This is the multi-page printable view of this section. Click here to print.
We provide a variety of premium features exclusively for our paying customers.
For further details, please visit:
This article provides tips on how to effectively manage your CVAT Online subscriptions, including tracking expenses and canceling unnecessary subscriptions, to optimize your finances and save time.
Whether you’re a business owner or an individual, you’ll learn how to take control of your subscriptions and manage them.
See:
This section outlines the paid plans available on CVAT Online.
| Name | Description |
|---|---|
| Solo | The Solo plan has a fixed price and is designed for personal use only. It does not assume collaboration with team members and is not suitable for use within organizations, but it removes all other limitations of the Free plan. Note: Although it allows the creation of an organization and access for up to 2 members – it is for trial purposes only! Organization and members will have all the limitations of the Free plan. |
| Team | The Team is for collaboration, it removes limitations of the Free plan for the whole organization, allowing you to share paid benefits with your colleagues. The monthly payment for the plan depends on the number of team members you’ve added. All limits of the Free plan will be removed. Note: The organization owner is also part of the team. So, if you have two annotators working, you’ll need to pay for 3 seats (2 annotators + 1 organization owner). |
Whether you’re a new user, or have a subscription to Team or Solo plan, you can subscribe to our annual plan and save up to 30% on CVAT Online usage costs.
The annual subscription offers all the benefits of our paid plans but at a more affordable monthly rate.
For more information, see How to switch from monthly subscription to annual?
This section describes the billing model and gives short a description of limitations for each plan.
There are two types of subscriptions available for both the Solo and Team plans: monthly and annual.
For more information, see: Pricing Plans
To ensure VAT (tax) information and other relevant details are included on your CVAT Online invoices, it’s important to add this information before making the first payment.
Here’s how you can do it:
Select checkbox I agree to refund policy (4).
Note: Please read the Refund policy before selecting the checkbox.
Click Pay & Subscribe.
All information you’ve added will appear on the billing page and in the invoice.
By following these steps, you can seamlessly add VAT and other crucial information to your invoices, making your financial transactions with CVAT Online transparent and compliant.
In the top right corner, near the nickname, click on the arrow > manage plan.
You will see the Stripe page. Go to the Billing Information > Update Information.
Once an invoice has been paid, it is not possible to modify it. This restriction is due to the limitations of the payment processing platform used, which in the case of CVAT Online, is Stripe.
Stripe’s policy dictates that revisions to an invoice can only be made before payment. For more comprehensive information on this policy, please refer to Stripe’s official documentation on invoice edits at their website.
If you require a quote from CVAT Online for payment via bank transfer, certain criteria must be met:
Should you meet these requirements, please write to support@cvat.ai
Sign of specific agreements and approvals are available if you meet specific criteria (the total subscription cost must be $10,000 and up per year), for more details contact support@cvat.ai
Yes, it is available if you fit the quota criteria, for details contact support@cvat.ai.
In the top right corner, near the nickname, click on the arrow > manage plan.
You will see the Stripe page. At the bottom of the page, you will see the Invoice History section with all invoices.
Invoices are automatically sent to the account owner’s address used for the registration.
To see the invoice click on the Show Invoice Icon
icon.
To consider your request for a discount, we’d need a few details from you:
All these details must be sent to support@cvat.ai. Once we have this information, we’ll gladly offer you a 50% discount for one year.
This section describes how to change or add payment methods.
Note At the moment this method of payment works only with US banks.
To pay with a bank transfer:
Note that the completion of the payment process may take up to three banking days.
In the top right corner, near the nickname, click on the arrow > manage plan > +Add Payment Method
Solo plan is for personal use only, you cannot add or remove team members.
Team plan is for collaboration. To add members to your Organization, go to the Manage Team plan > Update quantity.
If you’ve added a user before the current billing period ends, the payment will be prorated for the remaining time until the next billing cycle begins. From the following month onward, the full payment will be charged.
In case you removed the user before the current billing period ends, funds will not be returned to your account, but next month you will pay less by the amount of unused funds.
The procedure is the same for both Solo and Team plans.
If for some reason you want to change your plan, you need to:
If you have monthly subscription, and wish to switch to the Annual plan, please follow these steps:
The price will be adjusted according to the number of members, selected in the Quantity field (if updated), taking into account the amount of money that was not spent in the current period.
