n8n-nodes-autoelevate

This is an n8n community node. It lets you read data from the AutoElevate Partner API (beta) in your n8n workflows: companies, computers, locations, elevation requests, events, sessions and rules, the audit log, and per-company active-agent counts for billing.

AutoElevate is a privilege access management product from CyberFOX for managed service providers. Its Partner API exposes each MSP's tenant data to integrations.

n8n is a fair-code licensed workflow automation platform.

• Installation
• Operations
• Credentials
• Compatibility
• Usage
  • Agent counts for billing
  • Approving and denying
  • Timestamps
  • Rate limits
  • Development
• Resources
• Changelog
• Attribution
• License

Installation

Follow the installation guide in the n8n community nodes documentation. The package name is n8n-nodes-autoelevate.

Operations

The node reads by default. The two write operations, Elevation Request → Approve and Deny, are off unless the credential has Allow Write Operations turned on and the key carries the requestEdit scope; the node checks the toggle before sending anything, and the API enforces the scope with a 403. Keep separate credentials for reading and writing.

| Resource | Operations | Filters | |---|---|---| | Usage | Get, Get Agent Counts by Company | | | Company | Get, Get Many | | | Computer | Get, Get Many | Company, Location | | Location | Get, Get Many | Company | | Elevation Request | Approve, Deny, Get, Get Many | Approval State, Company, Start, End | | Elevation Event | Get Many | Company, Start, End | | Elevated Session | Get, Get Many | Company, Computer ID, Status | | Elevation Rule | Get Many | Company | | Audit Log | Get Many | Action, Entity Type, Start, End |

• Get Many pages at the API maximum (200 rows) and checks the rows returned against the server's totalCount. A mismatch stops the node with a message instead of returning a silently short list.
• Computer → Get Many returns only computers that checked in within the last 30 days. That is the API's active-fleet window, so it is the billable count, not the inventory.
• Start and End accept any date n8n can parse and are sent as epoch milliseconds.
• The company and location dropdowns list what the key can see. A restricted key sees only its permitted companies.

Credentials

1. In the AutoElevate admin portal, open Users and create a service user for n8n. Don't attach keys to a person's account.
2. In that user's API Keys section, add a key. Prefer HMAC (AE-HMAC-SHA256): it shows a token (aeh_…) and a separate signing key, and every request is signed so a captured request can't be replayed elsewhere or after five minutes. API Token (AE-BEARER) gives one aeb_… secret.
3. Grant only the scopes you need (table below) and set the shortest practical expiry.
4. Copy both values immediately. They are shown once.

In n8n, create an AutoElevate API credential:

| Field | Value | |---|---| | Authentication | HMAC (default) or Bearer, matching the key type | | API Token | The aeh_… or aeb_… token | | HMAC Signing Key | The signing key, exactly as displayed (HMAC only) | | Base URL | Leave at https://partner-api.autoelevate.com | | Allow Write Operations | Off by default. Turn on only on a credential meant to approve or deny elevation requests; the key also needs the requestEdit scope. |

Saving the credential runs a signed GET /usage and reports the partner name and active-agent count. A 401 means the token, signing key, or scheme is wrong; a 403 means the key lacks computerView.

| Resource / operation | Scope | |---|---| | Usage → Get | computerView | | Usage → Get Agent Counts by Company | computerView, companyView | | Company | companyView | | Computer | computerView | | Location | locationView | | Elevation Request | requestView | | Elevation Request → Approve / Deny | requestEdit | | Elevation Event | eventView | | Elevated Session | elevatedSessionView | | Elevation Rule | ruleView | | Audit Log | auditLogView (may also need Early Access enrolment) |

The CyberFOX support article covers service users, key creation, and 401/403 troubleshooting in more detail.

Compatibility

Built and tested against n8n 2.38 with n8nNodesApiVersion 1. It uses only n8n-workflow and Node's crypto; there are no other runtime dependencies. Node.js 20 or later.

