> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Iru

> Connect Iru (formerly Kandji) to Oleria to discover the users of your Iru tenant and the administrative activity in its audit log.

Connect Iru to Oleria to see who your Iru tenant manages devices for, and what administrators and API tokens change in it. Iru, formerly Kandji, is an Apple-first endpoint management platform. Oleria reads its users and its audit log through the Iru API using a read-only API token.

## What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your Iru tenant:

* **Accounts** - every user that your user directory integrations (such as Okta, Microsoft Entra ID, Google Workspace, or SCIM) bring into Iru, with email, name, department, and job title. A user is shown as disabled when they are inactive or archived, for example after they're removed from your directory.
* **Activity** - the tenant audit log for the past year. That covers:

  * blueprint and library item changes;
  * access to sensitive device data, such as FileVault recovery keys;
  * device enrollment and removal;
  * user directory changes;
  * API token and administrator management.

  Oleria records who made each change but doesn't import the changed values themselves.

Oleria refreshes this data on its [regular sync schedule](/integrations/overview#sync-model).

<Note>
  This integration covers your Iru users and audit log. It doesn't read your devices, blueprints, or library items, so Oleria doesn't populate Access Inventory or resource-level Access Graph data for Iru. The Iru API doesn't list Iru administrators or API tokens, so they appear only as the actors in Activity.
</Note>

## Prerequisites

* Access to the **Access** page in your Iru tenant, where API tokens are created.
* Admin access on the Oleria platform to add a new integration.

## Create an API token in Iru

<Steps>
  <Step title="Open API tokens">
    In the Iru web app, open the Account menu and select **Access**. Go to **API Token**.
  </Step>

  <Step title="Copy your API URL">
    Note the **API URL** shown on the page, for example `accuhive.api.kandji.io`. Tenants in the EU use an address ending in `.api.eu.kandji.io`.
  </Step>

  <Step title="Create the token">
    Add a token for Oleria and turn on read access for the following. The exact permission names in Iru can differ slightly:

    | Permission | Why Oleria needs it |
    | :- | :- |
    | Users | Read the users in your Iru tenant. |
    | Audit Log | Read the audit log. |

    Oleria makes no changes in Iru, so it needs no other permissions. Copy the token and store it somewhere safe until you've connected Oleria.
  </Step>
</Steps>

<Note>
  All API tokens in an Iru tenant share a rate limit of 10,000 requests per hour. Oleria spaces its requests well below that limit.
</Note>

## Connect Iru to Oleria

<Steps>
  <Step title="Open the integration">
    Go to your Oleria workspace, select **Integrations** -> select **Iru**.
  </Step>

  <Step title="Complete the connection form">
    Select **Continue** and provide the following:

    | Field | Notes |
    | :- | :- |
    | API URL | Required. The API URL from the **API Token** page, for example `accuhive.api.kandji.io`. You can paste a full address; Oleria keeps only the host. |
    | API Token | Required. The token you created. |
  </Step>

  <Step title="Confirm the connection">
    Select **Authenticate**. Oleria checks that the token can read users and the audit log. Find the newly connected tenant on the **Connected** tab of your Oleria **Integrations** page.
  </Step>
</Steps>

If **Authenticate** fails, Oleria shows the reason:

* **Token rejected** - check that you copied an Iru API token and that it hasn't been revoked.
* **Missing permission** - turn on the permission the message names (**Users** or **Audit Log**) for the token.
* **Not an Iru API URL** - enter the API URL shown on the **API Token** page.

<Note>
  You can connect each Iru tenant to Oleria once, and you can't move a connection to a different tenant. To keep the stored token when you edit the integration, leave the **API Token** field empty.
</Note>

## Update a connection made with SCIM

If you connected Iru to Oleria earlier through SCIM, that connection used a SCIM token, which can't read the Iru API. After this update, its syncs fail with a message asking for an API token. To fix it:

1. [Create an API token](#create-an-api-token-in-iru) with the **Users** and **Audit Log** permissions.
2. In Oleria, edit the Iru integration and paste the new token into **API Token**. The API URL is kept.
3. Select **Update**. The next sync uses the new token.

Groups from the SCIM directory are no longer imported. They're copies of the groups in your identity provider, which Oleria discovers from the identity provider itself.

## Verify the integration

Confirm the Iru tenant appears on the **Connected** tab of your Oleria **Integrations** page with a status of **Healthy**. After the first sync completes, you can review the discovered accounts and activity in your Oleria workspace.

## Known limitations

* **Iru administrators and API tokens aren't inventoried.** The Iru API doesn't list them; their changes appear in Activity.
* **No groups or roles.** The Iru API has no group or role data.
* **No MFA, SSO or last sign-in data.** Your users sign in through your identity provider, so Iru doesn't report this.
* **No remediation actions.** The Iru API's only user change is deleting a user, which can't be undone and is reversed by the next directory sync. Remove users in your identity provider instead; Iru follows it.
* **One year of activity.** The Iru audit log keeps one year of events.

## Contact us

For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.