Using Arc with IBM PA Cloud (v11)

This page covers setting up and using Arc when your IBM Planning Analytics (TM1) instances are hosted on the IBM PA Cloud (v11), whether you reach them over the REST API or through the IBM-provided Remote Desktop System.

For TM1 v12, see Using Arc with IBM PAaaS (TM1 v12) instead.

Step 1: Choose where to install Arc

Arc is lightweight and can run on a developer's laptop. For teams, Cubewise recommends a centralised Arc Server, so all developers share the same configuration, templates, snippets and license.

Arc does not need to run on the TM1 host. It connects to TM1 through the REST API, so it can sit on a laptop, on a virtual machine, or on a dedicated server.

If you work through the IBM Remote Desktop System, Arc can also be installed there. See Option B below.

Step 2: Choose your authentication method

Option A: IBM ID (OAuth)

Arc uses OAuth so that the same IBM ID credentials used to log in to IBM PA Cloud also authenticate with Arc. This works with IBM ID, federated systems linked to Active Directory, and third-party identity providers such as Okta and Auth0.

Requirement: Arc must be running with SSL/TLS enabled (usessl: true in settings.yml) to use OAuth.

A1. Request OAuth security keys from IBM

Submit a request to IBM using the official form: IBM OAuth Request Form

You will need to provide:

• The IBM PA environments you need access to (PAW URLs)

• The exact URLs that your Arc and Pulse instances will be running on, so IBM can whitelist them

All Cubewise products use the same OAuth endpoint: /auth/token. If Arc is accessed via https://arc.company.com, the URL given to IBM must be https://arc.company.com/auth/token. Include the port if a non-standard one is used, for example https://arc.company.com:8080/auth/token.

Support ticket template:

A2. Configure connections in settings.yml

Once you receive the IBM security keys, open settings.yml and add a connection entry for each TM1 instance:

If several instances share the same IBM credentials, define ibmclientid, ibmsecretid, ibmtenantid and ibmaccountid once at the top level of settings.yml, outside the connections block.

A3. Refresh and log in

Save settings.yml and refresh Arc. Click on the instance name and you will be prompted to log in with your IBM ID.

Option B: Non-interactive account on the IBM Remote Desktop System

These steps apply to the IBM Cloud classic environment, accessed through the IBM-provided Remote Desktop System, with TM1 security mode 5 (the default).

B1. Set up Arc on the Remote Desktop System

1. Upload the Arc executable to your IBM Cloud Remote Desktop System, using the FTP upload facility provided by IBM.

2. Create a folder named Arc in your Documents directory.

3. Save arc.exe to Documents\Arc.

4. Double-click arc.exe to start the Arc server.

5. Open settings.yml in Wordpad and change the admin host from https://localhost:5898 to https://data:5898.

6. Save settings.yml.

B2. Log in using the TM1 non-interactive account

IBM Cloud uses a TM1 non-interactive account for automation tools. Request it from IBM Support if it is not already set up.

1. Navigate to http://localhost:7070 in a browser on the Remote Desktop.

2. Go to the About page (top-right icon) and enable TM1 Credentials → Store Credentials.

3. Click on your TM1 instance to log in using the automation credentials from your IBM welcome pack:

B3. Grant admin access to the non-interactive account

The TM1 non-interactive account must be added to the Admin group:

1. Log in to IBM Architect using your IBM ID.

2. Right-click the server, then Security → Clients/Groups.

3. Find the TM1 automation user and tick the Admin group box.

4. Close and reopen Arc.

Alternative: change TM1 to security mode 1 to avoid the need for the non-interactive account.

Key differences from an on-premise setup

Related pages

• Using Arc with IBM PAaaS (TM1 v12)

• Connect to a TM1 Instance Directly via the REST API

• Connect to Multiple Admin Hosts

• Arc & Slice Comparison table (on-premise vs IBM Cloud)