HaloPSA Clients — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited HaloPSA Clients (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Clients (customers) are the foundation of HaloPSA. All tickets, contracts, assets, and invoices are associated with clients. Proper client data management is critical for accurate service delivery and billing.
HaloPSA calls end-user contacts Users. That word does not mean a HaloPSA login, and it does not mean a technician.
entity with its own IDs; use halopsa-agents. Assigning a ticket needs an agent_id, never a user_id.
ConnectWise company, or an Autotask company is a different record with different required fields; use freshdesk-contacts-companies, connectwise-psa-companies, or autotask-crm. Do not assume IDs or domains map across.
identity questions are cipp-users or cipp-mailboxes; a HaloPSA User is a CRM contact record with no directory presence.
are halopsa-contracts; what they have been billed is halopsa-invoices.
Three linked entities make up the CRM layer:
| Entity | Endpoint | Key relationship |
|---|---|---|
| Client | /api/Client | Root record; owns sites, contacts, tickets, assets, contracts |
| Site | /api/Site | client_id -> Client; one site may be flagged main_site |
| Contact (User) | /api/Users | client_id -> Client, optional site_id -> Site |
Most-used client fields: id, name (required), emailaddress, phonenumber, website, accountmanager_id, inactive, client_to_invoice, toplevel_id. Most-used contact fields: name (required), client_id (required), site_id, emailaddress, jobtitle, isimportantcontact, inactive.
Clients are classified (Customer, Prospect, Lead, Partner, Vendor) via custom fields and categories rather than a built-in type enum.
See references/fields.md for the complete field reference for clients, sites, contacts, and client types.
HaloPSA supports parent-child client relationships via two separate fields:
client_to_invoice — the client that receives the invoicetoplevel_id — the top-level parent in the reporting hierarchySet both when a child should both roll up for reporting and bill to the parent.
POST /api/Client (also /api/Site,/api/Users) creates when no id is present and updates when id is supplied. There is no PUT/PATCH.
you batch multiple creates/updates in one request.
id plus the fields you are changing.GET /api/Client/123?includesites=true&includeusers=true.page_no, page_size, order, orderdesc.See references/api.md for full request/response examples covering client, site, and contact create/search/update.
Search for an existing record by name or email before each create step — HaloPSA does not enforce uniqueness on client names or contact emails across clients. See references/examples.md for a contact-onboarding routine that does the duplicate check.
When a client churns:
[{ "id": 123, "inactive": true }]Never delete a client that has related records — HaloPSA returns 409 and deactivation is the supported path.
| Code | Message | Resolution |
|---|---|---|
| 400 | Name is required | Client must have a name |
| 400 | Invalid client_id | Parent client doesn't exist |
| 400 | Duplicate email | Contact email already in use |
| 404 | Client not found | Verify client ID |
| 409 | Cannot delete - has related records | Deactivate instead |
See references/examples.md for client validation and duplicate-detection helpers.
GET /api/Client?hasusers=false&inactive=falseGET /api/Users?emailaddress=null&inactive=falseDuplicate client names are not detectable via a query parameter — fetch and normalize names client-side (see references/examples.md).
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.