Overview

The HaloPSA integration makes DMARC Report a native part of your PSA workflow. Once connected, it works in both directions:

  • Auto-provisioning — creating a client in HaloPSA automatically creates a matching monitored team in DMARC Report.
  • Self-closing tickets — DMARC, SPF, DKIM, BIMI, and deliverability alerts open a HaloPSA ticket and close it automatically when the condition clears.
  • DNS onboarding tickets — adding a domain opens a “DNS Setup Required” ticket containing the exact record the client must publish; it auto-closes once the record is detected.
  • Billing sync — monitored domains and power-ups sync to HaloPSA as client subscriptions, priced with your own markup.
  • Automatic routing — a one-time team→customer mapping files every alert, ticket, and subscription under the right HaloPSA customer.

Before you begin

  • A DMARC Report account with access to the Integrations page (under Alerts).
  • Administrator access to your HaloPSA instance.

Step 1 — Create a HaloPSA API application

  1. In HaloPSA, go to Configuration → Integrations → HaloPSA API.
  2. Create a new API application using the Client Credentials authentication method.
  3. Grant it access to the all scope (or at minimum: read/write Tickets, Clients, and Software Licences).
  4. Copy the Client ID and Client Secret, and note your HaloPSA API URL (for example, https://yourcompany.halopsa.com).

Step 2 — Add the integration in DMARC Report

  1. In DMARC Report, open Alerts → Integrations and click Add integration.
  2. Choose HaloPSA.
  3. Enter your HaloPSA URL, Client ID, and Client Secret. Optionally set a Tenant (hosted/multi-tenant Halo only) and a Default customer ID to file unmapped tickets under.
  4. Save. Use Send test to confirm the connection works.

Step 3 — Map your teams to HaloPSA customers

Each DMARC Report team maps to one HaloPSA customer, so alerts and tickets file under the right client everywhere.

  1. On the HaloPSA integration, click Map customers.
  2. Choose the Ticket type new alert tickets should open as (e.g. Incident).
  3. For each team, pick its matching HaloPSA customer, then click Save mapping.
  4. Click Sync now to pull in your existing HaloPSA clients — a DMARC Report team is created for each one. This is idempotent: re-run it any time and only new clients are added.

Step 4 (optional) — Auto-provision new clients

Have a new HaloPSA client automatically become a monitored team the moment it’s created.

  1. On the HaloPSA integration, turn on Auto-provisioning and save.
  2. DMARC Report shows a Payload URL and a Secret. Copy both.
  3. In HaloPSA, go to Configuration → Integrations → Webhooksand add a webhook:
    • URL: the Payload URL from DMARC Report.
    • Authentication: Sign Request Body with a Secret Key; paste the Secret; algorithm SHA-256.
    • Event: Client created.

Note: if you change the webhook URL in HaloPSA later, Halo clears the secret — re-paste it from DMARC Report.

Step 5 (optional) — Enable billing sync

Push monitored domains and power-ups to HaloPSA as a subscription per client.

  1. On the Map customers page, turn on Enable billing sync.
  2. Under Your client prices, enter what you charge your client for monitoring and each power-up (Unlimited volume, SPF flattening). The preview shows each customer’s bill, your DuoCircle cost, and your margin.
  3. Click Push billing to HaloPSA. A subscription is created or updated for every mapped customer; removed items are zeroed automatically.

What you pay DuoCircle is shown for reference only and is never sent as the client’s price.

What the tickets look like

  • Alert tickets open at the alert’s severity and close automatically when the underlying issue is resolved — no manual cleanup.
  • DNS Setup Required tickets carry the exact DNS record the client must publish and close automatically once DMARC Report detects it live.

Troubleshooting

  • “Couldn’t deliver a test” — re-check the API URL, Client ID, and Client Secret, and confirm the API application uses Client Credentials.
  • No customers in the mapping list — the API application needs read access to Clients; click Refresh.
  • Auto-provisioning not firing — confirm the HaloPSA webhook points at the current Payload URL, the secret matches, and the event is Client created.
  • Duplicate teams — won’t happen: provisioning and Sync reuse already-mapped clients.

Looking for SuperOps instead? See the SuperOps Integration Guide in this section. SuperOps supports tickets, client mapping, billing, and on-demand client sync (SuperOps has no client-created webhook, so new clients are pulled in with the Sync now button rather than pushed automatically).