vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Viewer Not applicable 
 Operator Not applicable 
 Editor Not applicable 
 Administrator View and update IBM Cloud Shell settings 
 Cloud Operator Create Cloud Shell environments to manage IBM Cloud resources. 
 Cloud Developer Create Cloud Shell environments to manage IBM Cloud resources and develop applications for IBM Cloud (Web Preview enabled). 
 File Manager Create Cloud Shell environments to manage IBM Cloudresources and manage files in your workspace (File Upload and File Download enabled). 







 License and entitlement 

You can assign users access to manage licenses and entitlements within an account. Any member of an account can view and use an account’s entitlement.



Table 14. Roles and example actions for the license and entitlement service

 Roles Actions 

 Viewer Not applicable 
 Operator Not applicable 
 Editor Editors can create entitlements and view, update, bind, or delete only the entitlements they acquired. 
 Administrator Administrators can create entitlements and view, update, bind, or delete any entitlements in the account. 







 Partner Center 

You can give users access to view and edit partner profile details, offers, fast tracks, and to create and view support cases.



Table 15. Roles and example actions for the Partner Center service

 Roles Actions 

 Viewer View details about partner profile, offers, fast tracks, support cases. 
 Editor View and edit partner profile, offers, and fast tracks. Create, edit, and view support cases. 
 Operator 
 Administrator View and edit partner profile, offers, and fast tracks. Create, edit, and view support cases. 







 Partner Center - Sell 

You can give users access to onboard, validate, and publish products.



Table 16. Roles and example actions for the Partner Center - Sell service

 Roles Actions 

 Administrator Create, edit, validate, and publish products 
 Editor Validate and edit products 
 Approver Approves or rejects a workflow instance's task 







 Projects 

You can give users access to configure, validate, and monitor Infrastructure as Code (IaC) deployments.



Table 17. Roles and example actions for the Project service

 Roles Actions role_ID value 

 Viewer View details about projects, configurations, and deployments.
You can give users access to create, update, and delete resources for the Security and Compliance Center service in the account that you are assigned access.



Table 17. Roles and example actions for the Security and Compliance Center service

 Roles Actions 

 Viewer View available profiles and attachments<br><br>View created resources such as scopes, credentials, or rules<br><br>View global settings for the service 
 Operator Access the Security and Compliance Center dashboard to view current posture and results<br><br>Create an audit log for monitoring compliance activity 
 Editor Create, update, or delete objects such as scopes, credentials, and collectors<br><br>Update the parameter settings of a goal<br><br>Create, update, or delete rules and templates<br><br>Edit global admin settings for the service 
 Administrator Perform all platform actions based on the resource that this role is being assigned, including assigning access policies to other users. 
 Manager Permissions beyond the writer role to complete privileged actions as defined by the service. In addition, you can create and edit service-specific resources. 
 Reader Perform read-only actions within a service such as viewing service-specific resources. 
 Writer Permissions beyond the reader role, including creating and editing service-specific resources. 







 Software instance 

You can give users access to create, delete, or update a software instance. And, you can give users access to view the details page and the logs for the software instance.



Table 18. Roles and example actions for the Software instance service

 Roles Actions 

 Viewer View the software instance details page 
 Operator Update a software instance<br><br>View the details page for the software instance 
 Editor Create, delete, update a software instance<br><br>View the details page for the software instance 
 Administrator Create, delete, update a software instance<br><br>View the details page for the software instance<br><br>View the logs for the software instance<br><br>Assign IAM permissions 







 Support center 

You can give users access to manage support cases.



Table 19. Roles and example actions for the Support Center service

 Roles Actions 

 Viewer View cases<br><br>Search cases 
 Operator Not applicable
Reader Perform read-only actions within a service such as viewing service-specific resources. 
 Writer Permissions beyond the reader role, including creating and editing service-specific resources. 







 Software instance 

You can give users access to create, delete, or update a software instance. And, you can give users access to view the details page and the logs for the software instance.



Table 19. Roles and example actions for the Software instance service

 Roles Actions 

 Viewer View the software instance details page 
 Operator Update a software instance<br><br>View the details page for the software instance 
 Editor Create, delete, update a software instance<br><br>View the details page for the software instance 
 Administrator Create, delete, update a software instance<br><br>View the details page for the software instance<br><br>View the logs for the software instance<br><br>Assign IAM permissions 







 Support center 

You can give users access to manage support cases.



