MSP permissions

A missing grant is HTTP 403, code grant_missing. A parked vendor permission is HTTP 409, code scope_parked. An unsupported capability is HTTP 501, code unsupported_capability.

ConnectWise and Halo connect are numbered click paths. Halo takes a client ID, a client secret, and the two server URLs. SuperOps connects with an API token, a subdomain, and a region. The sandbox offers SuperOps tickets (read and write), companies (read), and agreements (read). SuperOps has no custom-field value writes, no agreement-line writes, and no draft contracts. A missing permission is named in English. PSA company create is not supported (403 company_create_not_supported); companies are created by the MSP. Billing writes are quantity updates on lines the MSP matched, on an existing agreement. Send quantity 0 to stop billing. Ending a line is refused.

ISV experience config

GET|PUT /isv/experience-config sets category config for PSA, RMM, Docs, CS, and Commerce, plus recommended grants and branding. Vendors inherit the category template. Access is List, Read, and Write, and those stack. Never is its own setting. The MSP can tighten the starting verbs. Recommended grants drive Connect rows. Sandbox Experience Preview walks Connect: keys, grants, boards, map, done. Getting Started on Setup is Suggest, Save, Preview, then Use MCP or Use API. After Save, copy-paste prompts follow the saved profile. Partner credentials and Production MSP Connect keys are separate. Connections lists each MSP and vendor, last sync, and sync detail. Issues gives a support blurb and a redacted request debug.

Mechanism

The MSP pastes keys in the guided flow. The probe names the permission to fix. The ISV does not paste MSP creds.

What the caller sees

Reads still serve from the store. A missing grant is HTTP 403, code grant_missing. A parked vendor permission is HTTP 409, code scope_parked. An unsupported capability is HTTP 501, code unsupported_capability.

HTTP 403
{
  "status": 403,
  "code": "grant_missing"
}

# Portal copy names the permission.
# ISV does not paste MSP creds.

The MSP pastes PSA keys in Connect. A partial connect stays partial. It is not reported as failed.

When alerts are on, Connect adds an alerts setup step with Back and Continue. The MSP chooses where alerts go. Type is required. Subtype (ConnectWise), Item, and the Halo subcategory are optional and default to None. "ConnectWise requires Subtype on {board}." is returned only when the stack mandates Subtype. A save that cannot be read back says "Reload the page and try again." Too many saves says "Too many saves. Wait a minute and try again." Details are on Alerts.