vania-janet/multiturn-rag-retrieval-data huggingface dataset:
The most common form of URI is the web page address, which is a particular form or subset of URI called a Uniform Resource Locator (URL). A URI typically describes how to access the resource, the computer that contains the resource, and the location of the resource on that computer.





 Uniform Resource Locator (URL) 

The unique address of an information resource that is accessible in a network such as the Internet. The URL includes the abbreviated name of the protocol used to access the information resource and the information used by the protocol to locate the information resource. See also [host](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx2002243), [subdomain](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx2040080), [custom domain](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx5728384), [domain](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx2021210), [route](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx2037338).





 unit of measure (UOM) 

A standardized unit that is used to measure a specified property of something.





 UOM 

See [unit of measure](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx4259569).





 URI 

See [Uniform Resource Identifier](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx2116436).





 URL 

See [Uniform Resource Locator](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx2042491).





 user 



* An IBMid or SoftLayer ID that is used as a person's identity in an account.
* A participant in a blockchain network that has indirect access to the ledger through a trust relationship to an existing member.







 user registry
* UI
* API







 Obtaining tokens 

When users or backend services interact with your app, they might need to be authorized to perform specific actions. App ID verifies that the entity that makes the request is authorized and returns access and identity tokens to your app. If the entity making the request is an end user, the tokens might contain information about the user such as the scope of their permissions and their name. If it is a backend service, then only an access token is returned.



 Getting your client ID and secret with the GUI 

To obtain tokens, you must have your client ID and secret. The credentials are specific to every application and are used to help identify and validate the users that a token might be assigned to.



1. Navigate to the Applications tab of the App ID dashboard.
2. If you already have a set of credentials listed, you can skip to step 3. If you do not, create one.



1. On the Applications tab, click Add application.
2. Give your application a name and click Save to return to a list of your registered apps. The name of your application cannot exceed 50 characters.



3. From the list of registered apps, select the application that you want to work with. The row expands to show your credentials.
4. Copy your client ID and secret.







 Getting your client ID and secret with the API 

To obtain tokens, you must have your client ID and secret. The credentials are specific to every application and are used to help identify and validate the users that a token might be assigned to.



1. Make a POST request to the [/management/v4/<tenantID>/applications endpoint](https://us-south.appid.cloud.ibm.com/swagger-ui//Management%20API%20-%20Applications/mgmt.registerApplication).

Request:
You can also include [user tags for the volumes](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-block-storage&interface=clicreate-instance-vol-cli) in the volume attachment.

Information about the network interfaces that are created for the new instance aren't returned after the instance is created. You can view the information by using the ibmcloud is instance INSTANCE command as described in the next step.

The status displays pending until the instance is created.

For a full list of command options, see [ibmcloud is instance-create](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-referenceinstance-create).
2. Next, run the following instance details command to verify that you can see your new instance and view the network interfaces that were created for the new instance. For INSTANCE specify the ID that was assigned to your new virtual server instance in the previous step.

ibmcloud is instance INSTANCE

The status now shows running. Check the Network Interfaces section to locate the ID of the network interface.
3. Request a floating IP address to associate to your instance by using the following command. For FLOATING_IP_NAME specify a name for your floating IP, and for TARGET_INTERFACE specify the ID of the network interface that you identified in the previous step.

ibmcloud is floating-ip-reserve FLOATING_IP_NAME --nic TARGET_INTERFACE

Record the floating IP Address to use later.

For a full list of command options, see [ibmcloud is floating-ip-reserve](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-referencefloating-ip-reserve).

Need more help? You can always run ibmcloud is instance-create --help to display help for creating an instance.







 Create a boot volume from a snapshot and use it to provision a new instance with the CLI
Resetting the ingestion key that is used by a Kubernetes cluster 

If the ingestion key that you use to forward logs from a cluster to an IBM Log Analysis instance in the IBM Cloud is compromised, you must reset the key and update the Kubernetes cluster configuration to use the new ingestion key.



 Before you begin 

Work in a [supported region](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-regions). Note: You can work with a Kubernetes cluster that is located in the same region or in a different region.

Read about IBM Log Analysis. For more information, see [About](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-getting-startedgetting-started-ov).

