API permissions by vendor
Short answer: for every vendor, StackTether needs view-only access through a dedicated API user or app. The table shows the read-only setup for each vendor and, for later, what a read-write setup would add. Write tools do not exist yet, so set up read-only only.
| Vendor | Status | API identity | Read-only setup (use this) | Read-write (future only) | Official docs |
|---|---|---|---|---|---|
| Kaseya BMS | Live | Employee with User Type API Employee | Internal security role with View on Service Desk tickets, CRM accounts and contacts, hardware assets (optional: time logs), plus Has API Access under Admin > Special Features | Modify on the specific areas a write tool changes; never delete, finance or approve rights | Dedicated API integration account |
| Autotask | Live | API user (API-only), tracking identifier Custom (Internal Integration) | A copy of API User (system) Can't Read Costs (API-only) with every Add, Edit and Delete removed; View on the entities listed on the Autotask page; Can view non-billable time entries allowed | Add or Edit on only the entities a write tool changes, in a separate copied level | Adding an API user, Custom security level |
| ConnectWise PSA | Coming soon | API Member with a public/private API key pair | Security role with Inquire only (Add, Edit, Delete at None) on tickets, companies, contacts, configurations, projects, time, schedule, agreements and table setup | Add or Edit on the specific items a write tool changes | ConnectWise Developer Network |
| HaloPSA | Coming soon | API application, Client ID and Secret (Services), logged in as a dedicated agent | Only read: permissions on the Permissions tab (for example read:tickets, read:customers), and a read-only agent |
Matching edit: permissions for a write tool's data only; never all |
Creating API Applications |
| NinjaOne | Coming soon | Client app, API Services (machine-to-machine), Client Credentials | Scope Monitoring only | Management would allow changes; Control allows remote access. StackTether has no plan to ask for Control | NinjaOne Public API |
| Datto RMM | Coming soon | Dedicated user with Generate API Keys | API Security Level set to a level that can view only; lowest API Component Level | A level that may run the specific jobs a write tool needs | Datto RMM API |
FAQ
What if I already gave a vendor's admin role?
Create a read-only user or app as shown above, replace the credentials on Connections with Test and replace, then disable the old admin-level user.