vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Managing archiving by using the API 

You can archive events from an IBM Cloud Activity Tracker instance into a bucket in an IBM Cloud Object Storage (COS) instance by using an API.



 Prerequisites on the IBM Cloud Activity Tracker service 



* You must have a paid service plan for the IBM Cloud Activity Tracker service. [Learn more](https://cloud.ibm.com/docs/services/activity-tracker?topic=activity-tracker-service_planservice_plan).
* Check that your user ID has permissions to manage archiving. The following table lists the minimum roles that a user must have to manage archiving by using the API:





Table 1. IAM roles

 Role Permission granted 

 Platform role: Viewer Allows the user to view the list of service instances. 
 Service role: Manager Allows the user to manage archiving by using the API. 



For more information on how to configure policies for a user, see [Granting user permissions to a user or service ID](https://cloud.ibm.com/docs/services/activity-tracker?topic=activity-tracker-iam_view_eventsiam_view_events).

You must have a COS bucket configured, and the details of the service credential that you must use to write data to the bucket. For more information on creating buckets, see [Create some buckets to store your data](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-getting-started-cloud-object-storage).





 Get details of the archiving configuration 

Use [this method](https://cloud.ibm.com/apidocs/activity-trackerget-v1-config-archiving) to get the details about an existing archiving configuration.

curl -X GET https://<ENDPOINT>/v1/config/archiving
-H "content-type: application/json"
-H "servicekey: <SERVICE_KEY>"



* Replace <ENDPOINT> with the IBM Cloud Activity Tracker API endpoint.
For administrators 

Storage and system administrators familiar with IBM Cloud® Object Storage can easily and conveniently manage users, create and rotate API keys, and grant roles to users and services.

If you haven't already, go ahead and read through the [getting started tutorial](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-getting-started-cloud-object-storage) to familiarize yourself with the core concepts of buckets, objects, and users.



 Set up your storage 

First, you need to have at least one Object Storage resource instance, and some buckets to store data in. How do you want to segment access to your data? Where do you want your data to physically reside? How often will the data is accessed?



 Segmenting access 

You can segment access at two levels: at the resource instance level and at the bucket level.

Perhaps you want to make sure that only a development team can access particular instances of Object Storage. Or, you want to ensure that only the application your team is making can edit the data that is stored. You might want your developers with access to the cloud platform to only be able to read data for troubleshooting reasons, but not change anything. These are examples of service level policies.

Now what if the development team, or any individual user, who has viewer access to a storage instance, but should be able to directly edit data in one or more buckets? You can use bucket level policies to elevate the level of access that is granted to users within your account. For instance, a user might not be able to create new buckets, but can create and delete objects within existing buckets.







 Manage access 

IAM is based on a fundamental concept: A subject is granted a role on a resource.

There are two basic types of subjects: a user and a service ID.

There is another concept, a service credential. A service credential is a collection of important information that is needed to connect to an instance of IBM Cloud® Object Storage.
Configuring archiving through the UI 

You can archive events from an IBM Cloud Activity Tracker instance into a bucket in an IBM Cloud Object Storage (COS) instance.

For more information about archiving, see [Archiving events to IBM Cloud Object Storage](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-archiving-ov).

Complete the following steps to archive an IBM Cloud Activity Tracker instance into a bucket in an IBM Cloud Object Storage instance:



 Prerequisites on the IBM Cloud Activity Tracker service 



* You must have a paid service plan for the IBM Cloud Activity Tracker service. [Learn more](https://cloud.ibm.com/docs/services/activity-tracker?topic=activity-tracker-service_planservice_plan).
* Check that your user ID has permissions to launch the web UI and configure archiving. The following table lists the minimum roles that a user must have to be able to launch the IBM Cloud Activity Tracker web UI, and configure archiving through the UI or by using the API:





Table 1. IAM roles

 Role Permission granted 

 Platform role: Viewer Allows the user to view the list of service instances in the Observability dashboard. 
 Service role: Manager Allows the user to launch the web UI and configure archiving through the web UI or by using the API. 



For more information on how to configure policies for a user, see [Granting user permissions to a user or service ID](https://cloud.ibm.com/docs/services/activity-tracker?topic=activity-tracker-iam_view_eventsiam_view_events).





 Step 1. Grant IAM policies to a user to work with IBM Cloud Object Storage 

Note: This step must be completed by the account owner or an administrator of the IBM Cloud Object Storage service on the IBM Cloud.

As an administrator of the IBM Cloud Object Storage service, you must be able to provision instances of the service, grant other users permissions to work with these instances, and create service IDs.

There are different ways in which you can grant a user permission to become an editor of the IBM Cloud Object Storage service:
Troubleshooting for toolchains 

General problems with using toolchains might include tool integration configuration or toolchain template issues. In many cases, you can recover from these problems by following a few easy steps.



