> ## Documentation Index
> Fetch the complete documentation index at: https://help.dsalta.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Wrike

> Work management — team access & projects

<Tabs>
  <Tab title="Overview">
    Connect Wrike with a permanent access token to sync internal team members, projects, and (on Enterprise plans) security-relevant audit events, and run access reviews. Read-only.

    <Info>
      **Read-only access.** DSALTA only reads data from this integration. It never creates, modifies, or deletes anything in your environment, and every remediation step is performed by your team directly in the third-party product.
    </Info>

    <Note>
      DSALTA collects this integration's data when you connect it — you can refresh it at any time with **Sync from integrations** on the **Integrations** page. The compliance checks below re-run once a day at 02:00 America/New\_York.
    </Note>

    ## What DSALTA reads

    DSALTA reads your Wrike contacts — first and last name, email address, role, and whether the profile is active or deleted — which appear on your **Access** page; your Wrike Projects, which appear on your **Inventory** page; and a filtered slice of the audit log covering account, admin-rights, SSO and two-factor events, which appears on your **Incidents** page. Groups, Wrike's Robot accounts, and External Users and Collaborators are left out of the Access page, and tasks, comments, attachments, time logs and file contents are never read. The **Incidents** page requires a Wrike Enterprise plan, with the `amReadOnlyAuditLog` scope and the "Create user activity reports" admin right.

    It calls these Wrike endpoints:

    * `/account`
    * `/contacts` — and again as `/contacts?deleted=true`
    * `/folders?project=true`
    * `/workflows`
    * `/audit_log`

    Every request is a read. DSALTA has no code path that creates, modifies, or deletes anything in your Wrike environment.

    ## Troubleshooting

    <AccordionGroup>
      <Accordion title="Wrike shows more members than the Access page does">
        The Access page lists internal people only. Groups (including **My Team**), Robot accounts, and anyone holding an External User or Collaborator licence are not included — check the licence type in Wrike for anyone you expected to see.
      </Accordion>

      <Accordion title="The connection fails to validate">
        Invalid, revoked or truncated permanent access token. Wrike shows the token exactly once when you generate it, so a partial copy is the common cause.
      </Accordion>
    </AccordionGroup>

    <AccordionGroup>
      <Accordion title="How do I check whether the connection is healthy?">
        Open **Integrations** in the DSALTA sidebar, stay on the **Connected** tab, and click **Manage** on the integration's card. Open the **Status** tab: it shows either **Connected and working properly** or **Connection issues detected**.

        Use the **Status** tab, not **Overview** — Overview always reports **Connected** regardless of the real state.
      </Accordion>

      <Accordion title="A check shows Failed and nothing changed on my side">
        On an integration-powered check, **Failed** normally means DSALTA was blocked rather than that you are non-compliant. Open the test, go to **Source Data**, and read the result code: **403** is a missing permission, **428** is a setting DSALTA still needs, **500** is a failure on DSALTA's side.

        A real compliance gap shows **207** and leaves the test looking **Completed**. See [Understanding Test Results](/guides/data-library/test-results).
      </Accordion>

      <Accordion title="Data looks out of date">
        Compliance checks re-run once a day at 02:00 America/New\_York. To refresh sooner, open **Integrations → Connected** and click **Sync from integrations** at the top right — it refreshes every connected integration at once.
      </Accordion>

      <Accordion title="How do I repair a broken connection?">
        There is no Reconnect, Repair or Refresh Token button. The only repair available is to disconnect and connect again.

        <Warning>
          **Disconnecting is destructive and cannot be undone.** DSALTA removes the access records, inventory, vulnerabilities, code changes, incidents and device records collected from this integration, and deletes the test results tied to the connection. Export anything you still need as audit evidence first — see [Integration errors](/troubleshooting/integration-errors).
        </Warning>
      </Accordion>

      <Accordion title="Configure scope will not let me change anything">
        That is expected. **Configure scope** is read-only — it shows what DSALTA is permitted to read, and has no Save action. To change what DSALTA can see, change the permissions on the credential in the third-party product, then disconnect and connect again.
      </Accordion>
    </AccordionGroup>
  </Tab>

  <Tab title="How to connect">
    A Wrike permanent access token (Bearer auth). Never expires until you revoke it. Read-only.