Upon payment, your subscription will be renewed and the start date will be reset to the day you switch to the new plan.
Paid plans are not mutually exclusive. You can have several active subscriptions, for example, the Solo plan and several Team plans for different organizations.
This section describes how to cancel your CVAT subscription and what will happen to your data.
Once you have terminated your subscription, your data will remain accessible within the system for a month. During this period, you will be unable to add new tasks and free plan limits will be applied.
In case you possess a substantial amount of data, it will be switched to read-only mode. It means you will not be able to save annotations, add any resources, and so on.
Following the one month, you will receive a notification requesting you to either remove the excess data or it will be deleted automatically.
To cancel the plan, in the top right corner, near the nickname, click on the arrow> manage plan > Cancel plan
Please, fill out the feedback form, to help us improve our platform.
To understand if you are eligible for a refund, see Refund policy.
Our team will review your request. We may request additional information if needed. Once approved, the refund will be processed to your original payment method within 5-10 business days.
To renew your CVAT Online subscription, in the top right corner, near the nickname, click on the arrow> manage plan > Renew plan.
Note: This is a paid feature available for Enterprise clients.
You can now easily set up authentication with popular social services, which opens doors to such benefits as:
Currently, we offer three options:
With more to come soon. Stay tuned!
To enable authentication, do the following:
Log in to the Google Cloud console
Create a project, and go to APIs & Services
On the left menu, select OAuth consent, then select User type (Internal or External), and click Create.
On the OAuth consent screen fill all required fields, and click Save and Continue.
On the Scopes screen, click Add or remove scopes and
select auth/userinfo.email, auth/userinfo.profile, and openid.
Click Update, and Save and Continue.
For more information, see Configure Auth Consent.
On the left menu, click Credentials, on the top menu click + Create credentials, and select OAuth client ID.
From the Application Type select Web application and
configure: Application name, Authorized JavaScript origins, Authorized redirect URIs.
For example, if you plan to deploy CVAT instance on https://localhost:8080, add https://localhost:8080
to authorized JS origins and https://localhost:8080/api/auth/social/goolge/login/callback/ to redirect URIs.
Create configuration file in CVAT:
Create the auth_config.yml file with the following content:
---
social_account:
enabled: true
google:
client_id: <some_client_id>
client_secret: <some_client_secret>
Set AUTH_CONFIG_PATH="<path_to_auth_config> environment variable.
In a terminal, run the following command:
docker compose -f docker-compose.yml -f docker-compose.dev.yml -f docker-compose.override.yml up -d --build
There are 2 basic steps to enable GitHub account authentication.
Open the GitHub settings page.
On the left menu, click <> Developer settings > OAuth Apps > Register new application.
For more information, see Creating an OAuth App
Fill in the name field, set the homepage URL (for example: https://localhost:8080),
and authentication callback URL (for example: https://localhost:8080/api/auth/social/github/login/callback/).
Create configuration file in CVAT:
Create the auth_config.yml file with the following content:
---
social_account:
enabled: true
github:
client_id: <some_client_id>
client_secret: <some_client_secret>
Set AUTH_CONFIG_PATH="<path_to_auth_config> environment variable.
In a terminal, run the following command:
docker compose -f docker-compose.yml -f docker-compose.dev.yml -f docker-compose.override.yml up -d --build
Note: You can also configure GitHub App, but don’t forget to add required permissions.
In the Permission > Account permissions > Email addresses must be set to read-only.
To enable authentication with Amazon Cognito for your CVAT instance, follow these steps:
Now, let’s dive deeper into how to accomplish these steps.
This step is optional and should only be performed if a user pool has not already been created. To create a user pool, follow these instructions:
Cognito in the list of servicesCreate user poolTo create a new app client, follow these steps:
App clients item in the menu on the leftCreate app client
Application type: Traditional web applicationApplication name: Specify a desired name, or leave the autogenerated oneReturn URL (optional): Specify the CVAT redirect URL
(<http|https>://<cvat_domain>/api/auth/social/amazon-cognito/login/callback/).