Table 20. Roles and example actions for the Support Center service

 Roles Actions 

 Viewer View cases<br><br>Search cases 
 Operator Not applicable 
 Editor View cases<br><br>Search cases<br><br>Update cases<br><br>Create cases 
 Administrator View cases<br><br>Search cases<br><br>Update cases<br><br>Create cases 



Assign users the viewer role on the user management service in addition to a support center access policy so the user can see all cases in the account regardless of user list visibility settings. If the user list visibility is set to be restricted, this can limit a user's ability to view, search, and manage support cases in an account that they didn't open themselves.





 User management 

You can give users access to view users in an account, invite and remove users, and view and update user profile settings.



Table 21. Roles and example actions for the User Management service

 Roles Actions 

 Viewer View users in the account<br><br>View user profile settings 
 Operator View users in the account<br><br>View user profile settings
A service key is a unique code that is passed in an API request to identify the calling application or user. The service key is specific to a logging instance. For more information on how to generate a service key, see [Managing service keys](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-service_keys).

KEY_NAME
: Name that you want to give the key. The maximum size of a name is 30 characters.





 Change the name of a key 

curl -X PUT https://API_ENDPOINT/v1/config/keys/KEY_ID
-H 'content-type: application/json' -H 'servicekey: SERVICE_KEY' -d '{"name": "KEY_NAME"}'

Where:

API_ENDPOINT
: Depending on [your account settings](https://cloud.ibm.com/docs/account?topic=account-service-endpoints-overview), you can use public or private endpoints to manage categories programmatically. For information about endpoints per region, see [API endpoints](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-endpointsendpoints_api).

SERVICE_KEY
: Service key value. A service key is a unique code that is passed in an API request to identify the calling application or user. The service key is specific to a logging instance. For more information on how to generate a service key, see [Managing service keys](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-service_keys).

KEY_ID
: ID value of the service key for which you want to get details.

KEY_NAME
: Name that you want to give the key. The maximum size of a name is 30 characters.





 Delete a key 

To delete an service key, run the following command.

curl -X DELETE "https://API_ENDPOINT/v1/config/keys/KEY_ID"
Managing user access 

IBM Watson® IoT Platform is deprecated. As of 30 April 2023, only subscribers on paid plans will be able to deploy new instances. The service will be fully withdrawn on 1 December 2023. Any instances that still exist on 1 December 2023 will be deleted. For more information, see [the deprecation details](https://cloud.ibm.com/docs/IoT?topic=IoT-deprecation).

This IBM Cloud® documentation collection pertains to the IBM Watson® IoT Platform Lite pricing plan and includes basic getting started information, API references, and general troubleshooting information. For the full Watson IoT Platform feature documentation, see the [Watson IoT Platform product documentation ![External link icon](https://cloud.ibm.com/docs-content/v1/content/icons/launch-glyph.svg)](https://www.ibm.com/support/knowledgecenter/SSQP8H/iot/overview/overview.html) on IBM Knowledge Center. More information about the various plans can be found in [Watson IoT Platform service plans](https://cloud.ibm.com/docs/services/IoT?topic=IoT-plans_overviewplans_overview).

From the Members page of the dashboard, you can control and manage access to your IBM Watson® IoT Platform organization. You can add users by adding, inviting, or importing them. You can also give different levels of access to your users by assigning roles.



 Adding users 

From the Members page of the dashboard, you can add individual members by using the Add function. You can also add members simultaneously by using the Import function.

By default, members accounts do not expire. When you add users to your Watson IoT Platform org, you can optionally set an expiry date for their account.



 Adding members to your Watson IoT Platform organization 

To add a member to your organization, you will need the IBMid of the member. To add a member, you do not need confirmation from the member.

To add a single member to your Watson IoT Platform organization:



1.
: Depending on [your account settings](https://cloud.ibm.com/docs/account?topic=account-service-endpoints-overview), you can use public or private endpoints to manage categories programmatically. For information about endpoints per region, see [API endpoints](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-endpointsendpoints_api).

SERVICE_KEY
: Service key value. A service key is a unique code that is passed in an API request to identify the calling application or user. The service key is specific to a logging instance. For more information on how to generate a service key, see [Managing service keys](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-service_keys).

KEY_ID
: ID value of the ingestion key for which you want to get details.

KEY_NAME
: Name that you want to give the key. The maximum size of a name is 30 characters.





 Delete a key 

To delete an ingestion key, run the following command.

curl -X DELETE "https://API_ENDPOINT/v1/config/keys/KEY_ID"
-H 'content-type: application/json' -H 'servicekey: SERVICE_KEY'

Where:

API_ENDPOINT
: Depending on [your account settings](https://cloud.ibm.com/docs/account?topic=account-service-endpoints-overview), you can use public or private endpoints to manage categories programmatically. For information about endpoints per region, see [API endpoints](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-endpointsendpoints_api).

KEY_ID
: ID value of the ingestion key to be deleted.

