> For the complete documentation index, see [llms.txt](https://docs.openg2p.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openg2p.org/products/open-agri-stack/exchange/composite/console.md). # Composite Console The Composite's read-only staff console: use cases with their data scopes, registries and their scope catalogues, partners and the call log. Staff log in through IAM (Keycloak staff realm). The console shows how the Composite is set up and what it has been doing. It is **read-only**: use cases, registries and settings are still changed in the Helm values (Git and Helm history record those changes); partners, their keys and their use-case grants are managed in Partner Management, and consents in the Consent Manager; the console links to both portals. | Page | What it shows | | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **Overview** | Composite partner ID, consent mode and Exchange Consent Manager, signing key, Audit Manager on/off; counts of use cases (and files that failed to load), registries and partners; calls and failures in the last 24 hours | | **Use cases** | Each published use case: its sources (one search per registry), what happens if a source can't answer, which sources run after which, their required and optional [data scopes](/products/open-agri-stack/exchange/composite/use-case-configuration.md#data-scopes), inputs, output fields (with their mapping), **Granted to** (the partners with a policy for this use case, `name@major`, in Partner Management), and the use case file. The labels are explained in [reading a use case in the console](/products/open-agri-stack/exchange/composite/creating-a-use-case.md#reading-a-use-case-in-the-console) | | **Registries** | Each configured registry: its URL, whether it answers, and its data scope catalogue (read from the registry with the Composite's signature, cached 5 minutes): every scope with its fields and the use case sources that use it. This is where an admin picks the scopes when writing a use case. | | **Partners** | Read from Partner Management: every partner with a policy for a published use case (one policy per use case), with its **Partner (Partner Management ID)**, **Granted use cases** and the keys PM serves for it. Policy versions are in Partner Management. If PM cannot be read, the page says *Partner Management could not be read* and the list may be incomplete; the Overview's partner count shows a dash | | **Activity** | The call log, newest first, filtered by partner, use case and outcome: time, HTTP status, outcome and reason, the consent used, duration and each source's status | ## Access Staff log in through the IAM staff portal (Keycloak staff realm), as for the catalogue. The console registers itself in IAM as the application `agri-composite`: | Role | Permissions | | ----------------------- | ------------------------------------------------------------- | | `AGRI_COMPOSITE_ADMIN` | `composite:view`, `composite:manage` (kept for editing later) | | `AGRI_COMPOSITE_VIEWER` | `composite:view` | The console's API is `GET /composite/v1/admin/...` on the Composite service, allowed only with an IAM session holding `composite:view`. The partner API is unchanged: it needs no session and is not affected by the login checks. ## Call log The Audit Manager stays the record of every request (it has no read API), so the console keeps its own call log in a small database (`agri_composite` in the shared Postgres): one row per query whose partner signature verified (unsigned or forged requests are not logged, so nobody can write rows under another partner's name), with the time, use case, partner, HTTP status, outcome and reason, duration, each source's status and the consent's ID (as the Exchange CM names it). Never the subject, the consent's content or any data. Rows are written in batches in the background, so a query never waits on the database. Once a day one worker (across all pods) deletes rows older than `console.activityRetentionDays` (default 90). The Activity page counts up to 10,000 matching rows and shows "10000+" beyond that. ## Install In the Composite's Rancher form, group **Console**, or in Helm values: | Value | Default | | | -------------------------------------------- | ------------------------------------------------------------- | ----------------------------------------------------------------------------------------------- | | `console.enabled` | `true` | `false`: no UI, no login checks, no database (the partner API only) | | `global.consoleHostname` | `agri-composite-console..openg2p.org` | The console's address | | `console.iam.providerApiUrl` | `http://commons-services-iam-staff-portal-api` | IAM staff portal API (in-cluster) | | `console.iam.publicUrl` | `https://staff-iam..openg2p.org` | IAM staff portal API, public (the browser's login) | | `console.iam.redisUrl` | `redis://commons-redis-master:6379/0` | Login sessions | | `console.iam.keycloakClientId` | `agri-composite` | The console's Keycloak client and IAM application | | `console.db.*` | `commons-postgresql`, `agri_composite`, `agri_composite_user` | Created by the chart's database job; password in Secret `agri-composite-db` (kept on uninstall) | | `console.pmPortalUrl`, `console.cmPortalUrl` | the namespace's PM and CM portals | Links shown in the console | | `console.activityRetentionDays` | `90` | Call log retention | With the console on, the chart also creates the Keycloak client and registers the console in IAM (a Helm hook; set `console.iamRegister.runAsHook: false` in an umbrella install that runs it after IAM is ready). Then grant staff `AGRI_COMPOSITE_ADMIN` or `AGRI_COMPOSITE_VIEWER` in IAM. **Uninstall:** [`scripts/uninstall-agri-composite.sh`](https://github.com/openg2p/agri-stack/blob/develop/scripts/uninstall-agri-composite.sh) `--namespace ` removes the release and what survives `helm uninstall`: its Jobs, ConfigMaps and Secrets, the console database and role, and the console's IAM application rows (`--keep-db`, `--keep-iam` to keep them; `--dry-run` to see the plan). It keeps the console's Keycloak client (a reinstall updates it), the PM/CM entries, and the signing Secret unless `--drop-signing-secret`. {% hint style="info" %} **Later:** editing use cases in the console (stored in the database, with a record of who changed what and when, also sent to the Audit Manager), and a "give partner X use case Y" flow that raises the policy request in Partner Management from the console. See the [open items](/products/open-agri-stack/open-items.md). {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.openg2p.org/products/open-agri-stack/exchange/composite/console.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.