Datto RMM: prepare a read-only API user

StatusComing soon

Short answer: turn on Enable API Access under Setup > Global Settings > Access Control, create a dedicated Datto RMM user for StackTether, click Generate API Keys on that user, and set its API Security Level to a level with view-only rights. Copy the API key, the API secret key and the API URL.

Steps

1. Create a security level for StackTether that can view devices, sites, alerts and patch status but cannot run jobs, change settings or open remote sessions. Start from your most restricted level and copy it if needed.
2. Go to Setup > Global Settings > Access Control and turn on Enable API Access (off by default, account-wide).
3. Create a dedicated user for StackTether, not a person's own account.
4. Go to Setup > Users, click that user, and click Generate API Keys.
5. Set API Security Level to the view-only level from step 1, and API Component Level to the lowest level you use (StackTether will not run components).
6. Copy the API Key, API Secret Key and the API URL shown on the user page. The secret key is hidden once you leave the page.
7. Click Save User.

Official reference: Datto RMM API. It states that the API security level decides what the keys can do through the API.

Rotate and revoke

• Rotate: click Generate API Keys again on the user. The old keys stop working at once; replace them in StackTether.
• Revoke: click Delete API Keys, or deactivate the user. Inactive or deleted users' keys stop working.

Limits to know

Datto RMM limits API reads to 600 requests per 60 seconds for the whole account, shared by every integration. Persistent requests over the limit get the calling address blocked for a while.

FAQ

Datto RMM keys belong to a user. What if that user leaves?

That is why the user must be dedicated to StackTether. Keys tied to a person stop when the person is deactivated.