> ## Documentation Index > Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt > Use this file to discover all available pages before exploring further. # Acronis API > Work Acronis Cyber Protect Cloud from Neo: triage EDR incidents and run response actions, handle failed backups, read and dismiss alerts, manage plans, workloads, users and services per customer The common uses are an EDR incident, where the agent reads its detections, verdict and workload, records the triage and, once approved, isolates the workload, and a failed backup, where the agent reads why it failed, runs the protection plan again for that workload, and dismisses the alert once a backup succeeds. Automatically enabled when you configure Acronis permissions in your agent workflow. ## What It Does * Read a customer's EDR incidents with their detections, verdict, severity and workloads, and set an incident's investigation state, priority and comment * Run a response action Acronis offers on an incident: isolate or release a workload, restart or shut it down, stop a process, quarantine or delete a file, roll back * Read and dismiss alerts, or mark one a false positive * Read why a backup failed from its activity, run the plan again for the workload, and read its recovery points * Read protection plans and their status, apply or revoke a plan, and change one * Read workloads and agents, and update agents * Read your customer tenants, their services, usage and users; turn a service off, and disable and delete a leaver's user so Acronis stops charging for it * Read and update Advanced Automation (Acronis PSA) tickets, and read its contracts and invoices ## Permission Groups | Group | Covers | | - | - | | EDR Incidents | Incidents, their detections and activities, and their investigation state | | EDR Response Actions | Response actions on an incident's workload | | