NinjaRMM integration

In xClause this integration is labeled NinjaRMM on the integration card and NinjaOne in some messages. They are the same product.

What it does

The NinjaRMM integration connects xClause to your NinjaOne instance with a NinjaOne API application (Client ID and Client Secret). It is read-only. xClause never writes to NinjaOne.

Imports NinjaOne organizations as xClause clients. You choose which organizations to import, and which of their users become client users, from the Manage drawer on the integration card.
Keeps imported clients current. Every 6 hours, and whenever you click Sync all, xClause refreshes devices, sites (NinjaOne locations), and optionally alerts for the organizations you have already imported.
Stores your device list per client. Device counts by type are available as a source when you import line items into a SOW. This is off until you turn on NinjaRMM as a source under your SOW integration settings.
Shows counts on the card: Total Devices, Total Organizations, and Total Alerts (alerts that are not yet resolved).

Sync never creates new xClause clients on its own. A NinjaOne organization only becomes an xClause client when you select it in Manage.

Before you start

In xClause

You need a plan that includes PSA integrations. If yours does not, connecting fails with a message in the form PSA integrations are not available on your <plan> plan. Upgrade to Pro to connect integrations. The Free and MSP Starter plans do not include them.
The Integrations settings page is not available on the MSP Starter plan unless your account has been given integrations access. In that case opening Settings > Integrations sends you to the billing page.
You must be signed in as a user who belongs to your MSP company. The connect action checks company membership only. It does not check for an admin role.

In NinjaOne

Permission to create an API application under Administration > Apps > API.
To know which NinjaOne instance you sign in to: app.ninjarmm.com (US), us2.ninjarmm.com (US2), eu.ninjarmm.com (EU), ca.ninjarmm.com (CA), or oc.ninjarmm.com (OC). Credentials from one instance do not work on another.

Connect

NinjaRMM lives under Settings > Integrations, on the NinjaRMM tile (category PSA & RMM).

In NinjaOne, go to Administration > Apps > API and click Add.
Set Application platform to API Services (machine-to-machine).
Under Allowed grant types, check Client credentials. NinjaOne pre-selects Authorization code. xClause connects server-to-server, so enable Client credentials. You can leave Authorization code unchecked.
Leave Redirect URIs blank. xClause never uses one. If NinjaOne refuses to save without it, enter any valid URL. It is never called.
Under Scopes, enable Monitoring. That is the only scope xClause requests. Management and Control are not needed.
Click Add, then copy the Client ID and Client Secret right away. NinjaOne shows the secret only once.
In xClause, open Settings > Integrations and open the NinjaRMM tile.
Click Connect to NinjaRMM.

Fill in the fields:

Field	What to enter
Client ID (required)	The Client ID from step 6.
Client Secret (required)	The Client Secret from step 6.
Region	The instance you sign in to. The options are US (app.ninjarmm.com), US2 (us2.ninjarmm.com), EU (Europe) (eu.ninjarmm.com), CA (Canada) (ca.ninjarmm.com), and OC (Oceania) (oc.ninjarmm.com). The default is US.

Click Connect. xClause requests an access token and makes a test call to NinjaOne. On success you see NinjaOne connected! Use "Manage" to import clients and users, or Sync all.

To change the credentials or region later, click Update connection on the card and submit the form again.

To choose what to import:

On the connected card, find the Clients & users section and click Manage.
Optional: turn on Keep picked clients' contacts updated on each NinjaOne sync if you want new contacts imported automatically on later syncs. The list of NinjaOne orgs shows either way, and nothing is imported until you pick it.
Expand an organization. Tick Import this org as a client.
For its users, choose Import everyone, select individual people, or choose no users. A user whose email already belongs to a non-client xClause account is shown as locked and is not imported.
Click Save.

Permissions the API account needs

xClause requests one OAuth scope, exactly this string: monitoring. It sends it in a client_credentials token request to /ws/oauth/token on your NinjaOne instance. The in-app instructions state that Monitoring is the only scope needed and that Management and Control are not.

Every NinjaOne data call is an HTTPS GET to /api/v2/....

NinjaOne area	What xClause does there	Read or write
Token endpoint (`POST /ws/oauth/token`)	Gets an access token with your Client ID and Client Secret. The token request is a POST, but it only authenticates. It does not change NinjaOne data. xClause requests a new token the same way when the old one expires.	Authentication only
Organizations (`GET organizations`)	Tests the connection, lists organizations for Manage, finds the organizations to refresh during sync, and fills Total Organizations.	Read
Devices (`GET devices`, filtered by organization)	Reads each imported organization's devices: ID, system name, device type, status, last seen, location, operating system name and version, serial number. Fills Total Devices.	Read
Users (`GET users`, filtered by organization)	Reads the people in each organization (name, email, ID) for the Manage drawer and for contacts you chose to import.	Read
Locations (`GET organization/{id}/locations`)	Reads each imported organization's locations (name, address, phone, notes, active flag) as client sites.	Read
Alerts (`GET alerts`)	Reads alerts (ID, severity, message, trigger and resolve times, device and organization) when Sync alerts from NinjaRMM is on.	Read

xClause makes no POST, PUT, PATCH, or DELETE calls to NinjaOne data endpoints.

