Control Determines what content is cached from the origin and how often the content is updated. For more information, view [Managing your CIS deployment for optimal reliability](https://cloud.ibm.com/docs/cis?topic=cis-manage-your-ibm-cloud-internet-services-deployment-for-optimal-reliability). 
 Forwarding URL URL to use in case the website is unavailable.
"email" : "cade@example.com",
}

// Sample NodeJS code on your server.
const jwt = require('jsonwebtoken');
const RSA = require('node-rsa');

const rsaKey = new RSA(process.env.PUBLIC_IBM_RSA_KEY);

/
* Returns a signed JWT. Optionally, adds an encrypted user_payload in stringified JSON.
/
function mockLogin(userID, userPayload) {
const payload = {
sub: userID, // Required
iss: 'www.ibm.com', // Required
acr: 'loa1' // Required
// A short-lived exp claim is automatically added by the jsonwebtoken library.
};
if (userPayload) {
// If there is a user payload, it is encrypted in base64 format using the IBM public key.
payload.user_payload = rsaKey.encrypt(userPayload, 'base64');
}
const token = jwt.sign(payload, process.env.YOUR_PRIVATE_RSA_KEY, { algorithm: 'RS256', expiresIn: '10000ms' });
return token;
}
Show more
3. From the Zendesk application, enable visitor authentication.



* From the Chat dashboard navigation pane, expand Settings, and then click Widget.
* Open the Widget security tab.
* In the Visitor Authentication section, click the Generate button.



For more information, see [Enabling authenticated visitors in the Chat widget](https://support.zendesk.com/hc/en-us/articles/360022185314-Enabling-authenticated-visitors-in-the-Chat-widget). You do not need to follow the steps to create a JWT. The Assistant service generates a JSON Web Token for you.
4.
The information being sent to Amplitude is not Content as defined in the Cloud Service Agreement (CSA); it is Account Usage Information as described in Section 9.d of the CSA and is handled accordingly as described in the [IBM Privacy Statement](https://www.ibm.com/privacy). The purpose of this information gathering is limited to establishing statistics about use and effectiveness of the web chat and making general improvements.





 Private network endpoints 

You can set up a private network for Watson Assistant instances that are part of a Plus or Enterprise service plan. Using a private network prevents data from being transferred over the public internet, and ensures greater data isolation.

![Plus or higher plans only](https://cloud.ibm.com/docs-content/v1/content/ca9232b3702768f24bb897f48f10778fcda28718/watson-assistant/images/plus.png) This feature is available only to users of paid plans.

Private network endpoints support routing services over the IBM Cloud private network instead of the public network. A private network endpoint provides a unique IP address that is accessible to you without a VPN connection.

For implementation details, see [Public and private network endpoints](https://cloud.ibm.com/docs/watson?topic=watson-public-private-endpoints).



 Important private network endpoint notes 



* The integrations that are provided with the product require endpoints that are available on the public internet. Therefore, any built-in integrations you add to your assistant will have public endpoints. If you only want to connect to a client application or messaging channel over the private network, then you must build your own custom client application or channel integration.
* Before you can use a search integration or search skill, you must create a Discovery instance with a private network endpoint. The list of Discovery instances that are displayed for you to connect to includes only instances with private network endpoints.









 Related topics 



* [Security architecture](https://www.ibm.com/cloud/architecture/architecture/practices/watson-security-architecture/): Describes the security components that are needed for secure cloud development, deployment, and operations.
CORS is supported by all current versions of commonly used browsers.

Versions of Microsoft™ Internet Explorer before version 10 offer partial support for CORS. Versions of Microsoft™ Internet Explorer before version 8 don't support CORS.





 Security 

Storing sensitive data in databases that can be accessed by using CORS is a potential security risk. When you place a domain in the list of allowed origins, you're trusting all the JavaScript from the domain. If the web application that runs on the domain is running malicious code or has security vulnerabilities, sensitive data in your database might be exposed.

Also, allowing scripts to be loaded by using HTTP rather than HTTPS, and then accessing data by using CORS, introduces the risk that a man-in-the-middle attack might modify the scripts.

To reduce the risk of man-in-the-middle attacks, follow these guidelines:



* Don't allow CORS requests from all origins. In other words, do not set "origins": [""] unless you're certain that you want to meet the following conditions:



* You want to allow all data in your databases to be publicly accessible.
* User credentials that give permission to modify data are never used in a browser.



* Allow CORS requests only from HTTPS origins, not HTTP.
* Ensure that web applications that run on allowed origin domains are trusted and do not have security vulnerabilities.



For more information, see the [API and SDK documentation](https://cloud.ibm.com/apidocs/cloudantgetcorsinformation) about the configuration endpoints for CORS.





 Dashboard 

CORS support is available in the IBM Cloudant Dashboard.

