> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# GitLab

> Connect GitLab to Iru Compliance with a personal access token to collect project inventory, branch protection, group membership, and audit-event evidence.

### About GitLab

The **GitLab** connector reads project metadata, group membership, branch protection, CI/CD configuration, and (where your plan and token allow) audit-oriented events from your **GitLab.com group** or **self-managed** instance. Data appears as artifacts in Iru Compliance for mapping to actions and controls. Iru sends credentials using GitLab’s **`PRIVATE-TOKEN`** header - typically with a **personal access token** so reads can span the groups and projects you choose.

### How It Works

GitLab’s REST API authenticates with the **`PRIVATE-TOKEN`** header:

```http theme={null}
PRIVATE-TOKEN: glpat-XXXXXXXXXXXXXXXXXXXX
```

Personal access tokens are usually the best fit because they can cover multiple projects and groups. Project-scoped or group-scoped tokens work but may narrow what evidence Iru can collect.

| Detail             | Value                                                      |
| ------------------ | ---------------------------------------------------------- |
| **Category**       | Developer tools / source control                           |
| **Authentication** | `PRIVATE-TOKEN` header (personal access token recommended) |
| **Hosting**        | GitLab SaaS or self-managed                                |

Documentation: [Personal access tokens](https://docs.gitlab.com/ee/user/profile/personal_access_tokens.html), [REST authentication](https://docs.gitlab.com/ee/api/rest/authentication.html), [Token scopes](https://docs.gitlab.com/ee/user/profile/personal_access_tokens.html#personal-access-token-scopes).

### Prerequisites

* GitLab access to the **groups and projects** compliance cares about.
* Group **Owner** or **Maintainer** where you need membership and audit-style reads (exact needs depend on your controls).
* For **self-managed** GitLab, confirm Iru targets your instance **base URL** (not only `gitlab.com`).

**Starting point for scopes**

| Scope             | Purpose                                                                          |
| ----------------- | -------------------------------------------------------------------------------- |
| `read_api`        | Broad read access to API endpoints used for inventory and configuration evidence |
| `read_repository` | Repository metadata aligned to branch protection and repo settings               |
| `read_user`       | User profile reads needed for membership evidence                                |

Add scopes only when your security team requires deeper reads.

### Connect GitLab to Iru

<Tabs>
  <Tab title="GitLab">
    <Note>
      Complete this tab before you connect the source in Compliance.
    </Note>

    <Steps>
      <Step title="Sign in to GitLab">
        Open your GitLab instance (**gitlab.com** or self-managed URL) and sign in with a user who can create **personal access tokens** for the namespaces Iru should read.
      </Step>

      <Step title="Open your profile">
        Select your **avatar** in the upper-right, then choose **Edit profile** (or **Preferences** on some versions).
      </Step>

      <Step title="Open Access Tokens">
        In the left sidebar of your profile, select **Access Tokens** (sometimes under **User settings** → **Access Tokens**).
      </Step>

      <Step title="Add a new token">
        Select **Add new token** (or **Create personal access token**).
      </Step>

      <Step title="Set name, expiration, and scopes">
        Enter a **name** (for example **Iru Compliance**). Set an **expiration** (GitLab requires one; maximum duration may be limited by your administrator). Choose the **read** scopes listed under **Prerequisites** in this article.
      </Step>

      <Step title="Create and copy the token">
        Create the token and **copy it immediately**. GitLab shows it once. Tokens typically begin with **`glpat-`**.
      </Step>
    </Steps>

    <Note>
      Continue on the [**Iru Compliance**](#iru-compliance) tab.
    </Note>
  </Tab>

  <Tab title="Iru Compliance">
    <Note>
      Finish the [**GitLab**](#gitlab) tab first.
    </Note>

    <Steps>
      <Step title="Open Sources">
        In Iru Compliance, on the left navigation bar, expand **Compliance** and select **Sources**.

        <Frame>
          <img src="https://mintcdn.com/iru/7HsGH7lnQ8GpVmI0/assets/media/images/iru-navigation-compliance-sources.png?fit=max&auto=format&n=7HsGH7lnQ8GpVmI0&q=85&s=595982441fd777b333b3ecfea24adc24" alt="Left navigation: Compliance expanded, Sources selected" width="424" height="1056" data-path="assets/media/images/iru-navigation-compliance-sources.png" />
        </Frame>
      </Step>

      <Step title="Turn on GitLab">
        Find **GitLab** (use **Category** or **Search by name or description**). On that card, turn on the **toggle**. A browser tab or window may open for the connector wizard.
      </Step>

      <Step title="Paste the personal access token">
        When the wizard asks for the **`PRIVATE-TOKEN`** value, paste your token and submit.
      </Step>

      <Step title="Finish the connection">
        Click **Submit API Key**. When the connection succeeds, the wizard shows **Connection Configured**.
      </Step>

      <Step title="Confirm the source is Active">
        Close the **Iru is requesting access to external services** browser tab, then return to **Compliance** → **Sources** and confirm the **GitLab** card is **Active**.
      </Step>
    </Steps>
  </Tab>
</Tabs>

### Troubleshooting

<AccordionGroup>
  <Accordion title="Nothing opens when you turn the source on">
    Check **pop-up blocker** settings for the Iru site and try again.
  </Accordion>

  <Accordion title="401 Unauthorized">
    Confirm the full token string, check expiry, and verify the account still has access to target groups.
  </Accordion>

  <Accordion title="403 Forbidden">
    Increase scopes or elevate project/group role - your token cannot read endpoints your account cannot access.
  </Accordion>

  <Accordion title="Self-managed URL issues">
    Ensure the integration points at your instance hostname and that network paths allow Iru’s outbound calls.
  </Accordion>

  <Accordion title="Missing audit-class events">
    Some audit APIs require **Premium/Ultimate** features - compare your GitLab tier to the evidence your framework expects.
  </Accordion>
</AccordionGroup>

### Considerations

<CardGroup cols={2}>
  <Card title="Tokens expire on a schedule: rotate early and update…" icon="circle-info">
    Tokens expire on a schedule - rotate early and update the connector.
  </Card>

  <Card title="GitLab applies rate limits; large groups may take…" icon="shield">
    GitLab applies **rate limits**; large groups may take longer during first sync.
  </Card>

  <Card title="Iru reads configuration exposed by the API: it does…" icon="server">
    Iru reads configuration exposed by the API - it does not rewrite pipelines or repository settings.
  </Card>
</CardGroup>

### Related Articles

<CardGroup cols={2}>
  <Card title="Sources Management" icon="plug" href="/en/compliance/sources-management">
    Browse and manage every Compliance source.
  </Card>

  <Card title="Getting Started With Compliance" icon="rocket" href="/en/compliance/getting-started-with-compliance">
    Frameworks, actions, and **Artifacts**.
  </Card>

  <Card title="Iru Overview" icon="layer-group" href="/en/iru/platform-overview/iru-overview">
    How Endpoint, Compliance, and Identity fit together.
  </Card>

  <Card title="Artifacts Management" icon="folder-open" href="/en/compliance/artifacts-management">
    Upload, review, and organize evidence from sources and actions.
  </Card>
</CardGroup>