This setting can also be updated or specified later after the app client is created.Login pages tab of the created app clientManaged login pages configuration section and edit them if needed:
Allowed callback URLs: Must be set to the CVAT redirect URLIdentity providers: Must be specifiedOAuth grant types: The Authorization code grant must be selectedOpenID Connect scopes: OpenID, Profile, Email scopes must be selectedTo configure social authentication in CVAT, create a configuration file
(auth_config.yml) with the following content:
---
social_account:
enabled: true
amazon_cognito:
client_id: <client_id>
client_secret: <client_secret>
domain: <custom-domain> or
https://<custom-cognito-prefix>.auth.us-east-1.amazoncognito.com
To find the client_id and client_secret values, navigate to the created app client page
and check the App client information section. To find domain, look for the Domain item in the list on the left.
Once the configuration file is updated, several environment variables must be exported before running CVAT:
export AUTH_CONFIG_PATH="<path_to_auth_config>"
export CVAT_HOST="<cvat_host>"
# cvat_port is optional
export CVAT_BASE_URL="<http|https>://${CVAT_HOST}:<cvat_port>"
Start the CVAT enterprise instance as usual.
That’s it! On the CVAT login page, you should now see the option Continue with Amazon Cognito.
Note: This is a paid feature available only to Enterprise clients.
CVAT supports Single Sign-On (SSO) using both OpenID Connect (OIDC) and Security Assertion Markup Language (SAML) protocols.
To configure SSO, complete the following 2 main steps:
If the application is already configured, refer to the Configuring SSO in CVAT section. Otherwise, you may follow one of the detailed platform-specific guides to set up such an application:
Follow these steps to configure an application on the Microsoft Azure platform and integrate it with CVAT:
To start, log into your Microsoft Azure Portal. Once you’re in:
Navigate to the Microsoft Entra ID service -> App registrations section in the menu on the left.
Click on the + New registration button.
Enter application name.
Select Supported account types based on your needs.
Add Redirect URI: choose Web platform and set <scheme:cvat_domain>/api/auth/oidc/<idp-id:azure-oidc>/login/callback/
to the value field.
Click on the Register button.
You’ve created an app, now you should configure the credentials for it.
Overview tab of your newly created application.
Client credentials section, click the Add a certificate or secret link.
This will take you to the Certificates & secrets page.+ New client secret.Add.
The newly created secret will appear in the list.
Make sure to copy the value now — you won’t be able to see it again later.
Utilize the example below as a template for your configuration:
sso:
enabled: true
selection_mode: email_address
identity_providers:
- id: <idp-id:azure-oidc>
protocol: OIDC
name: Azure OIDC-based IdP
server_url: https://<Directory (tenant) ID>/v2.0/
client_id: <Secret ID>
client_secret: <Secret Value>
email_domain: <company_email_domain>
Secret ID and Secret Value values may be found on Certificates & secrets tab of the application,
while Directory (tenant) ID - on the Overview tab.
You can now proceed to start CVAT. For additional CVAT configuration details, refer to Configuring SSO in CVAT.
Follow these steps to configure an application on the Microsoft Azure platform and integrate it with CVAT:
To start, log into your Microsoft Azure Portal. Once you’re in:
Microsoft Entra ID service -> Enterprise applications section in the menu on the left.+ New application and enter a name for the application in the popup window, then click Create.
You’ve created an app, now you should finalize its configuration and assign users or groups.
Single sign-on section in the menu on the left.
Basic SAML Configuration:
Identifier (Entity ID): <scheme:cvat_domain>/api/auth/saml/<idp-id:azure-saml>/metadata/Reply URL (Assertion Consumer Service URL): <scheme:cvat_domain>/api/auth/saml/<idp-id:azure-saml>/acs/
Attributes & Claims by adding a new uid claim:
uidhttp://schemas.xmlsoap.org/ws/2005/05/identity/claimsattributeuser.objectid
At this point, no users or groups have been assigned to the application. To grant access:
Users and groups section of the application.+ Add user/group button.The selected users or groups will now appear in the assignment list.
That’s it, now we can move on to the configuration in CVAT.
