vania-janet/multiturn-rag-retrieval-data huggingface dataset:
The Secure Gateway client uses outbound port 443 and port 9000 to connect to npm registry and the IBM Cloud® environment as mentioned in the [network requirement](https://cloud.ibm.com/docs/services/SecureGateway?topic=SecureGateway-client-requirementsnetwork-requirements). If the Secure Gateway client use the proxy for the outbound request, you can use following option to define the proxy configuration.



 Port 443 for gateway authentication connection and port 9000 for WSS connection 

You can use the [startup option](https://cloud.ibm.com/docs/services/SecureGateway?topic=SecureGateway-client-interactingstartup-args)--proxy to define the proxy agent for the outbound request to the Secure Gateway server, for example, if you are using the auto-start [configuration file](https://cloud.ibm.com/docs/services/SecureGateway?topic=SecureGateway-auto-start-confauto-start-linux):

SECGW_ARGS="--no_license --l $LOGLEVEL -x <proxy_info> --service"

Note:

For the Secure Gateway client v182fp2 and former, the proxy option only support for the port 9000 wss connection, if you want to define the proxy for the port 443 gateway authentication connection, you can add the environment variable http_proxy or https_proxy to the configuration file, for example:

SECGW_ARGS="--no_license --l $LOGLEVEL -x http://prox-server:3128 --service"
export http_proxy=http://prox-server:3128

Or you can define the environment variable before starting the interactive command line interface.





 Port 443 for npm module installation 

For the Secure Gateway client v185 and later, You can define the proxy option for the npm module installation during the Secure Gateway client installation. For example (MacOX):

Enter the gateway IDs, separated by spaces: <gateway_id>
INFO: The gateway ID for this install is: <gateway_id>
To pass artifacts between jobs, separate the jobs into two stages, and use the output from the job in the first stage as input to the second stage.

For more information about pipeline jobs, see [Jobs](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-deliverypipeline_aboutdeliverypipeline_jobs).
* Is there a maximum time limit that my pipeline jobs can run?

The lengths of Classic pipeline jobs and Tekton pipeline runs are determined by the private worker that the pipeline run occurs on. On IBM Managed workers, this value is 6 hours. On self-managed [Delivery Pipeline Private Workers](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-install-private-workers), the default length of time for a pipeline run is 24 hours.
* How secure are the pipeline secure properties?

Pipeline secure properties are encrypted by using AES-128, and decrypted immediately before they are passed to your pipeline script. These properties are also masked by using asterisks in the properties user interface and in your pipeline log files. Before data is written to the log file for your pipeline job, it is scanned for exact matches to all of the values in the pipeline secure properties. If a match is found, it is masked by using asterisks. Be careful when you are working with secure properties and log files since only exact matches are masked.
* How do I find information about the environment variables that are used in pipeline jobs?

For information about the environment properties and resources that are available by default in pipeline environments, see [Environment properties and resources](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-deliverypipeline_environmentdeliverypipeline_environment).
* Can I use the IBM Cloud CLI to run a pipeline stage?

You can use the IBM Cloud developer tools CLI plug-in to run a pipeline stage.



1. [Install the IBM Cloud developer tools CLI plug-in](https://cloud.ibm.com/docs/cli?topic=cli-install-devtools-manually).
If you change any of the arguments in the initialization block, Terraform deletes the tool integration from the toolchain and creates a replacement tool integration. All of the arguments in the initialization block are annotated with the Terraform behavior Forces new resource.

By contrast, arguments in the parameters block influence how the tool integration works after it is initialized. If an argument is not annotated with Forces new resource and you change the argument, Terraform applies the change to the existing tool integration. It does not delete and re-create the tool integration.

If you change any resource argument that is annotated with Forces new resource, Terraform deletes and re-creates the resource, irrespective of the block that contains the argument.