 Why can't I create a toolchain from a template that uses a private repo in a different region? 

The toolchain template that you are using references a private Git Repos and Issue Tracking repo.

 What’s happening 

Git Repos and Issue Tracking is region-specific. When you try to create a toolchain from a template and target a region that the private repo isn't located in, the Git integration setup fails.

 Why it’s happening 

When you add a Git Repos and Issue Tracking repo to a toolchain in a specific region, your IBM ID is mapped to a GitLab user name that gives you access to GitLab in that region. Even though your GitLab user name appears the same in all regions, the associated GitLab user is different in each region because each region has a separate installation of GitLab. Access to GitLab users in other regions isn't automatically granted to toolchains even when the GitLab user name appears to be the same.

 How to fix it 

Make the Git Repos and Issue Tracking repo public so that it can be accessed from anywhere, including other IBM Cloud regions.

If the repo must be private, the repo owner can grant access to it by creating a [personal access token](https://cloud.ibm.com/docs/services/ContinuousDelivery?topic=ContinuousDelivery-git_workingcreate_pat) on the GitLab server where the source repo is located. You need access only to the private repo to clone the content during the toolchain creation. The personal access token can be created with an expiry date to limit its lifetime to expire after one day.

After you have a personal access token, you can create a URL to access the repo from other regions. While you are configuring the tool integration, in the Source repository URL field, update the repo URL to use your user name and access token.
To grant a user access to 1 or more teams, an administrator must grant the user a policy for each team that the user needs access to. By using individual policies for each team, administrators can define different service access and permissions levels to work with data in the monitoring instance.

For example, a user that needs to work in a team requires the following policies:



* A policy with a platform role viewer to allow the user to see monitoring instances in the IBM Cloud.
* A policy to grant the user access to 1 team. The service role determines the permissions of the user to work with data that is in scope for the team.



Complete the following steps to grant a user or service ID permissions to work with the IBM Cloud Monitoring service within the context of a team:



 Prerequisites 

Your user ID needs administrator platform permissions to manage the IBM Cloud Monitoring service. The account owner can grant user access to the account for the purposes of managing user access and managing account resources. [Learn more](https://cloud.ibm.com/docs/account?topic=account-userroles).





 Step 1. Create an access group 

Do the following to create an access group:



1. From the menu bar, click Manage > Access (IAM), and select Access Groups.
2. Click Create.
3. Enter a name and optional description for your group, and click Create.



You can delete a group by selecting the Remove group option. When you remove a group from the account, you are removing all users and service IDs from the group and all access that is assigned to the group.

To create an access group by using the CLI, you can use the [ibmcloud iam access-group-create](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_iamibmcloud_iam_access_group_create) command.

ibmcloud iam access-group-create GROUP_NAME [-d, --description DESCRIPTION]





 Step 2. Add permissions to view Monitoring instances in the Observability UI 

After you set up your group, you can assign a common access policy to the group.
* Standard-member: A standard-member role allows a user to monitor data through views, dashboards, screens, and alerts, and to manage resources such as dashboards, and alerts that are in scope for the group.
* Reader: A reader role allows a user to monitor data through views, dashboards, screens, and alerts that are in scope for the group.
* Manager: The manager role is an instance level role that grants administrative permissions. If you grant this role in a policy for a group, you are granting admin permissions over the instance to the users that belong to that group. Managers can see all log data.



You can define in the Activity Tracker UI more groups to define different levels of access to data per group and set of users.

To grant a user access to 1 or more groups, an administrator must grant the user a policy for each group that the user needs access to. By using individual policies for each group, administrators can define different service access and permissions levels to work with data in the auditing instance.

For example, a user that needs to work in a group requires the following policies:



* A policy with a platform role viewer to allow the user to see auditing instances in the IBM Cloud.
* A policy to grant the user access to 1 group. The service role determines the permissions of the user to work with data that is in scope for the group.



Complete the following steps to grant a user or service ID permissions to work with the IBM Cloud Activity Tracker service within the context of a group.



 Prerequisites 

Your user ID needs administrator platform permissions to manage the IBM Cloud Activity Tracker service. The account owner can grant user access to the account for the purposes of managing user access and managing account resources. [Learn more](https://cloud.ibm.com/docs/account?topic=account-userroles).





 Step 1. Create an IAM access group 

Do the following to create an access group:



1. From the menu bar, click Manage > Access (IAM), and select Access Groups.
2. Click Create.
3. Enter a name and optional description for your group, and click Create.
Searching logs by using queries 

Through the IBM Log Analysis web UI, you can apply search and filtering criteria to define the set of logs that are displayed through a custom view.



