> For the complete documentation index, see [llms.txt](https://docs.catalyx.solutions/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.catalyx.solutions/catalyx-blockchain-manager/canton-network/version-2.0/support-and-resources/faq.md).
# FAQ
Frequently asked questions about CAT-BM 2.0 for Canton.
## Getting started
Can I upgrade a 1.10 or 1.11 deployment in place?
No. 2.0 is a complete rewrite with a new operator, a new API, and new custom resources. It installs fresh. Contact IntellectEU support before planning a migration — the procedure depends on your deployment.
Why can't I create a validator from the UI?
By design. A validator is a `Validator` custom resource, so creating one is a Kubernetes apply — which makes it reviewable, diffable, and GitOps-friendly. The UI is for operating validators once they exist.
See [Create a Validator](/catalyx-blockchain-manager/canton-network/version-2.0/validator-management/create-a-validator.md).
Do I have to use Keycloak?
No. Any OIDC-compliant identity provider works — Okta, Microsoft Entra ID, Auth0, Ping Identity, and others. Set `managedKeycloak: false` and supply the client IDs yourself.
Managed provisioning, where CAT-BM creates the clients for you, is Keycloak-specific. See [Identity Provider Configuration](/catalyx-blockchain-manager/canton-network/version-2.0/validator-management/identity-provider-configuration.md).
Do I need to create the validator databases first?
No. The operator creates them, provided the credentials you give it can `CREATEDB` and can reach the `postgres` maintenance database.
***
## Operating
My validator says Ready but the participant says Disconnected. Which is right?
Both. They measure different things.
* **Ready** is about Kubernetes — every workload the validator owns is running.
* **Disconnected** is about Canton — the participant node has lost its synchronizer connection.
A healthy set of pods with an unhealthy network connection is exactly this combination. Start on the validator's [Participant](/catalyx-blockchain-manager/canton-network/version-2.0/console-guide-canton/validators/participant-and-keys.md) tab, under **Connected Synchronizers**.
I changed the Validator resource and nothing happened.
Check three things, in order:
1. **Observed Generation** on the [Status](/catalyx-blockchain-manager/canton-network/version-2.0/console-guide-canton/validators/status-and-specification.md) tab. If it lags behind, the change has not been reconciled.
2. **The `Ready` condition.** A reason of `InvalidSpec` means the operator rejected your change and the message names the field.
3. **Whether the field survived.** Unknown fields are silently pruned by the Kubernetes API server, so a typo disappears without an error. Run `kubectl get validator -o yaml` and look for it.
Where is ledger pruning?
It is not exposed in the CatalyX UI in 2.0. Prune through the [Canton console](/catalyx-blockchain-manager/canton-network/version-2.0/console-guide-canton/canton-console.md), which gives you the participant's full administrative command set.
Where do I buy traffic or top up a balance?
Not in the CatalyX UI — the Balances and Traffic tabs are read-only monitoring. Use the Wallet UI, or the Canton console.
Watch **Base remaining** and **Extra consumed** on the [Traffic](/catalyx-blockchain-manager/canton-network/version-2.0/console-guide-canton/validators/balances-and-traffic.md) tab: a participant that exhausts both is throttled by the synchronizer and command submission starts failing.
The CPU and Memory columns are empty.
Live usage comes from the Kubernetes metrics API, which needs `metrics-server` installed and healthy in the cluster. Requests and limits still display without it; only actual usage is missing.
Why do the Grafana links go nowhere?
The buttons are always rendered, whether or not Grafana is configured. Set `ui.grafana.baseUrl` in the Helm values. See [Grafana Links](/catalyx-blockchain-manager/canton-network/version-2.0/console-guide-canton/grafana-dashboards.md).
***
## Parties and users
What is the difference between a party, a ledger user, and a wallet user?
* A **party** is an on-ledger identity that can hold contracts.
* A **ledger user** is an account on the participant that has rights over one or more parties, and is what an application authenticates as.
* A **wallet user** is a registration with the validator app so a person can sign in to the Wallet UI.
