Tactical RMM

Tactical RMM is a self-hosted, open source remote monitoring and management platform. Connecting Tactical RMM to Hudu pulls your clients and agents into Hudu automatically, so hostnames, hardware details, operating systems, and check results are documented alongside the rest of each company's assets. This article walks through creating a Tactical RMM API key, connecting Tactical RMM to Hudu, matching Tactical RMM clients to Hudu companies, and choosing where synced agents land.

Visit Understanding Integrations for additional information on how integrations work in Hudu.

What you'll need

A Tactical RMM server you administer.
The API host for that server, usually the api. subdomain created during installation (for example, api.example.com).
Access to create users, roles, and API keys in Tactical RMM.
A valid, publicly trusted TLS certificate on the API host.
- A standard Tactical RMM install already has one through Let's Encrypt.
Admin or Super Admin role within Hudu.

Tactical RMM runs on your own server, so the API host must be reachable from wherever Hudu runs. On Hudu Cloud, the API host needs to be publicly resolvable and reachable over the internet. If you self-host Hudu, your Hudu server needs a network route to the Tactical RMM server.

Integration features

The Tactical RMM integration syncs the following into Hudu:

Clients — Tactical RMM clients are matched to Hudu companies, either existing ones or new companies you create. Only matched clients are imported.
Agents — devices running the Tactical RMM agent, created as assets on the layouts you choose.

Each synced agent gets a Tactical RMM integration card and populates connected fields on its asset. Re-syncing updates existing assets rather than creating duplicates.

Tactical RMM sites are not synced as separate records. Each Tactical RMM client maps to one Hudu company, and the site an agent belongs to is shown on the agent's integration card.

This article uses "company," which is Hudu's default term. If your account renames it, the integration screens use your term instead.

Obtaining the Tactical RMM information

Hudu needs two things from Tactical RMM:

Tactical RMM API domain — the API host for your server, entered without a scheme (for example, api.example.com).
API key — generated in Tactical RMM and tied to a Tactical RMM user.

Creating a read-only user for Hudu

An API key inherits the permissions of the user it belongs to, so we recommend creating a dedicated user with a read-only role rather than reusing an administrator account. Hudu only reads from Tactical RMM.

In Tactical RMM, go to Settings → Permissions Manager and select New Role.
Name the role something like Hudu Read Only, and grant list/read permissions for Clients/Sites and Agents. Leave Allowed Clients and Allowed Sites blank so the role can see every client you may want to sync.
Select Save, then go to Settings → Users and create a new user for Hudu.
Assign the new role to that user and save.

Permission scoping in Tactical RMM applies to the API key as well. If the role is limited to certain clients or sites, Hudu only sees those clients, and the rest never appear for matching.

Generating the API key

In Tactical RMM, go to Settings → Global Settings → API Keys.
Select Add and choose the Hudu user you created.
Give the key a name, such as Hudu, and set an expiration if your policy requires one.
Copy the key and store it somewhere safe.

Keep this key confidential. Anyone holding it can read your Tactical RMM data, and Tactical RMM API keys bypass two-factor authentication.

Treat your Tactical RMM API key like a password. Consider storing it in a Hudu password record so your team can find it later. If you set an expiration, note the date. When the key expires, syncing stops until you generate a new key and update it in Hudu.

Enabling the integration

Integrations can be enabled at any point during your Hudu environment testing and/or during production. Integrations can be merged into your existing documentation based on set rules, so you can start with integration setup or easily connect them at a later date. To enable the Tactical RMM integration:

Navigate to the Hudu admin area → Integrations.
Select Tactical RMM from the list.

Setting up the integration in Hudu

Step 1. Connect to Tactical RMM

Enter your Tactical RMM API domain without a scheme, for example api.example.com.
- Hudu connects over https unless you enter an explicit http:// prefix, which is only intended for instances terminating TLS at an internal proxy.
Paste your API Key.
Select Save Credentials.

Pasting the full URL from your browser is fine. Hudu strips the scheme and anything after the host, so https://api.example.com/clients/ is saved as api.example.com. Make sure you enter the API host (api.example.com), not the web interface host (rmm.example.com).

Step 2. Test the connection

Select Test Connection. Hudu lists your Tactical RMM clients to confirm the key works.
Once the test succeeds, you're moved to the next step automatically.
If the test fails, see the Troubleshooting section of this article.

Step 3. Activate and sync

Select Activate and Sync. Sync time varies depending on data size.
- You can navigate away while the sync runs.
Check the logs during sync for status updates.

Step 4. Configure options

Customize what to sync and what Hudu updates.

Optional settings:
- Auto-update names of assets — automatically syncs asset names from Tactical RMM to keep them current.
- Do not update basic company details — prevents Tactical RMM from overwriting company type, sync status, and the company active/inactive state in Hudu.
- Match assets on primary serial — assets are only matched when both the asset name and primary serial number match. Agents that report no serial number are unaffected.
Optional exclusions: skip the following:
- Devices
Select Save Options to move to the next step.

Step 5. Choose device types

Tactical RMM has no device type list of its own. Each agent reports a platform and a monitoring type, so Hudu creates these six device types up front:

	Server	Workstation
Windows	Windows Server	Windows Workstation
Linux	Linux Server	Linux Workstation
Mac	Mac Server	Mac Workstation

Check any device type you don't want to bring into Hudu. Skipped device types are not synced.
Select Save Device Types.

Because these device types are generated rather than discovered, they're available right away. You don't need a second sync before skipping types or mapping layouts.

Step 6. Match companies

Match at least one company before syncing.

