API & integrations

Integrate Xcellerate RMM with PSA tools, documentation platforms, and custom workflows via the REST API.

Overview

Xcellerate RMM exposes a comprehensive REST API that lets you read and write nearly every resource in the platform programmatically — endpoints, groups, patches, scripts, alerts, users, and more. The API uses JSON over HTTPS and follows standard REST conventions.

In addition to the raw API, Xcellerate includes built-in integration connectors for popular PSA (Professional Services Automation) and documentation tools. These connectors sync data bidirectionally so you do not have to build custom integrations for common workflows.

The API documentation browser with endpoint list and try-it-out panel

Key concepts

API key — a token used to authenticate API requests. Generated per user from the Administration page. Include it in the Authorization: Bearer <key> header.
REST endpoint — a URL path that maps to a resource (e.g. GET /api/v1/endpoints returns all endpoints, POST /api/v1/scripts/{id}/run executes a script).
Webhook — a callback URL that Xcellerate calls when a specific event occurs (e.g. alert fired, patch installed, endpoint enrolled). Use webhooks to trigger external workflows in real time.
Integration connector — a pre-built bridge to a third-party tool (ConnectWise, Autotask, HaloPSA, IT Glue, Hudu). Configured with credentials and sync rules.
Rate limit — the API enforces a rate limit of 60 requests per minute per API key. Exceeding it returns a 429 Too Many Requests response.

Step-by-step walkthrough

Generate an API key

Go to Administration → API keys → New key. Name the key (e.g. "PSA sync"), select the user it belongs to, and choose the permission scope (full access or read-only). Click Generate. Copy the key immediately — it is shown only once.

Explore the API docs

Navigate to Administration → API → Documentation (or visit https://your-server/api/docs). The interactive documentation lists every endpoint with request/response examples and a Try it button.

Make your first API call

Use any HTTP client (curl, Postman, your favourite language). Example: curl -H "Authorization: Bearer YOUR_KEY" https://your-server/api/v1/endpoints returns a JSON array of all endpoints.

Set up a webhook

Go to Administration → Webhooks → New webhook. Enter the destination URL, select the events to subscribe to (e.g. alert.created, endpoint.enrolled), and optionally add a secret for signature verification. Save.

Configure a PSA connector

Navigate to Administration → Integrations. Click the connector for your PSA tool (e.g. ConnectWise Manage). Enter the API URL, credentials, and mapping rules (which Xcellerate fields map to which PSA fields). Click Test connection, then Enable sync.

Webhook configuration with event selection and delivery log

Example: creating an endpoint via API

curl -X POST https://your-server/api/v1/endpoints \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "hostname": "WS-LONDON-042",
    "group_id": "grp_abc123",
    "os": "Windows 11",
    "tags": ["london", "sales"]
  }'

Tips & best practices

Create separate API keys for each integration or script — if one is compromised, you can revoke it without affecting others.
Use read-only scope for keys that only need to fetch data (reporting, dashboards).
Implement webhook signature verification on the receiving end to prevent spoofed events.
Respect the rate limit (60 req/min). For bulk operations, use the batch endpoints or add a delay between requests.
Test PSA connector mappings in a sandbox/test environment before enabling sync in production to avoid duplicate tickets.
Monitor the webhook delivery log for failed deliveries — they may indicate the receiving server is down or rejecting payloads.

The API supports pagination via ?page=1&per_page=50 query parameters. Always paginate when fetching large datasets to avoid timeouts.

Backup & recovery