You can update your CORS settings by using the CORS tab within the dashboard. See the following screenshot:

Zoom

![CORS dashboard lets you connect to remote servers directly from the brower. Using CORS, you can host browser-based apps on static pages, and load data directly from IBM Cloudant.]
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to an arbitrary code execution in Gnome libxml2 (CVE-2022-40304)](https://www.ibm.com/support/pages/node/6967669)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Python Charmers Future (CVE-2022-40899)](https://www.ibm.com/support/pages/node/6967679)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass in Golang Go (CVE-2022-41716)](https://www.ibm.com/support/pages/node/6967671)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Golang Go (CVE-2022-41717)](https://www.ibm.com/support/pages/node/6967677)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Freedesktop D-Bus (CVE-2022-42010)](https://www.ibm.com/support/pages/node/6967691)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Freedesktop D-Bus (CVE-2022-42011)](https://www.ibm.com/support/pages/node/6967693)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Freedesktop D-Bus (CVE-2022-42012)](https://www.ibm.com/support/pages/node/6967695)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to cross-site scripting in GNOME libxml2 (CVE-2016-3709](https://www.ibm.com/support/pages/node/6967621)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in SQlite (CVE-2020-35525)](https://www.ibm.com/support/pages/node/6967623)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass in Amazon AWS S3 Crypto SDK for GoLang (CVE-2020-8912)](https://www.ibm.com/support/pages/node/6967631)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to elevated system privileges in the Red Hat Build of OpenJDK (CVE-2021-20264)](https://www.ibm.com/support/pages/node/6967637)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to an arbitrary code execution in e2fsprogs (CVE-2022-1304)](https://www.ibm.com/support/pages/node/6967639)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to errors in TrustCor (CVE-2022-23491)](https://www.ibm.com/support/pages/node/6967641)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in GnuTLS (CVE-2022-2509)](https://www.ibm.com/support/pages/node/6967643)
"message": "I'll transfer you to an agent"
},
"agent_unavailable": {
"message": "Sorry, I could not find an agent."
},
"message_to_human_agent": "The caller needs help resetting their password"
}
]
}
}
Show more

The connect_to_agent response type supports the following phone-specific properties.



 Parameter Default Description 

 service_desk.sip.uri N/A The SIP or telephone URI to transfer the call to, such as sip:12345556789@myhost.com or tel:+18883334444 
 service_desk.sip.transfer_headers N/A A list of custom header field name/value pairs to be added to a transfer request 
 service_desk.sip.transfer_headers_send_method custom_header The method by which the SIP transfer headers are sent:<br><br><br><br> * custom_header: Sends the transfer headers as part of the SIP message. This is the default value.<br> * contact_header: Sends the transfer headers in the Contact header.<br> * refer_to_header: Sends the transfer headers in the Refer-To header.<br><br><br> 



If you define a SIP URI as the transfer target, escape the at sign (@) in the URI by adding two backslashes (\) in front of it. This is to prevent the string from being recognized as part of the entity shorthand syntax.

"uri": "sip:12345556789\@myhost.com"



 Passing Watson Assistant Metadata in SIP Signaling 

To support loading the conversational history between the caller and Watson Assistant, the phone integration specifies a value for the User-to-User header as a key that can be used with the web chat integration. If User-to-User is specified in the transfer_headers list, the session history key is sent in the X-Watson-Assistant-Session-History-Key header.

The value of the SIP header is limited to 1024 bytes.
You can access the GLB URL http://<glb_name>.<your_domain_name>/hostname to view your application. Based on your location, you are redirected to the closest cluster or a cluster from the default pool if CIS was not able to map your IP address to a specific location.







 Step 4: Secure the application 



 Turn the Web Application Firewall On 

The Web Application Firewall(WAF) protects your web application against ISO Layer 7 attacks. Usually, it is combined with grouped rule-sets, these rule-sets aim to protect against vulnerabilities in the application by filtering out malicious traffic.



1. In the IBM Cloud Internet Services dashboard, navigate to Security, then on the WAF.
2. Ensure the WAF is On.
3. Click OWASP Rule Set. From this page, you can review the OWASP Core Rule Set and individually enable or disable rules. When a rule is enabled, if an incoming request triggers the rule, the global threat score will be increased. The Sensitivity setting will decide whether an Action is triggered for the request.



1. Leave default OWASP rule sets as it is.
2. Set Sensitivity to Low.
3. Set Action to Simulate to log all the events.



4. Click CIS Rule Set. This page shows additional rules based on common technology stacks for hosting websites.



For a secured connection with HTTPS, you can either obtain a certificate from [Let's Encrypt](https://letsencrypt.org/) as described in the following [IBM Cloud® blog](https://www.ibm.com/cloud/blog/secure-apps-on-ibm-cloud-with-wildcard-certificates) or through [IBM Cloud Secrets Manager](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-public-certificates&interface=ui).