SERVICE_KEY
: Service key value. A service key is a unique code that is passed in an API request to identify the calling application or user. The service key is specific to a logging instance.
The action is specified to one of the following valid action types: start, stop, and reboot.
* The target field contains information about the top-level resources, for example, VPC, subnets, and instances (virtual machine). For subresources, such as volume-attachments and security-group rules, their unique identifier can be found from the responseData.responseURI field. The mapping to the parent resources is reflected by the URI.
* For events that are related to volume-attachments, the ID of the volume that was attached can be found indirectly by getting the ID of the volume-attachment from the target.responseURI field (which also contains the instance ID), and by using that ID to query the corresponding GET /instance/{instance_id}/volume-attachment/{volume-attachment-id} API. The volume ID can be found from the response of the GET API call.
* For events that are related to Load Balancer requests, consider the following information:

You can get more data in the requestData.requestPath field. You can find details about a subresource such as a listener ID or rule ID.

When you create resources, you can get IDs from the responseData.responseContent field.

For update actions, the original value is not included. You can do a read action to get the value before you run an update on the resource.
* The following fields for Bare Metal Servers for VPC AT events are changing between the Beta and LA releases:



1. The severity field in Beta events is not consistent with general practice within VPC and is corrected in the LA release.
2. The target resourceGroupID field in Beta events does not include the CRN prefix. This is corrected in the LA release.
3. Some Beta events include array data. If the array is too large, the event isn't be recorded. For LA, these events display an array element count rather than the actual data.



* Each time you open a console for a virtual server instance or bare metal server, two API calls are issued: the first one generates a console access token, the second one uses the generated token to open the console websocket.
[checkmark icon](https://cloud.ibm.com/docs-content/v1/content/f16b1f78a92498247223b337bd9303c2758b9ba8/icons/checkmark-icon.svg) 



You cannot subsequently download files that you add to Discovery because the original files are not stored in Discovery. However, you can retrieve information from the file that is stored in the collection index when the original file is processed. Use the [Query API](https://cloud.ibm.com/apidocs/discovery-dataquery) to submit a query that will return a passage from the file of interest, and then check the response body for data from the file. For example, for some file types, text from the original file is stored in the text field.

For information about resources that are created with the Content Mining application, see [Content Mining resources](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-recoverycm-resources).



 Ingested documents 

Your uploaded documents are converted, enriched, and stored in the search index. If a disaster occurs, the search index is not recoverable. Store a backup of all your source documents in a safe place.

If you also import documents by doing scheduled crawls of external data sources, you might want to retain your data source credentials externally so that you can reestablish the connection to your data sources quickly. For the list of available sources and the credentials that are needed for each one, see [Configuring IBM Cloud data sources](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-sources).

You can get some of the text that was stored in the index when the original document was ingested by using the Query API. For more information, see [Recovering documents](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-migrate-to-v2migrate-to-v2-advanced-transfer).





 Training data 

Refer to this task to back up your training data queries and examples for a trained project.
* You must have an IBM Cloud Activity Tracker instance provisioned in your account that has [archiving configured to a bucket in the COS instance in your account](https://cloud.ibm.com/docs/services/activity-tracker?topic=activity-tracker-archiving).

Events are archived daily to a file in a COS bucket.

Notice that if archiving is not configured, you must wait at least 24 hours before an archive file is available after archiving is configured.
* You must have 1 or more archive files uploaded in the bucket.
* You must have a policy on the COS service with at least platform role reader so that you can view data in the COS bucket where the archive files are uploaded.
* You must have a policy on the COS instance with at least Writer access to at least one COS bucket so that result files (files containing output data) can be written there.







 Step 1. Provisioning an Data Engine instance 

To query archive files hosted in a COS bucket, you can use the Data Engine service.

You must provision the Data Engine service in the same account where the COS instance that manages the bucket with the archive files is available.

To provision an instance, see [Create your Data Engine service instance](https://cloud.ibm.com/docs/sql-query?topic=sql-query-getting-started).

Once you have Data Engine running on IBM Cloud, you can immediately start querying your data by using the Data Engine UI, or programmatically by using either [the Data Engine REST API](https://cloud.ibm.com/apidocs/sql-query), or the Python ibmcloudsql library.





 Step 2. Granting user permissions to run a query 

To run queries with the SQL query service, a user needs a platform role and a service role. The following tables show the roles and actions that you can assign a user to run SQL queries:



Table 1. Platform roles

 Platform actions Administrator Editor Operator Viewer 

 View details of the Data Engine service instance !
Administrator Administrators can create entitlements and view, update, bind, or delete any entitlements in the account. crn:v1:bluemix:public:iam::::role:Administrator 







 Partner Center 

You can give users access to view and edit partner profile details, offers, fast tracks, and to create and view support cases.