Utilize the example below as a template for your configuration:
sso:
enabled: true
selection_mode: email_address
identity_providers:
- id: <idp-id:azure-saml>
protocol: SAML
name: Azure SAML-based IdP
entity_id: <Microsoft Entra Identifier> (https://sts.windows.net/<tenantId>/)
metadata_url: <App Federation Metadata Url>
attribute_mapping:
uid: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/uid
username: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier
email: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
first_name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
last_name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
# email_verified: it is not possible to configure SAML-based application to send this claim to the SP
email_domain: <company_email_domain>
Actual Microsoft Entra Identifier and App Federation Metadata Url values may be found
on the Single sign-on tab of the created application
You can now proceed to start CVAT. For additional CVAT configuration details, refer to Configuring SSO in CVAT.
Follow these steps to configure an application on the Okta platform and integrate it with CVAT:
To start, log into your Okta admin dashboard. Once you’re in:
Navigate to the Applications section in the menu on the left.
Click on the Create App integration button.
Select OIDC - OpenID Connect as a sign-in method and Web Application type.
Fill the form with the following content:
App integration name: enter a name for the applicationSign-in redirect URIs: <scheme:cvat_domain>/api/auth/oidc/<idp-id:okta-oidc>/login/callback/Controlled access to match your requirements. In this example, we’ll use Skip group assignment for now.
You’ve created and configured the app, now you should assign users or groups to the application.
At this point, no users or groups have been assigned to the application. To grant access:
Assignments tab of the application.Assign button and select Assign to People or Assign to Groups based on your needs.assign.The selected users or groups will now appear in the assignment list.
Utilize the example below as a template for your configuration:
sso:
enabled: true
selection_mode: email_address
identity_providers:
- id: <idp-id:okta-oidc>
protocol: OIDC
name: Okta OIDC-based IdP
server_url: https://<okta_domain>/
client_id: <client_id>
client_secret: <client_secret>
email_domain: <company_email_domain>
Client ID and Client secret key values may be found on the General tab of the created application
You can now proceed to start CVAT. For additional CVAT configuration details, refer to Configuring SSO in CVAT.
Follow these steps to configure an application on the Okta platform and integrate it with CVAT:
To start, log into your Okta admin dashboard. Once you’re in:
Navigate to the Applications section in the menu on the left.
Click on the Create App integration button.
Select SAML 2.0 as a sign-in method, then click Next.
Fill the form with the general settings and go to the next configuration step.
On the Configure SAML form set the following fields:
Single sign-on URL: <scheme:cvat_domain>/api/auth/saml/<idp-id:okta-saml>/acs/Audience URI (SP Entity ID: <scheme:cvat_domain>/api/auth/saml/<idp-id:okta-saml>/metadata/
Define attribute statements that will be shared with CVAT.
In our example we will use the Basic attribute name format and set the mapping as shown below:
firstName: user.firstNamelastName: user.lastNameusername: user.loginemail: user.emailuid: user.getInternalProperty("id")
Attribute Statements
Navigate to the next configuration step and fill the Feedback form.
You’ve created and configured the app. You can now either complete an optional step to simplify the login process in CVAT or proceed directly to the CVAT configuration step.
If CVAT is configured to require email verification,
it expects the Identity Provider to include the email_verified claim. However, Okta does not send this claim
by default. As a result, users will receive a confirmation email with a verification link.
There is an option to include email verification claim on the sign-in step:
emailVerified -> user.emailVerified on SAML-based application configuration step:
SAML Settings on the General tab and click Edit.emailVerified:
Directory section in the menu on the left -> Profile Editor itemUser (default))+ Add Attributeboolean data type
SavePeople section in the menu on the leftUtilize the example below as a template for your configuration:
sso:
enabled: true
selection_mode: email_address
identity_providers:
- id: <idp-id:okta-saml>
protocol: SAML
name: Okta SAML-based Identity Provider
entity_id: <Issuer>
metadata_url: <Metadata URL>
attribute_mapping:
uid: uid
username: username
email: email
first_name: firstName
last_name: lastName
email_verified: emailVerified # if configured
email_domain: <company_email_domain>
Metadata URL and Issuer values may be found on the Sign On tab of the application setting
You can now proceed to start CVAT. For additional CVAT configuration details, refer to Configuring SSO in CVAT.
Follow these steps to configure an application in the Auth0 platform and integrate it with CVAT:
To start, log into your Auth0 dashboard. Once you’re in:
Applications section in the menu on the left, click + Create Application.Regular Web Applications type, then click Create.
