Security & Backup

Wasabi

Read Wasabi Sub-Account profile, storage utilization, and invoices through the Account Control API - with scoped admin writes behind approval.

Dex connects to the Wasabi Account Control API (WACA) so admins can run Sub-Account administration conversationally - read a Sub-Account profile, check storage and per-bucket utilization, and review invoices. Scoped writes let admins update a Sub-Account (rename, FTP, trial quota, or reset MFA and access keys) behind inline approval, and create a new Sub-Account from the MSP master. Deployed as an MSP global app: one Control Account WACA API key is shared, and each Dex tenant is confined to its own Wasabi Sub-Account by AcctNum. The Wasabi S3 data-plane is out of scope, and deleting a Sub-Account is not offered through Dex.

Start free →

What Dex does with Wasabi

Dex handles both admin workflows and employee self-service — all policy-guardrailed and audit-logged.

For admins (Dex Pro)

Read a Wasabi Sub-Account profile by AcctNum (path-forced on a scoped child)
Check storage utilization for the Sub-Account, including per-bucket breakdowns
Review Sub-Account invoices and look up a specific invoice
List every Sub-Account from the MSP master connection
Update a Sub-Account - rename, toggle FTP, set trial quota, or reset MFA and access keys - with approval
Create a new Sub-Account from the MSP master - with approval
Deploy as an MSP global app - one Control Account WACA key, each customer confined to its Wasabi Sub-Account by AcctNum

Just ask Dex

Your team types a request in plain language. Dex investigates, plans, and executes — with the right guardrails.

Admin prompts

>What is the current storage utilization for this tenant's Wasabi Sub-Account?
>Show me the per-bucket utilization breakdown for this Sub-Account
>List the recent invoices for this Wasabi Sub-Account
>Pull up the Sub-Account profile and confirm the AcctNum on file
>Rename this Sub-Account and enable FTP access

Policy actions

Every action Dex can take on Wasabi is declared, scoped, and guardrailed. Admins control which apply, who approves them, and whether they're limited to self-service.

Action	What it does	Guardrails
`wasabi_list_accounts`	List every Wasabi Sub-Account (MSP master connection only)	—
`wasabi_get_account`	Read one Wasabi Sub-Account by AcctNum (path-forced on a scoped child)	—
`wasabi_list_utilizations`	Read storage utilization for this Sub-Account (path-forced)	—
`wasabi_list_bucket_utilizations`	List per-bucket utilizations for this Sub-Account (path-forced)	—
`wasabi_get_bucket_utilization`	Read one bucket utilization under this Sub-Account (path-forced)	—
`wasabi_list_invoices`	List invoices for this Sub-Account (path-forced)	—
`wasabi_get_invoice`	Read one invoice under this Sub-Account (path-forced)	—
`wasabi_create_subaccount`	Create a Wasabi Sub-Account (MSP master only) - billing impacting	approval
`wasabi_update_subaccount`	Update this Sub-Account (name, FTP, trial quota) or reset its MFA / access keys	approval

How to configure Wasabi

Onboarding takes minutes. Dex validates your credentials before saving them.

Setup steps

1
Confirm Wasabi has enabled Account Control (WACA) access on your Control Account - contact Wasabi Sales if needed.
2
On the Control Account, generate a WACA API key for Dex. Keep it secret and rotate via Wasabi if breached.
3
In Dex, enable the Wasabi integration and paste the Control Account WACA API key. Leave account_number blank on the MSP master.
4
Run discovery from the MSP master to look up each tenant's AcctNum via GET /v1/accounts.
5
On each tenant's own connection, set account_number to that tenant's Wasabi Sub-Account AcctNum so Dex confines every call to it.

Credentials required

api_key: Wasabi Control Account WACA API key, sent as the raw Authorization header value (secret, never Bearer, never in the query string)
account_number: This tenant's Wasabi Sub-Account AcctNum (positive integer, e.g. 30059) - leave blank on the MSP master, set it on the tenant connection once discovered

Requirements

•A Wasabi Control Account with WACA access enabled and a Control Account WACA API key
•Each Dex tenant mapped to exactly one Wasabi Sub-Account by AcctNum - a child connection must have a non-blank account_number or it resolves the master unscoped
•The Wasabi S3 data-plane (object CRUD on wasabisys S3 endpoints) is out of scope
•Sub-Account create and suspend / convert-to-paid are MSP-master only; deleting a Sub-Account is not offered through Dex