RMM & Endpoint

Kaseya VSA 10

Run the Kaseya VSA 10 fleet conversationally - telemetry, alert triage, and approval-gated remediation through scripts, tasks, and workflows.

Dex connects to Kaseya VSA 10 (the new VSA platform, REST API v3, formerly VSA X) so admins can run the endpoint fleet in plain language - browse device telemetry and inventory, triage alerts, and remediate through the scripts, tasks, and workflows that already live in VSA 10, every run approval-gated. It also covers organization, site, group, and custom-field administration. Kaseya VSA 10 is a different product from classic VSA 9 (the separate Kaseya VSA app). Available as an MSP global app: one shared third-party API token, with each managed tenant scoped to its numeric organization id. Dex Go self-service is off by default; when an admin turns it on, employees can check their own device and request approved fixes.

Start free →

What Dex does with Kaseya VSA 10

Dex handles both admin workflows and employee self-service — all policy-guardrailed and audit-logged.

For admins (Dex Pro)

Browse fleet health and telemetry - online state, uptime, maintenance mode, IPs, agent version, CPU, memory, disks, installed software, and pending updates
Triage alerts (notifications) across every device the token sees, by priority and device
Proactively find alerts that produced no PSA ticket by comparing each organization's PSA mapping and notification threshold
Remediate through existing scripts, tasks, and workflows on named devices - every run approval-gated with the device, Identifier, and organization quoted
Clear alerts and optionally complete the linked PSA ticket, or raise a custom alert - with approval
Administer organizations, sites, groups, and custom field values - with approval
Read antivirus status, applied patch and endpoint protection policies, scopes, and the audit log
Deploy as an MSP global app - one shared third-party token, each managed tenant scoped to its numeric organization id

For employees (self-service)

Check whether your own computer is online, how long it has been up, and its open alert counts
See your machine's CPU, memory, disk space, pending updates, antivirus, and firewall status
Review the open alerts on your own device in plain words
Run an IT-provided self-service fix script or task on your own computer - with approval

Just ask Dex

Your team types a request in plain language. Dex investigates, plans, and executes — with the right guardrails.

Admin prompts

>Which devices are offline right now, and which have critical alerts open?
>Show me the telemetry for LAPTOP-42 - disk space, pending updates, and antivirus status
>Find recent critical alerts that produced no PSA ticket and tell me the likely cause
>Run the "Restart computer" script on LAPTOP-42 in the Contoso organization
>List the automation workflows and which are enabled

Employee prompts

>Is my laptop online, and how long has it been up?
>My disk is almost full - how much free space is left and what updates are pending?
>Is my antivirus on and up to date?
>Please run the approved cleanup fix on my computer

Policy actions

Every action Dex can take on Kaseya VSA 10 is declared, scoped, and guardrailed. Admins control which apply, who approves them, and whether they're limited to self-service.

