# Level RMM

Monitor all your managed devices, groups, and alerts across your MSP clients with Level's modern RMM platform and AI-powered insights.

Connect Weavestream to Level RMM to monitor:

• 💻 Devices - All managed endpoints with real-time status
• 🏢 Groups - Organization and device groupings
• 🚨 Alerts - Real-time monitoring alerts and incidents
• 🔗 Relationships - Devices linked to groups, alerts linked to devices
• 📊 System Details - OS, hardware, network, and health status

Estimated Setup Time: 10 minutes

• Level account with API access
• Admin or appropriate role permissions
• At least one organization with managed devices
• Weavestream installed on your Mac

1. Go to https://app.level.io
2. Sign in with your Level account

1. Click on your profile icon (top right)
2. Select "Settings" or "Account Settings"
3. In the left sidebar, look for "API" or "Integrations"
4. Click "API Keys" or "API Access"

1. Click "Generate New API Key" or "Create API Key"
2. Fill in the details:
   • Name: Weavestream Monitor
   • Description: API access for Weavestream unified monitoring dashboard
   • Permissions: Select:
     • ✅ Read Devices
     • ✅ Read Groups
     • ✅ Read Alerts
     • ❌ Don't select write permissions (read-only is safer)
3. Click "Generate" or "Create"

After creation, you'll see:

📋 API Key

• Example: lvl_abc123xyz789randomstring456...
• ⚠️ IMPORTANT: Copy this immediately - you may not see it again!

Save this API key securely - you'll need it for Weavestream.

1. Open Weavestream
2. Click the "+" button in the sidebar
3. Select "Add Source"
4. Fill in the source details:
   • Name: Level
   • Base URL: https://api.level.io/v2
   • Auth Type: API Key or Bearer
   • API Key: Paste your Level API key
   • Header Name: Authorization (if using Bearer) or X-API-Key
   • Header Value: Bearer YOUR_API_KEY (if Bearer) or just the key
   • Icon: Select server.rack or shield.checkered or custom icon
   • Color: Choose your preference (suggested: #64D2FF - Level blue, or #00C9FF)
   • Refresh Interval: 15 minutes (for real-time monitoring)
5. Click "Add" or "Save"

Note: Check Level's API documentation for the exact authentication format (Bearer token vs API key header).

Now we'll add endpoints to monitor different aspects of your Level environment.

Monitor all your MSP client organizations and device groups.

Configuration:

• Name: Groups
• Path: /groups
• Method: GET
• Query Parameters: (none needed)

Field Mapping:

• ID Field: id
• Title Field: name
• Date Field: created_at (if available)
• Summary Fields: description, device_count
• Status Field: (none)

Retention Mode: Keep All (preserve group history)

Get detailed information about all managed devices across all groups.

Configuration:

• Name: Devices
• Path: /devices
• Method: GET

Query Parameters:

• per_page: 100 (results per page)
• page: 1 (pagination)

Pagination Config:

• Type: Page-based
• Page Field: page
• Page Size Field: per_page
• Page Size: 100
• Max Items: 1000 (or adjust based on your fleet size)

Field Mapping:

• ID Field: id
• Title Field: hostname (or name)
• Date Field: last_seen_at or created_at
• Summary Fields: group_name, full_operating_system, ip_address, mac_address
• Status Field: online
  • Map true → ok
  • Map false → critical

Retention Mode: Keep All (preserve device history)

Relationships:

• Link to Groups endpoint
• Source Field: group_id
• Target Endpoint: Groups
• Target ID Field: id
• Fields to Include: name (group name)

Monitor all active alerts and incidents across your managed devices.

Configuration:

• Name: Alerts
• Path: /alerts
• Method: GET

Query Parameters:

• per_page: 100
• status: open (optional - only open alerts)

Field Mapping:

• ID Field: id
• Title Field: name (or alert_type)
• Date Field: started_at (or created_at)
• Summary Fields: description, severity, group_name
• Status Field: is_resolved
  • Important: Enable "Invert Status Boolean"
  • This maps is_resolved: false → critical and is_resolved: true → ok
  • Or map directly: false → critical, true → ok

Retention Mode: Keep All (preserve alert history)

Relationships:

• Link to Devices endpoint
• Source Field: device_id
• Target Endpoint: Devices
• Target ID Field: id
• Fields to Include: hostname, group_name, full_operating_system

This allows AI to answer: "Which device triggered this alert?" and "Show me device details for this alert"

Monitor devices for a specific client/group.

