> For the complete documentation index, see [llms.txt](https://support.suptask.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://support.suptask.com/integrations-automations-and-workflows/integration-guides/iru-formerly-kandji.md). # Iru (formerly Kandji) Integrate with Iru (formerly Kandji) and manage devices, Blueprints and Library Items from tickets directly The Iru connector links Suptask to your Iru tenant. Once connected, the AI Assistant on an Inbox can look up devices, Blueprints and Library Items — and, depending on the tools you enable, run device actions directly from a ticket in Slack. Iru is connected through its MCP server. Instead of an OAuth sign-in, you create an API token in Iru with MCP enabled, then paste the MCP URL, API key and MCP profile into Suptask. Permissions are set on the token in Iru, so the Assistant can only reach the endpoints you allow. {% hint style="info" %} You set up this connector in the Suptask Web App as an admin under Intelligence. Your agents then use it from Slack while working on tickets. {% endhint %} *** ### What you can use it for * **Answer device questions from a ticket** — an agent asks which Blueprint a Mac is on, when it last checked in, or what OS version it runs, without leaving Slack. * **Resolve app requests** — a user asks for an application, the Assistant finds the Library Item and checks whether it's assigned to the requester's Blueprint. * **Run device actions** — restart, lock or reissue a device from the ticket, with an agent approving each action. * **Enrich tickets with fleet context** — attach the requester's device details, agent status or Blueprint to the ticket automatically. * **Close the loop on IT requests** — the ticket, the action and the audit trail all stay connected. *** ### Before you begin You'll need: * An **admin** role in Suptask. * An **Iru** admin account with permission to create and manage API tokens under **Access**. * The **Inbox** you want to connect Iru to. What you'll do: * Create an MCP-enabled API token in Iru * Choose which Iru endpoints the token may access * Add the Iru connector on your Inbox * Choose which tools your Assistant may use *** ### Step 1: Create an API token with MCP in Iru 1. In Iru, open the **Account Menu**, then select **Access**. 2. Open the **API tokens** tab and click **Add Token**. 3. Give the token a **Name** and **Description** — for example `Suptask - IT Helpdesk`. 4. Turn on **Enable MCP**. This is required — without it, Iru issues a regular API token with no MCP configuration. 5. Click **Create.** Iru now shows a one-time success screen with your **MCP configuration**. You'll need three values from it: | Value | Where to find it | | --------------- | ---------------------------------------------------------------------- | | **MCP URL** | The `url` field | | **API key** | The `X-API-Key` entry under `headers`, including the `sk_live:` prefix | | **MCP profile** | The `X-MCP-Profile` entry under `headers` | Copy the values, store them securely, then select the confirmation checkbox and click **Next**. {% hint style="warning" %} The MCP configuration is shown only once. If you lose it, revoke the token and create a new one. {% endhint %} *** ### Step 2: Set the token's permissions in Iru After clicking **Next**, Iru shows the **Manage API Permissions** screen. Click **Configure** to set permissions now, or **Skip** to do it later. To set permissions later — or change them at any time — open the token under **Access → API tokens**, click **Edit**, and open the **Permissions** tab. Permissions are grouped by area, such as **Devices** (Device Information, Device Actions, Device Secrets) and **Blueprints**. Expand a group, check the endpoints you want the Assistant to reach, and click **Save**. {% hint style="info" %} Start with the read-only groups, such as Device Information. Add action groups like Device Actions only if you want the Assistant to change something. You can come back and adjust permissions without creating a new token. {% endhint %} *** ### Step 3: Connect Iru in Suptask 1. In the Suptask Web App, open the **Inbox** you want to connect Iru to. 2. Go to the **AI Assistant** settings and open **Connectors**. 3. Add the **Iru** connector. 4. Paste the **MCP URL**, **API key** and **MCP profile** from your Iru MCP configuration. 5. Click **Connect**. When it's done, the connector status changes to **Connected**. *** ### Step 4: Choose which tools your Assistant may use The connector provides a set of **tools** to the AI Assistant, based on the permissions you enabled on the token in Iru. Each tool can be set individually, so you can let the Assistant read your fleet without allowing it to change anything. Each tool can be set to: * **Auto** — the Assistant uses the tool on its own when it's relevant. * **Ask** — the Assistant prepares the action and pauses for an agent to approve before it runs. * **Off** — the Assistant can't use the tool at all. {% hint style="info" %} A common setup is Auto for every read tool and Ask for every action tool. That gives agents instant answers while keeping a human in the loop before a device is restarted, locked or erased. {% endhint %} *** ### How permissions work Access is controlled in two places, and the Assistant only gets what both allow: * **Token permissions in Iru** decide which endpoints the connector can reach at all. If an endpoint isn't checked on the token, the Assistant can't use it — regardless of tool settings in Suptask. * **Tool settings in Suptask** decide how the Assistant uses the endpoints it can reach. They sit inside the token's permissions and can restrict, never expand, what the token allows. {% hint style="warning" %} Grant the token only the endpoints you need. Every tool set to Auto runs with the full permissions of the token in Iru. {% endhint %} *** ### Use different Iru access per Inbox Each Inbox in Suptask has its own connector, so different teams can work against Iru in different ways. Create a separate token in Iru for each: * **IT Helpdesk Inbox** — a token with Device Information and Library access; device actions on **Ask**. * **Security Inbox** — a token with Device Actions enabled for lock and erase; every action on **Ask**. A ticket in one Inbox only reaches the tools enabled on that Inbox's connector. *** ### How to use the integration The connector is used by the AI Assistants you set up in Suptask. Agents work with it in Slack, from inside the ticket.
Examples of what an agent can ask in a ticket thread: ``` @Suptask which Blueprint is the requester's MacBook on? ``` ``` @Suptask when did this device last check in? ``` ``` @Suptask restart the requester's device ``` When a tool is set to **Ask**, the Assistant posts the prepared action in the ticket and waits for an agent to approve it before running. {% content-ref url="/pages/EMXzCysY1oz2JPFXI8gH" %} [AI Assistants](/suptask-ai/ai-assistants.md) {% endcontent-ref %} *** ### Auditing and revoking access Every API token in Iru has an **Activity** tab, next to **Permissions**, that shows the requests made with that token. Because the Suptask connector uses its own token, you can see exactly what the Assistant has done. To cut off access, revoke the token under **Access → API tokens**. Revoking is immediate and total — the Suptask connector stops working until you create a new token and reconnect. {% hint style="info" %} Iru limits API usage to 10,000 requests per hour per tenant, shared across all tokens and integrations. Normal ticket usage stays well below this. {% endhint %} *** ### Troubleshooting * **The connector won't connect** — check that all three values were copied exactly from the MCP configuration, including the `sk_live:` prefix on the API key, and that **Enable MCP** was turned on when the token was created. * **The Assistant can't find a device or Blueprint** — the token doesn't have the matching permission enabled in Iru. Edit the token and check the endpoint under the relevant group. * **The Assistant can read but won't run actions** — the action tool is set to **Off** in Suptask, or it's set to **Ask** and is waiting for an agent to approve. Or the **Device Actions** group isn't enabled on the token. * **It worked before and stopped** — the token may have been revoked in Iru, or the token's permissions were changed. Check the token under **Access → API tokens**. * **Actions fail with a rate limit error** — the tenant-wide hourly limit was reached, usually by another integration. Wait for the limit to reset. *** ### Need help? Reach out to [Suptask Support](/getting-started/contact-support.md) and our team will help you connect Iru.