> For the complete documentation index, see [llms.txt](https://docs.arnica.io/arnica-documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.arnica.io/arnica-documentation/code-risks/code-risk-magic-links.md).

# Code Risk Magic Links

Access finding-specific views and personalized code risk lists through pre-authenticated Arnica links

## Summary

Arnica magic links provide access to a code risk finding or a personalized list of findings without requiring sign-in. A magic link can be received in pull request feedback, status checks, and ChatOps notifications, or created from a finding within Arnica.

## Availability and configuration

Magic links have settings such as: enable/disable, expiration time, and usage limit. The organization's Arnica Customer Success Manager can be contacted for changing these settings.

## Access and permissions

Permissions depend on where the link was created and whether an Arnica session is already active:

* Links from pull requests, the finding **Share** menu, and the `risks mine` and `risks product` commands, provide read-only access when opened without an existing Arnica session.
* Some actionable policy alerts allow the finding status to be changed when dismissal approval is not required.
* For users who are already signed in, the permissions granted to their Arnica account are retained.

{% hint style="warning" %}
Magic links should be treated as sensitive. Anyone who obtains a valid link can access the permitted finding data until the link expires, even without an Arnica account.
{% endhint %}

## Create a link from Arnica

A finding can be shared manually from **Risks** → **Code**:

1. The finding is opened.
2. **Share** is selected.
3. One of the following link types is selected and copied:
   * **Magic Link** — temporary access is provided without requiring sign-in.
   * **Permalink** — the link does not expire, and the recipient is required to sign in to Arnica.

In pull request feedback, status checks, ChatOps alerts, and issue-management integrations, the link type is selected automatically by Arnica.

## Magic links in pull request feedback

When a magic link is available, **View in Arnica** will appear in the pull request finding comment, and can be used to open the finding without signing in. This behavior applies to GitHub, Azure DevOps, GitLab, and Bitbucket.

<figure><img src="https://4035514934-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMxc1Ek3qoIZi5t2Sx7do%2Fuploads%2Fgit-blob-3e9c1cbf552cbe3e8023c9ce043067c063707149%2Fcode-risk-pr-comment-magic-link.png?alt=media" alt="Pull request finding comment with a View in Arnica magic link"><figcaption><p>View in Arnica opens the finding without requiring sign-in when a magic link is available.</p></figcaption></figure>

If a magic link is unavailable, **View in Arnica** may use a standard Arnica link that requires sign-in. If no Arnica link is available, **View in Arnica** is omitted from the finding comment.

### Status check links

Each finding title displayed in a failed Arnica status-check report is a link. When the title is selected, the destination is determined as follows:

* **A pull request comment exists for the finding** — the pull request comment is opened in the SCM.
* **No pull request comment exists and a magic link is available** — the finding is opened in Arnica without requiring sign-in.
* **No pull request comment or magic link is available, but a standard Arnica link is available** — the finding opens in Arnica and requires sign-in.
* **No Arnica link is available** — the finding's source file is opened in the SCM.

<figure><img src="https://4035514934-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMxc1Ek3qoIZi5t2Sx7do%2Fuploads%2Fgit-blob-316a1072c367efb32c7b47ce5e8732ae80294821%2Fcode-risk-status-check-magic-links.png?alt=media" alt="Failed Arnica status check with linked code risk finding rows"><figcaption><p>Finding links in a failed Arnica status check.</p></figcaption></figure>

### Public repositories

To prevent tenant information from being exposed through public pull requests, Arnica handles links according to the repository visibility recorded during the most recent inventory scan:

* **Public repositories** — Can include magic links when they are enabled and available. These links provide read-only access to the finding without requiring sign-in. Arnica omits the organization identifier from Arnica URLs published in public pull request comments and status checks.
* **Private and internal repositories** — Magic links retain their standard tenant context.

{% hint style="info" %}
After changing a repository’s visibility, allow the next inventory scan to complete for Arnica’s pull request links to reflect the change.
{% endhint %}

## Magic links in ChatOps

### Code risk alerts

Code risk alerts in Slack and Microsoft Teams can include a magic link to the finding. If the alert does not include a link, the finding can be opened from Arnica or the associated SCM feedback.

### Filtered risk lists

When magic links are enabled, the following ChatOps commands return a magic link to a filtered risk list:

* **Slack commands** — `/arnica risks mine` or `/arnica risks product`
* **Microsoft Teams (chat with the Arnica bot)** — `risks mine` or `risks product`

The generated magic link opens:

* **`risks mine`** — findings for which the requester is recorded as the author, committer, or pusher.
* **`risks product`** — findings associated with products owned by the requester.