> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Arnica

> Connect Arnica to Iru Compliance with a scoped read-only API key to collect secret-detection findings, repository inventory, developer risk, and security policy status.

### About Arnica

Iru reads **findings**, **repository inventory**, **security policies**, and **developer risk** data from Arnica's REST API using a **Bearer** API key created in the Arnica web platform under **Admin** → **API**. Keys are **scope-bound** at creation. Grant only the **read** scopes your controls require, and avoid write scopes entirely.

### How It Works

```http theme={null}
Authorization: Bearer YOUR_API_TOKEN
```

Arnica's API is served from `https://api.app.arnica.io` at version **v1**. Keys are created per-scope in the Arnica dashboard, so a key that is missing a scope returns an error rather than a partial result. Arnica returns **`403`**, not `401`, for every authentication and authorization failure. An invalid key, a revoked key, and a key missing a required scope all look the same. Iru stores the API key only; there is no host or subdomain to configure.

| Detail             | Value                   |
| ------------------ | ----------------------- |
| **Category**       | Security                |
| **Authentication** | Bearer (scoped API key) |

Official references: [Arnica documentation](https://docs.arnica.io/), [API reference (Swagger)](https://api.app.arnica.io/swagger).

### Prerequisites

* **Arnica admin** access. Only admins can open **Admin** → **API** to create a key.
* Decide which repositories are in scope. Arnica lets you exclude repositories, and excluded repositories produce no evidence. Iru cannot tell whether a repository has no findings or was never scanned.

### Connect Arnica to Iru

<Tabs>
  <Tab title="Arnica">
    <Note>
      Complete this tab before you connect the source in Compliance.
    </Note>

    <Steps>
      <Step title="Sign in to Arnica">
        Sign in to Arnica at [https://app.arnica.io](https://app.arnica.io) with an account that has the **admin** role.
      </Step>

      <Step title="Open Admin API">
        Go to **Admin** → **API**.
      </Step>

      <Step title="Create a new API key">
        Select **Create a New API Key**.
      </Step>

      <Step title="Name the key">
        Enter a name such as **Iru Compliance** so you can identify this key later.
      </Step>

      <Step title="Select read-only scopes">
        Select **read-only** scopes that cover your compliance program: `risks:read`, `products:read`, `inventory:read`, `policies:read`, and `status-checks:read`. Add `groups:read` if your controls cover developer group membership. Do **not** grant `risks:write` or any other write scope.
      </Step>

      <Step title="Create and copy the token">
        Select **Create**, then copy the token value **once** while Arnica displays it. Store it securely until you paste it into Iru as the **Bearer** token.
      </Step>
    </Steps>

    <Note>
      Continue on the [**Iru Compliance**](#iru-compliance) tab.
    </Note>
  </Tab>

  <Tab title="Iru Compliance">
    <Note>
      Finish the [**Arnica**](#arnica) tab first.
    </Note>

    <Steps>
      <Step title="Open Sources">
        In Iru Compliance, on the left navigation bar, expand **Compliance** and select **Sources**.

        <Frame>
          <img src="https://mintcdn.com/iru/tI0HDLDwHj8r9Ile/assets/media/images/iru-navigation-compliance-sources.png?fit=max&auto=format&n=tI0HDLDwHj8r9Ile&q=85&s=87dcef15fc17d2fb9a6e53f454e41710" alt="Left navigation: Compliance expanded, Sources selected" width="410" height="1024" data-path="assets/media/images/iru-navigation-compliance-sources.png" />
        </Frame>
      </Step>

      <Step title="Turn on Arnica">
        Find **Arnica** (use **Category** or **Search by name or description**). On that card, turn on the **toggle**. A browser tab or window may open for the connector wizard.
      </Step>

      <Step title="Paste the Bearer token">
        Paste the token into the **Bearer** field.
      </Step>

      <Step title="Finish the connection">
        Click **Submit Bearer Token**. When the connection succeeds, the wizard shows **Connection Configured**.
      </Step>

      <Step title="Confirm the source is Active">
        Close the **Iru is requesting access to external services** browser tab, then return to **Compliance** → **Sources** and confirm the **Arnica** card is **Active**.
      </Step>
    </Steps>
  </Tab>
</Tabs>

### Troubleshooting

<AccordionGroup>
  <Accordion title="Nothing opens when you turn the source on">
    Check **pop-up blocker** settings for the Iru site and try again.
  </Accordion>

  <Accordion title="Connection fails with a 403">
    Arnica returns `403` rather than `401` for auth failures, so this covers an invalid, expired, or revoked key as well as a missing scope. Regenerate the key, confirm you pasted the full string, and re-check the scope list.
  </Accordion>

  <Accordion title="Findings are missing for some repositories">
    Either the key lacks `risks:read` or `inventory:read`, or those repositories are **excluded** in Arnica. Excluded repositories are invisible to Iru.
  </Accordion>

  <Accordion title="The card is Active but no artifacts have appeared">
    Arnica is polled on a schedule rather than on demand. Allow a full collection cycle before investigating.
  </Accordion>
</AccordionGroup>

### Related Articles

<CardGroup cols={2}>
  <Card title="Sources Management" icon="plug" href="/en/compliance/sources-management">
    Browse and manage every Compliance source.
  </Card>

  <Card title="Getting Started With Compliance" icon="rocket" href="/en/compliance/getting-started-with-compliance">
    Frameworks, actions, and **Artifacts**.
  </Card>

  <Card title="Iru Overview" icon="layer-group" href="/en/iru/platform-overview/iru-overview">
    How Endpoint, Compliance, and Identity fit together.
  </Card>

  <Card title="Artifacts Management" icon="folder-open" href="/en/compliance/artifacts-management">
    Upload, review, and organize evidence from sources and actions.
  </Card>
</CardGroup>