The ISV rewrites the calls. The MSP pastes keys once. Connect names a missing permission in the flow.

.raw is extra vendor fields on a read. .raw is read-only. vendor.native is the same payload. Ticket writes accept optional vendor_native.

Order: inventory, coverage, reads, writes. Webhooks only if we already have them. Reads first. Keep the old vendor clients until Bitlync matches in their environment. dry_run is the shadow pass on writes.

Never: mint an agreement header; auto-create an unmatched company.

Device write is off unless the MSP turns it on for your grant.

Tickets are two-way when the MSP grants it. You can create, update, and close. You can subscribe to events when the MSP changes the ticket in their PSA. Grants: psa.ticket.create, psa.ticket.update, psa.ticket.events. When a ticket is created, updated, noted, closed, or reopened, you can list those events or get a signed webhook. After a tenant sync, GET /tenants/{id}/connections/events?kind=ticket.closed (also created, updated, noted, reopened). Optional signed webhook. Grant is the connection (psa.ticket.events). Missing is grant_missing. When a device is created or updated, you can list those events or get a signed webhook. After a tenant sync, GET /tenants/{id}/connections/events?kind=device.updated (also created). Optional signed webhook. Grant is the connection (rmm.device.events). Missing is grant_missing. When a company is created or updated, you can list those events or get a signed webhook. After a tenant sync, GET /tenants/{id}/connections/events?kind=company.updated (also created). Optional signed webhook. Grant is the connection (psa.company.events). Missing is grant_missing. You can close a ticket once they accept the connection. Auto-close when a finding is fixed is a separate switch. Line items: on an existing agreement only. Public word Agreement. Time: hours the caller states, on a linked ticket. Company create is a separate grant (psa.company.create). Company create is off unless the MSP turns it on for your grant. We always match first. If two records match, we refuse. A company create at a distributor, when that write exists and the MSP granted it, is not a PSA create.

What we write lists the refuse codes.