You’ve created an app, now you should finalize its configuration.
Settings tab of your new application, scroll down to the Application URIs section.<scheme:cvat_domain>/api/auth/oidc/<idp-id:auth0-oidc>/login/callback/ to the Allowed Callback URLs.
That’s it, now we can move on to the configuration in CVAT.
Utilize the example below as a template for your configuration:
sso:
enabled: true
selection_mode: email_address
identity_providers:
- id: <idp-id:auth0-oidc>
protocol: OIDC
name: Auth0 OIDC-based IdP
server_url: https://<auth0_domain>/
client_id: <client_id>
client_secret: <client_secret>
email_domain: <company_email_domain>
Client ID, Client Secret and Domain can be found in the Basic Information section of application settings
You can now proceed to start CVAT. For additional CVAT configuration details, refer to Configuring SSO in CVAT.
Follow these steps to configure an application in the Auth0 platform and integrate it with CVAT:
To start, log into your Auth0 dashboard. Once you’re in:
Applications section in the menu on the left, click + Create Application.Regular Web Applications type, then click Create.
You’ve created an app, now you should finalize its configuration.
Navigate to the Addons tab of the created application and click on the SAML2 WEB APP button.
Open the Settings tab in the popup window and set the following configuration:
Application Callback URL: <scheme:cvat_domain>/api/auth/saml/<idp-id:auth0-saml>/acs/Settings: enter a JSON object like the following:{
"audience": "<scheme:cvat_domain>/api/auth/saml/<idp-id:auth0-saml>/metadata/",
"recipient": "<scheme:cvat_domain>/api/auth/saml/<idp-id:auth0-saml>/acs/",
"destination": "<scheme:cvat_domain>/api/auth/saml/<idp-id:auth0-saml>/acs/",
"mappings": {
"user_id": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier",
"email": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
"nickname": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/username",
"given_name": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname",
"family_name": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname",
"email_verified": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailverified"
},
"createUpnClaim": false,
"passthroughClaimsWithNoMapping": false,
"mapIdentities": false
}
Scroll down and click Enable.
That’s it, now we can move on to the configuration in CVAT.
Utilize the example below as a template for your configuration:
sso:
enabled: true
selection_mode: email_address
identity_providers:
- id: <idp-id:auth0-saml>
protocol: SAML
name: Auth0 SAML-based IdP
entity_id: <Issuer>
metadata_url: <Metadata URL>
attribute_mapping:
uid: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier
username: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/username
email: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
first_name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
last_name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
email_verified: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailverified
email_domain: <company_email_domain>
Metadata URL and Issuer values may be found on the Usage tab of the SAML2 Web App plugin
You can now proceed to start CVAT. For additional CVAT configuration details, refer to Configuring SSO in CVAT.
To configure SSO in terms of Keycloak we need to create a client.
Follow these steps to do that:
To start, go to the Keycloak service (by default it is listening for HTTP and HTTPS requests using the ports 8080 and 8443, respectively) and log into your admin account. Once you’re in:
realm navigate to the Clients section and click create client.
Client type: OpenID ConnectClient ID: enter client identifierClient authentication toggle.
Login settings section, provide the following values:
Home URL: <scheme:cvat_domain>Valid redirect URIs: <scheme:cvat_domain>/api/auth/oidc/<idp-id:keycloak-oidc>/login/callback/Web origins: <scheme:cvat_domain>That’s it, now we can move on to the configuration in CVAT.
Utilize the example below as a template for your configuration:
sso:
enabled: true
selection_mode: email_address
identity_providers:
- id: <idp-id:keycloak-oidc>
protocol: OIDC
name: Keycloak OIDC-based Identity Provider
server_url: <scheme:keycloak_domain>/realms/<custom_realm>/.well-known/openid-configuration
client_id: <Client ID>
client_secret: <Client Secret>
email_domain: <company_email_domain>
Client Secret value can be found on the Credentials tab of the created OIDC client
You can now proceed to start CVAT. For additional CVAT configuration details, refer to Configuring SSO in CVAT.