For more information about the Git tool integration Terraform resources, see the following Terraform Registry documentation:



* [ibm_cd_toolchain_tool_bitbucketgit](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/cd_toolchain_tool_bitbucketgit)
* [ibm_cd_toolchain_tool_githubconsolidated](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/cd_toolchain_tool_githubconsolidated)
* [ibm_cd_toolchain_tool_gitlab](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/cd_toolchain_tool_gitlab)
* [ibm_cd_toolchain_tool_hostedgit](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/cd_toolchain_tool_hostedgit)







 What type of authentication should I use to access GitHub repos from my toolchain? 

Before you can use a repo integration, you must authorize it so that IBM Cloud can access your GitHub account by using one of the following authentication methods.
ignore_speech Whether to disable speech recognition during collection of DTMF digits, until either the collection completes or a timeout occurs. If this parameter is true, speech recognition is disabled automatically when the first DTMF signal is received. no false 
 stop_after_collection Whether to stop DTMF input when the DTMF collection completes. After this command, all DTMF input is ignored until it is reenabled using the start response type. no false 







 command_info.type : disable_barge_in 

Disables DTMF barge-in so that playback from the phone integration is not interrupted when callers press keys. If disable_barge_in is enbaled, keys pressed during playback are ignored.

This command has no parameters.





 command_info.type : enable_barge_in 

Enables DTMF barge-in so that callers can interrupt playback from the phone integration by pressing a key.

This command has no parameters.





 command_info.type : send 

Sends DTMF signals using the phone integration.

This command supports the following parameters:



 parameter description required default 

 digits An array of JSON objects where each element represents a DTMF tone to be sent to a caller. yes n/a 
 digits[].code The event code to send. In addition to the digits 0 through 9, you can specify the following codes:<br><br><br><br> * 10: <br> * 11: <br> * 12: A<br> * 13: B<br> * 14: C<br> * 15: D<br><br><br> yes n/a 
 digits[].duration The duration (in milliseconds) of the event. no 200 
 digits[].volume The power level of the tone, in dBm0. The supported range is 0 to -63 dBm0. no 0 
 send_interval An interval (in milliseconds) to wait before sending the next DTMF tone in the list. no 200 







 Examples 

This example shows the dtmf response type with the collect command, used to collect DTMF input.

{
The cdr_custom_data object can contain any valid JSON data.

When you generate a CDR report, the custom data is included in the injected_custom_data field, as in this example:

{
"payload": {
...
"injected_custom_data": {
"key1": "value1",
"key2": "value2"
}
...
}
}

For more information about the structure of the CDR log event payload, see [CDR log event reference](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-cdr-log-reference).



 Merging and deleting custom CDR data 

Each time the cdr_custom_data object is defined by an action, the new data is merged with any previously existing data. New values specified for previously defined properties overwrite the previous values, and any new properties are added; otherwise, the previously defined data is unchanged.

To remove a previously defined property, you must explicitly set it to an empty value, as in this example:

"context": {
"integrations": {
"voice_telephony": {
"cdr_custom_data": {
"key1": ""
}
}
}
}







 Access phone integration context variables from your action 

If you want to access the phone integration context variables, use the JSON editor to edit the context.

The following example shows how to access the user phone number (i.e. the phone number that the call was received from):

"context": {
"variables": [
{
"value": {
"expression": "${system_integrations.voice_telephony.private.user_phone_number}.replace('+','')"
},
"skill_variable": "user_phone_number"
}
]
}
For more information, including examples of other DTMF commands, see [Handling phone interactions](https://cloud.ibm.com/docs/assistant?topic=assistant-dialog-voice-actions).

{
"output": {
"generic": [
{
"response_type": "dtmf",
"command_info": {
"type": "collect",
"parameters": {
"termination_key": "",
"count": 16,
"ignore_speech": true
}
},
"channels":
{
"channel": "voice_telephony"
}
]
}
]
}
}
Show more







 stop_activities 

Sends a command to a channel integration to stop one or more activities that are specific to that channel. The activities remain stopped until they are restarted using the start_activities response type.