Configuration:

• Name: [Group Name] Devices
• Path: /devices
• Method: GET

Query Parameters:

• group_id: 123 (your group ID - get from Groups endpoint)
• per_page: 100

Alternative: Create a Smart Filter on Devices endpoint:

• Condition: group_id equals [GROUP_ID]

Field Mapping: Same as "Devices" endpoint

Get detailed information about a specific device.

Configuration:

• Name: Device Details - [Hostname]
• Path: /devices/{device_id}
• Method: GET

Replace {device_id} with actual device ID from Devices endpoint.

Field Mapping:

• ID Field: id
• Title Field: hostname
• Date Field: last_seen_at
• Summary Fields: cpu, memory, disk, network

Use Case: Create separate endpoints for critical servers to track detailed metrics.

{
  "id": "dev_abc123",
  "hostname": "WORKSTATION-01",
  "group_id": "grp_xyz789",
  "group_name": "Acme Corporation",
  "online": true,
  "last_seen_at": "2024-01-26T14:30:00Z",
  "created_at": "2024-01-15T10:00:00Z",
  "full_operating_system": "Windows 11 Pro (22H2)",
  "operating_system": "Windows",
  "os_version": "11",
  "ip_address": "192.168.1.100",
  "mac_address": "00:1A:2B:3C:4D:5E",
  "cpu": {
    "model": "Intel Core i7-12700",
    "cores": 12,
    "usage_percent": 45
  },
  "memory": {
    "total_gb": 32,
    "used_gb": 16,
    "usage_percent": 50
  },
  "disk": {
    "total_gb": 1000,
    "used_gb": 550,
    "free_gb": 450,
    "usage_percent": 55
  }
}

{
  "id": "alert_123",
  "device_id": "dev_abc123",
  "name": "High CPU Usage",
  "description": "CPU usage exceeded 90% for 5 minutes",
  "severity": "critical",
  "started_at": "2024-01-26T14:00:00Z",
  "resolved_at": null,
  "is_resolved": false,
  "alert_type": "cpu",
  "threshold": 90,
  "current_value": 95,
  "group_name": "Acme Corporation"
}

{
  "id": "grp_xyz789",
  "name": "Acme Corporation",
  "description": "Main office and satellite locations",
  "device_count": 45,
  "created_at": "2023-06-01T00:00:00Z",
  "updated_at": "2024-01-26T10:00:00Z"
}

1. Under Level source, click "+" → "New Filter"
2. Name: Offline Devices
3. Select Endpoint: Devices
4. Add Condition:
   • Field: online
   • Type: Boolean
   • Operator: equals or is false
   • Value: false
5. Logic: Match ALL (AND)
6. Save

1. Create new filter
2. Name: Critical Alerts - Unresolved
3. Select Endpoint: Alerts
4. Add Conditions:
   • Field: severity
   • Operator: equals
   • Value: critical
   • AND
   • Field: is_resolved
   • Operator: equals
   • Value: false
5. Logic: Match ALL (AND)
6. Save

1. Create new filter
2. Name: Windows Devices
3. Select Endpoint: Devices
4. Add Condition:
   • Field: operating_system
   • Operator: equals or contains
   • Value: Windows
5. Save

1. Create new filter
2. Name: Stale Devices (24h+)
3. Select Endpoint: Devices
4. Add Condition:
   • Field: last_seen_at
   • Operator: not in last
   • Value: 24 hours
5. Save

1. Create new filter
2. Name: [Client Name] Devices
3. Select Endpoint: Devices
4. Add Condition:
   • Field: group_id
   • Operator: equals
   • Value: grp_xyz789 (get from Groups endpoint)
5. Save

Pro Tip: Create one filter per VIP client for quick access.