Follow these steps to configure a client:
To start, go to the Keycloak service (by default it is listening for HTTP and HTTPS requests using the ports 8080 and 8443, respectively) and log into your admin account. Once you’re in:
realm navigate to the Clients section and click create client.
Client type: SAMLClint ID the URL: <scheme:cvat_domain>/api/auth/saml/<idp-id:keycloak-saml>/metadata/Login settings section, provide the following values:
Home URL: <scheme:cvat_domain>Valid redirect URIs: <scheme:cvat_domain>/api/auth/saml/<idp-id:keycloak-saml>/acs/You’ve created a client, now you should finalize its configuration.
SAML capabilities section.Name ID format: emailForce name ID format: OnKeys tab and enable the Client signature required toggle.Navigate to the Client scopes tab on the created client -> dedicated scopes for the client.
You will see that there is no configured mappers.
Set up mappers for the following attributes:
For attributes like email, first name, and last name, you can either
To configure other mappers click Configure a new mapper if it is a first mapper or Add mapper
-> By configuration and then select User Property.
For instance, to configure a mapper for the username attribute, fill in the form as it is done below:
Name: usernameProperty: usernameSAML Attribute Name: usernameAttributeThat’s it, now we can move on to the configuration in CVAT.
Utilize the example below as a template for your configuration:
sso:
enabled: true
selection_mode: email_address
identity_providers:
- id: <idp-id:keycloak-saml>
protocol: SAML
name: Keycloak SAML-based Identity Provider
entity_id: <scheme:keycloak_domain>/realms/<custom_realm>
metadata_url: <scheme:keycloak_domain>/realms/<custom_realm>/protocol/saml/descriptor
attribute_mapping:
uid: uidAttribute
email_verified: emailVerifiedAttribute
email: emailAttribute
last_name: lastNameAttribute
first_name: firstNameAttribute
username: usernameAttribute
email_domain: <company_email_domain>
Metadata URL may be found in the Realm settings on the General tab
You can now proceed to start CVAT. For additional CVAT configuration details, refer to Configuring SSO in CVAT.
CVAT provides a dedicated configuration file to customize the login and registration flow.
The sso section of this file specifies which external Identity Provider (IdP)
integrations are enabled. To set up SSO, you typically create a custom YAML configuration file
(e.g., auth_config.yml) and supply its path when starting CVAT.
| Setting | Description |
|---|---|
enabled |
Enables or disables Single Sign-On (SSO) functionality. |
selection_mode |
Defines how the Identity Provider (IdP) is selected for authenticating a given user. Available modes:
|
enable_pkce |
Controls whether Proof Key for Code Exchange (PKCE) is enabled for the authentication flow (disabled by default). This setting applies to all configured OIDC-based Identity Providers |
---
sso:
enabled: true|false
selection_mode: email_address|lowest_weight
enable_pkce: true|false
...
To integrate an Identity Provider, you must define its configuration block under the identity_providers section
in the CVAT config file. Each provider’s configuration includes both general and protocol-specific settings.
| Setting | Required | Description |
|---|---|---|
id |
required | A unique, URL-safe identifier for the IdP. Used in callback URLs. |
name |
required | A human-readable name for the IdP. |
protocol |
required | Authentication protocol (OIDC/SAML). |
email_domain |
optional | Company email domain (used with email_address selection mode). |
weight |
optional | Determines priority (used with lowest_weight selection mode). The default is 10. |
Additionally, each IdP configuration must include several protocol-specific parameters:
client_id and client_secret (required): These values can be obtained
from the configuration page of the specific provider.
server_url (required): URL is used to obtain IdP OpenID Configuration Metadata.
NOTE: How to check server_url correctness: server_url + /.well-known/openid-configuration API should exist
and return OpenID Provider Metadata.
Generally, each authentication platform provides a list of all endpoints. You need to find the corresponding endpoint
and select the part in front of /.well-known/openid-configuration. For example, in the case of integrating
an OIDC Microsoft Entry ID application, don’t forget to specify the second version of API
(https://login.microsoftonline.com/<tenant_id>/v2.0).
token_auth_method (optional): Token endpoint authentication method which can be one of
client_secret_basic, client_secret_post. If this field is omitted, a method from
the server’s token auth methods list will be used.
entity_id (required): IdP entity ID, should be equal to the corresponding setting in the IdP configuration.metadata_url (optional): SAML metadata URL. This can typically be found on the IdP configuration page.x509_cert (optional): The SAML X.509 certificate. Also could be found in the IdP’s configuration.
