Skip to main content

​
About Arnica

Iru reads findings, repository inventory, security policies, and developer risk data from Arnica’s REST API using a Bearer API key created in the Arnica web platform under Admin → API. Keys are scope-bound at creation. Grant only the read scopes your controls require, and avoid write scopes entirely.

​
How It Works

Arnica’s API is served from https://api.app.arnica.io at version v1. Keys are created per-scope in the Arnica dashboard, so a key that is missing a scope returns an error rather than a partial result. Arnica returns 403, not 401, for every authentication and authorization failure. An invalid key, a revoked key, and a key missing a required scope all look the same. Iru stores the API key only; there is no host or subdomain to configure. Official references: Arnica documentation, API reference (Swagger).

​
Prerequisites

  • Arnica admin access. Only admins can open Admin → API to create a key.
  • Decide which repositories are in scope. Arnica lets you exclude repositories, and excluded repositories produce no evidence. Iru cannot tell whether a repository has no findings or was never scanned.

​
Connect Arnica to Iru

Complete this tab before you connect the source in Compliance.
1

Sign in to Arnica

Sign in to Arnica at https://app.arnica.io with an account that has the admin role.
2

Open Admin API

Go to Admin → API.
3

Create a new API key

Select Create a New API Key.
4

Name the key

Enter a name such as Iru Compliance so you can identify this key later.
5

Select read-only scopes

Select read-only scopes that cover your compliance program: risks:read, products:read, inventory:read, policies:read, and status-checks:read. Add groups:read if your controls cover developer group membership. Do not grant risks:write or any other write scope.
6

Create and copy the token

Select Create, then copy the token value once while Arnica displays it. Store it securely until you paste it into Iru as the Bearer token.
Continue on the Iru Compliance tab.

​
Troubleshooting

Check pop-up blocker settings for the Iru site and try again.
Arnica returns 403 rather than 401 for auth failures, so this covers an invalid, expired, or revoked key as well as a missing scope. Regenerate the key, confirm you pasted the full string, and re-check the scope list.
Either the key lacks risks:read or inventory:read, or those repositories are excluded in Arnica. Excluded repositories are invisible to Iru.
Arnica is polled on a schedule rather than on demand. Allow a full collection cycle before investigating.

Sources Management

Browse and manage every Compliance source.

Getting Started With Compliance

Frameworks, actions, and Artifacts.

Iru Overview

How Endpoint, Compliance, and Identity fit together.

Artifacts Management

Upload, review, and organize evidence from sources and actions.