Connect Pax8

• Syncs companies and subscriptions from your Pax8 tenant into customers and license_subscriptions. Pax8 companies are fuzzy-matched to PSA rows so license data hangs off the canonical customer hub.
• Weekly usage snapshots land in license_usage so seat-count drift is detected on week-scale cadence — the same Money Found signal Sherweb produces.
• Lifecycle webhooks (optional): subscription add/change/cancel events from Pax8 land in pax8_webhook_events so drift is caught in near-real-time, not only on the weekly sync.
• Coexists with Sherweb, Ingram Micro, TD SYNNEX. Subscriptions are vendor-tagged, so leakage + margin + drift detection work identically whether your MSP uses one distributor or several.
• Read-only. Vectis never writes back to Pax8 — subscription changes always go through the Pax8 portal or your billing flow, not Vectis.

• Client ID and Client Secret from the Pax8 portal’s Account → API Settings page
• Pax8 partner admin access (or a role that can mint API credentials)
• Optional: audience override (only needed for Marketplace Vendor scopes — api://provisioning or api://usage)

1. Sign in to app.pax8.com as a partner admin.
2. Open Account → API Settings.
3. Click Create API Client. Label it “Vectis” so it’s easy to rotate or revoke independently of any other tool you integrate.
4. Copy the Client ID and Client Secret Pax8 displays. The secret is shown only once — if you lose it, revoke and regenerate.

1. Go to Admin → Integrations and click Configure on Pax8.
2. Paste the client ID and client secret. Leave audience blank for partner credentials — only set it when you need a Marketplace Vendor scope (api://provisioning or api://usage).
3. Click Test. You’ll see “Connected to Pax8 — N companies visible” within a few seconds.
4. Click Save, then trigger an initial sync.

1. After saving credentials, a Webhook bearer token field appears on the Pax8 integration card. Click Generate token and copy the value.
2. In Pax8, open app.pax8.com/integrations/events?tab=webhooks.
3. Click Add Webhook. Destination URL: https://<your-subdomain>.mspvectis.com/api/webhooks/pax8/lifecycle.
4. Set the Authorization header to Bearer <token> (paste the value you copied from Vectis).
5. Subscribe to the events you want delivered — subscription created / updated / cancelled are the ones Vectis acts on.
6. Save. Incoming events land in Data & Integrations → Pax8 webhooks.

• Customer hub → Licensing section: per-SKU rollups, cost vs. revenue margins, uncontracted-seat counts. Pax8 subscriptions render identically to Sherweb / Ingram / SYNNEX in the same table — the vendor column disambiguates.
• Licensing-leakage dashboard preset: every customer with uncontracted Pax8 seats or below-margin SKUs surfaces here.
• Weekly Money Found digest: seat-growth findings + licensing drift events surface in the Monday email.
• QBR report: Licensing section vendor label reads “Pax8”, “Sherweb”, or “Mixed” depending on which distributor(s) the customer uses.

401 Unauthorized — Client ID / secret pair is wrong, or the client was revoked. Rotate from the Pax8 portal and re-enter.

403 Forbidden — The API client lacks the scope to read companies or subscriptions. Recreate the client with partner-admin scope.

Audience mismatch on token request — The audience must match the credential scope. Partner credentials use https://api.pax8.com (the default when the field is blank). Marketplace Vendor credentials use api://provisioning or api://usage.

429 Too Many Requests — Pax8 rate-limits at 100 req/min per tenant. The Python ETL paces below that; if you see 429s, another tool is likely sharing the credential — mint a dedicated one for Vectis.

Webhook 401 — The bearer token on the Pax8 webhook doesn’t match what’s stored in Vectis. Regenerate on the Pax8 integration card and update Pax8’s Authorization header.