Skip to main content

Per-vendor integration setup

This page is the credential lookup table — what each vendor needs, where to find it in the vendor's portal, and what gets unlocked once the connection is healthy. For the cross-vendor workflow (Test connection, encryption, Integration Status, troubleshooting), see Integrations overview. For Microsoft 365 specifically, see Connect your Partner tenant.

Autotask (PSA)​

Type: PSA. Plan tier required: any.

Credentials needed​

  • Username (API user) — the API username from the dedicated API user you create in Autotask.
  • Integration code — the tracking identifier associated with the API user and intended integration.
  • Secret — the password generated alongside the API user.
  • Zone URL (optional) — auto-detected on first connection.

How to get them​

An authorised Autotask administrator creates an API-only resource and assigns the appropriate API-user security level and tracking identifier. Use permissions sufficient for the agreed operations, not unrestricted access merely to make a test pass. The API user and its integration code must belong together; normal Kaseya SSO is not an API credential.

Follow Autotask's current API-user instructions and REST authentication guidance. Keep the username, secret and integration code in approved credential storage and enter them only in the authorised integration setup. Do not put them into a chat, screenshot, ticket or help search. An existing connected workspace does not need new credentials merely to run the Autotask walkthrough.

What gets unlocked​

  • Read tickets, companies, resources, contracts.
  • Write ticket updates, time entries, notes.
  • Webhooks (creates/deletes managed via the Webhooks page — see Webhooks for reconcile).

Integrations page — Autotask, Datto RMM, IT Glue, Pax8, and Datto EDR each shown as a verified instance with the last-verified timestamp

Datto RMM​

Type: RMM. Plan tier required: any.

Credentials needed​

  • API endpoint — your Datto RMM region's API URL (e.g. https://pinotage-api.centrastage.net for the EU pinotage zone).
  • API key — generated in the Datto RMM admin panel.
  • API secret key — generated alongside the API key.

How to get them​

  1. In Datto RMM, sign in as an admin and open Setup → Users.
  2. Pick (or create) an API user, then under Account Information click Generate API Keys.
  3. Copy the key + secret immediately — the secret is shown only once.
  4. The endpoint is the host shown in your browser's address bar when you're signed into the Datto RMM portal — substitute -api into the subdomain (e.g. pinotage → pinotage-api).

What gets unlocked​

  • Read device inventory, alerts, monitor state.
  • Trigger jobs on devices.

Datto RMM alerts aren't sent to Ops AI automatically. Connecting doesn't set up a webhook or a routing rule.

Common pitfall​

Datto API keys silently expire. If your integration starts returning 401s "out of nowhere," it's almost always the key's expiry — re-issue and re-paste.

Datto EDR​

Type: Security (endpoint detection & response). Plan tier required: any. The Security Incidents sidebar item only appears when this integration is configured.

Credentials needed​

  • Endpoint URL — your EDR region's API URL.
  • API key — from the Datto EDR admin panel.
  • Site mapping (optional) — link Datto EDR sites to Ops AI customers via Customer Mapping.

How to get them​

  1. In Datto EDR, click your user icon at the top right and choose Admin.
  2. Open Users & Tokens, then the API Tokens tab.
  3. Click Create new token, give it a description such as "Ops AI", and click Create.
  4. Copy the token immediately — Datto EDR doesn't show it again.

Common pitfall​

Datto EDR tokens expire one year after you create them. If the integration starts failing with authentication errors a year on, create a new token and update the credentials in Ops AI. Put a reminder in your calendar before the anniversary.

What gets unlocked​

Datto EDR alerts aren't sent to Ops AI automatically. Connecting doesn't set up a webhook or a routing rule.

IT Glue​

Type: Documentation. Plan tier required: any. Read and gated write — see What gets unlocked below, and How Ops AI governs AI actions for exactly how writes are controlled.

Credentials needed​

  • API key — from your IT Glue user account.
  • API base URL — https://api.itglue.com (US) or https://api.eu.itglue.com (EU). This matters — see below.

How to get them​

  1. In IT Glue, My Account → API Keys (top-right user menu).
  2. Click Generate API key, name it "Ops AI", and copy the value.

EU vs US accounts​

IT Glue hosts accounts on two separate regional servers:

  • If your IT Glue account is on the EU server, you must enter https://api.eu.itglue.com as the API base URL.
  • If you leave the URL blank, the system defaults to the US endpoint.

If you enter the wrong URL, Test connection auto-detects the EU endpoint when it sees the regional redirect and advises you to update the URL — but you'll save a step by setting it correctly upfront. US accounts don't need to set a URL.

What gets unlocked​

Read: documentation, configurations, contacts, flexible assets, SSL certificates, and password records. Customer-specific runbook content is surfaced into agent context (see Knowledge base).