Currently, only the phone integration supports the stop_activities response type.



 Fields 



 Name Type Description Required? 

 response_type string stop_activities Y 
 activities list A list of objects identifying the activities to stop. Y 
 activities[].type string The name of the activity to stop. Y 



Currently, the following activities for the phone integration can be stopped:



* speech_to_text_recognition: Stops recognizing speech. All streaming audio to the Speech to Text service is stopped.
* dtmf_collection: Stops processing of inbound DTMF signals.







 Example 

This example uses the stop_activities response type to stop recognizing speech. Because this command is specific to the phone integration, the channels property specifies voice_telephony only.

{
"output": {
"generic": [
{
"response_type": "stop_activities",
"activities":
{
"type": "speech_to_text_recognition"
}
],
"channels":
{
"channel":"voice_telephony"
}
]
}
]
}
* Resource Hostname: This is the IP or hostname of the resource you need to connect to.
* Resource Port: This is the port that your resource is listening on.
* Protocol: This is the type of connection your application will be making. See the table below for the various [protocol options](https://cloud.ibm.com/docs/SecureGateway?topic=SecureGateway-add-destprotocols-options). For configuring the type of connection your resource is expecting, check the [Resource authentication](https://cloud.ibm.com/docs/SecureGateway?topic=SecureGateway-add-destdest-resource-auth) section.



If you have selected a cloud destination you will also need to provide a Client Port. This is the port that the Secure Gateway Client will listen on to allow connections to the associated resource hostname and port.





 Protocol options 

This table provides all of the available options for how your application can initiate connections/requests with Secure Gateway.



 Protocol Description 

 TCP No authentication. Your application can communicate directly with the Secure Gateway servers without requiring any certificates. 
 TLS: Server Side Transport Layer Security (TLS) is enabled and the server provides a certificate to prove its authenticity. 
 TLS: Mutual Auth The server provides a set of certificates and your application must also provide a certificate as part of its connection. 
 HTTP TCP connection where the host header is rewritten to match the on-premises hostname. 
 HTTPS TLS: Server Side connection where the host header is rewritten to match the on-premises hostname. 
 HTTPS: Mutual Auth TLS: Mutual Auth connection where the host header is rewritten to match the on-premises hostname. 







 Configuring Mutual Authentication 

For protocols enforcing mutual authentication, you will need to upload your own certificate or the server will automatically create a self-signed certificate/key pair for your application to use. This pair can be downloaded alongside the server certificate. !
* Resource Hostname: This is the IP or hostname of the resource you need to connect to.
* Resource Port: This is the port that your resource is listening on.
* Protocol: This is the type of connection your application will be making. See the table below for the various [protocol options](https://cloud.ibm.com/docs/services/SecureGateway?topic=SecureGateway-add-destprotocols-options). For configuring the type of connection your resource is expecting, check the [Resource authentication](https://cloud.ibm.com/docs/services/SecureGateway?topic=SecureGateway-add-destdest-resource-auth) section.



If you have selected a cloud destination you will also need to provide a Client Port. This is the port that the Secure Gateway Client will listen on to allow connections to the associated resource hostname and port.





 Protocol options 

This table provides all of the available options for how your application can initiate connections/requests with Secure Gateway.



 Protocol Description 

 TCP No authentication. Your application can communicate directly with the Secure Gateway servers without requiring any certificates. 
 TLS: Server Side Transport Layer Security (TLS) is enabled and the server provides a certificate to prove its authenticity. 
 TLS: Mutual Auth The server provides a set of certificates and your application must also provide a certificate as part of its connection. 
 HTTP TCP connection where the host header is rewritten to match the on-premises hostname. 
 HTTPS TLS: Server Side connection where the host header is rewritten to match the on-premises hostname. 
 HTTPS: Mutual Auth TLS: Mutual Auth connection where the host header is rewritten to match the on-premises hostname. 







