Read-Only Datto RMM API Access — Without a Scoped Key

Datto RMM API keys ignore user permission scoping. Regardless of what permissions you configure, the key retains full access to modify sites, devices, alerts, and policies.

Start free trial Try the demo

The Problem with Datto RMM API Keys

Datto RMM doesn't support scoped API keys. You configure permissions for the API user in the interface, but the generated key retains full access regardless. Sites, devices, alerts, policies — all writable through the API.

This means any script, integration, or AI agent using the API key can modify your RMM environment. A misbehaving automation or a hallucinating AI agent could change device policies, disable alerts, or alter site configurations.

Multiple MSPs have reported this on community forums. The permission settings in the UI don't apply to API keys — a full-access key is your only option.

Datto RMM doesn't support scoped API keys. A single full-access key is your only option — until now.

How GuardProxy Fixes It

Route your Datto RMM API calls through a GuardProxy endpoint. Same key, same auth flow, same endpoints.

Write methods (POST, PUT, PATCH, DELETE) are blocked at the proxy. Your RMM data is readable but untouchable.

No changes to your existing scripts. Just swap the base URL from the Datto API to your GuardProxy endpoint.

Set up in under a minute. No agents to install, no infrastructure to manage.

your terminal

# Before — direct to Datto RMM (full access)

$curl https://your-tenant.datto-rmm.com/api/v2/audit \

# After — through GuardProxy (read-only)

$curl https://cust_acme.guardproxy.dev/datto-rmm/v2/organizations \

-H "Authorization: Token YOUR_KEY"

200 OKdata returned, writes blocked

Lock down your Datto RMM API key in 60 seconds.

Free for 14 days. No credit card. Cancel anytime.

Start your free trial