Skip to content

See who exchanges data with whom

Read a map of your tenant's cryptographic exchanges: which of your applications send to or receive from which external counterparties or other applications, under which exchange context, and what each grant authorizes right now.

Who can do it

Anyone who can read the tenant's exchanges and list its exchange contexts: a tenant administrator, tenant access administrator, tenant key manager, tenant auditor or tenant viewer. A platform administrator, operator, auditor or viewer reads it from inside the tenant, where the console acts as the matching tenant role. The map is read-only, with one exception: a person who holds the permission to re-pin capability grants can change a grant's policy version from it.

The screen is for STANDARD tenants. A SIMPLE tenant does not see it.

Before you start

  • The tenant has at least one exchange. Until then the map is empty and offers Go to Cryptographic Exchanges.
  • The map draws at most 200 exchanges. When the tenant holds more, it says how many of the total it shows.

Steps

  1. Open Exchange Topology.
  2. Read the map. Your applications stand in the centre under Internal applications; external counterparties stand under External origins when they send and External destinations when they receive. The map draws one line per origin and destination, carrying every exchange between them. The legend reads Number on a line = grants · number on a card = exchanges: the number on a line counts its grants, and every card states that party's exchanges, such as "3 exchanges". A line is drawn Active, Suspended, Not started (draft or ready) or Ended (consumed, revoked or expired).
  3. To filter the map and the list, choose a Relationship: All, Same app A → A, Internal A → B, Outbound A → external or Inbound external → A. Only the exchanges with that relationship stay drawn and listed.
  4. Beside the map, the list under Exchange Contexts shows one entry per exchange, grouped by context and, inside a context, by origin → destination. When more than 12 exchanges are listed, the contexts start folded; open a context to see its exchanges.
  5. Select a line. A line that carries one exchange opens its detail. A line that carries several narrows the list to them; select one there. Show all exchanges returns the whole list. You can also select an entry in the list directly.
  6. The Exchange detail panel shows origin and destination, the Context, the status, the Authorized operations (from grants), and for each grant its actor, keys or Key pairs, Policy, Limits, Schedule and whether it is Usable now. The panel changes nothing.
  7. To change the exchange, select Open exchange: it opens on the exchange's own screen, where grants are added and the exchange is suspended or resumed.

What you see when it worked

The map and the list show every exchange the tenant holds, up to the drawing limit, each in its context. The detail panel's verdict on a grant is the administration plane's reading at that moment: the key's state, rate limits and usage counts are decided per request, so a grant shown as usable can still be refused when it is used.

If it fails

What you see Cause What to do
No exchange has this relationship. The relationship you chose matches no exchange Choose All or another relationship
Could not load the topology The exchanges or the exchange contexts could not be read Select retry; if it persists, check that you hold the permissions to read exchanges and list exchange contexts
Nothing to map yet The tenant has no exchange Create one from Cryptographic Exchanges
The map shows the first 200 of <n> exchanges. The tenant holds more exchanges than the map draws Use Cryptographic Exchanges, which pages through all of them
These exchanges are not drawn: the server sent a relationship that disagrees with their endpoints (<ids>). The relationship of the named exchanges does not match their endpoints Open them from Cryptographic Exchanges

Without the console

Surface How
Key management CLI ankasecure-km exchanges list (filter with --relationship, --exchange-context-id, --application-id, --counterparty or --status); exchanges get --id <uuid>
Admin SDK ExchangeOperations.list(ExchangeListQuery), ExchangeOperations.get(UUID). No method reads an application's exchange statistics
API GET /api/v3/admin/exchanges (operation listExchanges); GET /api/v3/admin/exchanges/{id} (operation getById); GET /api/v3/admin/tenants/{tenantId}/applications/{applicationId}/exchange-stats (operation getApplicationExchangeStats), an application's exchange counts