    **Before you begin**

    * A Wrike account with an Owner or Admin role
    * For the **Incidents** page only: a Wrike Enterprise plan, with the `amReadOnlyAuditLog` scope and the "Create user activity reports" admin right. Access and Inventory work on any plan.

    You will need:

    | Field                      | Where to find it                                                     | Example                          |
    | -------------------------- | -------------------------------------------------------------------- | -------------------------------- |
    | **Permanent Access Token** | [Open](https://help.wrike.com/hc/en-us/articles/210409445-Wrike-API) | `Shown once, when you obtain it` |

    <Steps>
      <Step title="Start in DSALTA">
        Open **Integrations** in the DSALTA sidebar, find **Wrike**, and click **Connect** to open the connect panel. Leave it open — it lists every value you need, and you create those in the steps below.
      </Step>

      <Step title="Open Apps & Integrations">
        In Wrike, click your profile picture in the left sidebar, then select "Apps & Integrations".
      </Step>

      <Step title="Open the API tab and create or select an app">
        Click the "API" tab at the top. Create a new app (any name — this is just a label for the token, e.g. "DSALTA"), or select an existing one, then click its Settings (gear) icon.
      </Step>

      <Step title="Obtain the permanent access token">
        Scroll to the "Permanent access token" section and click "Obtain token". Confirm the warning popup, then copy the token immediately — Wrike will not show it again.

        <Tip>
          If you're prompted to set a Wrike password first — which happens on SSO accounts — do that, then come back to this step.
        </Tip>

        <Warning>
          The token never expires until you revoke it, and it reads everything visible to the account that created it. Treat it as a secret: paste it straight into the connect panel, do not store it in a ticket or a chat message, and revoke it in Wrike if you disconnect the integration.
        </Warning>
      </Step>

      <Step title="Connect Wrike">
        Paste your permanent access token, then click Connect.
      </Step>
    </Steps>

    <Check>
      DSALTA validates the token when you click **Connect**, by calling `/account` and confirming it resolves to a Wrike account. On success the integration moves to the **Connected** tab, and **Manage → Status** reads **Connected and working properly**. Checks begin reporting after the first sync.
    </Check>

    <Warning>
      **If the connection is rejected.** Invalid token — it is wrong, revoked, truncated on copy, or resolves to no Wrike account.

      The on-screen message is generic — see [Connection error messages](/troubleshooting/connection-error-messages).
    </Warning>
  </Tab>

  <Tab title="Automated checks">
    Each check below re-runs once a day, at 02:00 America/New\_York, while this integration is connected. Click any check for step-by-step remediation guidance.

    | Check                                                                                                                | Severity | What it verifies                                                                 |
    | -------------------------------------------------------------------------------------------------------------------- | -------- | -------------------------------------------------------------------------------- |
    | [User access to Critical System should be valid](/integrations/wrike/user-access-to-critical-system-should-be-valid) | Info     | Checks that everyone with Wrike access is an active employee on the People page. |
    | [Offboarded users should not have active access](/integrations/wrike/offboarded-users-should-not-have-active-access) | High     | Checks that offboarded employees no longer have active Wrike access.             |
  </Tab>

  <Tab title="Useful links">
    | Topic   | Link                                                                                                     |
    | ------- | -------------------------------------------------------------------------------------------------------- |
    | Setup   | [Wrike API — get a permanent access token](https://help.wrike.com/hc/en-us/articles/210409445-Wrike-API) |
    | General | [Wrike website](https://wrike.com)                                                                       |
    | DSALTA  | [Connection error messages](/troubleshooting/connection-error-messages)                                  |
  </Tab>
</Tabs>