> For the complete documentation index, see [llms.txt](https://docs.catalyx.solutions/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.catalyx.solutions/catalyx-blockchain-manager/canton-network/version-2.0/console-guide-canton/validators/identity-and-endpoints.md).
# Identity & Endpoints
## Identity
*Managed Keycloak realm and OIDC client configuration for this validator.*
The fastest way to confirm that a validator's authentication is wired up as you intended.
### Metric cards
| Card | Values |
| -------------------- | ----------------------- |
| **Auth enabled** | `Yes` / `No` |
| **Managed Keycloak** | `Managed` or `External` |
| **Provisioned** | `Yes` / `No` |
### Realm
Each row appears only when the value is set, and each is copyable:
**Auth URL** · **Target Audience** · **Ledger API client ID** · **Ledger API user** · **CNS UI client ID** · **Wallet UI client ID** · **Wallet user** · **Management Scope**
With managed authentication these are the values the operator provisioned. With an external identity provider they are the values you supplied on the `Validator` resource — so if a component is failing to authenticate, check them here first against what actually exists in your identity provider.
### Authenticated user
| Row | Meaning |
| --------------------- | -------------------------------------------- |
| **User ID** | The ledger user the API is authenticating as |
| **Primary party** | That user's default party |
| **Identity provider** | The identity provider ID, or `default` |
| **Status** | `Active` or `Deactivated` |
{% hint style="info" %}
If this section fails to load, the API could not authenticate against the participant. That usually means the OIDC client secret, the audience, or the scope is wrong — the values above are where to look.
{% endhint %}
### Identity dump
The **Identity Dump** button downloads the participant's identity export as `-identities.json`.
{% hint style="danger" %}
**An identity dump is the validator's cryptographic identity.** Anyone holding it can reconstruct the node's identity on the network. Treat it exactly as you would a private key:
* store it in a secrets manager, not in a shared drive, ticket, or chat;
* never commit it to a repository;
* transfer it only over encrypted channels.
There is no confirmation step — clicking the button downloads the file immediately.
{% endhint %}
You need this file if the participant's database is ever lost or corrupted beyond recovery. See [Identity & Backups](/catalyx-blockchain-manager/canton-network/version-2.0/validator-management/identity-and-backups.md).
### States
| Situation | What you see |
| --------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| No managed authentication section | **No identity payload** — *No managedAuth section returned for this validator.* Expected when using an external identity provider |
| User lookup failed | **Failed to load user**, with the error |
***
## Endpoints
*Network endpoints exposed by this validator and its applications.*
Endpoints are grouped by the component that owns them, and each group lists:
| Label | Meaning |
| ------------ | ------------------------------------------------------ |
| **Internal** | The in-cluster address, reachable from other workloads |
| **External** | The public address through the ingress |
Every URL has a copy button. `https://` URLs render as links you can open directly.
### What you use these for
* **External** URLs are what you give to people — the Wallet UI and CNS UI addresses for end users, and the Wallet Gateway address where enabled.
* **Internal** URLs are what you give to applications running in the same cluster — a Daml application connecting to the Ledger API, for instance, should use the internal participant address rather than going out through the ingress.
{% hint style="info" %}
Only components with an ingress route have an **External** URL. The participant and the validator app are deliberately not exposed publicly; to reach the Ledger API from outside the cluster, front it yourself with appropriate authentication and network controls.
{% endhint %}
### States
| Situation | What you see |
| ------------- | ------------------------------------------------------------------------------------------------------------ |
| Loading | *Loading endpoints…* |
| None reported | **No endpoints exposed** — *The validator and its applications have not reported any addressable endpoints.* |
| Load failed | **Failed to load endpoints**, with the error |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.catalyx.solutions/catalyx-blockchain-manager/canton-network/version-2.0/console-guide-canton/validators/identity-and-endpoints.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.