Archer IRM

What this connects to: Archer IRM (formerly RSA Archer) through its REST API: the platform API under /api/core for application metadata and records by id, and the Content API under /contentapi (OData) for searching records with readable field names. Every call runs with the permissions of the Archer user the connector logs in as. This first version only reads.

Start with archer_list_applications to see the applications (risk register, findings, controls, incidents, policies, vendors...). To read records, use archer_list_content_endpoints and archer_query_records with the alias it lists. For field-level detail, archer_list_application_fields maps field ids to names and archer_get_values_list turns value ids into labels.

Authentication: the connector posts the instance name, user name, user domain and password to /api/core/security/login and sends the returned session token as Authorization: Archer session-id="<token>". It logs in again when the session times out (Archer's session timeout, often 20 to 30 minutes, applies). Use a dedicated API account. With single sign-on enabled, the REST login works only when Allow manual bypass is selected for the instance in Archer Control Panel. The instance name is shown on the Archer login page and in Administration > Installation Settings.

Base URL: the address you open Archer on, e.g. https://yourcompany.archerirm.com for Archer SaaS. On-premise installs often live under a virtual directory such as https://archer.example.com/RSAarcher; include it.

Content API: /contentapi lists every level (and cross-reference) the Archer user can read, under its level alias; fields carry their aliases from Application Builder. Aliases are case-sensitive, and when two levels share an alias the endpoint is ModuleAlias_LevelAlias. A record's id is the <alias>_Id field (e.g. Risk_Register_Id). One call returns at most 1,000 records; $top and $skip page through more. Keep $select short, because large records with many cross-references are slow.

Reports: Archer serves saved reports and statistic searches only through its SOAP web services, which this connector does not call. Rebuild the report as a query_records filter instead.

Pitfalls: ids are numbers (application, level, field, values list, content). Platform answers wrap the data as RequestedObject with IsSuccessful; a false value with ValidationMessages means the request was refused. A 401 means the session or login failed; a 403 means the account lacks the permission for that application.