Use a user ID that is a member or an owner of an IBM Cloud account. To get an IBM Cloud user ID, go to: [Registration](https://cloud.ibm.com/login).

The IBM Log Analysis instance is provisioned in the default resource group.

To complete the steps in this tutorial, your IBMID must have assigned IAM policies for each of the following resources:



Table 1. List of IAM policies required to complete the tutorial

 Resource Scope of the access policy Roles Region Information 

 Resource group Default Resource group Viewer us-south This policy is required to allow the user to see service instances in the Default resource group. 
 IBM Log Analysis service Resource group Editor <br>Manager us-south This policy is required to allow the user to reset the ingestion key. 
 Kubernetes cluster instance Resource Editor us-south This policy is required to delete and configure the secret and the logging agent in the Kubernetes cluster. 



For more information about the IBM Cloud® Kubernetes Service IAM roles, see [User access permissions](https://cloud.ibm.com/docs/containers?topic=containers-access_referenceaccess_reference).

Install the IBM Cloud CLI and the Kubernetes CLI plug-in.
The browser contacts IAM and provides the authorization code, so that IAM can retrieve the required tokens from IBMid using the OpenID Connect standard.
11. After IBMid provides the required tokens, IAM is now finishing its authentication flow with the console by sending an OAuth2 compliant redirect with an authorization code to the browser.
12. The browser provides the authorization code to the console, which in turn is used to retrieve the required tokens from IAM.
13. When the console receives the tokens, the login sequence ends. The console can now invoke IBM Cloud APIs and identify the user.
14. The console displays the dashboard with user-specific content.







 Login sequence for App ID with a connected SAML partner 

If you choose to integrate with your external IdP to securely authenticate external users to your account by using an App ID instance, the login sequence works according to the following sequence. For more information about this type of authentication, see [Enabling authentication from an external identity provider](https://cloud.ibm.com/docs/account?topic=account-idp-integration).

Zoom

![Login process for users who are connected from an App ID instance connected with a SAML partner](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/account/images/login-appid-saml.svg)

Figure 3. Login process for users who areconnected from an App ID instance connected with a SAML partner



1. The user starts the sequence by visiting an account-specific URL with their browser. This is either https://cloud.ibm.com/authorize/<account id> or https://cloud.ibm.com/authorize/<account alias>. The account alias can be configured on the IAM Identity provider configuration pages in the IBM Cloud console.

Using a specific URL is required to address the correct federated SAML partner.
2.
Authorization to the logging Configuration API is enforced by using a service key.

A service key is a unique code that is passed in an API request to identify the calling application or user. The service key is specific to a logging instance. For more information on how to generate a service key, see [Managing service keys](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-service_keys).

Use of the logging Configuration REST API is done by adding a valid service key to the HTTP Authorization request header. You must pass the service key as a header parameter (-H) of your requests.

For example, in a cURL request, you must set the content-type header as follows:

-H 'servicekey: <SERVICE_KEY>'





 Body parameters 

The following fields are body parameters that you can set in API request:



 name (string) 

Specifies the name of the view.

The following table indicates when the name parameter is required:



Table 2. Required status per method

 Action Request Field required 

 Create a view and attach an alert to a view. POST ![Check mark icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/images/checkmark-icon.svg) 
 Modify an existing view and the alerts that are attached to the view. PUT ![Check mark icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/images/checkmark-icon.svg) 
 Delete a view and its associated alerts. DELETE 







 query (string) 

Specifies the search query that is applied to the view.

Check the query in the logging web UI to validate that the data that is displayed through the view matches the data entry that you plan to monitor through that view.
* UI
* CLI







 Assigning access to an individual bucket 

Assign access roles for users and Service IDs against buckets, by using either the UI or the CLI to create policies.



 Access role Example actions 

 Manager Make objects public, create, and destroy buckets and objects 
 Writer Create and destroy buckets and objects 
 Reader List buckets, list objects, and download objects. 
 Content Reader List and download objects 
 Object Reader Download objects 
 Object Writer Upload objects 





 Granting access to a user 

If the user needs to be able to use the console and is able to see the list of all buckets within an instance, it is possible to use a custom platform access role. This allows them to view only the contents of specific buckets. If it is not appropriate for a user to read the names of other buckets then it is necessary to design and implement a custom portal or other user interface using the API.

