Skip to main content
Set up

Create the role, API agent, and API application in HaloPSA

Create a narrow role, an API-only agent, and an API application in HaloPSA so Lemhi can connect with a client ID and secret.

Written By The Lemhi Product Team

Last updated 1 day ago

For the MSP admin with access to Configuration in HaloPSA. When you finish, you have a role, an API-only agent, and an API application with a client ID and client secret ready to enter in Lemhi.

Lemhi connects to your HaloPSA as an API-only agent through an API application you create, with a narrow role you control. Everything in this article happens in HaloPSA, under Configuration.

Step 1: Create the role

  1. Go to Teams & Agents > Roles and select New.

  2. Enter a Role Name, for example Lemhi Compass API, and save. The Permissions tab unlocks only after the first save. Every permission on a new role starts as "Not set".

  3. On the Permissions tab, set these seven settings:

Setting

Value

Customers Access Level

View (Names Only)

Tickets Access Level

Read and Modify

Can add new Tickets

Yes

Can view Unassigned Tickets

Yes

Can view Tickets that are assigned to other Agents

Yes

Can Edit Tickets Which Are Not Assigned To Them

Yes

Can edit closed Tickets

Yes

  1. Leave Is a Halo Administrator at No, and save the role.

The role's Permissions tab with the seven settings Lemhi needs

Check: The role saves, and the seven settings above show the values you set.

What each setting lets Lemhi do

Setting

Why Lemhi needs it

Customers Access Level

Read your client list, so each Lemhi client can be matched to its Halo client

Tickets Access Level

Read tickets, including their current status, and add a note to a ticket you link

Can add new Tickets

Log a ticket from a Compass task

Can view Unassigned Tickets

See the tickets it logs, which arrive unassigned unless the ticket type has a default agent

Can view Tickets that are assigned to other Agents

Keep seeing a ticket after a technician picks it up

Can Edit Tickets Which Are Not Assigned To Them

Add the link note to a ticket a technician owns

Can edit closed Tickets

Add the link note to a closed ticket

The last two only matter when you link an existing ticket. Without them, the link still works but the note is refused.

Step 2: Create the API-only agent

  1. Go to Teams & Agents > Agents and select New.

  2. Fill in the agent:

Field

What to enter

Username

A name your team will recognize, for example Lemhi Compass API

Roles

The role you created in Step 1

Is an API-only Agent

Ticked

Default Team

*No Default Team* is fine

  1. Save the agent.

The new agent, with Is an API-only Agent ticked and the Step 1 role assigned

Check: The agent appears in the agent list with the Step 1 role.

API-only agents do not take up a licence. HaloPSA says so on the form. They also cannot log in to the web or mobile apps, and cannot be assigned tickets.

Step 3: Create the API application

  1. Go to Integrations > Halo API. The menu label is "Halo API", not "HaloPSA API". Note the Tenant this page shows; you may need it when you connect in Lemhi.

  2. Select View Applications, then New.

  3. Fill in the application:

Field

What to enter

Application Name

For example Lemhi Compass

Authentication Method

Client ID and Secret (Services)

Login Type

Agent

Agent to log in as

The agent you created in Step 2

  1. Copy the Client ID and the Client Secret, then save the application.

The API application set to Client ID and Secret (Services), logging in as the API-only agent

The client secret is shown only once. HaloPSA says so on the page. A secret takes effect only when you save the application after selecting Generate. Generating a new secret stops the old one from working, so if you lose it, generate a new one, save, and use the new one.

Step 4: Give the application its permissions

  1. Edit the application and open its Permissions tab.

  2. Tick only these three: read:customers, edit:tickets, and all:teams.

  3. Save the application.

The application's Permissions tab with read:customers, edit:tickets, and all:teams ticked

Permission

Why Lemhi needs it

read:customers

Read your clients for client mapping

edit:tickets

Log tickets, read them back, and add the link note

all:teams

List the teams a ticket can go to

Check: You have the client ID and client secret copied somewhere safe, and the application shows exactly those three permissions.

Do not tick "all" or "admin". HaloPSA's own tab warns that they expose administration level access. Lemhi asks for the three permissions above and nothing more.

Next

Connect HaloPSA to Lemhi and set ticket defaults

Was this helpful?

Still need help? Ask the team