Autotask setup: read-only API user
Short answer: in Autotask, copy the API User (system) Can't Read Costs (API-only) security level, turn off every add, edit and delete right in the copy, then create a new API user with that level and a Custom (Internal Integration) tracking identifier. In StackTether, enter the user's API username, Secret and Integration code on Connections and click Test and connect. You do not need the API zone URL: StackTether finds it from the username.
StatusLive
What you need
- An Autotask administrator who can manage Resources/Users (HR) and security levels.
- A monitored mailbox for the API user. Autotask sends integration alerts, such as usage threshold warnings, to it.
- A StackTether admin account signed in with 2FA.
Step 1: make a read-only API security level
Autotask's built-in API levels give full access through the API and cannot be edited, but they can be copied and the copy restricted.
- Go to Admin > Organization Settings & Users > Resources/Users (HR) > Security > Security Levels.
- Right-click API User (system) Can't Read Costs (API-only) and choose Copy Security Level. Starting from the "Can't Read Costs" level keeps internal cost fields out of every answer.
- Name the copy, for example "StackTether Read-Only (API-only)", and make sure it is active.
- In each module, keep View (query) and remove every Add, Edit and Delete right.
- Keep view access to the entities in the table below. Make sure Can view non-billable time entries is allowed, or non-billable time is silently left out.
- Do not limit contract visibility, or contracts can be missing from answers.
- Save.
Entities StackTether reads
| Area | Autotask entities (view only) | Used by |
|---|---|---|
| Service Desk | Tickets, TicketNotes, TicketHistory, TicketChecklistItems, ticket field and picklist information | psa_search_tickets, psa_get_ticket, psa_get_ticket_history, psa_list_related_tickets, psa_list_ticket_options, search, fetch |
| Time | TimeEntries, BillingCodes (work type names only) | psa_list_ticket_time_entries, psa_search_my_time_entries |
| CRM | Companies, CompanyLocations, CompanyNotes, Contacts, Countries | psa_search_clients, psa_get_client, psa_list_client_notes, psa_search_contacts |
| Configuration items | ConfigurationItems, ConfigurationItemCategories, Products | psa_search_assets, psa_get_asset |
| Projects | Projects, Phases, Tasks, ProjectNotes | psa_search_projects, psa_get_project, psa_search_tasks |
| Contracts | Contracts | psa_search_contracts (never prices or billing terms) |
| Dispatch | ServiceCalls, ServiceCallTickets, ServiceCallTasks, ServiceCallTicketResources, ServiceCallTaskResources | psa_list_schedule |
| Resources | Resources (names, and the sign-in email to match "me") | Every tool that shows a tech or accepts "me" |
Step 2: create the API user
- Go to Admin > Organization Settings & Users > Resources/Users (HR) > Resources/Users, click New and choose New API User.
- Under General, enter a name such as "StackTether", a monitored Email Address, and choose the security level from step 1.
- Under Credentials, click Generate Key for Username (Key) and Generate Secret for Password (Secret). Copy both into your password manager now; the secret is hidden once you save.
- Under API Tracking Identifier, choose Custom (Internal Integration) and enter an Internal Integration Name such as "StackTether". Autotask generates the Tracking Identifier. Copy it. It cannot be changed after you save.
- Leave Line of Business unassociated unless your business is strictly split by line of business: Autotask advises against it because the API user cannot see the resulting gaps.
- Save. API users are free of charge and cannot sign in to the Autotask screens.
Official reference: Adding or editing an API user and The API tracking identifier.
Step 3: connect it in StackTether
- In the StackTether portal, open Connections, PSA tab.
- Choose Slot Primary (or Secondary) and Vendor Autotask.
- Fill in:
StackTether field Autotask value API username Username (Key) of the API user Secret Password (Secret) Integration code The Tracking Identifier from the Custom (Internal Integration) option - Click Test and connect. StackTether looks up your Autotask zone from the username, signs in and reads one ticket, and saves only if that works.
- Turn on vendor access for each person: Vendor access.
Where the API zone URL comes from
Each Autotask database lives in a zone with its own API address (for example https://webservices3.autotask.net/atservicesrest/). StackTether asks Autotask's zone information service for the right address using the API username, so you never type it. Autotask documents this in its REST API security and authentication pages.
Check it worked
- Connections shows Autotask with status Working.
- Ask your AI app for your newest tickets, then for a project or contract. Empty results where you expect data usually mean a missing view right in the security level.
- With two PSAs connected, Autotask IDs carry the
autotask:prefix, for example#autotask:T20241018.0001.
Rotate the secret
- In Autotask, edit the API user and click Generate Secret. Save.
- In StackTether, on Connections, pick the same slot, enter all three fields again and click Test and replace.
Exclude the API user from password expiry if your Autotask password policy would otherwise expire it, so the integration does not stop on its own.
Revoke access
- Fastest: in StackTether, Remove the connection. The saved credentials are deleted at once.
- In Autotask: clear Active on the API user (or generate a new secret and do not enter it anywhere).
Limits to know
- Autotask allows 10,000 API requests an hour per database, shared by every integration you run. StackTether keeps its own use to at most 2,000 an hour per MSP. See Call budgets.
- Autotask cannot sort results on the server. For "newest first", StackTether reads recent windows (last day, week, month, quarter, year) and says when older records need a narrower search.
FAQ
"Autotask did not accept these login details."
Check the API username, secret and integration code, and that the user is an active API user. A user locked after failed logins has Locked ticked; clear it.
"Autotask accepted the login, but the API user is not allowed to view tickets."
Give the security level view access to tickets, then test again.
Can I use the built-in API User (system) level?
It works, but it grants full read and write access to everything, including internal costs. Use a copied, view-only level.
Can I restrict the API user to StackTether's IP addresses?
Autotask's API user documentation does not describe IP restrictions, and StackTether does not publish fixed outbound addresses today. Rely on the dedicated user, the view-only level and Autotask's own login records.