Action	What it does	Guardrails
`kaseya_vsa10_list_devices`	List or search devices by name, group, site, organization, or agent state	self-only
`kaseya_vsa10_get_device`	Read one device: online state, uptime, maintenance mode, IPs, agent version, alert counts	self-only
`kaseya_vsa10_get_device_assets`	Read one device's full telemetry and inventory, including installed and available updates	self-only
`kaseya_vsa10_list_device_notifications`	List one device's alerts with priority and time	self-only
`kaseya_vsa10_get_device_antivirus`	Read one device's antivirus status	self-only
`kaseya_vsa10_list_notifications`	List alerts across every device the token sees	—
`kaseya_vsa10_clear_notification`	Clear (delete) an alert; with completePsaTicket=true it also completes the linked PSA ticket	approval
`kaseya_vsa10_create_notification`	Raise a custom alert for a published device instance	approval
`kaseya_vsa10_run_script`	Run a script on one online device with optional variable values (remediation)	approval
`kaseya_vsa10_run_task`	Run an automation task on named devices (a non-empty DeviceIdentifiers list is required)	approval
`kaseya_vsa10_run_workflow`	Run an automation workflow on named devices (a non-empty DeviceIdentifiers list is required)	approval
`kaseya_vsa10_cancel_workflow_executions`	Cancel running workflow executions	approval
`kaseya_vsa10_move_device`	Move a device to another group (can move it to another organization) - disabled by default	approval
`kaseya_vsa10_publish_device`	Register or update a custom (non-agent) device instance in a group - disabled by default	approval
`kaseya_vsa10_create_organization`	Create an organization (optionally with team access and a PSA mapping)	approval
`kaseya_vsa10_update_organization`	Rename an organization, change its type or team access (admin change)	approval
`kaseya_vsa10_delete_organization`	Delete an organization and everything under it - disabled by default	approval
`kaseya_vsa10_create_site`	Create a site in an organization	approval
`kaseya_vsa10_update_site`	Rename a site or change its contact information	approval
`kaseya_vsa10_delete_site`	Delete a site and its groups - disabled by default	approval
`kaseya_vsa10_create_group`	Create a device group in a site	approval
`kaseya_vsa10_update_group`	Rename a group or change its notes	approval
`kaseya_vsa10_delete_group`	Delete a device group - disabled by default	approval
`kaseya_vsa10_assign_custom_field`	Assign a custom field value to an organization, site, group, or device	approval
`kaseya_vsa10_update_assigned_custom_field`	Change an assigned custom field value	approval
`kaseya_vsa10_unassign_custom_field`	Remove a custom field assignment (its value is lost) - disabled by default	approval
`kaseya_vsa10_create_notification_webhook`	Create a webhook that sends alerts to an outside URL (data export) - disabled by default	approval
`kaseya_vsa10_update_notification_webhook`	Change a webhook's target URL, headers, priorities, or organizations (data export) - disabled by default	approval
`kaseya_vsa10_regenerate_notification_webhook_secret`	Regenerate a webhook's signing secret (returns the new secret) - disabled by default	approval
`kaseya_vsa10_delete_notification_webhook`	Delete a notification webhook (stops alert delivery to that target) - disabled by default	approval

How to configure Kaseya VSA 10

Onboarding takes minutes. Dex validates your credentials before saving them.

Setup steps

1
In Kaseya VSA 10, go to Configuration > API Access > Third-Party Tokens > Add. Name it "Dex", set an expiry date and, if known, an IP allow-list.
2
Grant the token only the organizations Dex should manage, and the endpoint permissions you need: devices, assets, notifications, automation scripts/tasks/workflows, organizations/sites/groups, custom fields, scopes, patch management, endpoint protection, and audit logs. Leave notification webhooks and group packages off unless needed.
3
Copy the Token ID and the Token Secret (the secret is shown once at creation).
4
In Dex, enable the Kaseya VSA 10 integration and enter the server host, Token ID, and Token Secret.
5
Dex validates the token with a live read before saving. For MSPs, leave organization_id blank on the master connection and set each child tenant to its numeric organization id.

Credentials required

server_url: VSA 10 server host - <name>.vsax.net (SaaS) or the public DNS name of an on-prem VSA 10 server (HTTPS, port 443). Host only.
token_id: The third-party token's Token ID
token_secret: The third-party token's Token Secret (shown once at creation)
organization_id: Blank for an MSP master or single company, or the numeric organization Id of this child tenant (per-tenant MSP scoping)

Requirements

•A Kaseya VSA 10 account (the new VSA platform / VSA X, REST API v3) - not classic VSA 9, which is the separate Kaseya VSA app
•A third-party API token with the endpoint permissions and organization access Dex needs - the token's permissions are the ceiling for reads, which Dex cannot gate
•Remediation runs through scripts, tasks, and workflows that already exist in VSA 10 - there is no public reboot, patch-install, or remote-control endpoint
•On a scoped child connection, writes and org-wide alerts are refused; remediation runs from the MSP master connection
•For MSPs, the integration deploys as a global app with per-tenant scoping by organization id

Related integrations

See Dex run Kaseya VSA 10

Book a 30-minute walkthrough with our team and see how autonomous IT works in your environment — or get started for free.

Start free →Browse all integrations →