Kaseya Authentication

generated: '2026-08-01'
method: searched
source: openapi/kaseya-bms-openapi-original.json, openapi/kaseya-autotask-psa-openapi-original.json,
  openapi/kaseya-datto-rmm-openapi-original.json plus the published auth documentation
  for each product
docs:
- https://ww2.autotask.net/help/developerhelp/Content/APIs/REST/General_Topics/REST_Security_Auth.htm
- https://rmm.datto.com/help/en/Content/2SETUP/APIv2.htm
- https://help.bms.kaseya.com/help/Content/BMS%20API/bms-api-v2-bms-rest-apis.html
- https://help.itglue.kaseya.com/help/Content/1-admin/it-glue-api/getting-started-with-the-it-glue-api.html
- https://helpdesk.kaseya.com/hc/en-gb/articles/4705556673169-Use-VSA-Access-Token-API
summary:
  types:
  - http
  - apiKey
  - oauth2
  api_key_in:
  - header
  oauth2_flows:
  - clientCredentials
  note: >-
    Kaseya has no single identity plane across its products. Each acquired product
    carries its own auth model: BMS issues a JWT from a username/password/company
    login endpoint, Autotask PSA uses three static headers on every request, Datto RMM
    uses OAuth 2.0 access tokens, IT Glue uses a long-lived account API key, and VSA
    10 uses scoped access tokens or "Trusted Applications" OAuth. Only Datto RMM
    (OAuth 2.0) and VSA 10 (Trusted Applications) offer delegated, revocable,
    scope-bearing credentials.
schemes:
- name: bearerAuth
  type: http
  scheme: bearer
  bearerFormat: JWT
  description: JWT Authorization header using the Bearer scheme.
  api: Kaseya BMS API 2.0
  sources:
  - openapi/kaseya-bms-openapi-original.json
  applied: >-
    global — the BMS OpenAPI declares a document-root security requirement of
    bearerAuth, so every one of the 435 operations requires it.
  token_endpoint: POST https://api.bms.kaseya.com/v2/security/authenticate
  credentials:
  - BMS username
  - password
  - company name
  - server URL
  refresh: refresh-token supported
- name: AutotaskHeaderCredentials
  type: apiKey
  in: header
  api: Datto Autotask PSA REST API
  sources:
  - openapi/kaseya-autotask-psa-openapi-original.json
  - https://ww2.autotask.net/help/developerhelp/Content/APIs/REST/General_Topics/REST_Security_Auth.htm
  description: >-
    Autotask PSA does not declare securityDefinitions in its Swagger 2.0 document.
    Credentials are instead modelled as three required header parameters present on
    all 3,009 operations.
  headers:
  - name: UserName
    description: The API-only user's e-mail address
    required: true
  - name: Secret
    description: The API-only user's password
    required: true
  - name: ApiIntegrationCode
    description: Tracking identifier assigned to the API-only user (vendor identifier
      or Custom/Internal Integration identifier)
    required: true
  - name: ImpersonationResourceId
    description: Optional; ID of a resource to impersonate when creating entities
    required: false
  account_model: Requires an "API User (API-only)" security level, which grants full
    system administrator access to Autotask via the REST API with no access to the UI
    and no per-seat charge.
  x-observation: Static, non-expiring, unscoped credentials sent in headers on every
    request and carrying full administrator authority — the weakest auth posture of
    any Kaseya API surface, and the one an agent integration is most likely to use.
- name: DattoRmmOAuth2
  type: oauth2
  api: Datto RMM API v2
  sources:
  - https://rmm.datto.com/help/en/Content/2SETUP/APIv2.htm
  description: >-
    OAuth 2.0 access tokens issued by the Datto RMM authorization server. The OpenAPI
    3.1.0 document does not declare a securityScheme, so the model is captured from
    the documentation.
  flows:
  - flow: clientCredentials
    tokenUrl: https://{region}-api.centrastage.net/auth/oauth/token
    scopes: {}
    scopes_note: Datto RMM documents no OAuth scope vocabulary; tokens inherit the
      permissions of the API user that generated the API Key / API Secret Key.
  token_lifetime: 100 hours (expired tokens return HTTP 401)
  credentials:
  - API Key (generated in the Datto RMM UI)
  - API Secret Key
  regions:
  - pinotage-api.centrastage.net
  - merlot-api.centrastage.net
  - concord-api.centrastage.net
  - vidal-api.centrastage.net
  - zinfandel-api.centrastage.net
  - syrah-api.centrastage.net
- name: ITGlueApiKey
  type: apiKey
  in: header
  parameter_name: x-api-key
  api: IT Glue API
  sources:
  - https://help.itglue.kaseya.com/help/Content/1-admin/it-glue-api/getting-started-with-the-it-glue-api.html
  description: Account-scoped API key generated by an IT Glue Administrator under
    Account > Settings > API Keys.
  key_hygiene: Since 2023-05-15 unused API keys are automatically revoked after 90 days
    of inactivity.
- name: VSA10AccessToken
  type: apiKey
  in: header
  api: Kaseya VSA 10 API
  sources:
  - https://helpdesk.kaseya.com/hc/en-gb/articles/4705556673169-Use-VSA-Access-Token-API
  - https://help.vsa10.kaseya.com/help/Content/2-Administration/configuration/api.htm
  description: >-
    VSA 10 access tokens are created in the tenant UI and can be configured with
    explicit REST API (Read, Write) scopes. Trusted Applications provide an
    OAuth-based authorization alternative that removes the need to manually create
    API access credentials.
  scopes:
  - REST API (Read)
  - REST API (Write)
- name: VSA9SessionToken
  type: apiKey
  in: header
  api: Kaseya VSA 9 REST API
  sources:
  - https://help.vsa9.kaseya.com/help/Content/Modules/rest-api/31615.htm
  description: >-
    The VSA 9 REST API exposes a general-purpose /auth resource that returns a
    sessionToken used on subsequent requests, plus an /echo resource for testing
    connectivity to the target Kaseya Server.
gaps:
- No OpenID Connect discovery document is served on any Kaseya host.
- No RFC 8414 /.well-known/oauth-authorization-server metadata for the Datto RMM
  authorization server.
- No documented OAuth scope vocabulary anywhere in the portfolio except the two
  coarse VSA 10 REST API (Read/Write) scopes, so scopes/ was not written.
- Neither the BMS nor the Autotask machine-readable contract declares its real
  security scheme in a way an agent can consume without reading prose docs
  (Autotask declares none at all).