HaloPSA

HaloPSA is the fullest of the Tidehawk integrations. It receives a formatted HTML ticket and can close it automatically once the certificate renews.

Before you start

You need the owner or admin role in Tidehawk.
Create an OAuth application in HaloPSA under Configuration › Integrations › API Clients.
Set the application’s redirect URI to https://app.tidehawk.co/api/integrations/halopsa/callback.
Give the application access to read clients, teams, statuses and ticket types, and to create tickets and actions.

What Tidehawk asks for

Field	What to enter
Tenant subdomain	The part before `.halopsa.com` in your Halo URL, for example `yourcompany`
Client ID	The OAuth client ID from HaloPSA
Client secret	The OAuth client secret. Leave blank for a Native Application client

Connect

Open Integrations and select Connect on the HaloPSA card.
Enter the Tenant subdomain, Client ID and, if your application uses one, the Client secret.
Select Authorise with HaloPSA →. You are sent to HaloPSA to sign in and approve the request, then returned to Tidehawk.
On Configure ticket defaults, choose a Default team / board, Default status and Default ticket type. Each can be left as — none — to use the Halo default.
Select Save & finish, then Test now. A working connection reports how many companies it can see.

What a Tidehawk ticket looks like

The summary reads SSL certificate expires in 12 days — mail.example.co.uk (Acme Ltd), or Domain expires in 12 days — example.co.uk (Acme Ltd).

HaloPSA receives the rich HTML version of the ticket: a navy Tidehawk header with a severity pill reading CRITICAL, HIGH or NORMAL, a coloured status line, a summary table of client, certificate or domain and expiry date, and a View & renew in Tidehawk button. A plain-text copy is sent alongside it as the fallback details.

The ticket is created against the Halo client whose name matches the Tidehawk client exactly, and takes your default team, status and ticket type where you set them. Priority maps from the alert: critical becomes priority 1, high becomes 2, normal becomes 3.

Tidehawk returns a direct link to the ticket at https://yourtenant.halopsa.com/tickets/<id>, so the Alerts page and the confirmation email both link straight to it.

Closing

When the certificate or domain is renewed, Tidehawk posts an action on the ticket with the outcome “Tidehawk auto-resolve” and a note explaining what renewed and what the new expiry date is. The action is hidden from the end user, so it reads as an internal note.

If a closed status is stored on the connection, Tidehawk then sets the ticket to that status and the ticket is closed. Without one, the note is posted and the ticket stays open for a human to close.

A ticket that no longer exists in Halo is treated as handled, not as an error.

Tokens and expiry

HaloPSA issues short-lived access tokens with a refresh token. Tidehawk checks every 30 minutes for connections whose token expires within 10 minutes and refreshes them in the background, storing the new tokens encrypted.

If a refresh fails, Tidehawk retries with a growing delay, up to six attempts, capped at six hours between tries. After the sixth failure the connection is marked failed, the Integrations card shows Needs attention, and you need to reconnect. A token expiring within seven days is flagged on the card as renewing soon.

Limitations

The closed status is not exposed on the configure screen. Without it, closing degrades to a note on an open ticket.
Only tenants on *.halopsa.com can be connected. A self-hosted Halo on your own domain is not supported.
Client matching is an exact, case-insensitive name match against your Halo client list, which is cached for an hour.