> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Drupal

> Connect Drupal to Iru Compliance over JSON:API using HTTP Basic Auth with a read-only service account to collect site, user, and role configuration evidence.

### About Drupal

Iru consumes **Drupal core JSON:API** (`/jsonapi`) for **content types**, **nodes**, **users**, **roles**, and related metadata. **Drupal 8.7+** ships JSON:API in core - enable it under **Extend**. Authentication uses **HTTP Basic** (**username** + **password**). Serve the site over **HTTPS** so credentials are not sent in clear text.

### How It Works

```http theme={null}
Authorization: Basic base64(username:password)
```

| Detail             | Value               |
| ------------------ | ------------------- |
| **Category**       | Web CMS             |
| **Authentication** | Basic (Drupal user) |

Official references: [JSON:API module](https://www.drupal.org/docs/core-modules-and-themes/core-modules/jsonapi-module), [Permission model](https://www.drupal.org/docs/administering-a-drupal-site/managing-users).

### Prerequisites

* **JSON:API** enabled; **`https://YOUR_HOST/jsonapi`** returns resource discovery JSON.
* Drupal user whose role may **GET** the bundles you care about.

### Connect Drupal to Iru

<Tabs>
  <Tab title="Drupal">
    <Note>
      Complete this tab before you connect the source in Compliance.
    </Note>

    <Steps>
      <Step title="Sign in as an administrator">
        Sign in to your Drupal site with a user who can install modules and change configuration (**Administrator** or equivalent).
      </Step>

      <Step title="Open Extend (modules)">
        Go to **Manage** → **Extend** (or **Administration** → **Extend**, depending on your admin theme).
      </Step>

      <Step title="Enable JSON:API">
        Locate the **JSON:API** module. Enable it and apply any configuration import or cache rebuild Drupal prompts for.
      </Step>

      <Step title="Confirm permissions">
        Ensure the integration user or role Iru will use can **GET** JSON:API resources your controls need (often **Anonymous** is too broad; prefer a dedicated service account with minimal read).
      </Step>

      <Step title="Verify the JSON:API endpoint">
        In a browser or with `curl`, request your site’s discovery document (for example **`https://YOUR_HOST/jsonapi`**) and confirm Drupal returns JSON (not **403** or **404**).
      </Step>
    </Steps>

    <Note>
      Continue on the [**Iru Compliance**](#iru-compliance) tab.
    </Note>
  </Tab>

  <Tab title="Iru Compliance">
    <Note>
      Finish the [**Drupal**](#drupal) tab first.
    </Note>

    <Steps>
      <Step title="Open Sources">
        In Iru Compliance, on the left navigation bar, expand **Compliance** and select **Sources**.

        <Frame>
          <img src="https://mintcdn.com/iru/7HsGH7lnQ8GpVmI0/assets/media/images/iru-navigation-compliance-sources.png?fit=max&auto=format&n=7HsGH7lnQ8GpVmI0&q=85&s=595982441fd777b333b3ecfea24adc24" alt="Left navigation: Compliance expanded, Sources selected" width="424" height="1056" data-path="assets/media/images/iru-navigation-compliance-sources.png" />
        </Frame>
      </Step>

      <Step title="Turn on Drupal">
        Find **Drupal** (use **Category** or **Search by name or description**). On that card, turn on the **toggle**. A browser tab or window may open for the connector wizard.
      </Step>

      <Step title="Enter hostname">
        Enter **hostname** only (for example **`cms.example.com`**). Confirm variables if the wizard shows a preview.
      </Step>

      <Step title="Enter Drupal credentials">
        Enter **username** and **password** for the integration account.
      </Step>

      <Step title="Finish the connection">
        Click **Submit Credentials**. When the connection succeeds, the wizard shows **Connection Configured**.
      </Step>

      <Step title="Confirm the source is Active">
        Close the **Iru is requesting access to external services** browser tab, then return to **Compliance** → **Sources** and confirm the **Drupal** card is **Active**.
      </Step>
    </Steps>
  </Tab>
</Tabs>

### Troubleshooting

<AccordionGroup>
  <Accordion title="Nothing opens when you turn the source on">
    Check **pop-up blocker** settings for the Iru site and try again.
  </Accordion>

  <Accordion title="404 on /jsonapi">
    Enable JSON:API module.
  </Accordion>

  <Accordion title="403 on resources">
    Grant **view** permissions on relevant entity types.
  </Accordion>

  <Accordion title="401">
    Correct password; Drupal is case-sensitive.
  </Accordion>
</AccordionGroup>

### Considerations

<CardGroup cols={2}>
  <Card title="Prefer a read-only service account scoped to…" icon="circle-info">
    Prefer a **read-only** service account scoped to required content types.
  </Card>
</CardGroup>

### Related Articles

<CardGroup cols={2}>
  <Card title="Sources Management" icon="plug" href="/en/compliance/sources-management">
    Browse and manage every Compliance source.
  </Card>

  <Card title="Getting Started With Compliance" icon="rocket" href="/en/compliance/getting-started-with-compliance">
    Frameworks, actions, and **Artifacts**.
  </Card>

  <Card title="Iru Overview" icon="layer-group" href="/en/iru/platform-overview/iru-overview">
    How Endpoint, Compliance, and Identity fit together.
  </Card>

  <Card title="Artifacts Management" icon="folder-open" href="/en/compliance/artifacts-management">
    Upload, review, and organize evidence from sources and actions.
  </Card>
</CardGroup>