How to Setup HaloPSA Notifications

ZoneWatcher connects to HaloPSA using an API application with Client ID and Secret authentication. This lets ZoneWatcher create tickets on your behalf without using a personal login.

To create the API application in HaloPSA:

1. In HaloPSA, go to Configuration → Integrations → HaloPSA API
2. Click View Applications, then New
3. Name the application something descriptive like "ZoneWatcher Integration"
4. Set the Authentication Method to Client ID and Secret (Services)
5. Copy the Client ID and Client Secret immediately — the secret is only shown once
6. Select a HaloPSA agent for the application to act as (tickets will be logged by this agent)
7. On the Permissions tab, grant all permissions, or at minimum read and edit access to tickets plus read access to customers (used to load your clients, teams, and priorities into ZoneWatcher's mapping dropdowns)

Your Endpoint URL is the address you use to access HaloPSA, e.g. https://your-instance.halopsa.com.

If you are on a hosted HaloPSA instance (your URL ends in halopsa.com), you also need your Tenant name — this is usually the subdomain of your instance (the your-instance part of the URL). It is shown on the HaloPSA API integration page as "Tenant". Self-hosted (on-premise) instances can leave the tenant field empty.

ZoneWatcher allows you to create unlimited Notification Channels, which can be customized to file tickets differently in HaloPSA.

Once you have your credentials, you can create a new Notification Channel by providing:

1. Channel Name: A descriptive name like "HaloPSA Tickets"
2. Endpoint URL: Your HaloPSA address (e.g., https://your-instance.halopsa.com)
3. Client ID and Client Secret: From the API application you created above
4. Tenant: Your tenant name (hosted instances only)

As soon as your credentials are entered, ZoneWatcher loads the ticket types, clients, teams, and priorities from your own HaloPSA instance so you can choose exactly how tickets are filed:

• Ticket Type (required): The HaloPSA ticket type new tickets are created with (e.g. Incident)
• Client / Customer (strongly recommended): The HaloPSA client tickets are filed against. Some HaloPSA instances reject tickets that have no client, so only leave this empty if your instance has a default client configured
• Team (optional): Route new tickets straight to a specific team's queue
• Priority Mapping (optional): Map ZoneWatcher's severity levels (Critical, High, Medium, Low) to your own HaloPSA priorities. Unmapped severities use your ticket type's default priority

Tip for MSPs: combine the Client setting with the channel's Provider Filter to give each customer their own ticket routing — create one channel per customer, pick their DNS providers in the filter, and file their tickets against their HaloPSA client.

When a DNS event occurs, ZoneWatcher will automatically create a HaloPSA ticket with:

• Summary: A concise title describing the event (e.g., "example.com DNS changes detected")
• Details: Full information about the DNS event, including a link back to the affected zone in ZoneWatcher
• Ticket Type, Client, Team, and Priority: Applied from your channel's mapping configuration

You can also customize which events you want to receive notifications for. Current events include:

• Zone Changed
• New Zone Discovered
• Zone Expiring Soon
• Zone Expired
• Zone Renewed
• Zone Nameservers Changed
• Zone Certificate Issued
• Zone Certificate Expiring Soon
• Zone Listed on Blocklist
• Zone Removed from Blocklist
• Provider Auto-Disabled
• Changeset Submitted
• Changeset Cancelled
• Changeset Schedule Reminder
• Changeset Approval Requested
• Changeset Approved
• Changeset Rejected
• Changeset Applied
• Changeset Failed
• Changeset Rolled Back
• Changeset Conflict Detected
• Changeset Propagated
• Changeset Propagation Timeout
• Changeset Rollback Failed

If ticket creation fails repeatedly (for example after credentials are revoked), ZoneWatcher automatically disables the channel after five consecutive failures and emails your team admins, so failures never go unnoticed.

• Credentials are stored encrypted in ZoneWatcher's database
• Create a dedicated API application for ZoneWatcher rather than reusing one across integrations
• Assign the API application to a dedicated service agent so ticket activity is clearly attributable
• Regularly rotate your client secret for enhanced security
• Monitor your HaloPSA audit logs for any unexpected activity