read thedocs.

Addigy is a cloud-based Apple device management (MDM) platform for MSPs — it manages macOS, iOS, iPadOS, and tvOS devices. Connecting it to StackJack gives your AI assistant a family of roughly 250 addigy_ MCP tools — MCP (Model Context Protocol) tools are the standardized commands an AI assistant can call through StackJack — covering devices and facts, policies, MDM commands and profiles, software deployment, monitoring and alerts, compliance, and more.

Two things make Addigy setup different from most connectors:

• The API token carries its own permissions. You choose exactly what the token may do when you create it in Addigy — and that choice is permanent for that token.
• Addigy enforces a severe rate-limit penalty. Exceeding the vendor's limit locks the token out of the API for 24 hours. StackJack's built-in pacing makes this unreachable from StackJack alone, but you should still read the warning below.

How StackJack authenticates to Addigy

Addigy API v2 uses a static API token sent with every request. There is no OAuth flow and nothing to refresh — the token alone authenticates every call, so treat it like a password. The base URL is fixed (Addigy is a global SaaS with no regional endpoints), so the token is the only thing you enter.

Before you begin

• In StackJack: you need a role that can manage connectors (tenant Owner, a co-owner, or an Administrator).
• In Addigy: you need access to Account → Integrations → API & Webhooks.
• Plan the token's permissions first — see the next section. Tokens cannot be edited after creation, so deciding up front saves you a second trip.

Choosing the token's permissions

When you create an Addigy V2 token, you select the permission categories it carries (device reads, policy edits, MDM commands, and so on). Two independent gates then apply to every AI call:

1. StackJack's tool permissions — which addigy_ tools your plan and your tool selections allow.
2. The Addigy token's own permissions — what Addigy itself will accept from that token.

Both must permit an operation for it to succeed. If a tool call returns a 403 error, the token lacks that endpoint's permission — and because tokens are immutable, the fix is always to create a new token with the missing permission and update the credential in StackJack.

Use least privilege, but note that StackJack's Addigy tools span devices, policies, MDM, software, monitoring, and more — grant the categories you actually intend your AI agents to use. The tool families and the token permissions they exercise:

The Permissions page in the StackJack portal maps each individual tool to the exact permissions it needs — use it to build a least-privilege token for the tools you plan to enable.

Step 1 — Create a V2 API token in Addigy

1. Sign in to Addigy and navigate to Account → Integrations → API & Webhooks.
2. In the Addigy API section, open the V2 tab and click New API Token.
3. Choose the permissions to grant (see the section above).
4. Copy the token immediately and store it securely — Addigy will not show it again. Anyone with the token has its full permission set on your Addigy organization.

Step 2 — Add the token in StackJack

1. In the StackJack portal, open Connectors.
2. Find the Addigy card. Click How To Connect for the same steps inline, or Configure to enter the credential.
3. Paste the token into the API Token field. There is no URL to enter — the base URL is fixed at https://api.addigy.com/api/v2.
4. Click Save.

StackJack Connectors page with the Addigy Configure dialog open, showing the single API Token field and the fixed base URL note

What happens when you save

• The token is stored encrypted in Azure Key Vault — never in the StackJack database, and it is never shown back to you.
• If this is the first time you configure Addigy, a Free-tier subscription for the connector is created automatically so its Free tools work right away.
• StackJack immediately live-validates the token by asking Addigy for the token's own permission list. Validation never blocks the save: you'll either see a success confirmation or a "saved but validation failed" warning with the reason.
• The connector card shows the current connection and validity status from then on.

The 24-hour lockout — read this before pointing anything else at the token

Addigy enforces a hard limit of 1,000 API requests per 10 seconds — and once exceeded, it rejects all further requests for 24 hours. There is no early release.

StackJack applies its own conservative pacing (600 requests per minute per tenant) specifically so that StackJack traffic alone can never come close to the vendor limit. But Addigy counts all traffic using the token, not just StackJack's. To keep the lockout unreachable:

• Create a dedicated token for StackJack. Don't reuse a token that another integration, script, or dashboard also uses.
• If every Addigy tool call suddenly starts failing and your team runs other heavy Addigy integrations, suspect the lockout — it clears on its own after 24 hours.

Working with multiple Addigy organizations

If your Addigy account has child organizations, the tools support all three access patterns:

• Plain tools act on the organization the API token itself belongs to.
• Organization-scoped tools take an organizationId parameter to act on a specific child organization. Discover the IDs with the addigy_list_child_organizations tool.
• Aggregate tools accept a multitenancy option to span all child organizations in one call.

Aggregate tools call Addigy's Organization-Aggregate (/oa/) endpoints, which require an MSP parent-organization API token. A token issued for a single (non-parent) organization is rejected with a 400 Bad Request for these tools even though the token itself is valid — issue the StackJack token from your Addigy parent organization, or use an organization-scoped tool with an explicit organizationId instead.

Plans and available tools

• Free includes the read tools (device and fact reads, policy reads, monitoring reads, and so on).
• Pro adds the write tools — MDM commands, policy and profile edits, software deployment, and other state-changing operations.
• Business offers the same tool set as Pro with a higher monthly call quota.

Addigy has no per-user sign-in flow, so there is no per-user attribution — all AI traffic uses the shared token. Current pricing and quotas are shown in the portal's Billing page and at checkout.

Rotating or replacing the token

To rotate: create a new token in Addigy (with the same or updated permissions), paste it into Connectors → Addigy → Configure, save, and then delete the old token in Addigy. The StackJack save takes effect immediately, so there is no gap if you delete the old token afterwards.

Troubleshooting