Post a Kaseya VSA 9 note on an agent
Short answer
Paste the VSA 9 server, a username, an access token, an organization id, and an agent id. A confirmed outage posts an agent note. It does not run a script.
How The Watchbill helps
- A check runs about once a minute.
- Email goes out when a check is down and when it recovers.
- Each client can have a status page that stays private until you publish it.
This guide is what to paste for Kaseya VSA 9, which permission the note needs, and what a confirmed outage writes.
On Pro or Business, open the client, then Alerting, then Remote monitoring, and choose Kaseya VSA. Paste the organization id, the VSA 9 server, the username, the personal access token, and the agent id. Confirm the note on that agent before you enable more clients.
Leave device id and the two-factor box blank. Leave the checkbox off until one agent note looks right. A confirmed outage posts a note on that agent. It does not run a script. The token is not the account password.
What you create on the VSA
VSA 9 help is public without a partner login. The REST overview says password authentication is deprecated and a personal access token is the replacement. The bearer token is limited to that VSA user's scope. Creating that token does not, on these pages, require a Kaseya partner program. An OAuth client-registration PDF describes registering a client in the VSA Server Management console. This form does not use that flow. It uses the personal access token the VSA user creates.
The personal-token page says GET /auth with Authorization: Basic of Base64 {username}:{token}. The sample client URL is {server}/api/v1.0/auth. Get Authentication shows a sample response field Result.Token. That page's header example is the deprecated username and password headers. The personal-token page does not print a separate response body. The call here reads Result.Token from the same GET /auth resource. Whether a personal-token response matches that sample was not shown on the personal-token page. Confirm a note in your VSA before you enable more agents.
What gets posted
Add Note to Agent is POST /assetmgmt/agent/{agentID}/note. The sample body is a JSON string. The note is on an agent, not on the organization. The form stores the organization id and requires the agent id. Both have to be digits. No organization-note write was found on the public VSA 9 pages in this pass, so an organization id alone is not enough.
The note text starts with [Watchbill], names the check, includes the status URL, and includes the organization id you saved. Open and recovery are two notes. HTTP 403 on the note page means the user needs function id 560206. Organizations are listed on GET /system/orgs.
Run-now, schedule, and script resources are not called. Those paths are refused before the request is sent.
Limits that were on the page
A numeric rate limit was not on the VSA 9 pages above. That limit is unverified. HTTP 429 is retried. A 401 or a 403 that is not a rate-limit response is a bad credential or a missing permission, including function id 560206. Five terminal failures turn the connection off.
The server has to be a public https host. A private address is rejected. The username and token are stored encrypted. Leave Access id and Access secret blank on a later save to keep the stored token. Paste a new token only when you rotate it.
Turn it on for one client
The checkbox is off until you check it. Each client has its own organization id, agent id, and token. There is no account-wide VSA switch. The trigger is a confirmed outage open and the matching recovery. A single failed minute does not send. A maintenance window does not send.
If the note never appears, confirm the server is the VSA 9 host, both ids are numeric, the token is a personal access token, and the user has function id 560206. Then look at the agent, not the organization record. The PSA mailbox for a ticket is a different screen, in ticket email.
What the screen shows
Before a row is saved, the line says Off. A saved connection with the checkbox clear stays Off. With the checkbox on, it says On. After failed attempts it says Off after failed attempts and shows the count. Remove deletes that client's connection and the stored token. It does not delete notes already on the agent. Those stay in VSA until someone removes them there.
The note starts with [Watchbill], says the check is down or back up, and includes the check URL, the status URL, the organization id, and a marker. Open and recovery are two notes on the same agent. There is no edit of the first note. If you need the note on a different agent, change the agent id and save. The organization id is stored with the connection and is written into the note. It is not a substitute for the agent id. A save without an agent id is rejected.
The server URL is https and a public host. A private address, a username in the URL, or a query string is rejected. Password headers from the older Get Authentication example are not sent. The Basic header on GET /auth is the username and the personal access token. The session token read from Result.Token is what the note call sends. If that field is missing, the attempt stops as a bad credential. That response shape is the password-auth sample. The personal-token page does not print its own JSON, so the first successful note is the check that the body matched.
Function id 560206 is the permission the Add Note page names for HTTP 403. A user who can open the REST screen but cannot add a note will fail here even when the token is valid. Grant that function, or use a user who already has it, and send one outage on a test agent. Five terminal failures turn the connection off. A 429 is retried. A numeric hourly cap was not on the VSA 9 pages this path uses.
How The Watchbill helps
On Pro and Business, Kaseya VSA 9 can post an agent note when a confirmed outage opens and when it closes. It stays off until that client turns it on. It posts a note. It does not run scripts. The token is the personal access token from VSA 9 help, limited to that user's scope.
Sources
Checked 12 Oct 2026.