 Prerequisites 

Before you start, check that your user ID has permissions to launch the web UI and view events. The following table lists the minimum roles that a user must have to be able to launch the IBM Log Analysis web UI, and view, search, and filter events:



Table 1. IAM roles

 Role Permission granted 

 Platform role: viewer Allows the user to view the list of service instances in the Observability dashboard. 
 Service role: reader Allows the user to launch the web UI and view events in the web UI. 
 Service role: standard-member Allows the user save a view based on a search. 



For more information on how to configure policies for a user, see [Granting user permissions to a user or service ID](https://cloud.ibm.com/docs/services/log-analysis?topic=log-analysis-iam_view_eventsiam_view_events).





 Step 1. Go to the web UI and select a view 

Complete the following steps:



1. [Go to the web UI](https://cloud.ibm.com/docs/services/log-analysis?topic=log-analysis-launchlaunch).
2. Click the Views icon ![Views icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/images/views.png).
3. Select Everything or a view.







 Step 2. Select the set of logs to display through a view by applying a search query 

To search for specific logs, you can apply a search query.



* You can do simple searches (single term string search), compound search (multiple search terms and operators), field searches if the log line can be parsed, and others.
* AND and OR operators are case-sensitive and must be capitalized.
Searching events by using queries 

Through the IBM Cloud Activity Tracker web UI, you can apply search and filtering criteria to define the set of events that are displayed through a custom view.



 Prerequisites 

Before you start, check that your user ID has permissions to launch the web UI and view events. The following table lists the minimum roles that a user must have to be able to launch the IBM Cloud Activity Tracker web UI, and view, search, and filter events:



Table 1. IAM roles

 Role Permission granted 

 Platform role: viewer Allows the user to view the list of service instances in the Observability dashboard. 
 Service role: reader Allows the user to launch the web UI and view events in the web UI. 
 Service role: standard-member Allows the user save a view based on a search. 



For more information on how to configure policies for a user, see [Granting user permissions to a user or service ID](https://cloud.ibm.com/docs/services/activity-tracker?topic=activity-tracker-iam_view_eventsiam_view_events).





 Step 1. Go to the web UI and select a view 

Complete the following steps:



1. [Go to the web UI](https://cloud.ibm.com/docs/services/activity-tracker?topic=activity-tracker-launchlaunch).
2. Click the Views icon ![Views icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/images/views.png).
3. Select Everything or a view.







 Step 2. Select the set of events to display through a view by applying a search query 

To search for specific events, you can apply a search query.



* You can do simple searches (single term string search), compound search (multiple search terms and operators), field searches if the log line can be parsed, and others.
* AND and OR operators are case-sensitive and must be capitalized.
Tokens are issued through the App ID OAuth Server and are formatted as [JSON Web Tokens (JWT)](https://jwt.io/introduction/). The tokens were signed with a [JSON Web Key (JWK)](https://datatracker.ietf.org/doc/html/rfc7517) with the RS256 algorithm.





 What happens to the information that the token contains? 

The access token contains a set of standard JWT claims and a set of App ID specific claims such as a tenant ID. The identity token contains user-specific information. The information in the tokens is stored as claims as part of a [user's profile](https://cloud.ibm.com/docs/appid?topic=appid-profiles).





 How are tokens received? 

The tokens are received by your app after a successful authentication. Your app can use the tokens to retrieve information about user authorization and authentication. The access token can be used to gain access to protected resources by sending a request to the resource. To extract the tokens, your app must parse the header.

Example request:

GET /resource HTTP/1.1
Host: server.example.com
Authorization: Bearer mF_9.B5f-4.1JqM mF_9.B5f-4.1JqM





 How are tokens configured? 

You can customize tokens by using custom claims mapping. For more information, see [Customizing tokens](https://cloud.ibm.com/docs/appid?topic=appid-customizing-tokens).
A policy assigns a user, service ID, or trusted profile one or more roles with a combination of attributes that define the scope of access. The policy can provide access to a single service down to the instance level, or the policy can apply to a set of resources organized together in a resource group. Depending on the user roles that you assign, the user, service ID, or trusted profile is allowed varying levels of access for completing platform management tasks or accessing a service by using the UI or performing specific types of API calls.

Zoom

![Diagram of IAM model](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/solution20-users-teams-applications/IAM-access-groups-diagram.svg)

How IAM access works in an account by using access groups





 Create the resources for one environment 

Although the three environments needed by this sample project require different access rights and may need to be allocated different capacities, they share a common architecture pattern.

Zoom

![Architecture diagram showing one environment](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/solution20-users-teams-applications/one-environment.svg)

Architecture diagram showing one environment

Let's start by building the Development environment. Note that IBM Cloud Container Registry is always present and you don't need to provision it.



