Integrating iru with imper.ai

Overview

Integrating Iru with imper.ai allows the platform to securely push ephemeral data-collection scripts to your managed Apple devices through your existing Iru tenant.

Once connected, imper.ai creates a dedicated Custom Script Library Item scoped to a Blueprint of your choice, runs the collector during normal device check-ins, and removes the item once collection completes — leaving no persistent artifact on the device.

This article walks you through the required prerequisites and the steps for creating an API token, granting the required permissions, identifying the target Blueprint, and completing the integration inside imper.ai.

Note: Kandji has rebranded to Iru. The Iru web app and API URLs may still display "kandji" during the transition (e.g., *.api.kandji.io).

This is expected and does not affect the integration.

Prerequisites

To integrate Iru with imper.ai, you must have Iru tenant admin permissions (or equivalent privileges to create API tokens and manage Blueprints) via the Iru web app.

We also recommend creating a dedicated Blueprint for imper.ai (e.g., imper-collectors) and assigning the devices you want imper.ai to manage to it. This ensures imper.ai's scripts are scoped only to that Blueprint and never touch your other configurations.

Step 1: Create an API token in Iru

1. Using an Iru admin user, login to your Iru web app.

2. Click the Access tab.
   

3. Click the Add API Token tab.

   

4. Enter a Name (e.g., imper.ai) and a Description, then click Create.

5. Copy the generated API Token to a secure location — this token needs to be entered later in imper.ai's integration interface.

   Important: The token is displayed only once. If you lose it, you must revoke it and generate a new one.

   

6. Copy the API URL displayed on the Access page. It will follow one of these formats:

   • US tenants: https://<subdomain>.api.kandji.io

   • EU tenants: https://<subdomain>.api.eu.kandji.io

Step 2: Configure API token permissions

After creating the token, you must grant it the specific permissions imper.ai requires. On the token's permissions page, enable only the following:

Blueprints:

• List Blueprints

• Get Blueprint

Devices:

• Device Details

• Device List

• Device ID

Finally, click Save to apply the permissions.

Note: imper.ai requires no permissions beyond those listed above. Granting additional permissions does not enable additional functionality and is not recommended.

Step 3: Connect IRU to imper.ai

1. Locate Iru and click Connect.

2. In the integration dialog, fill in the API URL (prefixed with “https://”) and API token obtained in Step 1.

3. Click Connect. imper.ai will validate the credentials and verify the token permissions.
   

4. Once validated, choose one of two setup options: Set Blueprint or Set Assignment ID.

Choose a setup option

Option 1: Set Assignment ID

Before extracting an Assignment Node ID, make sure the assignment map includes conditional logic that scopes the script to the devices you want Imper to monitor. If no conditional logic exists yet, add it.

Step 1: Tag the devices you want to monitor

Use the Tag feature in IRU to label the devices you want monitored by imper.ai. For example, apply the tag imper-verification to those devices.

Step 2: Add conditional logic to the assignment map

1. Navigate to Blueprint → Assignment Map.

2. Click Add conditional logic.

3. Add an assignment rule to limit which devices in the blueprint receive the library item, using the following condition:

   • Input: Tags

   • Operator: contains one of

   • Value: imper-verification

Step 3: Extract the Assignment ID

1. Navigate to Blueprint → Assignment Map.

2. Press and hold the Option (⌥) key on your keyboard. The assignment_node_id becomes visible on the node.

3. Click Copy, then paste the ID into the dialog below.

Option 2: Set Blueprint

1. Start typing to search for one or more Blueprints by name, then select them.

2. Click Save to begin monitoring all devices included in the selected blueprints.

Step 4: Save

Click Save to begin monitoring only the devices tagged imper-verification.