HaloPSA Assets — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited HaloPSA Assets (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Assets (also called Configuration Items or CIs) in HaloPSA represent managed devices, software, and other trackable items. Effective asset management is crucial for MSPs to track what's deployed at client sites, manage hardware lifecycle, and link service tickets to affected equipment.
A HaloPSA asset is the PSA's record of a device — what you believe is deployed, and what it is billed and contracted under. It is not the device's live state.
is the RMM's answer, not the PSA's; use datto-rmm-devices or the equivalent device skill for your RMM. The two routinely disagree, and the PSA is the one that goes stale.
scalepad-lifecycle-manager; Halo's warranty fields are a local copy that drifts.
configuration notes are hudu-assets or itglue-configurations.
billing are halopsa-contracts; the client and site it belongs to are halopsa-clients.
An asset is always owned by a client and optionally placed at a site, assigned to a user, and covered by a contract:
| Link field | Points to | Notes |
|---|---|---|
client_id | Client | Required |
site_id | Site | Physical location |
user_id | User (contact) | Assigned end user |
contract_id | Contract | Billing/coverage |
parent_id | Asset | Parent-child (e.g. host and its VMs) |
Most-used asset fields: devicename (required), serialnumber, assettag, macaddress, ipaddress, manufacturer, model, operatingsystem, devicetype_id, status_id, purchasedate, purchaseprice, warrantyexpires, lastauditdate, inactive.
devicetype_id and status_id are configurable per instance — the shipped IDs (1 Workstation, 2 Server, ... / 1 Active, 2 Spare, 3 In Repair, 4 Retired, 5 On Order, 6 Lost/Stolen) are defaults only. Query /api/AssetType and /api/AssetStatus for the actual values before hard-coding any ID.
See references/fields.md for the complete field reference plus the default asset type and status tables.
POST /api/Asset creates when no idis present and updates when id is supplied. There is no PUT/PATCH.
bulk-update many assets in a single request.
id plus the fields being changed.<field>_before / <field>_after suffixes, e.g.warrantyexpires_before=2024-06-30&warrantyexpires_after=2024-01-01.
GET /api/Asset/5001?includedetails=true.groupby plus count=true.See references/api.md for full request/response examples covering create, search, update, bulk update, ticket/asset linking, and reports.
HaloPSA integrates with RMM tools to auto-sync assets.
When integrated with an RMM, these fields typically auto-populate and will be overwritten on the next sync — do not hand-edit them:
devicenameoperatingsystemoperatingsystemversionipaddressmacaddresslastauditdateRMM sync must resolve to an existing asset or it will create duplicates. Match in this order of confidence: RMM device ID (ncentral_device_id, datto_device_id, connectwise_device_id) → serial number → hostname scoped to the client. Hostname alone is not unique across clients.
See references/examples.md for a matchOrCreateAsset implementation.
status_id for On Order, plus client_id)user_id and site_id GET /api/Asset?purchasedate_before=2020-01-01&inactive=false GET /api/Asset?warrantyexpires_before=2024-06-30&warrantyexpires_after=2024-01-01Compare RMM inventory against PSA records and flag assets missing warranty dates, missing serials, or running an out-of-support OS. See references/examples.md for an auditClientAssets implementation and an asset-value-by-client roll-up.
| Code | Message | Resolution |
|---|---|---|
| 400 | devicename required | Asset must have a name |
| 400 | client_id required | Asset must be linked to client |
| 400 | Invalid devicetype_id | Query /api/AssetType for valid IDs |
| 404 | Asset not found | Verify asset ID exists |
| 409 | Duplicate serial number | Serial already in use |
Serial numbers are enforced unique instance-wide, so a 409 on create usually means the device already exists under another client — search before creating rather than generating a new record. See references/examples.md for a pre-flight validateAsset helper.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.