Write (all gated — off by default, human-approved): Ops AI can write to IT Glue, and we'd rather tell you exactly what that means than pretend it can't. The tool registry exposes 16 IT Glue write tools — create / update / archive documents, configurations, contacts, flexible assets, SSL certificates, and related items — including four that touch the password vault: create a password, update a password, archive a password, and read a password in plaintext (a plaintext read is treated as a write for gating purposes, so it goes through the same controls).

None of these run on their own. Every one is subject to the full write-safety stack:

  • The integration must be connected and enabled — no connection, no writes.
  • Draft-then-apply on the most sensitive tools — the password-vault tools and archive operations can only be drafted by the AI; applying them is a separate, explicit step. (The document, configuration, contact, and flexible-asset writes aren't held behind this extra step — but on a propose-only customer they still can't apply without human approval; see the next point.)
  • Per-customer autonomy mode — new customers default to propose-only, which routes every write to the Approvals queue for a human to approve or reject before anything changes. A customer only writes autonomously if you explicitly switch it to full-auto.
  • Agent-type restriction + approval gates — the same per-MSP approval thresholds that gate every other vendor write apply here too.

If you want IT Glue to be strictly read-only for a given customer, set that customer's autonomy mode to read-only and no write — password or otherwise — can ever be applied against it.

Pax8​

Type: Marketplace. Plan tier required: any.

Credentials needed​

  • Client ID — from your Pax8 OAuth application.
  • Client secret — generated alongside the client ID.

How to get them​

  1. In the Pax8 admin panel, Account → API Access.
  2. Create an OAuth application named "Ops AI" and grant it the read + order-write scopes.
  3. Copy the client ID and secret.

What gets unlocked​

  • Read — companies, order history, subscription state.
  • Write (all gated with Approval by default) — these have real billing impact, so they run through the same write-safety stack as every other vendor:
    • Change a subscription's seat quantity (pax8_update_subscription_quantity).
    • Cancel a subscription (pax8_cancel_subscription).
    • Place an order (pax8_create_order).
    • Create / update companies and company contacts.

Common pitfall​

Pax8 secrets rotate periodically. Set a calendar reminder; the API stops working without warning when a rotation happens server-side.

UniFi​

Type: Networking. Plan tier required: any.

Credentials needed​

Use the admin-only UniFi connection wizard at /app/integrations/unifi/connect. A Site Manager API key discovers accounts, consoles and sites; optional per-console Network API keys enable deeper inventory and eligible actions. Standalone consoles use their URL and Network API key. Do not supply a controller username/password as the current wizard's credential model. Create dedicated keys with the required scope and keep values out of tickets, screenshots and chat.

How to get them​

Create the Site Manager key in your UniFi account's Admin → API settings. Use the wizard's account discovery, customer mapping and optional depth-key stations; it probes keys and persists connection/mapping state. Those are active operations, not read-only navigation. Code support does not establish live coverage or permission to enable writes.

What gets unlocked​

  • Read — site, device, and client inventory.
  • Write (all gated with Approval by default) — UniFi has a broad write surface; every one runs through the write-safety stack:
    • Block / unblock and reconnect clients.
    • Restart access points, switches, and gateways.
    • Create and update WLANs and networks; toggle switch-port PoE.
    • Create, update, enable, and delete firewall rules and port-forward rules (unifi_create_firewall_rule, unifi_create_port_forward, and related).
    • Create guest vouchers.

Common pitfall​

Self-signed certificates on the controller. The integration will fail with "SSL certificate verify failed" — use a trusted certificate or have Ops AI Support assess the specific connection. Do not disable TLS verification merely to make a connection test pass.

Microsoft 365 (CSP / GDAP)​

Type: Productivity. Plan tier required: any. Setup path: dedicated wizard, not the Integrations form.

Microsoft 365 doesn't use the standard credential-paste flow. It uses the CSP/GDAP wizard (see Connect your Partner tenant), which provisions a per-MSP Entra app on your side, mints a client secret, creates the GDAP relationship, and rotates secrets automatically.

What gets unlocked​

  • Read users, groups, mailboxes, license state across every onboarded customer tenant.
  • Lifecycle write operations via Microsoft Graph: create / disable / license users (always with Approval by default).

Multiple instances of the same vendor​

Non-PSA integrations can have multiple instances; mark the appropriate instance as default when a call does not name one. UniFi uses its account/console wizard below. PSA permits one integration record per MSP, including disabled and historical records. Self-service PSA disconnect/reconnect is unavailable; contact Ops AI Support.

Where to look when something goes wrong​

  • 401 / 403 immediately — credentials are wrong or rotated; re-paste fresh from the vendor portal.
  • Timeout — vendor IP allow-list problem; ask Ops AI Support for our outbound IP list.
  • Worked yesterday, broken today — open Integration Status for the last error message; usually credential expiry.
  • Vendor-specific quirks — see the per-vendor "Common pitfall" notes above.

For the cross-vendor troubleshooting tree, see Troubleshooting.