> ## Documentation Index
> Fetch the complete documentation index at: https://kb.mspprocess.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Huntress

> Connect Huntress to Triggr with a user API key and secret from the Huntress portal.

Triggr works with Huntress organisations, agents, incident reports, remediations, escalations, ITDR identities and invoices, plus reseller accounts.

## Set up Huntress

You need an Admin user in the Huntress portal.

**1. Choose the user**

The credential has exactly the permissions of its user, so choose an account-level Admin for every action. A Read-only user covers most reads (escalations need Admin or Security Engineer, invoices Admin or Finance). See [Write actions and roles](#write-actions-and-roles) and Huntress's [user permissions](https://support.huntress.io/hc/en-us/articles/4404012728083-Huntress-Platform-User-Permissions).

**2. Create a user API credential**

Open the menu in the top right and select **API Credentials**. Under User API Credentials, click **Add**, select the user, enter a Key Name such as `Triggr` and click Add.

**3. Copy the key and secret**

Copy the API Key and Secret, then click Ok. Huntress shows the secret only once.

Use a user API credential, not the older account API key, which is read-only and returns incomplete data. See Huntress's [Generating API Keys](https://support.huntress.io/hc/en-us/articles/4416826761235-Generating-API-Keys).

## Connect it in Triggr

**1. Open the integration**

Go to **Integrations > Huntress** and click Configure on the Base Configuration card.

![The Base Configuration card with Status Not Configured, Admin Consent Not Required and a Configure button.](https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/integrations-common/base-configuration.png?fit=max\&auto=format\&n=nyuVXZ1rouDTTEvu\&q=85\&s=bb81acb082055015f91beda7b4876f35)

**2. Enter the key and secret**

Enter the API Key as Public Key and the Secret as Private Key, then click Save Configuration.

![The Huntress configuration window with Public Key and Private Key fields, an Allow insecure TLS switch under Advanced, and a Save Configuration button.](https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/huntress/configure.png?fit=max\&auto=format\&n=nyuVXZ1rouDTTEvu\&q=85\&s=afbbb6faefe50f7ab4d54fd06f15b73d)

One connection covers all your clients. Actions on one organisation take its Huntress organisation ID, which Get Organizations returns.

## Write actions and roles

| Triggr action | Huntress role |
| - | - |
| Create an Incident Report Resolution, Create an Escalation Resolution | Admin or Security Engineer |
| Bulk Approve Remediations | Admin, Security Engineer or User |
| Update an Organization, Delete an Organization | Admin, Provisioner or User (Security Engineer can update only) |
| Delete Unwanted Access Rule, Delete Membership | Admin |

Reseller actions (Accounts, Reseller Invoices, Reseller Subscriptions and actions that take an account ID) need reseller-level credentials. Delete an Organization and Permanently Disable an Account can't be undone. For endpoints without a built-in action, use a Generic Integration Action step; see the [Huntress API reference](https://api.huntress.io/docs).

## Troubleshooting

> [accordion] Every action fails with 401
>
> Check Public Key holds the API Key and Private Key the Secret, in full and not swapped. If you've lost the secret, create a new credential.

> [accordion] publicKey not found in Huntress configuration
>
> A field is empty (or only spaces). Click Edit on the Base Configuration card and fill in both keys.

> [accordion] An action fails with 403
>
> The credential's user lacks the role the action needs. See [Write actions and roles](#write-actions-and-roles).

> [accordion] Records are missing or return 404
>
> Organisation-level users only see their own organisations, User and Read-only can't see escalations, and per-account actions need reseller-level credentials.

> [accordion] Requests fail with 429
>
> Huntress allows 60 requests a minute per account. Spread large workflows out or run them in smaller batches.

> [accordion] List actions fail with 504
>
> Huntress timed out building a large list. Narrow the action with its filters, such as an organisation ID or date range, or lower its limit.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.