## Introduction

Orca Security scans your cloud accounts and reports the risks it finds. This guide shows you how to create an API token in the Orca console and gather the values you need to configure the integration.

## Prerequisites

Before you begin, ensure that you have:

- Access to your Orca Security console
- At least one onboarded cloud account in the tenant you want to query


## Required Permissions

| Role | Purpose |
|  --- | --- |
| Viewer | Read the risks and cloud resources Orca has found. This is the lowest role that can read the data the integration queries |


## Creating an API Token

1. Sign in to your Orca Security console
2. Open **Settings**
3. Select **Users & Permissions**
4. Open the **API** tab
5. Select **Add Token**
6. Give the token a name that identifies this integration
7. Assign the token a role, as listed in the section above titled [Required Permissions](#required-permissions)
8. Select **Create**
9. Copy the token and store it in a safe location
10. You have now created an API token. Proceed to the next section titled [Find Your Region](#find-your-region)


The token is shown only once, when you create it. If you navigate away before copying it, delete the token and create a new one. Paste it exactly as shown, without trimming whitespace.

## Find Your Region

Your region is the first label of the hostname in your Orca console address. An address of `https://eu.app.orcasecurity.io` means your region is `eu`.

| Region | Orca API address |
|  --- | --- |
| `us` | `https://api.us.orcasecurity.io` |
| `eu` | `https://api.eu.orcasecurity.io` |
| `au` | `https://api.au.orcasecurity.io` |
| `in` | `https://api.in.orcasecurity.io` |
| `sa` | `https://api.sa.orcasecurity.io` |


The region has to match the one your Orca account is hosted in. A token is bound to the region that created it. Orca rejects a token sent to the wrong region with the same error as an invalid token. If a connection fails, check the region before you create a new token.

If your account is hosted somewhere not listed above, or you reach Orca through a proxy, set *Base URL* instead.

## Configuring the Integration

To configure a new Orca Security integration, provide each of the values as defined below:

| Integration Parameter | Description |
|  --- | --- |
| API Token | This is the token you created and stored above |
| Region | This is the region you found in the previous section |


### Optional fields

| Integration Parameter | Description |
|  --- | --- |
| Base URL | This is the address used to reach Orca. It is only needed for a custom or proxied environment, or for a region the Region field does not list. When you set it, the Region value is ignored  Example `https://api.eu.orcasecurity.io` |
| Compliance Framework IDs | These limit compliance findings to the frameworks you name, using the framework IDs shown in the Orca console. Leave it empty to cover every framework. Covering every framework is slower, because Orca returns compliance findings one framework at a time |