Skip to main content
To enable Neo Agent to interact with your VSA X tenant, create a Third-Party Token (a Token ID + Token Secret pair) with the appropriate permissions.
Token management lives under Configuration → API Access → Third-Party Tokens. If you don’t see API Access under Configuration, your account’s role lacks the API Access permission — ask a Super Admin to grant it or to create the token for you.

​
Creating a Third-Party Token

1

Navigate to Third-Party Tokens

In your VSA X portal, go to Configuration → API Access → Third-Party Tokens, then click Create Token in the upper-right corner.
VSA X Configuration → API Access → Third-Party Tokens page with the Create Token button
2

Configure the token details

On the Details tab, give the token a recognizable name (e.g. Neo Agent) and an optional description. You can optionally set start/expiration dates and restrict the token to specific IP addresses.
VSA X Create Token details form with name, description, expiry, and IP allowlist fields
3

Set the token authorization (scopes)

On the Authorization tab, scope the token to the organizations Neo should manage and grant the API endpoint permissions. For a standard Neo integration, grant read access to Devices, Device Assets, Organizations / Sites / Groups, and Automation, plus any areas you want Neo to write to (e.g. Notifications).
Missing permissions cause Neo to fail with 403 Forbidden on the affected endpoints. Grant at least read access to Devices, Assets, and Organizations so device sync and PSA mapping work.
4

Create and save the token

Click Create. VSA X displays the Token ID and Token Secret once.
VSA X generated Third-Party Token showing Token ID and Token Secret
Important: Copy both the Token ID and Token Secret immediately and store them securely. The Token Secret is not recoverable after you navigate away — you would have to regenerate it.
Before closing, make sure you’ve saved:
  • The Token ID
  • The Token Secret
  • Your tenant URL (e.g. https://yourtenant.vsax.net)
AreaAccessPurpose
DevicesReadDevice sync, status, custom fields, applied policies
Device AssetsReadHardware + installed-software inventory
Organizations / Sites / GroupsReadTenant hierarchy + PSA company mapping
AutomationReadBrowse the script / task / workflow catalog
NotificationsRead/WriteOnly if you want Neo to create notifications or manage webhooks
A revoked token has a 30-day grace period during which you can regenerate its secret before it’s permanently deleted.

​
What’s Next?

Once you’ve created your token, you’re ready to connect it to Neo Agent using the Token ID and Token Secret.