MSP permissions

A missing write permission can still connect as partial. Reads work. The parked write is refused distinctly. That is not a generic 500.

ConnectWise and Halo connect are numbered click paths in the flow. Halo pastes a client ID, client secret, and the two server URLs. If a permission is missing, we name it in English. Company create is off unless the MSP turns it on for your grant. We always match first. If two records match, we refuse. Create an agreement is off unless the MSP turns it on for your grant.

Mechanism

The MSP pastes keys in the guided flow. The probe names the permission to fix. The ISV does not paste MSP creds.

What the caller sees

Reads still serve from the store. A parked write is 501 unsupported. Portal copy tells the MSP which permission to fix.

HTTP 501
{
  "status": 501,
  "code": "unsupported"
}

# Portal copy names the permission.
# ISV does not paste MSP creds.

No ISV-side form that collects PSA keys. Partial connect is not collapsed into “failed.”