1. Most cloud service instances are regional. Keep this in mind and choose the same region for all resources in this tutorial.
2. [Create a resource group for the environment](https://cloud.ibm.com/account/resource-groups).
3. Create an instance of [IBM Cloud Activity Tracker](https://cloud.ibm.com/observe/activitytracker/create) for the region to allow the audit of all API calls for the region.
4.
* [Access the Key Protect GUI](https://cloud.ibm.com/docs/key-protect?topic=key-protect-view-keysview-keys-gui) to browse the keys that are stored in your Key Protect instance.
* [Use the Key Protect API](https://cloud.ibm.com/docs/key-protect?topic=key-protect-view-keysretrieve-keys-api) to retrieve a list of your keys, along with metadata about the keys.







 Step 2. Create an access policy 

You can create an access policy for a key by targeting the instance and the key by:



1. From the menu bar, click Manage > Access (IAM), and select Users to browse the existing users in your account.
2. Select a table row, and click the ⋯ icon to open a list of options for that user.
3. From the options menu, click Assign access.
4. Click Assign access to the users.
5. From the list of services, select Key Protect.
6. From the list of Key Protect instances, select the Key Protect instance that contains the key that you want to grant access to.
7. Select Resources based on selected attributes.
8. Click the Instance ID box and select the instance in which the key ring resides from the drop-down list.
9. Click the Resource type box and enter key.
10. Click the Resource ID box enter the ID that was assigned to your key by the Key Protect service.
11. Choose a combination of [platform and service access roles](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-accessmanage-access-roles) to assign access for the user.
12. Click Add.
13. Continue to add platform and service access roles as needed. When you are finished, click Assign.



Zoom

![The image shows an example of how to grant user access to a key.]
Managers in the Access Management application are able to grant existing users access to the customer they are managing. This process is similar to adding a new user to the Access Management tool. Once a user is granted access to a customer they can submit access requests for that customer. All access requests must be approved by a Manager User for that customer before they are granted.

Follow these steps to grant a user access to the customer you are assigned to manage.



1. Sign into the Self-Service Portal: [https://devops.maximo.com](https://devops.maximo.com)
2. Navigate to the Access Management tool.

![SSP-AM-Grant-User-Customer-1](https://cloud.ibm.com/docs-content/v1/content/bd177462727ef0a849ddcf8c842a6203b41f0625/mas-ms/images/SSP-AM-Grant-User-Customer-1.png)
3. Click on the Plus (+) icon.

![SSP-AM-Grant-User-Customer-2](https://cloud.ibm.com/docs-content/v1/content/bd177462727ef0a849ddcf8c842a6203b41f0625/mas-ms/images/SSP-AM-Grant-User-Customer-2.png)
4. Enter the following information for the user you are granting customer access to. During this process a question mark (?) icon will pop up in the IBMid field.

If a question mark icon does not pop up in the IBMid field, the user does not exist yet. Follow the steps in the [How to Create a New User](https://cloud.ibm.com/docs/mas-ms?topic=mas-ms-sspcreate-new-user-am-tool) document to create the new user. The process of creating a new user will also grant the user access to the customer you are managing.



 Value Description
Accessing images from your account with an API key 

If you are accessing Code Engine with the CLI, you must first create an IAM API key and then [save the IAM API key as registry access](https://cloud.ibm.com/docs/codeengine?topic=codeengine-add-registryadd-registry-access-ce) in Code Engine.

The following steps create an API key that stores the credentials of a user ID. Instead of using a user ID, you might want to create an API key for a service ID that has an IBM Cloud IAM service access policy to IBM Cloud Container Registry. If you choose to authenticate a user ID, make sure that the user is a functional ID or plan for cases where the user leaves so that Code Engine can still access the registry.



 Creating an API key from the console 

To create an IBM Cloud IAM API key from the console,



1. Launch [Access (IAM) Overview](https://cloud.ibm.com/iam/overview).
2. Select API keys.
3. Click Create an IBM Cloud API key.
4. Enter a name and optional description for your API key and click Create.
5. Copy the API key or click download to save it.

You won’t be able to see this API key again, so be sure to record it in a safe place.



Now that you created your API key, [save it as registry access](https://cloud.ibm.com/docs/codeengine?topic=codeengine-add-registryadd-registry-access-ce).





 Creating an API key with the CLI 

To create an IBM Cloud IAM API key with the CLI, run the [iam api-key-create](https://cloud.ibm.com/docs/account?topic=cli-ibmcloud_commands_iamibmcloud_iam_api_key_create) command. For example, to create an API key called cliapikey with a description of "My CLI API key" and save it to a file called key_file, run the following command: