Identity & Endpoints

OIDC configuration and the identity dump download, plus the URLs each component exposes.

Identity

Managed Keycloak realm and OIDC client configuration for this validator.

The fastest way to confirm that a validator's authentication is wired up as you intended.

Metric cards

Card	Values
Auth enabled	Yes / No
Managed Keycloak	Managed or External
Provisioned	Yes / No

Realm

Each row appears only when the value is set, and each is copyable:

Auth URL · Target Audience · Ledger API client ID · Ledger API user · CNS UI client ID · Wallet UI client ID · Wallet user · Management Scope

With managed authentication these are the values the operator provisioned. With an external identity provider they are the values you supplied on the Validator resource — so if a component is failing to authenticate, check them here first against what actually exists in your identity provider.

Authenticated user

Row	Meaning
User ID	The ledger user the API is authenticating as
Primary party	That user's default party
Identity provider	The identity provider ID, or default
Status	Active or Deactivated

If this section fails to load, the API could not authenticate against the participant. That usually means the OIDC client secret, the audience, or the scope is wrong — the values above are where to look.

Identity dump

The Identity Dump button downloads the participant's identity export as <validator-name>-identities.json.

An identity dump is the validator's cryptographic identity. Anyone holding it can reconstruct the node's identity on the network. Treat it exactly as you would a private key:

• store it in a secrets manager, not in a shared drive, ticket, or chat;

• never commit it to a repository;

• transfer it only over encrypted channels.

There is no confirmation step — clicking the button downloads the file immediately.

You need this file if the participant's database is ever lost or corrupted beyond recovery. See Identity Dumps & Database Backups.

States

Situation	What you see
No managed authentication section	No identity payload — No managedAuth section returned for this validator. Expected when using an external identity provider
User lookup failed	Failed to load user, with the error

---

Endpoints

Network endpoints exposed by this validator and its applications.

Endpoints are grouped by the component that owns them, and each group lists:

Label	Meaning
Internal	The in-cluster address, reachable from other workloads
External	The public address through the ingress

Every URL has a copy button. https:// URLs render as links you can open directly.

What you use these for

• External URLs are what you give to people — the Wallet UI and CNS UI addresses for end users, and the Wallet Gateway address where enabled.

• Internal URLs are what you give to applications running in the same cluster — a Daml application connecting to the Ledger API, for instance, should use the internal participant address rather than going out through the ingress.

Only components with an ingress route have an External URL. The participant and the validator app are deliberately not exposed publicly; to reach the Ledger API from outside the cluster, front it yourself with appropriate authentication and network controls.

States

Situation	What you see
Loading	Loading endpoints…
None reported	No endpoints exposed — The validator and its applications have not reported any addressable endpoints.
Load failed	Failed to load endpoints, with the error