Connect Kaseya VSA to Conduit

This walkthrough connects Kaseya VSA (RMM, VSA 10) to Conduit. You point Conduit at your VSA tenant URL and authenticate one of two ways: a Kaseya One token, or a VSA username + password. Once connected, any MCP client your organization uses can call VSA tools through Conduit’s gateway.

Menu labels can change

The VSA steps below stay deliberately generic; menu labels can shift between VSA releases. Follow Kaseya’s VSA 10 API configuration guide as the authority for enabling API access and creating credentials.

Before you start

You need:

• A Conduit role that can manage connections — owner or admin on your organization.
• Your VSA tenant URL, including the API path — for example https://vsa.example.com/api/v1.0. The /api/v1.0 suffix is required.
• One of:
  • a Kaseya One token, or
  • a VSA username and password for an account whose role covers whatever you want the AI to do.

Step 1 — Prepare API credentials in Kaseya VSA

1. Sign in to your VSA 10 tenant as an administrator.
2. Enable API access and prepare a credential per Kaseya’s API guide: either obtain a Kaseya One token, or confirm the username/password of the VSA account the AI should act as.
3. Copy the token (or have the username and password ready).

Caution

Copy the token or password now and store it somewhere safe. Don’t paste it into chat, email, or a shared document — the next step moves it directly into Conduit, which encrypts it at rest. If you accidentally expose a token, revoke and reissue it in Kaseya One first; if you expose a password, change it in VSA — the exposed credential becomes useless immediately.

Step 2 — Connect Kaseya VSA in Conduit

1. In Conduit, go to Connections (/org/catalog). Expected: the vendor catalog.
2. Find Kaseya VSA in the catalog (under RMM) and click Connect. Expected: a credential form with four fields.
3. Fill the fields:
   • Tenant URL (required) — e.g. https://vsa.example.com/api/v1.0. Include the /api/v1.0 path; a trailing slash is trimmed automatically.
   • Username (optional) — for username/password auth.
   • Password (optional) — for username/password auth.
   • Kaseya One token (alt to username/password) (optional) — provide this instead of username/password if you authenticate through Kaseya One. You must fill either the Kaseya One token or both username and password — the form rejects a connection with neither.
4. Click Connect. Expected: Conduit authenticates against your tenant immediately (via /auth/sso for a Kaseya One token, or VSA’s challenge-hash /auth flow for username/password — your password is never sent in the clear) and shows a green Connected status. Bad credentials or a wrong tenant URL are rejected here, not on the first tool call.

The credential is stored at the organization scope, so every technician in your org shares this VSA connection. (For per-technician credentials, connect at the personal scope instead — see Vendor connections.)

Verify it worked

Connect an MCP client to Conduit — Claude Desktop, Claude Code, Cursor, or any MCP-compatible client (see Connecting an AI client) — and ask it to run a read-only VSA tool, such as listing agents or devices. You should get real data back, and the call appears in your audit log with the correct user, vendor (kaseya-vsa), and a successful status.

Troubleshooting

Symptom	Likely cause
Connect fails with “Tenant URL is required (e.g. https://vsa.example.com/api/v1.0).”	The Tenant URL field was left empty. Enter your full tenant URL including /api/v1.0.
Connect fails with “Provide either Kaseya One token, or username + password.”	Neither auth method was completed. Fill the Kaseya One token, or both username and password.
Connect fails with “Kaseya One token rejected. Verify the token and tenant URL.”	The token is invalid or expired, or it doesn’t belong to this tenant. Reissue the token and confirm the tenant URL.
Connect fails with “VSA rejected the credentials. Verify username + password.”	The username or password is wrong, or the account is disabled/locked. Verify the login works in the VSA portal.
Connect fails with “VSA /auth endpoint not found. Is the tenant URL correct (must include /api/v1.0)?”	The tenant URL is missing the /api/v1.0 path or points at the wrong host. Fix the URL and reconnect.
Connect fails with “VSA returned HTTP <status> on /auth.” or “VSA returned HTTP <status> on /auth/sso.”	VSA answered with an unexpected error — often a proxy, maintenance window, or misconfigured API access. Check the API settings in VSA and retry.
Connect fails with “Failed to reach VSA tenant: <details>”	Conduit couldn’t reach the tenant at all — DNS, firewall, or an unreachable on-prem server. The tenant must be reachable from Conduit’s gateway.
Tool calls return 403 “no credentials for vendor”	VSA isn’t connected at a scope this user can resolve. Connect it at the organization scope, or confirm the user’s team has credentials.
Need to rotate the credential	Reissue the Kaseya One token or change the account password, then update the credential at /org/catalog.

Related

• Vendor connections — credential scopes, rotation, and the full vendor catalog.
• Security — how Conduit encrypts and resolves the credential you just stored.
• VSA 10 API configuration — Kaseya’s VSA 10 documentation.