If the metadata_url is not specified, this parameter becomes required.sso_url (optional): SAML endpoint for the Single Sign-On service. Also could be found in the IdP’s configuration.
If the metadata_url is not specified, this parameter becomes required.attribute_mapping (required): A mapping between user account attributes and attributes sent by
the Identity Provider.Below are examples of SSO configuration file for both protocols:
---
sso:
enabled: true
selection_mode: email_address
identity_providers:
- id: oidc-idp
protocol: OIDC
name: OIDC-based IdP
server_url: https://example.com
client_id: xxx
client_secret: xxx
email_domain: example.com
---
sso:
enabled: true
selection_mode: lowest_weight
identity_providers:
- id: saml-idp
protocol: SAML
name: SAML-based IdP
entity_id: <idp-entity-id>
weight: 1
# specify only metadata_url or sso_url and x509_cert
metadata_url: http://example.com/path/to/saml/metadata/
sso_url: <Login URL>
x509_cert: |
-----BEGIN CERTIFICATE-----
certificate content
-----END CERTIFICATE-----
attribute_mapping:
uid: uidAttribute
email_verified: emailVerifiedAttribute
email: emailAttribute
last_name: lastNameAttribute
first_name: firstNameAttribute
username: usernameAttribute
More information about OIDC-based and SAML-based IdP configuration expected by Django Allauth can be found here and here respectively.
Once the configuration file is created, several environment variables must be exported before running CVAT:
export AUTH_CONFIG_PATH="<path_to_auth_config>"
export CVAT_HOST="<cvat_host>"
# cvat_port is optional
export CVAT_BASE_URL="<http|https>://${CVAT_HOST}:<cvat_port>"
Start the CVAT Enterprise instance as usual.
That’s it! The CVAT login page now should have the Continue with SSO option,
allowing users to authenticate using the configured Identity Provider.
The shapes converter is a feature that enables bulk actions on filtered shapes. It allows you to perform mutual conversion between masks, polygons and rectangles.
Note: All shapes converter work only when the filter is set up.
See:
Annotations actions can be accessed from the annotation menu. To access it, click on the burger icon and then select Run actions.
Note: All Shapes converter functions work in alignment with set up filter.
You will see the following dialog:
With the following fields:
| Field | Description |
|---|---|
| Select action | Drop-down list with available actions: Note: only Propagate shapes and Remove filtered shapes is available in the community version. |
| Specify frames to run action | Field where you can specify the frame range for the selected action. Enter the starting frame in the Starting from frame: field, and the ending frame in the up to frame field. If nothing is selected here or in Choose one of the predefined options section, the action will be applied to all fields. |
| Choose one of the predefined options | Predefined options to apply to frames. Selection here is mutually exclusive with Specify frames to run action. If nothing is selected here or in Specify frames to run action section, the action will be applied to all fields. |
Recommended Precautions Before Running Annotation Actions
Saving changes: It is recommended to save all changes prior to initiating the annotation action. If unsaved changes are detected, a prompt will advise to save these changes to avoid any potential loss of data.
Disable auto-save: Prior to running the annotation action, disabling the auto-save feature is advisable. A notification will suggest this action if auto-save is currently active.
Committing changes: Changes applied during the annotation session will not be committed to the server until the saving process is manually initiated. This can be done either by the user or through the auto-save feature, should it be enabled.
To convert shapes, do the following:
Annotate your dataset.
Set up filters.
From the burger menu, select Run actions.
Choose the action you need from the Select action drop-down list.
(Optional) In the Starting from frame field, enter the frame number where the action should begin, and in the up to frame field, specify the frame number where the action should end.
(Optional) Select an option from Or choose one of the predefined options to apply the action.
Click Run.
A progress bar will appear. You may abort the process by clicking Cancel until the process commits modified objects at the end of pipeline.
Note: Once the action is applied, it cannot be undone.
The basic idea behind this feature is to provide annotators with quick feedback on their performance in a job. When an annotator finishes a job, a dialog is displayed showing the quality of their annotations. The annotator can either agree or disagree with the feedback. If they disagree, they have the option to re-annotate the job and request feedback again.
