vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Retrieving IAM access tokens 

Get started with the IBM Analytics Engine API by authenticating your requests to the service with an IBM Cloud® Identity and Access Management (IAM) access token.

An access token is a temporary credential that expires after 1 hour. After the acquired token expires, you must generate a new token to continue calling the IBM Analytics Engine API. To maintain access to the service, regenerate the access token for your API key on a regular basis.

The recommended method to retrieve a token programmatically is to create an API key for your IBM Cloud® ID and then use the IAM token API to exchange that key for a token.

You can create a token in two ways:



* [By using the IBM Cloud REST API](https://cloud.ibm.com/docs/AnalyticsEngine?topic=AnalyticsEngine-retrieve-iam-token-serverlesscreate-token-with-ibm-cloud-rest-api)
* [By using the IBM Cloud® CLI](https://cloud.ibm.com/docs/AnalyticsEngine?topic=AnalyticsEngine-retrieve-iam-token-serverlesscreate-token-with-ibm-cloud-cli)





 Create a token using the IBM Cloud REST API 

To create a token in IBM Cloud:



1. [Sign in to IBM Cloud](https://cloud.ibm.com) and select Manage>Security>Platform API Keys.
2. Create an API key for your own personal identity, copy the key value, and save it in a secure place. After you leave the page, you will no longer be able to access this value.
3. Use the API key you created with the IAM identity token API to generate an IAM token. For example:

curl -X POST 'https://iam.cloud.ibm.com/identity/token' -H 'Content-Type: application/x-www-form-urlencoded' -d 'grant_type=urn:ibm:params:oauth:grant-type:apikey&apikey=<your iam api key>'
ibmcloud iam service-policy-create $SERVICE_ID --roles "SecretsReader" --service-name secrets-manager
3. Create an API key for your service ID:

export IBM_CLOUD_API_KEY=ibmcloud iam service-api-key-create kubernetesnodeapp-tutorial $SERVICE_ID --description "An API key for scalable-webapp-kubernetes tutorial." --output json | jq -r ".apikey"
4. Create a secret in your cluster for that API key:

kubectl -n $KUBERNETES_NAMESPACE create secret generic kubernetesnodeapp-api-key --from-literal=apikey=$IBM_CLOUD_API_KEY
5. Run the following commands to install the External Secrets Operator:

helm repo add external-secrets https://charts.external-secrets.io

helm install external-secrets external-secrets/external-secrets
6. Create an Ingress file ingress-customdomain-https.yaml pointing to your domain from the template ingress-customdomain-https-template.yaml:

./ingress.sh customdomain_https
7. Deploy the Ingress:

kubectl apply -f ingress-customdomain-https.yaml
8. Validate the secret was created:

kubectl get secret kubernetesnodeapp-certificate -n $KUBERNETES_NAMESPACE
9. Access your application at https://$MYAPP.$CUSTOM_DOMAIN/.

curl -I https://$MYAPP.$CUSTOM_DOMAIN









 Step 6: Monitor application health 



1. To check the health of your application, navigate to [clusters](https://cloud.ibm.com/kubernetes/clusters) to see a list of clusters and click on your cluster.
2. Click Kubernetes Dashboard to launch the dashboard in a new tab.
3. Click Pods on the left then click a pod-name matching $MYAPP
Pass an Identity and Access Management (IAM) access token to authenticate with the service. You pass an IAM access token instead of passing an API key with the call. For more information, see [Authenticating to IBM Cloud](https://cloud.ibm.com/docs/watson?topic=watson-iamgs-credential-cloud).
IBM Cloud Pak for Data

Pass an access token as you would with the Authorization header of an HTTP request. For more information, see [Authenticating to IBM Cloud Pak for Data](https://cloud.ibm.com/docs/watson?topic=watson-iamgs-credential-cpd).



model (optional string)
: Specifies the language model to be used for transcription. If you do not specify a model, the service uses en-US_BroadbandModel by default. For more information, see



* [Previous-generation languages and models](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-models)
* [Next-generation languages and models](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-models-ng)
* [Using the default model](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-models-usemodels-use-default)



language_customization_id (optional string)
: Specifies the Globally Unique Identifier (GUID) of a custom language model that is to be used for all requests that are sent over the connection. The base model of the custom language model must match the value of the model parameter. If you include a custom language model ID, you must make the request with credentials for the instance of the service that owns the custom model. By default, no custom language model is used. For more information, see [Using a custom language model for speech recognition](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-languageUse).

acoustic_customization_id (optional string)
softlayer_endpoint_url = "https://api.softlayer.com/rest/v3"
softlayer_iam_endpoint_url = "https://api.softlayer.com/mobile/v3"
softlayer_datacenter = "dal10"

The IAM API key is listed in the Bluemix.iam_api_key section of your CLI output. If the Softlayer.softlayer_api_key is empty at the same time, then the IAM API key is used to determine your infrastructure permissions. The IAM API key is automatically set by the user who runs the first action that requires the IAM Administrator platform access role in a resource group and region. If a different API key is set in Softlayer.softlayer_api_key, then this key takes precedence over the IAM API key. The Softlayer.softlayer_api_key is set when a cluster admin runs the ibmcloud ks credentials-set command.
2. If you want to change the credentials, update the API key that is used.



1. [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)
2. To update the IAM API key, use the ibmcloud ks api-key reset[command](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_api_key_reset). To update the IBM Cloud infrastructure key, use the ibmcloud ks credential set[command](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_credentials_set).
3. Wait about 10 - 15 minutes for the storage-secret-store Kubernetes secret to update, then verify that the key is updated.
{"apikey":"<API_key>","host":"<ID_string>-bluemix.cloudant.com","iam_apikey_description":"Auto generated apikey during resource-key operation for Instance - crn:v1:bluemix:public:cloudantnosqldb:us-south:a/<ID_string>::","iam_apikey_name":"auto-generated-apikey-<ID_string>","iam_role_crn":"crn:v1:bluemix:public:iam::::serviceRole:Writer","iam_serviceid_crn":"crn:v1:bluemix:public:iam-identity::a/1234567890brasge5htn2ec098::serviceid:ServiceId-<ID_string>","password":"<ID_string>","port":443,"url":"https://<ID_string>-bluemix.cloudant.com","username":"123b45da-9ce1-4c24-ab12-rinwnwub1294-bluemix"}
3. Optional: Compare the service credentials that you decoded in the previous step with the service credentials that you find for your service instance in the IBM Cloud dashboard.



6. Now that your service is bound to your cluster, you must configure your app to [access the service credentials in the Kubernetes secret](https://cloud.ibm.com/docs/openshift?topic=openshift-service-bindingadding_app).







 Accessing service credentials from your apps 

To access an IBM Cloud service instance from your app, you must make the service credentials that are stored in the Kubernetes secret available to your app.

The credentials of a service instance are base64 encoded and stored inside your secret in JSON format. To access the data in your secret, choose among the following options:
By using the API key that you retrieved in the previous step, you can generate an IAM access token. The token is valid only for the duration that you initially defined for the IAM credential.

You can exchange the API key for an IAM access token by calling [IAM Identity Services API](https://cloud.ibm.com/apidocs/iam-identity-token-api). To generate an IAM token, run the following cURL command from your command line.

export IAM_TOKEN=curl -X POST "https://iam.cloud.ibm.com/identity/token" -H "Content-Type: application/x-www-form-urlencoded" -H "Accept: application/json" -d "grant_type=urn%3Aibm%3Aparams%3Aoauth%3Agrant-type%3Aapikey&apikey=$API_KEY" | jq -r ".access_token"; echo $IAM_TOKEN

Success! You now have a valid IAM token that you can use to access your Cloud Object Storage bucket. Continue to the next step.