 Increase performance and protect from Denial of Service attacks
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Freedesktop D-Bus (CVE-2022-42011)](https://www.ibm.com/support/pages/node/6967693)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Freedesktop D-Bus (CVE-2022-42012)](https://www.ibm.com/support/pages/node/6967695)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in MIT krb5 (CVE-2022-42898)](https://www.ibm.com/support/pages/node/6967697)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in libexpat (CVE-2022-43680)](https://www.ibm.com/support/pages/node/6967699)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to an arbitrary commands execution in Python (CVE-2015-20107)](https://www.ibm.com/support/pages/node/6981849)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary code execution in SQlite (CVE-2020-35527)](https://www.ibm.com/support/pages/node/6981851)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass in GNU Libtasn1 (CVE-2021-46848)](https://www.ibm.com/support/pages/node/6981853)
All credentials are sent over an encrypted connection that uses TLS v1.2 and are encrypted at rest with AES-256 encryption. Connections to data sources use the secure protocols that are supported by the data sources.





 Viewing collections that are connected to a gateway 

You can view a list of collections that are connected to a particular gateway. Complete the following steps to view collections that share a particular gateway:



1. From the My projects page, click Data usage and GDPR.
2. Click On premises.

Collections that share a common gateway are displayed in the Connected collections list.







 Connecting to data sources with IP restrictions 

Some data sources allow crawlers from only a limited number of trusted network addresses or domains to access and process their data. If one of the data sources that you want to connect to limits access in this way, you can add IBM-managed IP addresses to the allowlist of the data source.

Network addresses are subject to change from time to time. You can monitor for updates to these addresses by subscribing to the repo notifications for this page. Click Edit Topic and then select Watching in the Notifications dialog of the repo.



* For service instances that are hosted in a US-based data center and that were created on or after 1 May 2020, add the following IP addresses:

150.238.21.0/28
169.48.255.224/28
174.36.69.128/28
* For service instances that are hosted in non-US data centers and that were created on or after 21 February 2021, add the following IP addresses:

159.122.203.64/28
158.175.114.128/28
158.176.107.48/28
* For a list of IP addresses that you can add to an allowlist for services instances that were created before 1 May 2020 (US) and before 21 February 2021 (non-US), see the [network addresses](https://cloud.ibm.com/docs/cloud-foundry-public?topic=cloud-foundry-public-network-address) that are listed for Cloud Foundry.



* Refer to the Dallas data center IP addresses for all US-hosted service instances.
If you are using [https://cloudflareworkers.com](https://cloudflareworkers.com) to write and test your scripts, the request.cf content is not available in preview mode. You must be in production to run that content.

These properties contain special information from an incoming request to help with your app's logic. All plans have access to:



* asn: ASN of the incoming request (for example, 395747).
* colo: The three-letter airport code of the data center that the request hit (for example, "DFW").
* weight: The browser-requested weight for the HTTP/2 prioritization.
* exclusive: The browser-requested HTTP/2 exclusive flag (1 for Chromium-based browsers, 0 for others).
* group: HTTP/2 stream ID for the request group (non-zero only for Firefox).
* group-weight: HTTP/2 weight for the request group (non-zero only for Firefox).
* tlsCipher: The cipher for the connection to CIS (for example, "AEAD-AES128-GCM-SHA256").
* country: The two-letter country code of the incoming request. The same value is provided in the CF-IPCountry header (for example, "US").
* tlsClientAuth: Set only when enabled for mTLS. The object has the following properties: certIssuerDNLegacy, certIssuerDN, certIssuerDNRFC2253, certSubjectDNLegacy, certVerified, certNotAfter, certSubjectDN, certFingerprintSHA1, certNotBefore, certSerial, certPresented, certSubjectDNRFC2253
* tlsVersion: The TLS version of the connection to CIS (for example, TLSv1.3).



Standard and Enterprise plans have access to:
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to errors in TrustCor (CVE-2022-23491)](https://www.ibm.com/support/pages/node/6967641)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in GnuTLS (CVE-2022-2509)](https://www.ibm.com/support/pages/node/6967643)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to an arbitrary code execution in systemd (CVE-2022-2526)](https://www.ibm.com/support/pages/node/6967649)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to sensitive information exposure in AWS SDK for Go (CVE-2022-2582)](https://www.ibm.com/support/pages/node/6967651)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to denial of service in cURL libcurl (CVE-2022-32206)](https://www.ibm.com/support/pages/node/6967687)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a man-in-the-middle attack in cURL libcurl (CVE-2022-32208)](https://www.ibm.com/support/pages/node/6967655)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to spoofing attacks in GnuPG (CVE-2022-34903)](https://www.ibm.com/support/pages/node/6967657)
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in SQLite (CVE-2022-35737)](https://www.ibm.com/support/pages/node/6967659)
You can enable secure end-to-end encryption of your data when you use file shares with security-group-based access control mode and mount targets with virtual network interfaces. When such a mount target is attached and the share is mounted on a virtual server instance, the virtual network interface performs security group policy check to ensure only authorized instances can communicate with the share. The traffic between the authorized virtual server instance and the file share can be IPsec encapsulated by the client. For more information, see [Encryption in transit - Securing mount connections between file share and host](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-eit).

Encryption in transit is not supported between File Storage for VPC and Bare Metal Servers for VPC.