If the user interacts with data by using the API and doesn't require console access, and they are a member of your account, you can grant access to a single bucket without any access to the parent instance using the default roles.





 Policy enforcement 

IAM policies are enforced hierarchically from greatest level of access to most restricted. Conflicts are resolved to the more permissive policy. For example, if a user has both the Writer and Reader service access role on a bucket, the policy granting the Reader role is ignored.

This is also applicable to service instance and bucket level policies.



* If a user has a policy granting the Writer role on a service instance and the Reader role on a single bucket, the bucket-level policy is ignored.
* If a user has a policy granting the Reader role on a service instance and the Writer role on a single bucket, both policies are enforced and the more permissive Writer role will take precedence for the individual bucket.



If it is necessary to restrict access to a single bucket (or set of buckets), ensure that the user or Service ID doesn't have any other instance level policies by using either the console or CLI.



 Create a new policy for a user 

To create a new bucket-level policy:



1. Navigate to the Access IAM console from the Manage menu.
2.
If you have an existing application that uses the v1 API to send user input directly to a workspace, migrating your app to use the v2 API is a straightforward process.





 Assistant ID 

The v2 runtime API sends messages to an assistant. On the Assistant Settings page, find the assistant ID. Your application uses this ID to communicate with the assistant. The service credentials are the same for both the v1 and v2 APIs.

Currently, there is no API support for retrieving an assistant ID. To find the assistant ID, you must use the Watson Assistant user interface.





 Call the v2 runtime API 

After you create an assistant, you can update your client application to use the v2 runtime API instead of the v1 runtime API.



1. Before sending the first message in a conversation, use the v2 [Create a session](https://cloud.ibm.com/apidocs/assistant/assistant-v2createsession) method to create a session. Save the returned session ID:



* Java
* Python
* Node



CreateSessionOptions createSessionOptions = new CreateSessionOptions.Builder(assistantId).build();
SessionResponse session = service.createSession(createSessionOptions).execute().getResult();
String sessionId = session.getSessionId();

session_id = service.create_session(
assistant_id = assistant_id
).get_result()['session_id']

service
.createSession({
assistant_id: assistantId,
})
.then(res => {
sessionId = res.session_id;
})
2. Use the v2 [Send user input to assistant](https://cloud.ibm.com/apidocs/assistant/assistant-v2message) method to send user input to the assistant. Instead of specifying the workspace ID as you did with the v1 API, you specify the assistant ID and the session ID:



* Java
* Python
* Node
Depending on [your account settings](https://cloud.ibm.com/docs/account?topic=account-service-endpoints-overview), you can use public or private endpoints to manage categories programmatically. For information about endpoints per region, see [API endpoints](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-endpointsendpoints_api).





 Authentication 

When you manage categories programmatically, you must use a service key. Authorization to the logging configuration API is enforced by using a service key.

A service key is a unique code that is passed in an API request to identify the calling application or user. The service key is specific to a logging instance. For more information on how to generate a service key, see [Managing service keys](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-service_keys).

Use of the logging configuration REST API is done by adding a valid service key to the HTTP Authorization request header. You must pass the service key as a header parameter (-H) of your requests.

For example, in a cURL request, you must set the content-type header as follows:

-H 'servicekey: <SERVICE_KEY>'





 Body parameters 

The following field is body parameter that you can set in the API request:



 name (string) 

Specifies the name of the category to be created.

The following table indicates when the name parameter is required:



Table 2. Required status per method

 Action Request Field required 

 Create a new category for a given type. POST ![Check mark icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/images/checkmark-icon.svg) 
 Modify a category UPDATE !
Each type of report does include the following information:



* Resource display name
* The information for the user who exported the report
* A flag called fullReport that indicates if you have access to view the full detailed report. When this attribute is set to true, the user who downloaded the report has all of the required access.
* Subjects who have access to the resource, including the roles and actions mapped to each role by the service and the platform. Actions that are mapped to the role by the specific service are separated from the platform-specific actions that are mapped to the role in the JSON report only.
* The IDs of the policies that provide the access. Each ID is a link so that you can go directly to editing that specific policy in case you want to change the assigned access.





 JSON report example 

For a simplified preview, see the following JSON example with comments added to help you understand the structure of the report.

