Purpose
This guide explains how to connect Logsign USO to the legacy FSecure WithSecure Management API (provider name FSecure WithSecure in the Data Collection device list) using an account username, password, and an API key issued by your WithSecure/F-Secure partner or reseller.
This is not the same integration as "FSecure WithSecure Elements." Logsign has two separate FSecure/WithSecure API pollers, and picking the wrong one means the connection will never authenticate:
- FSecure WithSecure (this guide) authenticates with a username, a password, and an API key against a partner-specific management server, and pulls security events through a
/security-events/pollingendpoint scoped to a single account UUID. This matches the pattern of F-Secure's older PSB (Protection Service for Business) Management API, the account/reseller management layer that predates the Elements platform. As of this research (July 2026), WithSecure's current API catalog at connect.withsecure.com no longer lists a PSB or Business Suite API among its active APIs, only the Elements API, Commercial API, Provisioning API, and Distributor API, alongside one API explicitly marked legacy (Vulnerability Management). This strongly suggests the management API this poller talks to is itself a legacy, unpublished generation, though WithSecure has not published an explicit deprecation notice for it that could be verified during this research. - FSecure WithSecure Elements (separate guide, separate device type in the Provider dropdown) authenticates with an OAuth2 Client ID and Client Secret against the current Elements Security Center, and requires an Organization UUID. It pulls events from the modern
security-events/v1/security-eventsendpoint atapi.connect.withsecure.com, covering several detection engines (DeepGuard, email scan, EPP/EDR, ECP).
If your organization manages endpoints through the newer Elements Security Center (Management > Organization Settings > API Clients), use the FSecure WithSecure Elements integration instead. Use this guide only if your account still authenticates against an older PSB-style management portal with a username and password, not an OAuth Client ID/Secret pair.
Prerequisites
You need an account on the management portal (username and password) with permission to call the account's security-events API, plus a separate API key value (sent as the x-api-key header) that is typically issued to partners/resellers by WithSecure/F-Secure rather than self-generated from a self-service UI screen. Public WithSecure/F-Secure community references describe this API as using a role-based authorization model where full access to the account's Management API requires a role along the lines of "security and subscription management rights"; the exact role name and where to assign it in your specific portal version has not been verified against a live tenant during this research and should be confirmed with your WithSecure/F-Secure partner contact before assuming a plain admin account is sufficient.
Use least privilege. Do not request full reseller/partner administrator access if your only need is to read security events for one account. Ask your WithSecure/F-Secure partner contact for a scoped account limited to security event read access on the specific account UUID you intend to poll, if your portal offers that option.
Step 1: Obtain Your Management Server Address
Unlike Logsign's Elements integration, this legacy API does not use a single fixed hostname. Each partner/tenant is assigned its own management server address by WithSecure/F-Secure at onboarding, generally following a regional subdomain pattern such as https://eu1.psb.fsapi.com or a similar regional variant (US, APAC, and so on). This exact list of regional addresses is not published on WithSecure's current documentation site (the legacy management API is no longer listed there), so doğrulanmadı: do not guess your server address from the examples above. Confirm the correct address for your account with your WithSecure/F-Secure partner or support contact. It is the value you will enter as the URL field in Step 3.
Format matters. Logsign builds the login request by appending /authentication/login directly to whatever you enter in the URL field. Enter the address with the https:// scheme included and with no trailing slash, for example https://eu1.psb.fsapi.com. A trailing slash produces a double slash in the request path and will cause authentication to fail.
Step 2: Obtain Your API Key, Username, and Password
Request the following three items from your WithSecure/F-Secure partner or reseller, or locate them in your management portal account settings if you already have portal access:
- The portal username and password you use to sign in to the management portal.
- An API key value, separate from your login password, sent by Logsign as the
x-api-keyrequest header on every call. This is typically provisioned by WithSecure/F-Secure for partner/reseller integrations rather than self-generated from a visible "API Keys" screen; the exact self-service path (if one exists in your portal version) could not be confirmed from public documentation during this research and should be verified with your account contact.
Store the password and API key securely. Logsign only needs read access to security events; do not use credentials that also carry endpoint remediation or billing/subscription management rights unless your organization has already decided to reuse the same account for other integrations.