1. Create new filter
2. Name: Low Disk Space (<15%)
3. Select Endpoint: Devices
4. Add Condition:
   • Field: disk.usage_percent
   • Operator: greater than
   • Value: 85
5. Save

Track resolved/historical alerts.

1. Create new filter
2. Name: Alert History
3. Select Endpoint: Alerts
4. Add Condition:
   • Field: resolved_at
   • Operator: in last
   • Value: 30 days
5. Save

Now you can ask intelligent questions about your Level environment!

Device Status:

• "How many devices are offline right now?"
• "Which clients have offline devices?"
• "Show me all Windows 11 devices"
• "What devices haven't checked in today?"

Alert Management:

• "What critical alerts do I have?"
• "Show me all disk space alerts"
• "Which device has the most alerts?"
• "Summarize today's alerts by severity"

Group/Client Overview:

• "How many devices does Acme Corp have?"
• "Which group has the most devices?"
• "List all my clients and their device counts"

System Analysis:

• "Show me all devices running Windows 10"
• "Which workstations have high CPU usage?"
• "Find devices with low disk space"
• "What's the most common OS version?"

Troubleshooting:

• "Why is WORKSTATION-01 offline?"
• "Show me the alert history for server XYZ"
• "Which devices went offline today?"
• "Find devices with unresolved alerts"

Reporting:

• "Generate a health report for Acme Corp"
• "Summarize my entire MSP fleet"
• "Create a weekly alert summary"
• "Show me device trends across all groups"

Relationship Queries (Powered by linked data):

• "What group does this device belong to?"
• "Show me all alerts for Acme Corp devices"
• "Which device triggered this alert?"

Level API may support various query parameters (check their docs):

Device Filtering:

group_id: grp_xyz789     - Filter by group
online: true             - Only online devices
operating_system: Windows - Filter by OS
per_page: 100           - Results per page
page: 1                 - Page number

Alert Filtering:

severity: critical      - Only critical alerts
status: open           - Only open/unresolved
device_id: dev_123     - Alerts for specific device
alert_type: cpu        - By alert type
per_page: 100          - Results per page

Pagination: Level likely uses page-based pagination:

page: 1                - Current page
per_page: 100          - Items per page

Sorting:

sort: last_seen_at     - Sort field
order: desc            - Sort direction (asc/desc)

Level uses various status representations:

Device Online Status:

• online: true → Device is online → Map to ok
• online: false → Device is offline → Map to critical

Alert Resolution:

• is_resolved: false → Alert is active → Map to critical
• is_resolved: true → Alert is resolved → Map to ok
• Important: May need to invert this mapping

Alert Severity:

• critical → critical
• warning → warning
• info → info

Weavestream's relationship feature lets AI understand connections between data.

Example: Devices → Groups

When you link devices to groups:

• AI can answer: "Which group owns this device?"
• Can query: "Show me all devices for Acme Corp"
• Enriches device data with group name

Configuration:

• Source Field: group_id (in Devices)
• Target Endpoint: Groups
• Target ID Field: id (in Groups)
• Fields to Include: name, description

Example: Alerts → Devices

When you link alerts to devices:

• AI can answer: "Which device triggered this alert?"
• Can query: "Show me device details for alert XYZ"
• Enriches alerts with device info (hostname, OS, etc.)

Configuration:

• Source Field: device_id (in Alerts)
• Target Endpoint: Devices
• Target ID Field: id (in Devices)
• Fields to Include: hostname, group_name, full_operating_system

For MSPs managing many clients:

Setup:

• One "Devices" endpoint for all groups
• Create Smart Filters per group/client
• Filter condition: group_id equals [GROUP_ID]

Pros:

• Simple setup
• Easy cross-client queries
• One place for all device data

Cons:

• All devices in one large list
• Can't customize refresh per client

Setup:

• Multiple device endpoints with group-specific query params
• Each client gets dedicated endpoint with group_id filter

Pros:

• Clean separation in UI
• Can prioritize VIP clients (faster refresh)
• Better performance for large fleets

Cons:

• More complex setup
• More API calls
• Harder to query across all clients

Recommendation: Start with Approach 1, consider Approach 2 if you have 50+ groups.

