Kaseya BMS setup: read-only API user
Short answer: in Kaseya BMS, create a security role with View rights only on the areas StackTether reads (Service Desk tickets, CRM accounts and contacts, assets, and optionally time logs) plus Has API Access, then create an employee with User Type API Employee and that role. In StackTether, enter the API address, Company (tenant) name, API username and Password on Connections and click Test and connect.
StatusLive
What you need
- A BMS administrator who can manage security roles and employees.
- A real mailbox for the API user (BMS sends the password link there).
- A StackTether admin account signed in with 2FA.
Step 1: create a view-only security role
- In BMS, open Admin > Security > Roles and create a new role, for example "StackTether read-only".
- Set the role type to Internal. An API Employee cannot have an external role.
- Save, then open the role's permissions.
- Give View only (no add, modify or delete) on:
- Service Desk tickets (StackTether reads tickets, notes, per-ticket time logs, checklists, ticket history and linked tickets).
- CRM accounts and contacts.
- The hardware asset area of the Service Desk.
- Optional: time entries or timesheets ("Time Logs"), all employees. Needed only for
psa_search_my_time_entries, which shows each tech their own time.
- Under Admin, Special Features, tick Has API Access.
- Do not grant finance, billing, invoicing, approve or post rights. StackTether never shows prices or billing amounts.
- Save the role.
Step 2: create the API Employee
- Open HR > Employees and create a new employee.
- Set User Type to API Employee. This type cannot sign in to the BMS screens and does not use a licence.
- Give it a valid, monitored email address and assign the role from step 1.
- Save, then use Reset and Send instructions so BMS emails a link to set the password. Choose a long, unique password and store it in your password manager.
Kaseya's help says API Employee accounts are not asked for MFA, which StackTether needs: the connection test fails if the user gets a 2FA prompt.
Step 3: connect it in StackTether
- In the StackTether portal, open Connections, PSA tab.
- Choose Slot Primary (or Secondary) and Vendor Kaseya BMS.
- Fill in:
StackTether field What to enter API address The https:// Kaseya BMS API address for your region, usually https://api.bms.kaseya.com. If your BMS runs on a regional server (for example EMEA or APAC), confirm your API address with Kaseya.Company (tenant) name The company name you type on the BMS sign-in page. API username The API Employee's BMS username, not an email address. Password The password you set in step 2. - Click Test and connect. StackTether signs in and reads one ticket; it saves the details only if that works.
- Turn on vendor access for each person: Vendor access.
Which StackTether tools work on Kaseya BMS
| Tool | On Kaseya BMS | What it reads |
|---|---|---|
psa_search_tickets, psa_get_ticket, psa_get_ticket_history, psa_list_ticket_time_entries, psa_list_related_tickets | Yes | Tickets, notes, checklists, ticket audit history, time logs on a ticket, linked tickets |
psa_list_ticket_options | Yes | Status, priority, queue and issue type lists |
psa_search_clients, psa_get_client | Yes | CRM accounts and their locations |
psa_search_contacts | Yes | CRM contacts |
psa_search_assets, psa_get_asset | Yes | Hardware assets and their tickets |
psa_search_tasks | Yes, for anyone's tasks by project or client ("me" is not offered) | Project tasks |
psa_search_my_time_entries | Only after the role may view time logs | The signed-in tech's own time logs |
psa_search_projects, psa_get_project, psa_search_contracts | Not available on BMS today | The AI is told BMS does not let StackTether read them |
psa_list_client_notes, psa_list_schedule | Not offered by the BMS API | The AI is told BMS does not offer them |
search, fetch | Yes | Tickets and clients (for ChatGPT) |
StackTether also reads the BMS employee list to match "me" to your tech record by your sign-in email. With a secondary PSA connected, tools BMS cannot answer ask the secondary instead.
Check it worked
- Connections shows Kaseya BMS with status Working.
- Ask your AI app for a known ticket by number. If the tool says BMS "does not let StackTether read time logs with its current API permissions", add the time-log view right to the role, then click Test again.
Rotate the password
- Set a new password for the API Employee in BMS (Reset and Send instructions).
- In StackTether, on Connections, pick the same slot, enter all four fields again and click Test and replace.
Revoke access
- Fastest: in StackTether, Remove the connection. The saved credentials are deleted at once.
- In BMS: deactivate the API Employee or remove Has API Access from its role. StackTether's next call then fails cleanly.
FAQ
"Kaseya BMS did not accept these login details."
Check the tenant (company) name, that the username is the BMS username and not an email address, the password, that the role has API access, and that the user gets no 2FA prompt.
"Kaseya BMS accepted the login, but the API user is not allowed to view tickets."
Add the view right on Service Desk tickets to the role, then test again.
Can I use the Administrator role?
It works, but it gives StackTether far more than it needs. Use a view-only role. See Read-only access first.
Can I limit the API user to certain IP addresses?
Kaseya's API account article does not describe an IP restriction for API users, and StackTether does not publish fixed outbound addresses today. Ask Kaseya support if your BMS offers one.