Autotask API Permissions Review for Salesbuildr Integration

A customer flagged that the Autotask API security level documented in our setup guide appears overly permissive. We did a code review and confirmed a number of permissions are not used. Two open questions remain that need live testing in Autotask.

What's confirmed

The following can be removed from the recommended security level — no code calls these operations:

• CRM: Delete on Companies, Configuration Items, CI Notes, To-Dos, Attachments

• Inventory: Delete on Products, Inventory Items, Inventory Locations; Add/Edit on Inventory Locations (inventory is read-only)

• Service Desk: Delete on Tickets, Ticket Notes, Service Calls, Expenses; all Time Entry permissions

• Form Templates: anything beyond Read

Delete on Company Notes (CompanyAlerts) is intentional — we delete the Account Detail alert when a sticky note is cleared in Salesbuildr. This should be scoped to "own notes only".

What needs live testing

1. Admin section granularity — we need read access to Resources/Users, field definitions (queues, priorities, billing codes, org levels), and classification icons. Confirm whether Autotask allows these to be set to read-only independently, or whether the security level bundles them with write/admin access.

2. Edit vs Full for PATCH operations — confirm that Autotask's "Edit" permission (not "Full") is sufficient for all PATCH calls we make (companies, contacts, products, opportunities, quotes, tickets, ticket charges). Some older Autotask entities have non-standard permission behaviour.

3. Ticket Charges delete — the entity type in our code has canDelete: true but no delete is ever called. Confirm we can set this to Create/Edit only without any unexpected side effect.