Table 15. Roles and example actions for the Partner Center service

 Roles Actions role_ID value 

 Viewer View details about partner profile, offers, fast tracks, support cases. crn:v1:bluemix:public:iam::::role:Viewer 
 Editor View and edit partner profile, offers, and fast tracks. Create, edit, and view support cases. crn:v1:bluemix:public:iam::::role:Editor 
 Operator 
 Administrator View and edit partner profile, offers, and fast tracks. Create, edit, and view support cases. crn:v1:bluemix:public:iam::::role:Administrator 







 Partner Center - Sell 

You can give users access to onboard, validate, and publish products.



Table 16. Roles and example actions for the Partner Center - Sell service

 Roles Actions role_ID value 

 Administrator Create, edit, validate, and publish products 
 Editor Validate and edit products crn:v1:bluemix:public:iam::::role:Editor 
 Approver Approves or rejects a workflow instance's task crn:v1:bluemix:public:product-lifecycle::::serviceRole:LifecycleApprover 







 Projects 

You can give users access to configure, validate, and monitor Infrastructure as Code (IaC) deployments.



Table 17. Roles and example actions for the Project service

 Roles Actions role_ID value 

 Viewer View details about projects, configurations, and deployments. crn:v1:bluemix:public:iam::::role:Viewer
After the instance is created, associate a floating IP address to the instance. Then, you can connect to your instance. For more information, see [Connecting to your Linux instance](https://cloud.ibm.com/docs/vpc?topic=vpc-vsi_is_connecting_linux) or [Connecting to your Windows instance](https://cloud.ibm.com/docs/vpc?topic=vpc-vsi_is_connecting_windows).





 Creating a virtual server instance by using the API 

You can create instances by using the API.



 Before you begin 

Ensure that you have the required access. To call these methods, you must be assigned one or more IAM access roles that include the following actions, depending on any listed conditions. You can check your access by going to the Users page of [Cloud Identity and Access Management dashboard](https://test.cloud.ibm.com/iam/overview).





 Gathering information to create an instance by using the API 

Before you can create an instance, you need to know the details about the instance, such as the instance profile or the image that you want to use. Gather information by making the following API calls:



Table 2. Required instance details api

 Instance details Listing options API spec documentation 

 Image GET /images [List all images](https://cloud.ibm.com/apidocs/vpc/latestlist-images) 
 Profile GET /instance/profiles [List all instance profiles](https://cloud.ibm.com/apidocs/vpc/latestlist-instance-profiles) 
 Key GET /keys [List all keys](https://cloud.ibm.com/apidocs/vpc/latestlist-keys) 
 VPC GET /vpcs [List all VPCs](https://cloud.ibm.com/apidocs/vpc/latestlist-vpcs) 
 Subnet GET /subnets [List all subnets](https://cloud.ibm.com/apidocs/vpc/latestlist-subnets)
Imagine a scenario where you want to complete developer-related tasks, like working with the service instances from your application components. You can select the Developer profile when logging in to ensure that you have the access you need.

Similarly, if you want to complete an administrator-related task, you can select the Admin profile that has privileged permissions. This way, you reduce the risk of taking privileged actions by mistake.

You also have the option to log in to the account without applying a profile by continuing to the console.

To learn more about how trusted profiles work check out our IBM Cloud Identity and Access Management documentation which includes tutorials and other helpful resources to get started!







 Compute resources 

By using trusted profiles, you can define fine-grained authorization for all applications that are running in a compute resource without creating service IDs or managing the API key lifecycle for applications. The trusted profiles provide better control for granting access to compute resources.



* Application developers can programmatically retrieve a token that is associated with the compute resource identity that they are running on. That token is used to get the trusted profile identity token, which is used to access services and resources on IBM Cloud.
* Applications running on a compute resource can have a flexible, but secure way to access other IBM Cloud services from within compute resources. For example, it's more secure not having to store API keys.
* All compute resource instances that share certain conditions such as name, namespace, tags, or location, their identities are mapped to a common profile and can share access to IBM Cloud resources. This common identity makes it possible to give the applications within various compute resources access to an external resource one time rather than cluster-by-cluster.









 API keys for user authentication 

You can create multiple API keys for a user to support key rotation scenarios, and the same key can be used for accessing multiple services. IBM Cloud API keys enable users who use two-factor authentication or a federated ID to automate authentication to the console from the command line. A user can also have a single classic infrastructure API key that can be used to access classic infrastructure APIs; however, this is not required as you can use IBM Cloud API keys to access the same APIs.