Create a dedicated security role and API member for Neo Agent in ConnectWise
Neo Agent needs its own security role and API member in ConnectWise. Create the role first, set its permissions in one pass, then create the API member with it.
Go to System → Security Roles and create a new role with Role ID Neo. Save it.
System → Security Roles
Add a new role
Name it Neo and save
2
Set the permission levels, one module at a time
Open each module once. In every module, including Sales and Marketing, set Inquire Level to All on every entry first. Then open the groups below and set Add and Edit Level to All on the chips listed.
Service Desk
Service TicketsClose Service TicketsService Ticket - DependenciesMerge TicketsResource SchedulingKnowledge Base CreatorTicket Templates
Also set Delete Level to All on Resource Scheduling.
Companies
Company MaintenanceConfigurationsContactsManage AttachmentsManagementNotes
Sales and Marketing need no write access. Read access lets Neo look up context (companies, SLAs, agreements, configurations) and does not allow changes.
Two entries deserve a second look:
System → API Reports needs Inquire = All. ConnectWise treats this entry separately from the rest of the System module, and it lets Neo batch note history efficiently.
Companies → Manage Attachments is what enables ticket file attachments. Without Add = All there, attachments fail with a 403 permission error.
Keep Add, Edit, and Delete at None on the financial and admin entries not listed above. Neo does not need to write to them:
Invoicing and Invoice Approval
Billing Rate Maintenance
Accounting Interface
Purchase Orders and Purchasing Approvals
Member Maintenance
Security Roles
Add Licenses
The Neo dashboard’s permission groups control what Neo actually does; the role only sets the maximum access.
3
Create the API member and generate keys
Go to System → Members → API Members and create a new member.
Set the Security Role to Neo, the Member ID to something clear like neo_agent, and the email to psa-noreply@neoagent.io.
Open the member’s API Keys tab and create a key pair with a description like “Neo-API”.
Copy the Public Key and the Private Key now. ConnectWise does not show the private key again.
Use psa-noreply@neoagent.io here, never another @neoagent.io address such as team@neoagent.io. ConnectWise mails member notifications to the address on the member record. psa-noreply@neoagent.io discards everything it receives; any other Neo address delivers your ticket notifications, and the customer data inside them, to a Neo inbox instead of your team’s. An address on your own domain works too. Neo never reads this field — it authenticates with the API keys.
Note the Member ID, the Public Key (username), and the Private Key (password). The connection step needs all three.
4
Create a regular member for time entries (optional, recommended)
ConnectWise does not let API-only members create time entries. If Neo should log time, create a second, regular member:
Go to System → Members (the regular list, not API Members).
Create a member such as neo_agent_member and assign it the Neo security role.
Note its Member ID.
This member needs no API keys. Neo authenticates with the API member’s keys and only records this member as the author of time entries. After you connect, Neo asks which member to use and lists your members to pick from (connection setup).
If you skip this step, everything else works. Neo only cannot write time entries, and an attempt surfaces an action-required notice in your inbox.