Tactical RMM clients must be matched to:
- Existing companies in Hudu, or
- New companies you create
Use the Unmatched and Matched tabs to review clients. On the Unmatched tab, filter by All match types, Suggested matches, or No suggested matches.
Recommended: match one client first for testing.
Unmatched clients and their agents will not be imported.
Select Sync Now any time you make changes to matches.

Hudu only requests agents for matched clients, so leaving a client unmatched doesn't add to sync time.

Step 7. Choose where data will fill

Default asset layouts

Select a default layout for Tactical RMM devices. This is required. Without it, agents are skipped.
Use Add Sort Rule to send device types to different layouts (for example, servers and workstations), or to create exceptions to the default. Sort rules use the six device types from Step 5.
Select Save Asset Layouts, then select Sync Now to bring in your agents.

Asset layouts must exist and be active before you can select them. Layout changes only apply to new data that has not already been synced into Hudu, so choose your layouts before the initial sync.

Visit Asset Layouts for additional information on creating layouts.

Active integrations re-sync automatically every 3 hours. You can return to Admin → Integrations → Tactical RMM at any time to change settings or run a manual sync.

Tools

Integration cards

Each synced agent gets a Tactical RMM card on its asset showing:

Identity — hostname, description, status, client, site, monitoring type, and platform.
Hardware and OS — operating system, architecture, make and model, serial number, and last logged in user.
Networking — public IP and every local IP address the agent reports.
Components — processors (repeated sockets are collapsed into a count), physical disks, and graphics adapters.
Activity — last seen, boot time, whether the agent needs a reboot, whether patches are pending, whether it's in maintenance mode, and the pending actions count.
Checks — total, passing, failing, warning, and info counts, shown when the agent has at least one check configured.
Agent version

Use the re-sync button in the top right of the card to refresh a single asset.

Connected fields

Tactical RMM agents can populate the following connected fields on your asset layout:

Description
Display name
Firmware version (the agent version)
Hostname
IP address
Last logged in user
Model
Operating system name
Serial number
Device type

Set a field on your layout to one of these data points, then re-sync to fill it with the matching value from Tactical RMM.

Visit the Connected Fields article for additional information on mapping integration data to asset fields.

FAQ

How often does this integration sync?

Active integrations re-sync automatically every 3 hours. You can also select Sync Now in the integration settings or use the re-sync button on an individual card at any time.

Do I need a separate API key for each client?

No. One key covers your whole Tactical RMM instance, subject to the permissions of the user the key belongs to.

Does Hudu write anything back to Tactical RMM?

No. The integration is read-only. Hudu lists clients and agents and never creates, edits, or deletes anything in Tactical RMM.

Does the integration sync contacts from Tactical RMM?

No. Tactical RMM doesn't hold contact records, so contact connected fields stay empty for this integration.

Are Tactical RMM sites synced?

Not as separate records. Each Tactical RMM client maps to one Hudu company, and the site name appears on the agent's integration card.

Can I connect more than one Tactical RMM server?

Each Tactical RMM integration connects to a single API host. If you run more than one Tactical RMM server, add a separate Tactical RMM integration for each.

Will a second sync create duplicate assets?

No. Re-syncing updates the existing assets, cards, and connected fields rather than creating duplicates.

Does the integration support the paginated Tactical RMM API?

No. Hudu uses the standard API, which returns a plain JSON array. The opt-in /beta/v1 paginated API is not supported.

Troubleshooting

The connection test fails

Work through these in order:

Confirm you entered the API host (api.example.com), not the web interface host (rmm.example.com).
Confirm the host resolves publicly and is reachable from Hudu. A Tactical RMM server behind a firewall, on a private DNS zone, or on a VPN-only address can't be reached by Hudu Cloud.
Confirm the certificate on the API host is valid and publicly trusted. A self-signed or expired certificate causes the connection to fail.
Confirm the API key was copied in full, with no extra spaces or line breaks, and that it hasn't expired or been deleted in Tactical RMM.
Confirm the Tactical RMM user the key belongs to still exists, is active, and has a role assigned.

The connection succeeds but no clients appear for matching

The role assigned to the API key's user likely can't list clients, or is limited to certain clients through Allowed Clients and Allowed Sites. In Tactical RMM, open Settings → Permissions Manager, confirm the role grants read access to clients and sites, and clear those restrictions if you expect to see everything. Then re-sync.

Agents aren't syncing for a client

Check the following:

The Tactical RMM client is matched to a Hudu company.
A default layout is selected for Tactical RMM devices.
Devices is not selected under the skip options.
The agent's device type isn't skipped in Step 5.

Some agents synced for a client, but not all of them

The missing agents' device types are likely skipped. For example, if Windows Workstation is skipped, a client's servers sync while its workstations don't. Update your device type selections, then re-sync.

The logs say "Pagination is not supported"

Your Tactical RMM server is responding with the paginated /beta/v1 format, which this integration doesn't support. This is an opt-in setting in local_settings.py on your server. Revert that setting so the API returns plain JSON arrays, then re-sync.

The logs show a timeout or connection error for one sync

A Tactical RMM server that's briefly offline or unreachable doesn't stop the whole sync. The error is recorded in the logs and the next sync tries again. Check that the server is up and reachable, then re-sync. If it happens every sync, work through the connection test steps above.

Assets landed on the wrong layout

Agents use the layout from the matching sort rule, falling back to the default Tactical RMM devices layout. Layout changes only apply to data that has not already been synced, so existing assets stay on their original layout. Update the sort rules or default for future syncs.

A device type I expect isn't in the list

The list is fixed at the six combinations of Windows, Linux, and Mac with Server and Workstation. If Tactical RMM reports a platform Hudu doesn't recognize, those agents go to the default layout.