Skip to content
Chinron
Integrations

API & Integrations

Chinron's public REST API lets you onboard clients, sync their users from your PSA, launch their training, and pull training, phishing, and risk reporting back into your own dashboards — without logging into each client individually.

What the API does

It covers client onboarding end-to-end: register a client, provision its users, launch its training program, and pull reporting. Every client org your key is authorised for can be created, listed, onboarded, updated, and offboarded, its training program triggered, and its training-completion, phishing-simulation, and human-risk results read back.

It does not expose billing or Stripe controls — those stay behind the portal login by design, so a leaked key can't move money on your behalf. Scopes gate every key, so you can issue read-only or reporting-only keys where that's all an integration needs.

Getting a key

Generate one from MSP Settings → General → API Access. The key is shown once — store it in your automation platform's secret store, not in a script. Regenerating a key immediately revokes the previous one, so rotate during a maintenance window if you have integrations depending on it.

Reference docs

Full endpoint reference, request/response schemas, and error codes:

Interactive API docs OpenAPI spec (.yaml)

The spec URL can be imported directly into Postman, Rewst, or n8n's HTTP node for auto-generated request templates.

What integrations do

  1. Onboard a new client. A signed-agreement event becomes a POST /clients call — creates the client org, invites its admin, and inherits your branding. Idempotent on name, so re-runs are safe.
  2. Discover clients. GET /clients lists every org your key can act on. Map each one to its PSA company once — you don't need to hardcode IDs anywhere.
  3. Onboard / offboard on ticket events. A new-hire ticket becomes a POST /clients/{clientId}/users call (safe to retry — it's idempotent on email). An offboarding ticket looks the user up by email, then deactivates.
  4. Launch training. POST /clients/{clientId}/training-paths spins up a full year of training plus paired phishing and deepfake paths — the same build the portal wizard runs.
  5. Pull reporting on a schedule. Training completion, phishing results, and risk scores are all read-only GET calls — loop over your clients monthly and feed the numbers into your own QBR deck or PSA dashboard.

Your PSA / RMM

How you wire this up depends on what you run. Pick your platform:

HaloPSA

Native

Custom Integrations module calls the API directly — no middleware needed.

View guide →

ConnectWise PSA

Via middleware

Wire it up with Rewst, n8n, or Make in a few minutes.

View guide →

NinjaOne

Reporting only

Use directory sync for users; the API is for pulling reports into your RMM dashboards.

View guide →

Running Kaseya BMS/VSA? The API works the same way as any middleware integration below — point Rewst or n8n's Kaseya connector at our REST endpoints. We don't maintain a dedicated Kaseya connector at this time; email support@chinron.io if you'd like help wiring one up.

Rate limits & retries. Requests are limited per key (600/min by default). Responses include X-RateLimit-Remaining; a 429 includes Retry-After. Build your automation to honour it rather than retrying blind.
Portfolio Reporting Back to MSP Help Center