Create a dedicated security role and API member for Neo Agent in ConnectWise
Neo Agent needs its own security role and API member in ConnectWise. Create the role first, set its permissions in one pass, then create the API member with it.
Go to System → Security Roles and create a new role with Role ID Neo. Save it.
System → Security Roles
Add a new role
Name it Neo and save
2
Set the permission levels, one module at a time
Open each module once. In every module, including Sales and Marketing, set Inquire Level to All on every entry first. Then open the groups below and set Add and Edit Level to All on the chips listed.
Service Desk
Service TicketsClose Service TicketsService Ticket - DependenciesMerge TicketsResource SchedulingKnowledge Base CreatorTicket Templates
Also set Delete Level to All on Resource Scheduling.
Companies
Company MaintenanceConfigurationsContactsManage AttachmentsManagementNotes
Sales and Marketing need no write access. Read access lets Neo look up context (companies, SLAs, agreements, configurations) and does not allow changes.
Three entries deserve a second look:
System → Member Maintenance needs Inquire = All. Neo reads your member list to resolve its own API member and to sync technicians. Without it, the connection checks fail with a 403 on the Identity check.
System → API Reports needs Inquire = All. ConnectWise treats this entry separately from the rest of the System module, and it lets Neo batch note history efficiently.
Companies → Manage Attachments is what enables ticket file attachments. Without Add = All there, attachments fail with a 403 permission error.
Keep Add, Edit, and Delete at None on the financial and admin entries not listed above. Neo does not need to write to them:
Invoicing and Invoice Approval
Billing Rate Maintenance
Accounting Interface
Purchase Orders and Purchasing Approvals
Member Maintenance
Security Roles
Add Licenses
Inquire stays All on every entry in this list. Only Add, Edit, and Delete go to None.The Neo dashboard’s permission groups control what Neo actually does; the role only sets the maximum access.
3
Create the API member and generate keys
Go to System → Members → API Members and create a new member.
Set the Security Role to Neo, the Member ID to something clear like neo_agent, and the email to psa-noreply@neoagent.io.
Open the member’s API Keys tab and create a key pair with a description like “Neo-API”.
Copy the Public Key and the Private Key now. ConnectWise does not show the private key again.
Use psa-noreply@neoagent.io here, never another @neoagent.io address such as team@neoagent.io. ConnectWise mails member notifications to the address on the member record. psa-noreply@neoagent.io discards everything it receives; any other Neo address delivers your ticket notifications, and the customer data inside them, to a Neo inbox instead of your team’s. An address on your own domain works too. Neo never reads this field — it authenticates with the API keys.
Note the Member ID, the Public Key (username), and the Private Key (password). The connection step needs all three.
4
Create a regular member for time entries (optional, recommended)
ConnectWise does not let API-only members create time entries. If Neo should log time, create a second, regular member:
Go to System → Members (the regular list, not API Members).
Create a member such as neo_agent_member and assign it the Neo security role.
Note its Member ID.
This member needs no API keys. Neo authenticates with the API member’s keys and only records this member as the author of time entries. After you connect, Neo asks which member to use and lists your members to pick from (connection setup).
If you skip this step, everything else works. Neo only cannot write time entries, and an attempt surfaces an action-required notice in your inbox.
Excluded companies keeps a company’s tickets out of Neo’s sync and triggered agents. A scheduled agent or Chat Agent reads the PSA as the account Neo signs in with, so to keep those agents away from a company too, restrict that account.ConnectWise limits a member by its Level and each company’s Territory:
In System > My Company > Structure, add a location the Neo API member is not under.
On each company to hide, set Territory to that location.
On the Neo API member, set Level and Name to the location that holds your other companies, not Corporate.
ConnectWise says a member “will be able to search for companies at the specified level and the ones below it”, and that a company with no territory is never restricted. Its documentation does not say whether the API applies this limit, so after the change, check in a chat with Neo that it cannot open one of that company’s tickets. If the company’s tickets sit on boards of their own, Restrict Board Access on the API member hides those boards’ tickets instead.