 Configuring Mutual Authentication 

For protocols enforcing mutual authentication, you will need to upload your own certificate or the server will automatically create a self-signed certificate/key pair for your application to use. This pair can be downloaded alongside the server certificate. !
"env_values_2": "dummy_text"
}
],
"env_values_metadata":
{
"name": "env_values_1",
"hidden": false,
"secure": false
},
{
"name": "env_values_2",
"hidden": false,
"secure": false
}
]
}
]
}
Show more





 Does drift detection run automatically? 

No, the drift detection is not an automatic method of detection in the IBM Cloud Schematics. For more information, see [detecting drift in Schematics](https://cloud.ibm.com/docs/schematics?topic=schematics-drift-note&interface=apidrift-in-ibm).





 How can I initiate drift detection? 

You can initiate drift detection using the UI and CLI. For more information, see [detecting drift in Schematics](https://cloud.ibm.com/docs/schematics?topic=schematics-drift-note).





 Where can I see the status of a drift detection job ? 

To verify the results of a drift detection job, you need to check the drift detection job log. The job log provides the details of the drift detection as in progress or completed with the appropriate status such as failure or success. For more information, see [detecting drift in Schematics](https://cloud.ibm.com/docs/schematics?topic=schematics-drift-note&interface=apidrift-in-ibm).





 Can I interrupt or terminate running jobs? 

Yes, you can interrupt, force-stop, or terminate the provisioning resources or a running job in Schematics by using the job types. For more information, see [stopping the job types](https://cloud.ibm.com/docs/schematics?topic=schematics-interrupt-jobinterrupt-types).





 How do I correct an Incorrect Location Input error? 

Error

{
Or you can define the environment variable before starting the interactive command line interface.





 Port 443 for npm module installation 

For the Secure Gateway client v185 and later, You can define the proxy option for the npm module installation during the Secure Gateway client installation. For example (MacOX):

Enter the gateway IDs, separated by spaces: <gateway_id>
INFO: The gateway ID for this install is: <gateway_id>

Enter the gateway ID security tokens separated by spaces, enter 'none' for no security token: <token>

Enter the proxy info if you want to start the client with the proxy: <proxy_info>

If you are using http proxy, the proxy option should be http://<proxy host>:<proxy port>, if you are using https proxy, the proxy option should be https://<proxy host>:<proxy port>







 Limitations 



 Connection Limitations 

The SG gateway can only handle 250 concurrent connections. If the number of concurrent requests exceeds the limit, it can result in the connection attempts being rejected and lead to latency. An easy way to fix this is to use connection pooling on the calling app. Please note that the limit of 250 concurrent connections is on the gateway and not client or destination. This limit will be shared across all the client and destinations on the gateway.





 DataPower Client Limitations 

The Secure Gateway DataPower Client is in the process of being updated to match the capabilities of the rest of our clients. It currently has the following limitations:



* ACL will default to ALLOW ALL
* Enabling and disabling gateways or destinations from the Secure Gateway UI is not supported. However, the Administrative State option in the DataPower UI functions as an on/off switch for that particular client.
* Connection status polling for real-time connected and disconnected gateway status updates is not supported.
* Full certificate chains with destination-side TLS are not supported prior to DataPower version 7.5.1.0
* Cloud destinations are not supported prior to DataPower version 7.5.1.0
* The log level can't be changed to TRACE level
Connecting to an AWS peer 

You can use IBM Cloud VPN for VPC to securely connect your VPC to an on-prem network through a VPN tunnel. This topic provides guidance about how to configure your AWS VPN gateway to connect to VPN for VPC.

Because AWS requires PFS to be enabled in Phase 2, you must create a custom IPsec policy to replace the default policy for the VPN in your VPC. See [Creating an IPsec policy](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-ipsec-policy) for more details.

