Connect Kaseya BMS to Conduit

This walkthrough connects Kaseya BMS (PSA) to Conduit. BMS needs your tenant subdomain plus one token — either a BMS API token or a Kaseya One token. You supply whichever of the two you use; Conduit needs exactly one of them.

Menu labels can change

The BMS steps below reflect current Kaseya flows; menu labels can shift between BMS releases. If a label differs, see Kaseya’s guide to a dedicated API integration account — it is the authority for this flow.

Before you start

You need:

• A Conduit role that can manage connections — owner or admin.
• A Kaseya BMS administrator login (to create an API integration account), or a Kaseya One token if your organization authenticates BMS through Kaseya One.
• To know your tenant subdomain — the first label of your BMS address: for yourcompany.bms.kaseya.com, the subdomain is yourcompany.

Step 1 — Get a token from Kaseya

Pick one of the two:

• BMS API token — create a dedicated API integration account in BMS following Kaseya’s guide, and obtain its API token. A dedicated account is preferable to a person’s login — it survives staff changes and its permissions scope what the AI can do.
• Kaseya One token — if your BMS tenant signs in through Kaseya One, obtain a Kaseya One token instead.

Caution

Copy the token now and store it somewhere safe. Don’t paste it into chat, email, or a shared document — the next step moves it directly into Conduit, which encrypts it at rest. If you accidentally expose the token, revoke or regenerate it on the Kaseya side first; the exposed token becomes useless immediately.

Step 2 — Connect Kaseya BMS in Conduit

1. In Conduit, go to Connections (/org/catalog). Expected: the vendor catalog.
2. Find Kaseya BMS in the catalog (under PSA) and click Connect. Expected: a credential form with three fields.
3. Fill the fields:
   • Tenant Subdomain — e.g. yourcompany. Required. Just the subdomain, not the full URL.
   • API Token — your BMS API token. Optional if you provide a Kaseya One token instead.
   • Kaseya One token (alt to API token) — optional alternative to the API token. Provide one of the two.
4. Click Connect. Expected: Conduit makes a real authenticated call to your BMS tenant and shows Connected. A bad token or misspelled subdomain is rejected here, not on the first tool call.

The credential is stored at the organization scope, so every technician in your org shares this BMS connection. (For per-technician tokens, connect at the personal scope instead — see Vendor connections.)

Verify it worked

Connect an MCP client to Conduit (see Connecting an AI client) and ask it to run a read-only BMS tool, such as listing recent service tickets. Real data should come back, and the call appears in your audit log with vendor kaseya-bms.

Troubleshooting

Symptom	Likely cause
Connect fails with ‘Tenant subdomain is required (e.g. “yourcompany”).’	The subdomain field was left empty. Enter the first label of your BMS address.
Connect fails with “Tenant subdomain must contain only alphanumerics and hyphens (DNS-label characters).”	The field contains a full URL, dots, or other characters. Enter only the subdomain — yourcompany, not yourcompany.bms.kaseya.com or https://….
Connect fails with “Provide either an API token or a Kaseya One token.”	Both token fields were left empty. Fill exactly one of them.
Connect fails with “BMS rejected the token. Verify the credential and tenant subdomain.”	The token is wrong, revoked, or belongs to a different tenant than the subdomain you entered. Check both together.
Connect fails with “BMS endpoint not found. Verify tenant subdomain spelling.”	The subdomain doesn’t resolve to a BMS API endpoint — usually a typo.
Connect fails with “BMS returned HTTP …”	BMS responded with an unexpected status — often transient on the Kaseya side; retry, then verify the account’s permissions.
Connect fails with “Failed to reach BMS tenant: …”	Network-level failure reaching ‹subdomain›.bms.kaseya.com — the subdomain may not exist, or BMS was unreachable.
Tool calls return 403 “no credentials for vendor”	Kaseya BMS isn’t connected at a scope this user can resolve. Connect it at the organization scope, or confirm the user’s team has a credential.
Need to rotate the token	Regenerate it on the Kaseya side, then update the credential at /org/catalog.

Related

• Vendor connections — credential scopes, rotation, and the full vendor catalog.
• Security — how Conduit encrypts and resolves the credential you just stored.