canonical: https://jentic.com/apis/halopsa.com/halopsa # HaloPSA API HaloPSA is a professional services automation platform for managed service providers and IT teams, covering ticketing, asset management, contracts, billing, and project tracking. The API exposes 35 endpoints for working with tickets, clients, agents, assets, contracts, invoices, and recurring jobs against a per-tenant subdomain. Authentication uses an OAuth 2.0 Client Credentials flow scoped per resource (read:tickets, edit:tickets, read:customers, and so on). The base URL includes a tenant-specific instance variable so each customer reaches their own HaloPSA cloud. ## For AI agents Manage HaloPSA tickets, clients, assets, contracts, and invoices for managed service providers using OAuth 2.0 Client Credentials. ## Scope Does not handle remote control, scripting, RMM agent installs, or live chat - use for HaloPSA records (tickets, clients, assets, contracts, invoices) only. ## Capabilities - Open, fetch, and close support tickets in a HaloPSA tenant - Log time and actions against an existing ticket - Create and look up clients and their primary contacts - Track configuration items and assets associated with a client - List active contracts and their billing terms for a client - Generate invoices and recurring billing jobs for support work - Look up the current authenticated agent or list all agents on the tenant ## Use cases ### MSP Helpdesk Automation Automate first-line ticket creation by piping monitoring alerts into HaloPSA via POST /tickets and assigning the right agent based on client and asset. The HaloPSA API returns the created ticket with its ID so a downstream alert system can correlate the alert and ticket. This collapses a multi-step manual triage flow into a single API call per alert. Example prompt: When an SNMP alert fires for client 'Acme Corp', call POST /tickets with summary 'Switch unreachable' and link the affected asset record. ### Client Asset and Contract Reconciliation Reconcile asset inventories and contract entitlements by listing /assets and /contracts for each client and matching them against an external CMDB. Each asset and contract is returned with a clientId so an integration can flag unmanaged devices or expired contracts. This is read-heavy and runs well on a nightly schedule. Example prompt: List all assets for client ID 142 and contracts for the same client, then flag assets not covered by an active contract. ### Billable Time Capture Capture engineer time against tickets by posting to /actions with the ticketId, agent, duration, and a description, then issuing an invoice via the contract billing flow. HaloPSA tracks billable versus non-billable time per action, so reporting and invoicing stay consistent. Integrators typically pair this with a daily timesheet sync. Example prompt: Log a 45-minute billable action against ticket 8821 for agent 'Sara' with note 'Replaced failed RAID disk' via POST /actions. ### AI Agent Service Desk Copilot Wire an MSP service desk copilot that reads open tickets via GET /tickets, summarises each customer's queue, and opens follow-ups via POST /tickets. Through Jentic the OAuth Client Credentials are stored centrally and refreshed automatically, so the agent only handles short-lived bearer tokens. The agent cannot run scripts or remote-access endpoints - those are out of scope for this API. Example prompt: List open tickets for the on-call engineer, summarise priorities, and create a callback ticket for any customer waiting more than 4 hours. ## Key endpoints | Method | Path | Description | | --- | --- | --- | | POST | `/auth/token` | Obtain an OAuth 2.0 access token | | GET | `/tickets` | List tickets | | POST | `/tickets` | Create a ticket | | GET | `/tickets/{ticketId}` | Get a ticket by ID | | POST | `/actions` | Log an action or time entry against a ticket | | GET | `/clients` | List clients | | GET | `/assets` | List managed assets | | GET | `/contracts` | List service contracts | ## Key resources - **Tickets** — Create, list, fetch, and delete support tickets - **Actions** — Time entries and updates posted against tickets - **Clients** — Customer organisation records - **Agents** — Engineer and helpdesk agent records - **Assets** — Configuration items and customer-managed devices - **Contracts** — Service contracts and billing terms ## Why Jentic - **Setup:** Wiring the HaloPSA API by hand means running its OAuth2 Client Credentials exchange against `/auth/token`, refreshing the short-lived bearer, pointing calls at your own instance subdomain, and building each ticket, client, and asset request yourself. Through Jentic you install once, import the HaloPSA API from the API Directory, store the client id and secret once, and your agent calls it. - **Permission scoping:** HaloPSA puts the ticket id in the URL path (`/tickets/{ticketId}`), so a rule can pin your agent to one ticket: it can read and act on that ticket and nothing else. You choose the operations it may call, so creating tickets or reading clients, assets, and contracts are not included unless you add them. - **Credential handling:** Your HaloPSA client id and secret are stored once, encrypted, by your own Jentic One instance, which runs the token exchange and injects the short-lived bearer at execution time. The raw secrets never enter the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'create a support ticket' or 'list clients', and Jentic returns the matching HaloPSA operation with its input schema so the agent calls the right endpoint without crawling the HaloPSA Swagger docs. ## Related APIs - **Freshdesk** — General-purpose helpdesk and ticketing for non-MSP teams. - **Zendesk** — Customer support ticketing without PSA-specific contract or asset tracking. - **ServiceNow** — Enterprise IT service management with broader CMDB and workflow scope. ## FAQ ### What authentication does the HaloPSA API use? HaloPSA uses OAuth 2.0 Client Credentials. Exchange your client_id and client_secret at POST `/auth/token` to receive a bearer token, then send Authorization: Bearer on subsequent calls. Tokens are scoped (read:tickets, edit:tickets, read:customers, etc.). Through Jentic, the client_id and client_secret are stored in the encrypted vault and short-lived tokens are minted per call. ### Can I create tickets programmatically with the HaloPSA API? Yes. POST /tickets accepts a JSON body with summary, details, client_id, and priority fields and returns the created ticket with its ticketId. You can then attach actions or time entries via POST /actions referencing the same ticketId. ### What are the rate limits for the HaloPSA API? HaloPSA does not document a public per-second rate limit; tenant-level fair-use throttling applies and HTTP 429 is returned when exceeded. Build clients to back off on 429 and avoid bursting more than a few requests per second per tenant. ### How do I open a ticket in HaloPSA through Jentic? Search Jentic for 'create a halopsa ticket', load the schema for POST /tickets, and execute with summary, client_id, and details. Jentic handles the OAuth client_credentials exchange against `/auth/token` automatically. Run pip install jentic and use the async client.search, client.load, and client.execute pattern. ### Does the HaloPSA API expose remote control or scripting endpoints? No. This OpenAPI spec covers PSA records - tickets, clients, agents, assets, contracts, invoices, and time. Remote support, scripting, and agent installer flows are not part of the REST surface and require HaloPSA's separate remote tooling. ### Can I limit what my agent is allowed to do with the HaloPSA API? Yes. Jentic One is self-hosted by you, so your own rules decide which HaloPSA operations and credentials the agent may use. You pick the exact endpoints it can call, so listing or creating tickets, reading clients, assets, or contracts, and posting time entries are each off limits unless you add them. Because HaloPSA puts the ticket id in the URL path at `/tickets/{ticketId}`, a rule can pin the agent to a single ticket, letting it read and act on that one ticket and nothing else.