When the AWS VPN receives a connection request from VPN for VPC, AWS VPN uses IPsec Phase 1 parameters to establish a secure connection and authenticate the VPN for VPC gateway. Then, if the security policy permits the connection, the AWS VPN establishes the tunnel by using IPsec Phase 2 parameters and applies the IPsec security policy. Key management, authentication, and security services are negotiated dynamically through the IKE protocol.

Review the [VPN gateway limitations](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-limitations) before you connect to your on-prem peer.

To support these functions, you must perform the following general configuration steps on the AWS VPN:



* Define the Phase 1 parameters that the AWS VPN requires to authenticate the remote peer and establish a secure connection.
* Define the Phase 2 parameters that the AWS VPN requires to create a VPN tunnel with VPN for VPC.





 Connecting an IBM policy-based VPN to an AWS peer 

You can use a VPN for VPC policy-based VPN to connect to an AWS route-based VPN. However, policy-based VPNs require separate Security Associations (SAs) for each subnet, while route-based VPNs use a single SA for all encrypted traffic. Therefore, a connection between a policy-based VPN to a route-based VPN is limited to one SA associated with a single CIDR range.
All fields should be converted from TEXT search to another value (WILDCARD, EXACT, or NONE).
10. Each user account can have only (1) primary email address.
11. Each user account can have only (1) primary phone number.
12. The user account added for the mxe.int.dfltuser property must have complete user application and related object access inside Manage for user syncronization to work after migration.
13. Maximo Object Structure Tables and Data Dictionary Tables must be aligned before sending the database to IBM. See link below for further information:

[https://www.ibm.com/support/pages/bmxaa7733e-error-loading-object-structure-or-generating-schema](https://www.ibm.com/support/pages/bmxaa7733e-error-loading-object-structure-or-generating-schema)
14. Insure maxtable and maxintobjdetail are updated properly before sending the database to IBM. See link below for further information:

[https://www.ibm.com/support/pages/error-initializing-micservicebmxaa7733e-after-applying-fix-pack-7505](https://www.ibm.com/support/pages/error-initializing-micservicebmxaa7733e-after-applying-fix-pack-7505)
15. MaxSequence should be aligned before sending database to IBM. See link below for further information:

[https://www.ibm.com/support/pages/integrity-checker-sequence-not-setup-correctly](https://www.ibm.com/support/pages/integrity-checker-sequence-not-setup-correctly)







 Initial Set Up 

The initial set up includes several components including:

Creation of the target MAS SaaS environment Identification of all components that need to be migrated (database, code, attachments) Final documentation of the integration's and any initial set-up that can be done (including VPN's).
All fields should be converted from TEXT search to another value (WILDCARD, EXACT, or NONE).
10. Each user account can have only (1) primary email address.
11. Each user account can have only (1) primary phone number.
12. The user account added for the mxe.int.dfltuser property must have complete user application and related object access inside Manage for user syncronization to work after migration.
13. Maximo Object Structure Tables and Data Dictionary Tables must be aligned before sending the database to IBM. See link below for further information:

[https://www.ibm.com/support/pages/bmxaa7733e-error-loading-object-structure-or-generating-schema](https://www.ibm.com/support/pages/bmxaa7733e-error-loading-object-structure-or-generating-schema)
14. Insure maxtable and maxintobjdetail are updated properly before sending the database to IBM. See link below for further information:

[https://www.ibm.com/support/pages/error-initializing-micservicebmxaa7733e-after-applying-fix-pack-7505](https://www.ibm.com/support/pages/error-initializing-micservicebmxaa7733e-after-applying-fix-pack-7505)
15. MaxSequence should be aligned before sending database to IBM. See link below for further information:

[https://www.ibm.com/support/pages/integrity-checker-sequence-not-setup-correctly](https://www.ibm.com/support/pages/integrity-checker-sequence-not-setup-correctly)







 Initial Set Up 

The initial set up includes several components including:



* Creation of the target MAS Dedicated environment
* Identification of all components that need to be migrated (database, code, attachments)
* Final documentation of the integration's and any initial set-up that can be done (including VPN's)