This document catalogs the SysTrack API endpoints called by the iPaaS.com SysTrack integration, grouped by entity. Its primary purpose is to provide a complete inventory of every endpoint the integration depends on, so that when Lakeside Software publishes a deprecation or breaking-change notice, iPaaS.com staff can quickly determine whether the integration is affected. It also serves as a reference for firewall whitelisting, service account permission review, troubleshooting, and understanding data flow.
The SysTrack integration synchronizes two entities. Customer (SysTrack users, their linked systems, and the sensor actions available to those systems) flows inbound only, from SysTrack into iPaaS.com. Message (SysTrack sensor alerts) flows inbound from SysTrack into iPaaS.com and supports one outbound operation: dispatching a SysTrack automation (autofix) run for a message. Every endpoint below is called by iPaaS.com against the subscriber's SysTrack Cloud tenant. SysTrack does not send webhooks into iPaaS.com, so there are no inbound receiver endpoints.
Portal Info
SysTrack Cloud is hosted by Lakeside Software in three regions. Each region is a separate instance with its own dashboard host, and a subscriber's tenant lives in exactly one of them.
Region | Dashboard URL |
United States |
|
EU / UK |
|
Australia |
|
The correct host is the one the subscriber signs in to for the SysTrack Cloud dashboard. Two administration pages on that host are referenced during setup: the Tenant Information page at /Cloud/Dashboard/Admin/TenantInformation, and the Manage Service Accounts page at /Cloud/Dashboard/Admin/ManageServiceAccounts. For example, an Australian tenant reaches Tenant Information at https://cloud-au.lakesidesoftware.com/Cloud/Dashboard/Admin/TenantInformation.
See the SysTrack Installation Instructions article for end-to-end setup detail.
API Endpoints Intro
The SysTrack Cloud API is a REST API that exchanges JSON request and response bodies. Every call carries an OAuth 2.0 Bearer access token obtained from Microsoft Azure AD B2C — see Authorization Endpoint below, and the SysTrack Connections and Settings article for credential configuration.
The Base URL is the regional SysTrack Cloud host with /api appended. The subscriber enters it as the API URL subscription setting, and the integration issues every call in this document against that value.
Region | Base URL |
United States |
|
EU / UK |
|
Australia |
|
Throughout this document the placeholder [Base URL] refers to that fully constructed Base URL. For a United States tenant, [Base URL]/users resolves to https://cloud.lakesidesoftware.com/api/users.
The API URL and the CLIENT ID settings must both belong to the same region. Regional hosts are independent tenants with independent record identifiers, so mixing them produces authentication or lookup failures rather than a partially working connection.
Sandbox / test URL: SysTrack does not offer a sandbox or test environment. The hosts listed above are production. All configuration and validation is performed against the subscriber's live SysTrack tenant, so subscribers or their MiSP should schedule changes and high-volume synchronization runs during a low-activity window.
Table of Contents
Customer Endpoints
Message Endpoints
Authorization Endpoint
Customer Endpoints
Get All Users with Directory Information (GET)
[Base URL]/users?includeADinfo=true
Returns the full list of SysTrack users in the tenant, including their Active Directory information. The integration calls this when retrieving a single Customer — the SysTrack user whose account identifier matches the requested record is selected from the returned list.
Query parameters:
Parameter | Description |
| When |
NOTE: This endpoint returns every user in the tenant on each call; SysTrack does not offer a modified-since filter on it, and the narrowing to a single user happens after the response is received. On a large tenant the response grows with the user count, which makes the Concurrent Connections and throttle settings on the subscription meaningful to overall performance. Subscribers or their MiSP should validate response times against their own tenant size before increasing throughput.
Get All Users (GET)
[Base URL]/users
Returns the full list of SysTrack users in the tenant without Active Directory information. The integration calls this during scheduled Customer polling to enumerate the users that should be transferred into iPaaS.com. As with the endpoint above, the full user list is returned on every polling cycle.
Get the Systems Linked to a User (GET)
[Base URL]/users/{UserId}/systemsReturns the systems (devices) linked to a specific SysTrack user. {UserId} is the SysTrack user's account identifier — the same value used as the external-id link on the iPaaS.com Customer record, for example 3956. The response supplies the system GUID and operating system type recorded on the iPaaS.com Customer.
Get All Sensor Actions (GET)
[Base URL]/sensoractions
Returns the full catalog of sensor actions defined in the tenant, each with the operating systems it supports. The integration calls this alongside the user's systems and matches each system to the sensor actions valid for that system's operating system.