To ensure transparency with the annotator, the immediate feedback shows the computed score and the minimum required score. Information about the specific errors or frames that have errors is not available to annotators.
Feedback is only available a limited number of times for each assignment, to prevent Ground Truth revealing by annotators. This is controlled by a configurable parameter, so it can be adjusted to the requirements of each project.
Immediate feedback settings, such as Target metric, Target metric threshold,
Max validations per job and others, can be configured on the quality settings page.
This feature is considered enabled if the Max validations per job is above 0. You can change
the parameters any time.
Note: This feature requires a configured validation set in the task. Read more in the quality overview section or in the full guide.
Target metric and Target metric threshold values to what is required in your project.
Each assignee gets no more than the specified number of validation attempts.
Note: this functionality is only available in regular annotation jobs. For instance, it’s not possible to use it in Ground Truth jobs.
There are three types of feedbacks available for different cases:
Immediate feedback has a default timeout of 20 seconds. Feedback may be unavailable for large jobs or when there are too many immediate feedback requests. In this case annotators do not see any feedback dialogs and annotate jobs as if the feature was disabled.
The number of attempts does not decrease for staff members who have access to a job with ground truth annotations. For instance, if you’re trying to test this feature as the task owner, you may be confused if you see the number of attempts doesn’t decrease.
The number of attempts resets when the job assignee is updated.
Segment Anything 2 is a segmentation model that allows fast and precise selection of any object in videos or images. For enterprise customers, this model can be installed in their self-hosted solution. To ensure a good experience, it is strongly recommended to deploy the model using a GPU. Although it is possible to use a CPU-based version, it generally performs much slower and is suitable only for handling a single parallel request. Unlike a regular tracking model, the SAM 2 tracker is implemented as an annotation action. This allows it to be applied to existing objects (polygons and masks) to track them forward for a specified number of frames.
Note: This feature is not available in the community CVAT version.
Note: This feature requires the enhanced actions UI plugin, which is enabled by default. Usually, no additional steps are necessary on this.
You can use existing scripts from the community repository
(./serverless/deploy_cpu.sh or ./serverless/deploy_gpu.sh).
To deploy the feature, simply run:
./serverless/deploy_gpu.sh "path/to/the/function"
cvat_redis_ondisk uses.
When running the nuclio deploy command, make sure to provide the necessary arguments.
The minimal command is:nuctl deploy "path/to/the/function"
--env CVAT_FUNCTIONS_REDIS_HOST="<redis_host>"
--env CVAT_FUNCTIONS_REDIS_PORT="<redis_port>"
--env CVAT_FUNCTIONS_REDIS_PASSWORD="<redis_password>" # if applicable
The tracker can be applied to any polygons and masks. To run the tracker on an object, open the object menu and click “Run annotation action”.
Alternatively, you can use a hotkey: select the object and press Ctrl + E (default shortcut). When the modal opened, in “Select action” list, choose Segment Anything 2: Tracker:
Specify the target frame until which you want the object to be tracked, then click the Run button to start tracking. The process begins and may take some time to complete. The duration depends on the inference device, and the number of frames where the object will be tracked.
Once the process is complete, the modal window closes. You can review how the object was tracked. If you notice that the tracked shape deteriorates at some point, you can adjust the object coordinates and run the tracker again from that frame.
Instead of tracking each object individually, you can track multiple objects simultaneously. To do this, click the Menu button in the annotation view and select the Run Actions option:
Alternatively, you can use a hotkey: just press Ctrl + E (default shortcut) when there are no objects selected. This opens the actions modal. In this case, the tracker will be applied to all visible objects of suitable types (polygons and masks). In the action list of the opened model, select Segment Anything 2: Tracker:
Specify the target frame until which you want the objects to be tracked, then click the Run button to start tracking. The process begins and may take some time to complete. The duration depends on the inference device, the number of simultaneously tracked objects, and the number of frames where the object will be tracked.
Once the process finishes, you may close the modal and review how the objects were tracked. If you notice that the tracked shapes deteriorate, you can adjust their coordinates and run the tracker again from that frame (for a single object or for many objects).