Using the N-able N-central extension

The CloudRadial AutomationAI N-able N-central extension lets a workflow or agent work with your N-central server: look up customers, sites, and devices, check monitoring health, run scripts, manage patch maintenance windows, and review users and access. This article covers what the extension can do, the API user and access token it needs, how its approval gate works, and the skills that ship with it. It is for workspace users who build automations (Admin or Owner Role).

• What the Extension Covers
• Preparing the API User
• Getting an Access Token
• Providing the Credentials to Your Runner
• When the Access Token Expires
• Reads and Approval-Gated Changes
• Running Scripts on a Device
• Skills
• What the Extension Does Not Do

What the Extension Covers

The extension calls the N-central REST API on your own N-central server and provides 56 tools across these areas:

Install it from Extensions like any other catalog extension. See Browsing and installing extensions for the general install flow.

Preparing the API User

Use a dedicated N-central user for AutomationAI rather than a technician's own account:

• Turn multi-factor authentication off for this user. It signs in unattended.
• Give it access to the customers you want automations to reach
• Give it the role permissions for each area you plan to use. For example, user management permissions are needed for the users, roles, and access group tools.

Many of the endpoints the extension uses are marked as preview by N-able and need a recent N-central version: 2023.x or later in general, and 2024.x or later for users, roles, access groups, and maintenance windows.

Getting an Access Token

N-central does not accept the User-API Token (a JSON Web Token) directly on data calls. You exchange it for an access token, and the extension sends the stored access token on every call. The extension does not renew the token, so its lifetime decides how often you repeat these steps:

1. In N-central, go to Administration > User Management > Users, open the API user, and under API Access select Generate JSON Web Token.
2. Exchange the token for an access token. The header below requests a one-year (8,760-hour) expiry, but N-central caps it at the server's system-wide access token expiry, which is 1 hour by default. Ask your N-central administrator to raise that setting if you need a longer-lived token, and check the expiry in the response to see the lifetime you were granted:

   curl -X POST https://<server>/api/auth/authenticate \
     -H "Authorization: Bearer <JWT>" \
     -H "X-ACCESS-EXPIRY-OVERRIDE: 8760h"

3. Copy the value of tokens.access.token from the response. This long string is the access token you store in the next step.

When the access token expires, every call returns 401. Repeat steps 2 and 3 and replace the NCentral-AccessToken secret.

Providing the Credentials to Your Runner

Store two secrets in your runner's Key Vault with these exact names:

For how to add these, see Accessing and updating your runner's Key Vault. Once the secrets are in place, ask the AI Playground to check the N-central connection; the connection-check skill confirms the server responds, the token is valid, and which N-central version you are on.

When the Access Token Expires

The access token has a fixed expiry. When it lapses, every N-central call returns a 401 error. To fix it, repeat step 2 of Getting an Access Token to mint a new access token, and replace the value of NCentral-AccessToken in your runner's Key Vault. Note the expiry date when you create the token so you can renew it before it lapses.

The ncentral_validate_token tool tells you whether the stored token still works, so it is the quickest way to confirm that a 401 is an expired token rather than a permissions problem.

Reads and Approval-Gated Changes

Of the 56 tools, 43 are read-only and run without interruption. The remaining 13 create, update, delete, or run something, and every one of them is approval-gated: the run pauses and the request appears as an Action Required item in the Inbox until someone approves it. See Handling Action Required items in the Inbox.

The approval-gated tools are:

• Create a service organization, customer, or site
• Update a device's asset lifecycle data
• Run a script or automation policy on a device
• Add or delete device patch maintenance windows
• Set a device or org-unit custom property value
• Change an org-unit custom property's default and propagation
• Create a user role
• Create an org-unit or device access group

Running Scripts on a Device

The extension can run a script or automation policy from your N-central Script/Software Repository on one device at a time. A few rules apply:

• The script or automation policy must have Enable API turned on in the repository, or N-central rejects the request
• Windows scripts, Mac scripts, and automation policies are supported
• Tasks run as LocalSystem or with the device's own credentials. Custom credentials are not supported, so no username or password ever passes through the agent.
• After the task is created, the agent follows its status and reads the per-device output

Patch maintenance windows follow N-central's own rules: only windows created at device level can be deleted, and windows inherited from a rule cannot.

Skills

The extension ships 12 skills that guide an agent through common N-central tasks:

N-central has no search-by-name for devices, customers, or sites, so the agent resolves a name by listing and matching it. If several records match, it asks which one you mean rather than guessing.

What the Extension Does Not Do

Some N-central endpoints are deliberately left out:

• The token exchange and refresh endpoints, because they need the raw User-API Token or refresh token rather than the access token
• Endpoints that take a username and password in the request, including the authenticated server-info check and the PSA credential and ticket lookups. Credentials are kept out of the agent.
• Custom credentials for scripts, for the same reason
• The full-replace update for asset lifecycle data, which requires every field and would blank any you leave out. The extension uses a partial update that changes only the fields you pass.

If you are still having trouble, we’re here to help! Submit a ticket here for assistance, and don’t forget to check our status page to ensure there are no outages in your area.