Message Endpoints
Get the Sensors for a System (GET)
[Base URL]/sensors/{SystemId}Returns the sensor records currently reported for a single SysTrack system. {SystemId} is the SysTrack system identifier, for example 100007. This is the first call made when retrieving a Message: the sensor matching the requested sensor identifier is selected from the response and supplies the message name, severity, trigger count, triggered state, hidden flag, and result time.
Get Sensors Within a Time Range (GET)
[Base URL]/sensors?startTime={StartDateTime}&endTime={EndDateTime}Returns the sensor records reported across the tenant between two timestamps. The integration calls this during scheduled Message polling to determine which sensor alerts have activity since the previous cycle. Results are de-duplicated by sensor and system before transfer.
Query parameters:
Parameter | Description |
| Start of the window, sent with a trailing |
| End of the window, sent with a trailing |
Get System Details with Primary User (GET)
[Base URL]/systems?includePrimaryUser=true&id={SystemId}Returns the details of a single SysTrack system, including the primary user assigned to it. The integration calls this after retrieving the sensor, to populate the system name and the primary user's full name, user name, and email address on the iPaaS.com Message record.
Query parameters:
Parameter | Description |
| When |
| The SysTrack system identifier to retrieve. Example: |
Get the Latest Sensor History for a System (GET)
[Base URL]/sensorhistory/latest/child/{SystemId}?includePayloads=trueReturns the most recent sensor history record for a system, including the automation payloads attached to each sensor result. The integration uses this to determine which of the system's triggered sensors have a SysTrack automation available, and records those automations on the iPaaS.com Message so the automation can later be dispatched.
Query parameters:
Parameter | Description |
| When |
NOTE: A system that is offline or otherwise not reporting to SysTrack has no current sensor history. When this call returns no automation data, the sensor event does not become an iPaaS.com Message at all — the inbound mapping filter admits only sensor events that carry at least one automation. The alert can arrive on a later cycle once the system reconnects and reports again. See the SysTrack Integration Known Limitations article.
Dispatch a SysTrack Automation Run (POST)
[Base URL]/tools/autofix/run
Dispatches a SysTrack automation (autofix) run against a system for a specific sensor. This is the only outbound write the integration performs. The request body identifies the target system, the sensor, and the automation application to run. SysTrack responds with a batch identifier, which the integration records back on the iPaaS.com Message record so the run can be traced in SysTrack.
The run is asynchronous. A successful response means SysTrack accepted the request and queued the automation — it does not mean the automation has completed, or that the underlying condition on the system has been resolved. Subscribers or their MiSP should confirm the outcome in SysTrack using the returned batch identifier.
Authorization Endpoint
SysTrack does not issue its own API tokens. Authentication is delegated to Microsoft Azure AD B2C using the Resource Owner Password Credentials (ROPC) flow, with the credentials of a SysTrack service account that SysTrack Support creates and links to the tenant.
Get an Access Token (POST)
https://{TenantName}.b2clogin.com/{TenantName}.onmicrosoft.com/{RopcPolicy}/oauth2/v2.0/tokenThis address is not built from the API URL — it is built from the TENANT NAME and ROPC POLICY subscription settings, both of which are supplied by SysTrack Support. It is a Microsoft Azure AD B2C host rather than a Lakeside Software host, which matters for firewall whitelisting: allowing the regional SysTrack Cloud host alone is not sufficient.
Path parameters:
Parameter | Description |
| The Azure AD B2C tenant name for the subscriber's SysTrack tenant, entered as the TENANT NAME setting. It is substituted into the address in two places. Example: |
| The name of the Azure AD B2C Resource Owner Password Credentials policy for the tenant, entered as the ROPC POLICY setting. It determines which sign-in policy Azure AD B2C evaluates. Example: |
For the example values above, the resulting address is https://exampletenant.b2clogin.com/exampletenant.onmicrosoft.com/b2c_1_ropc_auth/oauth2/v2.0/token.
The same address serves two request forms:
Initial token request: the password grant, submitting the CLIENT ID, USER NAME, and PASSWORD settings and requesting offline access, so that a refresh token is returned alongside the access token.
Token refresh: the refresh token grant, submitting the stored refresh token and the CLIENT ID. This avoids re-sending the service account password while a valid refresh token is held.
iPaaS.com stores the access token and the refresh token with their expiry times and reuses the access token until it expires. When no usable refresh token is held, it re-authenticates with the password grant — which is why the service account password must remain valid in SysTrack for the integration to recover.
Because both values are substituted directly into the address, an incorrect TENANT NAME or ROPC POLICY produces an unreachable sign-in host or an unrecognized policy rather than a rejected credential. Enter both exactly as SysTrack Support supplies them, including case. For credential setup and rotation, see the SysTrack Connections and Settings article.
Related Documents
The following companion articles for the SysTrack integration are available in the iPaaS.com Help Center: