FAQ

This section covers answers to frequently asked questions about CatalyX Blockchain Manager and Canton Network operations.

This page is a work in progress. More questions will be added over time.

Backups, Identity Dumps & Retention

What's the difference between a database backup and an Identity Dump (IDDump)?

Database backups protect ledger and database state. Identity Dumps (IDDumps) protect validator identity and cryptographic keys. Both are required for full disaster recovery — neither can substitute for the other.

Learn more: Validator Backups and Identity Dumps

How long are security and audit logs retained?

30 days on Mainnet (Production), and 7 days on Devnet/Testnet.

Learn more: Data Retention & Pruning Policy

Does ledger pruning delete active data, and does it require downtime?

No to both. Pruning only removes obsolete ledger data that's no longer required for normal operation, and it runs as a scheduled maintenance task without requiring planned validator downtime.

Learn more: Data Retention & Pruning Policy

Validator and Network Upgrades

What is the difference between a version upgrade and a protocol upgrade?

A version upgrade updates the validator software independently on each node — this is what spliceVersion covers. A protocol upgrade changes the Canton Network protocol itself and is coordinated across the network, using the Logical Synchronizer Upgrade (LSU) mechanism in modern releases. See Platform and Canton Upgrades.

Where can I find the upgrade schedules?

Upgrade calendar and schedules can be found at https://sv-cal.canton.foundation

Does every upgrade require downtime?

Not necessarily. Validator component upgrades typically require a brief rolling restart. Protocol upgrades using LSU are designed to minimize service interruption and let applications keep operating during the transition.

Can validators be upgraded independently?

Yes, for version upgrades — each validator operator upgrades independently, within a compatible range of the platform. Protocol upgrades are coordinated across the Canton Network on a scheduled activation time.

Should upgrades be tested before Production?

Yes. Component versions are set per validator, so IntellectEU recommends upgrading a non-production validator first. See Before you upgrade.

What happens if I delay upgrading?

Running an outdated validator version may eventually lead to:

• package compatibility issues;

• inability to participate in newer protocol versions;

• application compatibility issues;

• unsupported configurations;

• reduced compatibility with newer Canton features.

Customers are encouraged to remain on supported versions and follow upgrade recommendations published by the Canton Foundation and validated by IntellectEU.

Does every version upgrade require a migration?

No. Many upgrades only require updating the validator software. Some releases introduce application or database changes that require a migration. Always review the release notes for the target version.

How often should validator nodes be upgraded?

Validator nodes should be upgraded after IntellectEU has validated and recommended the corresponding Canton Foundation release.

There is no fixed calendar for upgrades, as they depend on the Canton Foundation release schedule and the validation process performed by IntellectEU.

Can upgrades be rolled back?

Application versions can generally be reverted if necessary. However, migrations may introduce irreversible data changes.

Always create a database backup and Identity Dump before upgrading to ensure recovery options are available.

How long does an upgrade last?

Upgrade duration depends on:

• validator size,

• database size,

• whether migrations are required,

• infrastructure performance.

Most routine upgrades complete within a planned maintenance window.

KMS & Security

Can I use an external KMS (AWS, GCP, Azure) instead of storing validator keys directly?

Yes. Per-validator KMS is supported for storing participant keys with an external key management service.

Learn more: KMS Integration

Networking & API

How do I expose the Ledger API for a validator?

Covers enabling gRPC vs. JSON Ledger API access and configuring Keycloak-based token authentication.

Learn more: Expose Ledger API

Is there a REST API for triggering backups, restores, or pruning instead of using the UI?

Yes. 128 documented endpoints are available, including validator backup, restore, and prune operations.

Learn more: API Reference

Monitoring & Dashboards

How do I get access to the Grafana dashboard?

Grafana access is customer-specific and is provisioned by the IntellectEU team, together with the Grafana URL for your environment. Authentication typically goes through Keycloak SSO — once your account has been provisioned, open the provided URL and sign in with your customer account. Access to Grafana is separate from access to the CatalyX UI or the underlying Kubernetes/AWS infrastructure; having one does not automatically grant the other.

Learn more: Prerequisites

Why do I see "Forbidden" or "Access denied" in Grafana?

A 403 error usually means Grafana itself is reachable and you've authenticated successfully, but your account hasn't been granted access to the requested dashboard. Common causes include a user that hasn't been provisioned yet, authentication through the wrong Keycloak realm, or a dashboard belonging to another environment. Log out and back in with the correct account first; if the error persists, contact CatalyX support with the Grafana URL, the username/email you used, the environment (DevNet/MainNet/etc.), a screenshot, and roughly when it happened.

Troubleshooting

Why can't I log into the wallet UI, or why is the Primary Party field showing an error?

See the troubleshooting table for common causes and resolutions.

Learn more: Parties & Users

Why did my DAR upload fail, or why don't templates appear after upload?

See the troubleshooting table for common causes and resolutions.

Learn more: Upload DARs