 Step 5: Access a storage bucket 

As a user with lesser privileges, you can now read and write to your Cloud Object Storage bucket by using the access token that you generated in the previous step. After the lease duration of your IAM credentials expires, its associated API key is revoked automatically.

On the command line, run the following cURL request to list the buckets in your Cloud Object Storage instance.

curl -X GET "https://s3.us-south.cloud-object-storage.appdomain.cloud" -H "Authorization: Bearer $IAM_TOKEN" -H "ibm-service-instance-id: $COS_INSTANCE_ID" -H "Accept: application/json"

The following XML snippet shows an example response.

<ListAllMyBucketsResult xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
<Owner>
* Added the [Invoke an action on a configuration](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2action-on-config-element) method that be used to run operations on specific configuration elements, for example root or intermediate certificate authorities. Currently, this API supports private_cert secrets only.







 3 February 2022 

This release includes the following update:



* Added the [Register with Event Notifications](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2create-notifications-registration), [Get Event Notifications registration details](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2get-notifications-registration), [Unregister from Event Notifications](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2delete-notifications-registration), and [Send test event](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2send-test-notification) methods that can be used to manage your connection to the Event Notifications service.







 31 January 2022 

This release includes the following update:



* Added kv as a secret type to the [Create a secret](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2create-secret) method. You can store and manage key-value secrets, including complex JSON documents, that are used to access protected systems that are inside or outside of IBM Cloud.







 22 November 2021 

This release includes the following updates:



* Added the service_id string parameter as a request body option to the [Create a secret](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2create-secret) method. You can use this field to create IAM credentials with an existing service ID from your account, so that only an API key is generated when the secret is read or accessed.
If you need to retrieve your service endpoint URLs programmatically, you can also call the following API to retrieve the values that are specific to your Secrets Manager instance.

curl -X GET
-H "Accept: application/json" -H "Authorization: Bearer {IAM_token}"
"https://{region}.secrets-manager.cloud.ibm.com/api/v1/instances/{url_encoded_instance_CRN}/endpoints"

Replace the variables in the example request according to the following table.



Table 3. Required parameters for retrieving service endpoints with the API

 Parameter Description 

 {region} The region abbreviation that represents the geographic area where your Secrets Manager resides. For example, us-south or eu-de. 
 {url_encoded_instance_CRN} The Cloud Resource Name (CRN) that uniquely identifies your Secrets Manager service instance. The value must be URL encoded. 
 {IAM_token} Your IBM Cloud IAM access token. 



A successful request returns the endpoint URLs that are associated with the region and service instance CRN that you specify. The following JSON snippet shows an example response.

{
"plan": "standard",
"public_endpoints": {
"service_api": "https://927fb8ae-1ddd-4483-a21f-7d3c0fc845f5.us-south.secrets-manager.appdomain.cloud/api",
"vault_api": "https://927fb8ae-1ddd-4483-a21f-7d3c0fc845f5.us-south.secrets-manager.appdomain.cloud"
},
"private_endpoints": {
"service_api": "https://927fb8ae-1ddd-4483-a21f-7d3c0fc845f5.private.us-south.secrets-manager.appdomain.cloud/api",
To update the IAM API key, use the ibmcloud oc api-key reset[command](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clics_api_key_reset). To update the IBM Cloud infrastructure key, use the ibmcloud oc credential set[command](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clics_credentials_set).
3. Wait about 10 - 15 minutes for the storage-secret-store Kubernetes secret to update, then verify that the key is updated.

oc get secret storage-secret-store -n kube-system -o yaml | grep slclient.toml: | awk '{print $2}' | base64 --decode



3. If the API key is correct, verify that the key has the correct permission to provision persistent storage.



1. Contact the account owner to verify the permission of the API key.
2. As the account owner, select Manage > Access (IAM) from the navigation in the IBM Cloud console.
3. Select Users and find the user whose API key you want to use.
4. From the actions menu, select Manage user details.
5. Go to the Classic infrastructure tab.
6. Expand the Account category and verify that the Add/ Upgrade Storage (Storage Layer) permission is assigned.
7. Expand the Services category and verify that the Storage Manage permission is assigned.



