Skip to main content
To enable Neo Agent to interact with your ConnectWise system, you need to create a dedicated security role with the right permissions and then create an API member using that role.
This process involves creating a custom security role called “Neo”, configuring permissions across ConnectWise modules, and setting up API member credentials.

​
How Neo Agent Permissions Work

Neo Agent uses two layers of access control to keep your ConnectWise data safe:
  1. ConnectWise Security Role (what you configure here) — sets the maximum API access available, just like setting up any technician account.
  2. Neo Agent Dashboard — where you choose exactly what Neo can do. You configure permission groups that control which areas Neo can read, write, or ignore — and whether actions require technician approval first.
Think of it like onboarding a new team member: you give them a security role in ConnectWise so they can access the areas they need, then their manager decides which tasks they actually work on. The ConnectWise role is the ceiling — Neo Agent’s dashboard settings are the actual controls.
Granting API permissions here does not mean Neo Agent will use them all. It simply ensures Neo can operate when you enable a capability in the dashboard. You stay in control of what Neo actually does.

​
Creating the Security Role and API Member

1

Create a new 'Neo' security role

In ConnectWise, navigate to System → Security Roles and create a new security role for Neo Agent.
Open Security Roles
Add new role
Set the Role ID to Neo and save the role.
Save role
2

Grant read access (Inquire Level)

Set Inquire Level to All for all entries in every module listed below. This gives Neo Agent the ability to look up information across your ConnectWise system — read access alone does not allow any modifications.
Neo Agent needs broad read access to provide accurate context when resolving tickets — looking up company details, checking SLA coverage, finding related configurations, reviewing agreements, and referencing system metadata. Read-only access is safe and helps Neo make better decisions.
Double-check API Reports under the System module is set to Inquire = All. ConnectWise treats the API Reports entry separately from the other System entries, and without it Neo Agent falls back to slower per-ticket lookups when batching note history. Granting Inquire on System → API Reports lets Neo use the batched system/reports/ServiceNote endpoint, which meaningfully reduces API volume on busy tenants.
3

Grant write access (Add and Edit Levels)

Set Add Level and Edit Level to All for the specific entries listed below. These are the core areas Neo Agent needs to resolve tickets, manage time, and handle day-to-day operations.

​
Service Desk

​
Companies

Manage Attachments is what enables ticket file attachments. When Neo Agent attaches a file to a ticket — for example a screenshot a user shares in chat — it calls ConnectWise’s POST system/documents endpoint. Despite the system/ path, that endpoint is gated by the Companies → Manage Attachments permission (ConnectWise’s document-management permission, internal identifier dmdoc), so Add: All here is required. Without it, attachments fail with 403 "You do not have security permission to perform this action." (Older ConnectWise Manage versions exposed a separate System → Documents entry; current versions do not — Manage Attachments covers it.)

​
Time & Expense

​
Project

​
Finance

​
Procurement

​
System

Sensitive areas — left read-only intentionally. The following entries should keep Add, Edit, and Delete levels at None. Neo Agent does not need write access to these areas, and leaving them read-only protects your financial records and security settings:
  • Finance: Invoicing, Invoice Approval, Billing Rate Maintenance, Accounting Interface, Agreement Invoicing, Billing Reconciliation, Company Finance, Expense Reimbursements
  • Procurement: Purchase Orders, Purchasing Approvals
  • System: Member Maintenance, Security Roles, Add Licenses
  • Sales: All entries (Opportunity, Sales Orders, Sales Funnel, etc.)
  • Marketing: All entries (Campaigns, Marketing Groups, etc.)
You can grant write access to these areas later if needed — for example, if you want Neo Agent to manage sales opportunities or create purchase orders.
4

Grant delete access for schedule entries

Delete permissions are only needed for one specific entry:
This allows Neo Agent to manage schedule entries (e.g., rescheduling or removing technician appointments). No other delete permissions are required.
5

Create API member and generate keys

Create the API Member using your newly configured security role:
  1. Navigate to System → Members → API Members
  2. Create a new API member with the following settings:
    • Security Role: Select the “Neo” role you created
    • Email: Set to team@neoagent.io
    • Member ID: Use a descriptive identifier like neo_agent
  3. Generate API credentials:
    • Create API Keys with a description like “Neo-API”
    • You’ll receive both Public and Private keys
Make note of the following information as you’ll need it for the connection setup:
  • API Member identifier (text-based Member ID, e.g., neo_agent)
  • Public Key (acts as username)
  • Private Key (acts as password)
6

Create a regular member for time entries (optional, recommended)

ConnectWise does not allow API-only members to create time entries — even when the security role grants Time & Expense access. Time entries must be owned by a regular (non-API) member. So if you want Neo to log its own time on tickets, create a second member for Neo of the regular type:
  1. Navigate to System → Members (the regular Members list, not API Members).
  2. Create a new member — e.g. Member ID neo_agent_member — and assign it the Neo security role you created above (it already includes Time & Expense → Time Entry).
  3. Make note of this member’s Member ID.
This regular member does not need its own API keys — Neo still authenticates with the API member’s keys. Neo only uses the regular member’s ID as the author of the time entries it creates. You’ll provide this ID in the optional Neo’s Regular (non-API) Member ID field during connection setup.
If you skip this step, everything else works — Neo just can’t write time entries, and any attempt will surface an “API member does not have access to the Time module” action-required notice in your inbox.

​
What’s Next?

Once you’ve successfully created the API member with proper permissions, you’re ready to connect it to Neo Agent using the credentials and configuration details from your new API member.
Before proceeding, ensure you have:
  • The API Member identifier (Member ID)
  • The Public Key (username)
  • The Private Key (password)
  • Your ConnectWise PSA URL
  • Your exact company name from the ConnectWise login screen
  • (Optional) The regular (non-API) Member ID, if you want Neo to log time entries