Zoom

![Report example](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/account/images/json-report.svg)

Figure 1. JSON report example
An access group is used to easily organize a set of users, service IDs, and trusted profiles into a single entity to make access assignments easy. You can assign a single policy to an access group to grant all members those permissions. If you have more than one user or service ID that needs the same access, create an access group instead of assigning the same access multiple times per individual user, service ID, or trusted profile.

By using both resource groups and access groups, you can streamline the access assignment policy by assigning a limited number of policies. You can organize all of the resources a specific group of users and service IDs needs access to in a single resource group, group all the users or service IDs into an access group, and then assign a single policy that grants access to all resources in the resource group.

For more information, see [Best practices for organizing resources and assigning access](https://cloud.ibm.com/docs/account?topic=account-account_setuphow_access).
* How do I ensure that my users can create resources within a resource group?

To create a resource in a resource group, the user must have two access policies: one assigned to the resource group itself, and one assigned to the resources in the group. Access to the resource group itself is simply access to the container that organizes the resources, and this type of policy allows a user to view, edit, or manage access to the group, but not the resources within it. Access to services within the resource group enables a user to work with the service instances, which means the user can create a service instance.

So, minimally the user must have the following access:



* Viewer role or higher on the resource group itself
* Editor role or higher on the service or all services in the resource group



* What access enables a user to work with a single resource?

A user must be assigned an access policy on the specific resource with at least the Viewer role that is assigned on the resource group itself that contains the resource. To assign this type of policy, see [Assigning access to resources](https://cloud.ibm.com/docs/account?topic=account-assign-access-resources).
* What access do I need to provide others access?
(https://cloud.ibm.com/docs/account?topic=account-accountfaqsaccount-details).

If you don't have access to the account, a user that does have access must share the ID with you.







 Publishing products to specific accounts by using the console 

When you publish your product to specific accounts, the accounts are added to a list of IDs that are granted access to your product also known as the allowlist. Any ID that is not included in the allowlist can't access your product.

To manage the allowlist and publish your product to specific accounts, complete the following steps:



1. In the IBM Cloud console, click Manage > Catalogs > Private catalogs.
2. Select the private catalog where your product is located.
3. Select the product that you want to publish.
4. Click Actions... > Publish.
5. Select Publish to a set of accounts.
6. Select Publish to other accounts.
7. Click Add accounts > Account.
8. Enter the ID of the account that you want to publish your product to.

If you are already a member of the account that you want to publish to, you can click Add your accounts to choose from a list.
9. Click Add > Publish.







 Publishing products to specific accounts by using the CLI 

To publish your product to specific accounts, run the [ibmcloud catalog offering publish allowlist](https://cloud.ibm.com/docs/cli?topic=cli-manage-catalogs-pluginpublish-offering-allowllist). To run the command, you must include the catalog ID where the product is located, the product name or ID, and the account IDs that you would like to add to the allowlist.

When you publish your product to specific accounts, the accounts are added to a list of IDs that are granted access to your product also known as the allowlist. Any ID that is not included in the allowlist cannot access your product.

ibmcloud catalog offering publish allowlist [--catalog CATALOG][--account-ids ACCOUNT-IDS].



 Example command
When creating users and applications in IBM MQ on Cloud, you are required to give these entities a name (for an administrator, this must be a valid email address) from which a shorter name called an MQ username is generated. This shorter user name is based on the email address, but is guaranteed to be unique within the service instance, and also conform to the required format of an IBM MQ username.





 Passwords 

At the MQ on Cloud level, access control is implemented using

API keys. These are used by our system as the passwords associated with users and applications at the IBM MQ level.

In the panel showing the list of queue managers in your service instance, you will find two tabs which allow you to create user credentials and application credentials.

![Image showing tabs in an IBM MQ on Cloud service instance](https://cloud.ibm.com/docs-content/v1/content/3a120b16db5fdc3e70d071af8a63ce5515c1b096/mqcloud/images/users.png)

Administrators must generate and use their own Administrator API key. This must be used as their password to connect to a queue manager.

The Application credentials panel allows you to create an individual API key associated with a specific application. This is the password to be used with that application when connecting to all queue managers in your service instance - thus each application has a different password.