None of them is an account in your identity provider — that has to exist already. See [Users & Rights](/catalyx-blockchain-manager/canton-network/version-2.0/validator-management/users-and-rights.md).
Why can't I see all the parties on the network?
Because a production participant may know of hundreds of thousands of parties, so a full listing is impractical. **Browse Parties** is a prefix search requiring at least two characters. For the parties this participant hosts, use **Hosted Parties**, which is a complete list.
When should I use an external party instead of allocating one?
Allocate a party when your participant should legitimately act on its behalf. Onboard an **external party** when the party's owner should hold its own signing key — the participant then cannot submit for it.
External parties are also the prerequisite for multi-hosting. See [External & Multi-Host Parties](/catalyx-blockchain-manager/canton-network/version-2.0/validator-management/external-and-multi-host-parties.md).
I onboarded a multi-hosted party and it doesn't work.
A multi-hosted party is not usable until **every** named host has authorized it. Until then it exists as a proposal, not as effective state.
Check the Distribute step's host list, or ask each co-host's operator to look at their own **Hosting Proposals** tab. Note that approval propagation takes a few seconds.
I mistyped a participant UID and onboarding failed. Can I retry?
Not with the same party. The party's signature covers the host set, so it is consumed by the failed attempt. Start again with a **fresh party hint**.
This is why the wizard runs an advisory lookup on every UID — resolve any warning before you reach the signing step.
Can I multi-host a party I allocated with Allocate Party?
No. A participant-managed party has no external key holder to sign a hosting change. If you need a party on more than one participant, onboard it as an external party from the start.
Does the confirmation threshold control how many participants must approve the hosting?
No — that is the most common misreading of the field. Hosting authorization is **all-of-N**: every named host must authorize, regardless of the threshold.
The threshold governs how many *confirming* hosts must confirm each of the party's **ledger transactions**, once it is live.
***
## Security
Who can do what in the UI?
In 2.0 there is no per-validator or per-screen authorisation. Any user who can obtain a token for the UI client can reach every screen, including the operations that change ledger state and the Canton console.
Enforce access control at token issuance in your identity provider, and treat UI access as platform administrator access.
Are secrets visible in the UI?
No. The Specification tab filters out any field whose path looks like a secret, and application environment variables sourced from a Kubernetes Secret show a `from secret` badge instead of the value.
How sensitive is an identity dump?
Extremely. It is the validator's cryptographic identity — treat it as private key material. Store it in a secrets manager, never in a repository, ticket, or chat, and transfer it only over encrypted channels. See [Identity Dumps & Database Backups](/catalyx-blockchain-manager/canton-network/version-2.0/validator-management/identity-dumps.md).
Are the OpenAPI endpoints public?
Yes — `/v3/api-docs` and `/swagger-ui.html` are served without authentication on the platform hostname. If that is unacceptable in your environment, restrict them with a Traefik middleware or block them at your edge. See [Platform Installation](/catalyx-blockchain-manager/canton-network/version-2.0/installation-instructions-canton/platform-installation.md).
***
## Backups and recovery
Does CAT-BM back up my databases?
No. Database backups are yours to run, with your existing PostgreSQL tooling and retention policy. CAT-BM provides the identity dump, which is the other half of a recoverable validator.
See [Identity Dumps & Database Backups](/catalyx-blockchain-manager/canton-network/version-2.0/validator-management/identity-dumps.md).
What happens when I delete a Validator resource?
The child applications and their workloads are removed. **Not** removed: the databases, the identity provider clients and users created by managed authentication, and the managed authentication secret.
That is deliberate — it lets you recreate a validator against its existing state. It also means decommissioning permanently is a two-step job.
If I use a KMS, is an identity dump still enough to recover?
No. With a KMS, the keys live in the key vault, and an identity dump does not substitute for keys the node can no longer reach. Losing access to the vault is unrecoverable — give it the same backup and access-recovery treatment as your databases.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.catalyx.solutions/catalyx-blockchain-manager/canton-network/version-2.0/support-and-resources/faq.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.