TeamDynamix

Create the application-level role that will be available on the IT Tickets application assignment for the integration user.

1. Open the IT Tickets security role area. In TDAdmin, navigate to Applications, open IT Tickets, then go to Users and Roles and Security Roles.
2. Create a new role. Click New.
3. Name the role. Example: CIO Analytics Role.
4. Set the license type. Select Technician + Reporting.
5. Leave all permission checkboxes unchecked. Do not enable create, edit, delete, assign, manage, or administrative permissions at this application-role step.
6. Save the role.

Create the global user security role used by the service account. This role should provide only the visibility needed for the TeamDynamix ticketing data that Info-Tech reads.

1. Open global security roles. In TDAdmin, navigate to Users and Roles, then Security Roles.
2. Create a new role. Click New.
3. Name the role. Example: CIO Analytics Security Role.
4. Set the license type. Select Technician + Reporting.
5. Select only these permissions: View All Accts/Depts, View All Types, View People from Accts/Depts, and View all requests belonging to assigned Accts/Depts.
6. Leave write/admin permissions unchecked. Do not enable permissions that create, edit, delete, modify, manage, approve, import, move, merge, assign, or update records.
7. Save the role.

Create a named service account for the integration so API access is auditable, easy to rotate, and easy to revoke without depending on a named employee account.

1. Open the user list. In TDAdmin, navigate to Users and Roles, then Users.
2. Create the service account. Click Create or New, then choose the service-account option if your tenant presents one.
3. Name the account. Use a clear integration name, for example CIO Analytics or Info-Tech CIO Analytics.
4. Click Next and complete the user details. Fill out the required fields such as first name, last name, username, email, and any other required tenant fields.
5. Assign the security role. Set the user security role to the CIO Analytics role approved for this integration. If your tenant separates global and application roles, assign the global role from Step 2 on the user profile and assign the IT Tickets application role in Step 4.
6. Finish the user creation flow. Keep the account active so it can authenticate successfully.

The service account must be assigned to the actual TeamDynamix ticketing application before API ticket reads will work.

1. Open the new service account. Go to TDAdmin, Users and Roles, Users, and open the service account created in Step 3.
2. Open the Applications tab.
3. Enable the ticketing application. Make sure IT Tickets is checked. Do not rely only on Client Portal access.
4. Assign the application security role. For IT Tickets, select CIO Analytics Role or the equivalent read-only application role created in Step 1.
5. Save the user.
6. Retest API access after saving. If the API still returns 403 Forbidden, generate a fresh token and confirm the service account is assigned to the correct Accts/Depts and the correct IT Tickets application.

Info-Tech will use the TeamDynamix Web API to authenticate, retrieve a JWT, and read the required ticketing resources.

1. For standard login authentication, use the auth endpoint.

   curl -X POST "https://yourorg.teamdynamix.com/TDWebApi/api/auth" \
     -H "Content-Type: application/json" \
     -d '{"username":"INTEGRATION_USER","password":"INTEGRATION_PASSWORD"}'

2. For key-based administrative service account authentication, use loginadmin only if approved.

   curl -X POST "https://yourorg.teamdynamix.com/TDWebApi/api/auth/loginadmin" \
     -H "Content-Type: application/json" \
     -d '{"BEID":"YOUR_BEID","WebServicesKey":"YOUR_WEB_SERVICES_KEY"}'

3. Store the returned JWT securely. The token is used as Authorization: Bearer YOUR_TOKEN on later requests and expires after 24 hours.
4. Do not send secrets through unapproved channels. Passwords, BEID values, web services keys, and bearer tokens must be submitted only through the approved Info-Tech submission flow.

Before submitting credentials, confirm the integration identity can authenticate and read the required TeamDynamix resources.

1. Confirm the token can identify the authenticated user.

   curl "https://yourorg.teamdynamix.com/TDWebApi/api/auth/getuser" \
     -H "Authorization: Bearer YOUR_TOKEN" \
     -H "Content-Type: application/json"

2. Test ticket search.

   curl -X POST "https://yourorg.teamdynamix.com/TDWebApi/api/APP_ID/tickets/search" \
     -H "Authorization: Bearer YOUR_TOKEN" \
     -H "Content-Type: application/json" \
     -d '{"MaxResults":1}'

   Replace APP_ID with the ticketing application ID from step 1.
3. Test a single ticket read. Use a ticket ID returned by the search call:

   curl "https://yourorg.teamdynamix.com/TDWebApi/api/APP_ID/tickets/TICKET_ID" \
     -H "Authorization: Bearer YOUR_TOKEN" \
     -H "Content-Type: application/json"

4. Test ticket feed access. If the endpoint is enabled for the tenant, read the ticket feed for the same ticket to confirm comments and history are visible.
5. Test time-entry access if worklog reporting is in scope. Confirm the time search or time entry output can return entries associated with tickets.
6. Record failures by HTTP status and response body. TeamDynamix uses 401 for authentication or permission problems and 429 when rate limits are exceeded.