Step 3: Configure the Integration in Logsign USO
After obtaining the management server address, username, password, and API key, log in to Logsign USO and add a new data source, selecting FSecure WithSecure from the Provider dropdown (not "FSecure WithSecure Elements"). You will be asked for:
| Field | Value |
|---|---|
| URL | Your management server address from Step 1, including the https:// scheme and no trailing slash, for example https://eu1.psb.fsapi.com |
| x-api-key | The API key value from Step 2 |
| Username | Your management portal username from Step 2 |
| Password | Your management portal password from Step 2 |
Click Check Connection before saving. Logsign calls POST <URL>/authentication/login with your username and password in the body and the API key in the x-api-key header. On success, WithSecure returns a bearer token together with an account UUID; Logsign caches both and reuses them on later polls, only re-authenticating when the token is rejected. Logsign then periodically calls GET <URL>/accounts/<account UUID>/security-events/polling, using each event's persistenceTimestamp field as the sync cursor (up to 200 events per request) so polling resumes from the last event received rather than the beginning. If no prior position is stored, the first poll looks back a default of 1 hour.
Troubleshooting
| Error | Likely cause | What to check |
|---|---|---|
| Check Connection fails with "Authentication Failed" | The Logsign UI's connection test only reports a generic failure message; it does not distinguish between a wrong URL, a wrong username/password, or a wrong API key. | Re-verify all four fields against Step 3 one at a time. Confirm the URL has the https:// prefix and no trailing slash (Step 1), since a malformed URL and a wrong password both surface as the same generic error. |
| 400 Bad Request | The login or security-events request was malformed, most often because the account UUID or a required parameter is missing or invalid on WithSecure's side. | Confirm the account is active and the credentials belong to an account that actually has an associated account UUID in the management portal. |
| 401 Unauthorized | The username/password or API key is wrong, or a previously cached access token expired. | Logsign automatically re-authenticates once on a 401 during normal polling. If 401s persist across multiple polling cycles, the stored username, password, or API key in the Logsign data source configuration is stale; re-enter them and confirm they still work by signing in to the management portal directly. |
| 403 Forbidden | The account authenticates but does not have permission to read security events for the target account UUID. | Ask your WithSecure/F-Secure partner contact to confirm the account holds the security/subscription management role referenced in Prerequisites, scoped to the correct account. |
| 404 Not Found | The account UUID returned at login does not correspond to a valid security-events endpoint, or the URL in Step 1 points at the wrong regional server. | Re-confirm the management server address with your WithSecure/F-Secure contact; a customer on the wrong regional server will authenticate but then fail to find the events endpoint. |
| 429 Too Many Requests | Not an officially documented limit for this legacy API. The poller does not implement special retry/backoff handling for 429; a failed poll is simply retried on the next scheduled cycle. | If this appears repeatedly, reduce polling frequency or contact Logsign support; there is no published rate-limit figure to configure against. |
Notes and Limits
- This is a legacy integration. WithSecure's current, actively documented API surface is the Elements API family; this poller's authentication pattern (username/password plus a separately issued API key, against a partner-specific management server) does not appear among WithSecure's currently published active APIs. If your organization has since migrated to the Elements platform, use the FSecure WithSecure Elements integration instead, which is documented separately and requires an OAuth Client ID/Secret and Organization UUID rather than a username and password.
- Every event ingested through this poller is normalized into Logsign's fixed EventMap category
Security / Alert / Info(EventMap ID 23201). Unlike the Elements integration, which classifies events by detection engine (DeepGuard, email scan, EPP/EDR, ECP), this legacy poller applies the same single classification to every event regardless of its underlying WithSecure engine or category, since it was built before that engine-level detail was surfaced in the API. - Events are throttled on the Logsign side according to the EPS (events per second) value configured for the data source; there is no configurable value for the upstream request page size, which is fixed at 200 events per poll cycle.
- Field coverage is limited to endpoint/EDR alert-style data (account, device, alert reason, process, user), not the fuller event catalog the Elements API exposes. If you need broader endpoint telemetry, evaluate whether the Elements integration meets your requirements before continuing to rely on this legacy connector.
- Because the exact self-service steps for generating an API key and confirming the required role name could not be verified against a live portal during this research (WithSecure no longer publishes documentation for this API generation), treat Steps 1 and 2 as a starting point for a conversation with your WithSecure/F-Secure partner contact rather than a fully self-service walkthrough.