4. Remove the PVC that failed.

oc delete pvc <pvc_name>
5. Re-create the PVC.

oc apply -f pvc.yaml
You need the [Reader service role](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam) or higher to list secret locks.





 Command options 

-format
: Prints the output in the format that you specify. Valid formats are table, json, and yaml. The default is table. You can also set the output format by using the VAULT_FORMAT environment variable.





 Examples 

List the locks that are associated with an arbitrary secret in the default secret group.

vault read -format=json ibmcloud/arbitrary/locks/184408d6-8264-5ff3-c308-6922ed04ad88

List the locks that are associated with a user's credentials secret in a custom secret group.

vault read -format=json ibmcloud/username_password/locks/groups/d2e98a96-18ed-f13c-8dee-db955fb94122/c86946e6-b392-2613-159d-aff5a3f095b3





 Output 

The command returns the following output:

{
"request_id": "7a09ca14-6a7d-9ea2-2515-f7c22890f148",
"lease_id": "",
"lease_duration": 0,
"renewable": false,
"data": {
"locks": [
{
"attributes": {
"key": "value"
},
"created_by": "iam-ServiceId-222b47ab-b08e-42c3acb8",
"creation_date": "2022-06-30T21:04:15.143896Z",
"description": "Test lock for secret in the custom secret group.",
"last_update_date": "2022-06-30T21:31:19.343086Z",
Operator All operator role actions for IAM services crn:v1:bluemix:public:iam::::role:Operator 
 Editor All editor role actions for IAM services and the ability to create resource groups crn:v1:bluemix:public:iam::::role:Editor 
 Administrator All administrator role actions for IAM services and the ability to create resource groups crn:v1:bluemix:public:iam::::role:Administrator 
 User API key creator Create API keys when the account setting to restrict API key creation is enabled crn:v1:bluemix:public:iam-identity::::serviceRole:UserApiKeyCreator 
 Service ID creator Create service IDs when the account setting to restrict service ID creation is enabled crn:v1:bluemix:public:iam-identity::::serviceRole:ServiceIdCreator 



Some roles that you might assign on a policy for All IAM Account Management services affect only certain resources. For example, the role Service ID Creator is relevant to only the IAM Identity service.





 Billing 

You can give users access to update account settings, view subscriptions, view offers, apply subscription and feature codes, update spending limits, and track usage by using the Billing service.



Table 4. Roles and example actions for the Billing service

 Roles Actions role_ID value 

 Viewer View account feature settings<br><br>View subscriptions in account<br><br>View account name<br><br>View subscription balances and track usage crn:v1:bluemix:public:iam::::role:Viewer 
 Operator View account feature settings<br><br>View subscriptions in account<br><br>View and change account name crn:v1:bluemix:public:iam::::role:Operator
For more information and a comprehensive list of data centers and regions, see [Service availability](https://cloud.ibm.com/docs/overview?topic=overview-services_region).



Table 1. New location names

 Previous Location Display Name New Location Display Name Code 

 US South Dallas us-south 
 US East Washington DC us-east 
 United Kingdom London eu-gb 
 Germany Frankfurt eu-de 
 Sydney Sydney au-syd 
 AP North Tokyo jp-tok 









 October 2018 



 30 October 2018 

Assign account management access to others
: With IBM Cloud Identity and Access Management (IAM), you can delegate common tasks that you complete as an account administrator to another user in your account. By creating an access policy on one or all of the available account management services, you can easily delegate responsibilities such as inviting and removing users, managing access groups, managing service IDs, maintaining private catalog services, and even monitoring billing and tracking usage. There are four individual account management services and an all services option that you can use to set up access policies:



* User Management for inviting and removing users
* IAM Access Groups for creating, editing, deleting, updating, and assigning access
* IAM Identity Service for viewing, creating, deleting, and assigning access to service IDs and associated API keys across the account
* Global resource catalog for viewing private catalog offerings and updating the metadata and visibility for the offerings
* All account management services for access to each of the individual account management service options based on the assigned role as well as access to billing and usage tracking.



