> ## Documentation Index > Fetch the complete documentation index at: https://help.dsalta.com/llms.txt > Use this file to discover all available pages before exploring further. # New Relic > Observability platform — users & access Connect New Relic with a User API key to sync the users of your organization's authentication domains and your accounts, and run access reviews. Read-only. **Read-only access.** DSALTA only reads data from this integration. It never creates, modifies, or deletes anything in your environment, and every remediation step is performed by your team directly in the third-party product. **What you'll see.** The Access page lists every user in every **authentication domain** of your New Relic organization, with their name, email and user type (**Basic user**, **Core user** or **Full platform user**) shown in the role column. New Relic exposes no account status, join date or MFA state through this query, so every user is shown as **Active** with MFA **Unknown**, and each row is stamped with the date of the sync. **A User key is required.** License, Ingest and Browser keys authenticate data ingest only; New Relic's NerdGraph API rejects them, and so does DSALTA at connect time. DSALTA collects this integration's data when you connect it — you can refresh it at any time with **Sync from integrations** on the **Integrations** page. The compliance checks below re-run once a day at 02:00 America/New\_York. ## What DSALTA reads DSALTA reads the New Relic user roster — names, emails and user types across all authentication domains — which appears on your **Access** page; and your New Relic **accounts**, which appear on your **Inventory** page by name and ID. Telemetry, entities and alerts are not read. It sends these NerdGraph queries to `api.newrelic.com/graphql` (or `api.eu.newrelic.com/graphql` for EU-region accounts): * `actor { user { … } }` — the key's own user, used to validate * `actor { organization { userManagement { authenticationDomains { users … } } } }` * `actor { accounts { … } }` Every request is a read. DSALTA has no code path that creates, modifies, or deletes anything in your New Relic environment. ## Troubleshooting The key is not a **User** key (it should start with `NRAK-`), it was deleted, or the **Region** is wrong — an EU-region key sent to the US endpoint fails. Create a User key, check the region, and connect again. User keys inherit their owner's permissions. Listing users requires the key's owner to hold an organization-scoped role with authentication domain management permissions, such as **Authentication domain manager** or **Organization manager**. Create the key as such a user, then disconnect and connect again. Note that disconnecting permanently deletes the data already collected from New Relic. Open **Integrations** in the DSALTA sidebar, stay on the **Connected** tab, and click **Manage** on the integration's card. Open the **Status** tab: it shows either **Connected and working properly** or **Connection issues detected**. Use the **Status** tab, not **Overview** — Overview always reports **Connected** regardless of the real state. On an integration-powered check, **Failed** normally means DSALTA was blocked rather than that you are non-compliant. Open the test, go to **Source Data**, and read the result code: **403** is a missing permission, **428** is a setting DSALTA still needs, **500** is a failure on DSALTA's side. A real compliance gap shows **207** and leaves the test looking **Completed**. See [Understanding Test Results](/guides/compliance/test-results). Compliance checks re-run once a day at 02:00 America/New\_York. To refresh sooner, open **Integrations → Connected** and click **Sync from integrations** at the top right — it refreshes every connected integration at once. There is no Reconnect, Repair or Refresh Token button. The only repair available is to disconnect and connect again. **Disconnecting is destructive and cannot be undone.** DSALTA removes the access records, inventory, vulnerabilities, code changes, incidents and device records collected from this integration, and deletes the test results tied to the connection. Export anything you still need as audit evidence first — see [Integration errors](/troubleshooting/integration-errors). That is expected. **Configure scope** is read-only — it shows what DSALTA is permitted to read, and has no Save action. To change what DSALTA can see, change the permissions on the credential in the third-party product, then disconnect and connect again. A New Relic User API key (NRAK-…) — not a License, Ingest, or Browser key. Read-only. **Before you begin** * A New Relic account. The key's owner needs a **Core** or **Full platform** user type and an organization-scoped role with authentication domain management permissions, so that every user is visible. * Your data-center region: **US** is the default; enter **eu** if you sign in at `one.eu.newrelic.com`. You will need: | Field | Where to find it | Example | | --------------------- | -------------------------------------------------------- | ---------------------------- | | **User API key** | Profile → **API keys → Create a key**, key type **User** | `NRAK-…` | | **Region** (optional) | Your sign-in URL | `eu` for one.eu.newrelic.com | Open **Integrations** in the DSALTA sidebar, find **New Relic**, and click **Connect** to open the connect panel. Open [one.newrelic.com/api-keys](https://one.newrelic.com/api-keys) (or `one.eu.newrelic.com/api-keys` for EU accounts), click **Create a key** in the top right, and set **Key type** to **User**. Name the key and create it, then copy it — it starts with `NRAK-`. Only a **User** key works. New Relic's **License**, **Ingest** and **Browser** keys authenticate data ingest and cannot query the API DSALTA uses; DSALTA rejects them at connect time. New Relic states that a User key "is tied to a specific New Relic user, and cannot be transferred", and that a removed user's keys are deactivated. Create it as a user who will stay, or plan to reconnect if that person leaves. Return to the connect panel, paste the User key, enter **eu** as the region if your account is on the EU instance, and click **Connect**. DSALTA validates the key when you click **Connect**, by asking NerdGraph for the key's own user. On success the integration moves to the **Connected** tab, and **Manage → Status** reads **Connected and working properly**. Checks begin reporting after the first sync. **If the connection is rejected.** A License, Ingest or Browser key instead of a User key, a deleted key, or the wrong region. The on-screen message is generic — see [Connection error messages](/troubleshooting/connection-error-messages). Each check below re-runs once a day, at 02:00 America/New\_York, while this integration is connected. Click any check for step-by-step remediation guidance. | Check | Severity | What it verifies | | ------------------------------------------------------------------------------------------------------------------------ | -------- | ------------------------------------------------------------------------------------ | | [User access to Critical System should be valid](/integrations/new-relic/user-access-to-critical-system-should-be-valid) | Info | Checks that everyone with New Relic access is an active employee on the People page. | | [Offboarded users should not have active access](/integrations/new-relic/offboarded-users-should-not-have-active-access) | High | Checks that offboarded employees no longer have active New Relic access. | | Topic | Link | | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | | Setup | [New Relic API keys](https://docs.newrelic.com/docs/apis/intro-apis/new-relic-api-keys/) | | Remediation | [User management UI and tasks](https://docs.newrelic.com/docs/accounts/accounts-billing/new-relic-one-user-management/user-management-ui-and-tasks/) | | General | [New Relic](https://one.newrelic.com) | | DSALTA | [Connection error messages](/troubleshooting/connection-error-messages) |