generated: '2026-08-01' method: searched source: openapi/kaseya-bms-openapi-original.json, openapi/kaseya-autotask-psa-openapi-original.json, openapi/kaseya-datto-rmm-openapi-original.json plus the published auth documentation for each product docs: - https://ww2.autotask.net/help/developerhelp/Content/APIs/REST/General_Topics/REST_Security_Auth.htm - https://rmm.datto.com/help/en/Content/2SETUP/APIv2.htm - https://help.bms.kaseya.com/help/Content/BMS%20API/bms-api-v2-bms-rest-apis.html - https://help.itglue.kaseya.com/help/Content/1-admin/it-glue-api/getting-started-with-the-it-glue-api.html - https://helpdesk.kaseya.com/hc/en-gb/articles/4705556673169-Use-VSA-Access-Token-API summary: types: - http - apiKey - oauth2 api_key_in: - header oauth2_flows: - clientCredentials note: >- Kaseya has no single identity plane across its products. Each acquired product carries its own auth model: BMS issues a JWT from a username/password/company login endpoint, Autotask PSA uses three static headers on every request, Datto RMM uses OAuth 2.0 access tokens, IT Glue uses a long-lived account API key, and VSA 10 uses scoped access tokens or "Trusted Applications" OAuth. Only Datto RMM (OAuth 2.0) and VSA 10 (Trusted Applications) offer delegated, revocable, scope-bearing credentials. schemes: - name: bearerAuth type: http scheme: bearer bearerFormat: JWT description: JWT Authorization header using the Bearer scheme. api: Kaseya BMS API 2.0 sources: - openapi/kaseya-bms-openapi-original.json applied: >- global — the BMS OpenAPI declares a document-root security requirement of bearerAuth, so every one of the 435 operations requires it. token_endpoint: POST https://api.bms.kaseya.com/v2/security/authenticate credentials: - BMS username - password - company name - server URL refresh: refresh-token supported - name: AutotaskHeaderCredentials type: apiKey in: header api: Datto Autotask PSA REST API sources: - openapi/kaseya-autotask-psa-openapi-original.json - https://ww2.autotask.net/help/developerhelp/Content/APIs/REST/General_Topics/REST_Security_Auth.htm description: >- Autotask PSA does not declare securityDefinitions in its Swagger 2.0 document. Credentials are instead modelled as three required header parameters present on all 3,009 operations. headers: - name: UserName description: The API-only user's e-mail address required: true - name: Secret description: The API-only user's password required: true - name: ApiIntegrationCode description: Tracking identifier assigned to the API-only user (vendor identifier or Custom/Internal Integration identifier) required: true - name: ImpersonationResourceId description: Optional; ID of a resource to impersonate when creating entities required: false account_model: Requires an "API User (API-only)" security level, which grants full system administrator access to Autotask via the REST API with no access to the UI and no per-seat charge. x-observation: Static, non-expiring, unscoped credentials sent in headers on every request and carrying full administrator authority — the weakest auth posture of any Kaseya API surface, and the one an agent integration is most likely to use. - name: DattoRmmOAuth2 type: oauth2 api: Datto RMM API v2 sources: - https://rmm.datto.com/help/en/Content/2SETUP/APIv2.htm description: >- OAuth 2.0 access tokens issued by the Datto RMM authorization server. The OpenAPI 3.1.0 document does not declare a securityScheme, so the model is captured from the documentation. flows: - flow: clientCredentials tokenUrl: https://{region}-api.centrastage.net/auth/oauth/token scopes: {} scopes_note: Datto RMM documents no OAuth scope vocabulary; tokens inherit the permissions of the API user that generated the API Key / API Secret Key. token_lifetime: 100 hours (expired tokens return HTTP 401) credentials: - API Key (generated in the Datto RMM UI) - API Secret Key regions: - pinotage-api.centrastage.net - merlot-api.centrastage.net - concord-api.centrastage.net - vidal-api.centrastage.net - zinfandel-api.centrastage.net - syrah-api.centrastage.net - name: ITGlueApiKey type: apiKey in: header parameter_name: x-api-key api: IT Glue API sources: - https://help.itglue.kaseya.com/help/Content/1-admin/it-glue-api/getting-started-with-the-it-glue-api.html description: Account-scoped API key generated by an IT Glue Administrator under Account > Settings > API Keys. key_hygiene: Since 2023-05-15 unused API keys are automatically revoked after 90 days of inactivity. - name: VSA10AccessToken type: apiKey in: header api: Kaseya VSA 10 API sources: - https://helpdesk.kaseya.com/hc/en-gb/articles/4705556673169-Use-VSA-Access-Token-API - https://help.vsa10.kaseya.com/help/Content/2-Administration/configuration/api.htm description: >- VSA 10 access tokens are created in the tenant UI and can be configured with explicit REST API (Read, Write) scopes. Trusted Applications provide an OAuth-based authorization alternative that removes the need to manually create API access credentials. scopes: - REST API (Read) - REST API (Write) - name: VSA9SessionToken type: apiKey in: header api: Kaseya VSA 9 REST API sources: - https://help.vsa9.kaseya.com/help/Content/Modules/rest-api/31615.htm description: >- The VSA 9 REST API exposes a general-purpose /auth resource that returns a sessionToken used on subsequent requests, plus an /echo resource for testing connectivity to the target Kaseya Server. gaps: - No OpenID Connect discovery document is served on any Kaseya host. - No RFC 8414 /.well-known/oauth-authorization-server metadata for the Datto RMM authorization server. - No documented OAuth scope vocabulary anywhere in the portfolio except the two coarse VSA 10 REST API (Read/Write) scopes, so scopes/ was not written. - Neither the BMS nor the Autotask machine-readable contract declares its real security scheme in a way an agent can consume without reading prose docs (Autotask declares none at all).