RocketCyber Accounts

RocketCyber Account Management

Overview

RocketCyber uses a hierarchical account model designed for MSPs. The provider account (your MSP) contains multiple customer sub-accounts, each representing a managed client. All API operations can be scoped to a specific customer account using the accountId parameter.

Understanding the account hierarchy is essential for:

• Scoping API queries to specific customers
• Managing security policies per customer
• Reporting at both provider and customer levels
• Agent deployment to the correct customer account

Anti-triggers

• The client as a billing entity — use autotask-crm; as a documentation entity, itglue-organizations; as an RMM grouping, datto-rmm-sites. RocketCyber account IDs are shared with none of them.
• The endpoints inside an account — use rocketcyber-agents.

Key Concepts

Account Hierarchy

┌─────────────────────────────────────┐
│  Provider Account (MSP)             │
│  - API key is scoped here           │
│  - Provider-level reporting         │
│  - Global security policies         │
│                                     │
│  ┌───────────────────────────────┐  │
│  │  Customer Account: Acme Corp  │  │
│  │  - accountId: 12345          │  │
│  │  - Agents, Incidents, Apps   │  │
│  └───────────────────────────────┘  │
│                                     │
│  ┌───────────────────────────────┐  │
│  │  Customer Account: Beta LLC   │  │
│  │  - accountId: 12346          │  │
│  │  - Agents, Incidents, Apps   │  │
│  └───────────────────────────────┘  │
│                                     │
│  ┌───────────────────────────────┐  │
│  │  Customer Account: Gamma Inc  │  │
│  │  - accountId: 12347          │  │
│  │  - Agents, Incidents, Apps   │  │
│  └───────────────────────────────┘  │
└─────────────────────────────────────┘

Account Types

Account Status

Field Reference

Note: Field names are inferred from the Celerium PowerShell wrapper. Verify exact field names against RocketCyber API responses.

API Patterns

List All Accounts

# All customer accounts under the provider
curl -s "https://api-${ROCKETCYBER_REGION:-us}.rocketcyber.com/v3/accounts" \
  -H "Authorization: Bearer ${ROCKETCYBER_API_KEY}"

Response (verify against API docs):

{
  "data": [
    {
      "id": 12345,
      "name": "Acme Corporation",
      "type": "customer",
      "status": "active"
    },
    {
      "id": 12346,
      "name": "Beta LLC",
      "type": "customer",
      "status": "active"
    }
  ],
  "totalCount": 45,
  "page": 1,
  "limit": 50
}

Get Account by ID

# Single account details
curl -s "https://api-us.rocketcyber.com/v3/accounts/12345" \
  -H "Authorization: Bearer ${ROCKETCYBER_API_KEY}"

Response (verify against API docs):

{
  "id": 12345,
  "name": "Acme Corporation",
  "type": "customer",
  "status": "active",
  "createdAt": "2024-03-15T10:00:00Z",
  "agentCount": 47
}

Search Accounts by Name

The API may not support direct name search. To find an account by name:

# List all accounts and filter client-side
curl -s "https://api-us.rocketcyber.com/v3/accounts?limit=500" \
  -H "Authorization: Bearer ${ROCKETCYBER_API_KEY}" \
  | jq '.data[] | select(.name | test("acme"; "i"))'

Common Workflows

Account Inventory

1. List all accounts to get the full customer roster
2. For each account, query agent count and incident count
3. Identify accounts with no agents (coverage gaps)
4. Flag accounts with high incident counts for review

New Customer Setup

1. Create the customer account in the RocketCyber web console (verify if API supports account creation)
2. Note the account ID from the response or web UI
3. Deploy agents to all customer endpoints using the account-specific installer
4. Verify agent check-in by querying /agents?accountId={id}
5. Configure security policies as needed for the customer

Account-Level Security Posture

For a given customer account:

1. Query /accounts/{id} for account details
2. Query /agents?accountId={id} for agent deployment status
3. Query /incidents?accountId={id}&status=open for active threats
4. Query /apps?accountId={id} for application inventory
5. Aggregate into a security posture score or report

Provider-Level Dashboard

1. List all accounts
2. For each account, collect:
   • Total agents (online vs offline)
   • Open incidents by severity
   • Recent incidents in the last 24 hours
3. Sort accounts by risk (most open critical/high incidents first)
4. Flag accounts with offline agents or unreviewed incidents

Error Handling

Common Errors

Account Not Found

Account not found: ID 99999

The account may have been removed or the ID is incorrect.
List all accounts with GET /v3/accounts to find valid account IDs.

Related Skills

• api-patterns - Authentication, pagination, error handling
• incidents - Incidents scoped to accounts
• agents - Agents deployed per account
• apps - Applications inventoried per account