What syncs, and which direction

All data flows from NinjaOne to xClause.

Data	What xClause stores	Trigger
Organizations	Imported as xClause clients: name, address, city, state, postal code, country, phone, website, notes. xClause also saves the NinjaOne organization ID in the client's Tax ID field and uses it to match the client on later syncs.	You select an organization in Manage and click Save. xClause matches an existing client by name or by that ID, and updates it. Otherwise it creates one.
Users	Client user records (contact only by default), for the people you selected in Manage.	Sync all and the 6-hour sync, for imported clients.
Locations	Client sites.	Sync all and the 6-hour sync, only when Sync sites from NinjaRMM is on.
Devices	A device list per client (type, status, last seen, OS, serial number, location).	Sync all and the 6-hour sync, only when Sync devices from NinjaRMM is on.
Alerts	Alert records.	Sync all and the 6-hour sync, only when Sync alerts from NinjaRMM is on. This switch is off by default.

The scheduled sync runs every 6 hours for every connected NinjaRMM account. It does the same work as Sync all. Neither one imports new organizations. Only organizations you have already imported through Manage are refreshed.

The integration settings on the card:

Setting	What it does
Sync devices from NinjaRMM	On by default. When on, sync imports managed devices.
Sync sites from NinjaRMM	On by default. When on, sync imports locations as client sites.
Sync alerts from NinjaRMM	Off by default. When on, sync imports alerts.

When a manual sync finishes you see a summary such as Sync completed: 4 sites updated, 120 devices synced, or Sync completed — no changes needed.

Limits to know about:

Total Devices and Total Organizations on the card are counted from the first 100 results only.
If you change a client's Tax ID in xClause, sync can no longer match that client to its NinjaOne organization.
Importing an organization into an existing client with the same name overwrites that client's address, phone, website, notes, and Tax ID with the NinjaOne values.

Troubleshooting

What you see	What it means and what to do
Enter both the Client ID and Client Secret to connect.	Both fields are required.
PSA integrations are not available on your <plan> plan. Upgrade to Pro to connect integrations.	Your plan does not include PSA integrations. Upgrade, or contact support.
Failed to connect to NinjaOne. Please verify the region and try again.	xClause could not reach the instance. Check that Region matches the domain you sign in to.
Invalid Client ID or Client Secret	NinjaOne rejected the credentials. Re-copy them. If you lost the secret, create a new API application, because NinjaOne shows the secret only once.
API credentials do not have required permissions	The API application is missing the Monitoring scope. Enable it in NinjaOne and try again.
NinjaOne did not recognize this app. Create an API application in NinjaOne: Administration → Apps → API, then use that app's Client ID and Client Secret here.	The Client ID is not valid on the selected instance. Check the Region, and make sure you used the ID from an API Services (machine-to-machine) application.
Failed to obtain NinjaOne access token. Please check your credentials.	NinjaOne rejected the token request. Check the credentials, the Client credentials grant type, and the Region.
NinjaOne did not return an access token	NinjaOne answered without a token. Check the grant type and scope on the API application.
Invalid API key or unauthorized access, API key does not have required permissions, or Failed to connect to NinjaOne instance	The token was issued, but the test call to `organizations` failed. Check that Monitoring is enabled and the Region is correct.
NinjaRMM not connected or inactive	Sync was requested but no active connection exists. Connect or Update connection.
Failed to sync with NinjaRMM	A server-side error during sync. Try again. If it repeats, update the connection. If that does not help, contact support.
Sync completed with N errors. Check console for details.	The sync finished but some items failed. The details are in your browser's developer console.
We couldn't save your sync settings — check your connection and try again.	The toggle did not save and has reverted. Try again.
We couldn't load your NinjaRMM connection status — check your connection and refresh.	xClause could not read the status. Refresh the page.
Could not list orgs or Could not import the org — check the connection.	The Manage drawer could not read from NinjaOne. Click Refresh in the drawer. If it keeps failing, update the connection.
No organizations are refreshed by Sync all	Only organizations you imported through Manage are refreshed. Import them first.

Disconnecting

On the NinjaRMM card, click Disconnect.
Confirm the prompt: Are you sure you want to disconnect from NinjaRMM? This will remove all integration settings.

xClause deletes the saved NinjaRMM connection. That includes the access token, refresh token, Client ID, Client Secret, region, and sync settings. Scheduled syncs stop for your account.

The disconnect action removes only that connection record. It does not delete the clients, users, sites, devices, or alerts already imported into xClause, and it does not change anything in NinjaOne. You may also want to delete the API application in NinjaOne. xClause does not do that for you. To connect again, use Connect to NinjaRMM and enter the credentials again.