Enable external integrations deliberately
Find the integration surface you need, record tenant consent, and combine it with deployment enablement and a scoped API key.
Before you start
- An administrator with MFA available.
- An identified integration owner, purpose, and approved receiving service.
- Deployment-side approval for the relevant external gateway or MCP surface.
Screenshots show the Rapport interface with example data. Use your organization’s devices and values. Select an image to view it at full size.
Choose the correct integration route
Open Admin → Integrations. Under ITSM platforms, use Connect or an existing platform card for CI/ticket synchronization. Under Notify targets, use Add target for outbound notifications. Manage connectors opens analytics data sources. API/MCP access is controlled through Admin → API Keys, where the External integrations section holds tenant permissions.
Choose the minimum permission for the surface
In External integrations, locate MCP, REST API, or Employee resolver. Each starts Disabled. Choose Read only for an integration that only reads device/fleet information, or Read and write when it must dispatch scoped actions. Employee resolver requires write access and therefore has no read-only option.
| Field or control | What to do |
|---|---|
| MCP | Device, fleet, patch, remediation, and assistant tools for an external AI client, constrained by its key scopes. |
| REST API | HTTP access for external services to inventory, alerts, CI data, and authorized device actions. |
| Employee resolver | Employee issue resolution and events that can trigger downstream actions. |
Record consent and a useful reason
Read and select the consent checkbox for the data sharing you are authorizing. For read/write mode, the consent also covers scoped device actions and downstream events; privileged actions retain their human approval requirements. Enter Reason for change, for example Service desk device lookup, owner: IT Operations, change CHG-1042. Choose Save MCP permission, Save REST API permission, or Save Employee resolver permission and complete MFA.
Verify the saved permission and create the client credential
Check the card’s saved mode badge and Last changed timestamp, then create a named API key with only the required scopes. Tenant consent does not expand the key’s grants. For REST access, use the Base URL in API Reference; for an external client, use the approved deployment address supplied for that integration. Test a read operation before enabling a workflow that changes devices.
Connect an MCP client or employee resolver consumer
For MCP, configure your client’s remote HTTP server using the approved gateway’s /api/mcp address and an Authorization: Bearer <API key> header. Refresh the client’s discovered tool list; only tools permitted by the key and tenant mode are advertised. Start with find_endpoint using a known hostname or work email, inspect the returned endpoint, then request its experience or recent events. For Employee resolver, provision both endpoint-read and event-write scopes and use its separately approved gateway address.
Check external results and audit the change
Use a health/read request and check that the returned tenant and scopes match your intended organization. Review View integration changes in the audit log for the permission decision. For actions, inspect the resulting command, approval, event delivery, or ticket record; a successful permission save only enables access and does not demonstrate an integration run.
Disable future access when the integration is retired
Select Disabled, enter a reason, and save that surface’s permission. Revoke its API key when the credential is no longer needed. Disabling permission stops new requests; already-running device actions require cancellation in their operational view. Check the final saved badge and audit entry.
If something doesn’t work
A key exists but requests are still blocked.
Check all three controls: deployment enablement, the surface’s saved tenant permission, and the key’s scopes/expiry/revocation. Saving tenant consent does not bypass a deployment restriction.
A write request is denied with read access working.
Confirm Read and write mode and the specific write scope. Device actions may additionally need human approval; API keys cannot provide that approval.