Solution:

1. Verify API key is correct (no extra spaces)
2. Check authentication format (Bearer vs API Key header)
3. Ensure API key hasn't expired
4. Try creating a new API key
5. Verify your Level account has appropriate permissions

Solution:

1. Verify you have managed devices in Level
2. Check API permissions include device read access
3. Try removing query parameters to test
4. Ensure your Level user role has device visibility
5. Check pagination is configured correctly

Solution: Level API has rate limits (check their documentation):

Best practices:

• Increase refresh interval (15 min → 30 min)
• Reduce per_page if hitting timeouts
• Stagger sync times for multiple endpoints
• Monitor API usage in Level dashboard

Solution:

1. Check raw JSON to verify field name is exactly online
2. Ensure boolean mapping is correct (true = ok, false = critical)
3. Verify you're not inverting when you shouldn't

Solution:

1. Ensure both endpoints (source and target) are syncing successfully
2. Verify relationship source field exists in data (e.g., group_id, device_id)
3. Check target ID field matches (e.g., group id, device id)
4. Make sure target endpoint is synced before source endpoint
5. Check for typos in field names

Solution:

1. Verify pagination config is set correctly:
   • Type: Page-based
   • Page field: page
   • Page size field: per_page
2. Increase max items per sync if you have large fleet
3. Check Level API docs for exact pagination format
4. Try manual pagination test with different page numbers

• Use read-only API keys (no write access needed)
• Create separate API keys for each integration
• Rotate API keys every 90 days
• Monitor API usage regularly
• Store credentials securely (Weavestream uses macOS Keychain)
• Set appropriate permissions on API keys

• Grant write/delete permissions unless absolutely necessary
• Share API keys with anyone
• Use the same API key for multiple integrations
• Store credentials in plain text
• Leave inactive API keys enabled
• Commit API keys to version control

Here are more endpoints you may be able to add (check Level API docs):

Path: /scripts

List automation scripts available in your Level environment.

Path: /jobs

Track script execution and scheduled tasks.

Path: /policies

Monitoring policies and configurations.

Path: /users

Level users and their roles.

Path: /activity

Audit log of changes and actions.

Path: /reports

Pre-built or custom reports.

Level works great alongside:

NinjaOne / Action1:

• Cross-reference devices between RMM platforms
• Compare endpoint coverage
• Validate monitoring completeness

Azure AD / Microsoft 365:

• Match devices to Azure AD joined devices
• Verify domain membership
• Cross-reference with Intune management

PSA Tools:

• Link alerts to tickets
• Track device assignments to clients
• Generate billing reports

Backup Solutions:

• Verify backup coverage across all devices
• Identify devices missing from backup
• Cross-check backup status with device health

Before you finish, verify:

• ✅ Level API key created with read permissions
• ✅ API key copied and saved securely
• ✅ Level source added to Weavestream
• ✅ Groups endpoint syncing successfully
• ✅ Devices endpoint syncing (with online status mapped correctly)
• ✅ Alerts endpoint syncing (with is_resolved mapped correctly)
• ✅ Relationships configured (Devices→Groups, Alerts→Devices)
• ✅ Pagination configured for Devices endpoint
• ✅ Smart filters created for offline devices, critical alerts
• ✅ Tested AI questions about your Level environment

You're all set! Monitor your entire MSP fleet with intelligent AI insights. 🚀

Tip 1: Morning Dashboard Ask AI: "Summarize overnight alerts and offline devices"

Tip 2: Client Health Checks Create filters per VIP client with 5-min refresh for real-time status

Tip 3: Trending Analysis Weekly question: "What were the most common alerts this week?"

Tip 4: Proactive Monitoring Set up filters for:

• Devices offline >4 hours
• Critical alerts not resolved in 2 hours
• Devices with >5 warnings
• High resource usage (CPU, memory, disk)

Tip 5: Client Reporting Monthly: "Generate device health summary for [Client Name]"

Tip 6: Cross-Platform Validation If using multiple RMMs: "Compare device counts between Level and NinjaOne"

Last updated: February 2026 Level API version: v2