Add MSP360 Backup and RMM integrations

[tonyzorin]

Integration: MSP360 Backup + MSP360 RMM

Overview

• Service: MSP360 Managed Backup and MSP360 RMM
• Auth Type: Custom (Provider Login) / API key (RMM Bearer token)
• Category: Monitoring / Infrastructure
• Checks:
  • Backup: app availability, employee access (administrators), backup logs, restoration test
  • RMM: device list, secure devices, monitoring and alerting, infrastructure inventory

What This Integration Does

Two separate catalog providers so Backup Provider Login and the RMM API token are never mixed.

• MSP360 Backup authenticates with POST /api/Provider/Login, then reads GET /api/Administrators and GET /api/Monitoring. GET /api/Users is backup customers and is not used as staff.
• MSP360 RMM uses a Bearer token against fleet stats (/api/v1/computers/stat/{host,antivirus,summary,hardware,software}/latest). Live payloads wrap each computer as { header, data[] }; hid is normalized (braces/case) before joins.

Honest pass/fail:

• Failed backup jobs still fail. A successful latest run older than 10 days is treated as paused / not in scope, not as a failed job.
• No restore-family job in 90 days is a not-in-scope control pass, not a failed restore.
• Linux/Unix hosts without antivirus are not applicable; Windows without AV still fails. BitLocker/FileVault/screen lock are unverified unless the API returns those fields.

Catalog logo is MSP360’s public BIMI SVG: https://images.msp360.com/bimi/msp360-logo.svg.

Testing

• Connected successfully with live Backup Provider Login and a live RMM API token
• All checks run without errors (bun test src/manifests/msp360-backup src/manifests/msp360-rmm)
• Error handling works for missing credentials and empty host lists
• Live RMM envelope parsing joins antivirus/hardware/software by hid

Task Mapping

• Check: MSP360 Backup app availability → Task: App / system availability
• Check: MSP360 Backup employee access → Task: Employee access
• Check: MSP360 Backup logs → Task: Backup logs
• Check: MSP360 Backup restoration test → Task: Backup restoration test
• Check: MSP360 RMM device list → Task: Device list
• Check: MSP360 RMM secure devices → Task: Secure devices
• Check: MSP360 RMM monitoring and alerting → Task: Monitoring & alerting
• Check: MSP360 RMM infrastructure inventory → Task: Infrastructure inventory

Breaking Changes

None

Notes

Community Edition has no RMM API. Do not paste Backup Provider Login into the RMM connection or an RMM token into Backup.

---

Summary by cubic

Adds MSP360 Backup (msp360-backup) and MSP360 RMM (msp360-rmm) as separate integrations with distinct auth, tightening backup/restore outcomes and RMM pagination to prevent false passes and missed hosts.

• Review focus

  • Auth separation: Backup uses Provider Login (POST /api/Provider/Login) for /api/Administrators and /api/Monitoring; RMM uses a Bearer token for /api/v1/computers/stat/{host,antivirus,summary,hardware,software}/latest. Do not mix credentials.
  • Backup semantics: previously Running/Unknown were treated as paused; now they fail. A successful latest run older than 10 days is not in scope. Any restore-family job within 90 days without Success (missing or unrecognized status) now fails. Malformed monitoring payloads fail collection.
  • RMM parsing/paging: flatten { header, data[] }, normalize hids, keep paging bare-array responses until a short/repeated page, and only report truncation after probing past the cap returns new hosts; truncation findings include the effective page cap. Windows without AV fails; Linux/Unix without AV is not applicable. If RMM reports encryption or screen lock off, fail; absent fields are marked unverified.

• Rollout

  • Create two connections: MSP360 Backup (Provider Login username/password; optional baseUrl, default https://api.mspbackups.com) and MSP360 RMM (RMM API token; optional baseUrl, default https://api.rmm.mspbackups.com). No breaking changes.

^{Written for commit 39577eb. Summary will update on new commits.}

[CLAassistant]

All committers have signed the CLA.

[cubic-dev-ai]

All reported issues were addressed across 22 files

<sub>Tip: instead of fixing issues one by one fix them all with cubic

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 14 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 5 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic</sub>

[tonyzorin]

Hi, is security review manual?