The Partner API is in beta and can change without notice. The node sends the required X-Acknowledgment: i-understand-this-is-beta-and-may-change header on every request and pins /api/v1/ paths.

Usage

Agent counts for billing

Usage → Get Agent Counts by Company emits one flat item per company on the first output:

{
  "companyId": "…",
  "companyName": "Acme Industries",
  "managementSystemCompanyId": "PSA-1234",
  "activeAgents": 37,
  "agentsAudit": 2, "agentsLive": 35, "agentsPolicy": 0, "agentsTechnicianBypass": 0, "agentsUnknownMode": 0
}

With Add Summary Output on (the default) the node gains a second output, Summary, that carries one item:

{ "partnerName": "…", "activeAgentsFromUsage": 590, "activeAgentsFromComputers": 593, "agree": false, "companies": 36 }

activeAgentsFromUsage is the API's periodically refreshed snapshot; activeAgentsFromComputers is the live walk. A difference of a few units is snapshot lag. managementSystemCompanyId is the key a PSA integration set when it created the company, which is how you join these rows to Autotask, ConnectWise, or Halo. Companies with zero agents are present with 0; a computer whose company the key can't see appears in a row with companyName: null.

The operation walks /companies and /computers once each and reads /usage once. For N computers and C companies that is ceil(N/200) + ceil(C/200) + 1 requests. It runs once per input item, so feed it a single item.

Approving and denying

Elevation Request → Approve and Deny need a credential with Allow Write Operations turned on and a key carrying the requestEdit scope; the node checks both before sending anything. The request must be PENDING: approving or denying one that already moved — approved, denied, or withdrawn — returns a 409, and the node's error message says so.

| Approve Options | Meaning | |---|---| | Create Rule | Also creates an auto-approval rule from this request. Requires Rule Level. | | Duration (Minutes) | Session length for elevated-session requests; ignored for other request types. | | Elevation Type | Admin or User. Overrides the elevation level recorded on the request. | | Rule Level | Company, Computer, Location, or MSP (All Companies). Scope of the rule created when Create Rule is on. |

| Deny Options | Meaning | |---|---| | Create Rule | Also creates a denial rule from this request. Requires Rule Level. | | Denial Reason | Plain text shown to the end user with the denial. Maximum 1000 characters. | | Rule Level | Company, Computer, Location, or MSP (All Companies). Scope of the rule created when Create Rule is on. |

Both operations validate the payload before sending: Rule Level is required when Create Rule is on, Duration (Minutes) must be a positive whole number, and Denial Reason tops out at 1000 characters. A bad value stops the node before it spends a request.

Timestamps

The API returns every timestamp as epoch milliseconds in a field ending in At. The node keeps that value and adds an …AtIso twin in ISO-8601 UTC (createdAt → createdAtIso). endedAt on an elevated session is the scheduled end, not updated if the session ended early.

Rate limits

The API allows 100 requests per hour per HTTP method and route. A 429 stops the node with the Retry-After value in the message. The node does not retry on its own. Schedule billing runs accordingly and avoid Return All on large event or request histories inside a loop.

Development

From n8n-nodes-autoelevate/:

• npm install installs dependencies.
• npm run lint runs the n8n community-node linter; npm run build compiles to dist/.
• npm run dev launches a local n8n with the node loaded.

The OpenAPI document this node was written against is in openapi/ with its provenance. The signing algorithm and the pagination rules mirror @dszp/autoelevate-lib, which is the reference implementation with offline test vectors; keep the two transports in step.

Resources

• n8n community nodes documentation
• AutoElevate Partner API reference: endpoints, versioning, rate limits, and the OpenAPI document
• CyberFOX support: AutoElevate Partner API (Beta)
• @dszp/autoelevate-lib: the same client for Cloudflare Workers, Node, and the browser

Changelog

For a version history of changes and updates, see CHANGELOG.md.

Attribution

AutoElevate is a product of CyberFOX, which owns the AutoElevate trademarks and intellectual property. This node is not affiliated with or endorsed by CyberFOX and is provided as a service to the n8n community.

License

MIT