For more information on the tasks that a user can do based on which account management service they have a policy on and which role they are assigned, see [Example platform management roles and actions for account management services](https://cloud.ibm.com/docs/account?topic=account-account-servicesaccount-management-actions-roles). For more information about this new feature, see the [Introducing More Flexibility and Control for IBM Cloud Account Management Services Access](https://www.ibm.com/cloud/blog/announcements/introducing-more-flexibility-and-control-for-ibm-cloud-account-management-services-access) blog post.







 July 2018
Table 2. Roles and example actions for a policy on all IAM account management services

 Roles Actions 

 Viewer All viewer role actions for IAM services 
 Operator All operator role actions for IAM services 
 Editor All editor role actions for IAM services and the ability to create resource groups 
 Administrator All administrator role actions for IAM services and the ability to create resource groups 
 User API key creator Create API keys when the account setting to restrict API key creation is enabled 
 Service ID creator Create service IDs when the account setting to restrict service ID creation is enabled 



Some roles that you might assign on a policy for All IAM Account Management services affect only certain resources. For example, the role Service ID Creator is relevant to only the IAM Identity service.





 Billing 

You can give users access to update account settings, view subscriptions, view offers, apply subscription and feature codes, update spending limits, and track usage by using the Billing service.



Table 3. Roles and example actions for the Billing service

 Roles Actions 

 Viewer View account feature settings<br><br>View subscriptions in account<br><br>View account name<br><br>View subscription balances and track usage 
 Operator View account feature settings<br><br>View subscriptions in account<br><br>View and change account name 
 Editor View and update account feature settings<br><br>View subscriptions in account<br><br>View offers in account<br><br>View and apply subscription and feature codes<br><br>View and change account name<br><br>View and update spending limits<br><br>Set spending notifications<br><br>View subscription balances and track usage 
 Administrator View and update account feature settings<br><br>View subscriptions in account<br><br>View offers in account<br><br>View and apply subscription and feature codes<br><br>View and change account name<br><br>View and update spending limits<br><br>Set spending notifications<br><br>View subscription balances and track usage<br><br>Create an enterprise
If you see that field, you don't use the default infrastructure credentials that come with your Pay-As-You-Go or Subscription account in this region. Instead, the region is set to use the different infrastructure account credentials that you set.









 Customizing classic infrastructure permissions 

When you assign the Super User infrastructure role to the admin or functional ID that sets the API key or whose infrastructure credentials are set, other users within the account share the API key or credentials for performing infrastructure actions. You can then control which infrastructure actions the users can perform by assigning the appropriate [IBM Cloud IAM platform access role](https://cloud.ibm.com/docs/containers?topic=containers-userschecking-perms). You don't need to edit the user's IBM Cloud infrastructure permissions.

Classic infrastructure permissions apply only to classic clusters. For VPC clusters, see [Granting user permissions for VPC resources](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-user-permissions-for-vpc-resources).

For compliance, security, or billing reasons, you might not want to give the Super User infrastructure role to the user who sets the API key or whose credentials are set with the ibmcloud ks credential set command. However, if this user doesn't have the Super User role, then infrastructure-related actions, such as creating a cluster or reloading a worker node, can fail. Instead of using IBM Cloud IAM platform access roles to control users' infrastructure access, you must set specific IBM Cloud infrastructure permissions for users.

For example, if your account is not VRF-enabled, your IBM Cloud infrastructure account owner must turn on VLAN spanning. The account owner can also assign a user the Network > Manage Network VLAN Spanning permission so that the user can enable VLAN spanning. For more information, see [VLAN spanning for cross-VLAN communication](https://cloud.ibm.com/docs/containers?topic=containers-subnetsbasics_segmentation).



 Assigning infrastructure access through the console 

Classic infrastructure permissions apply only to classic clusters.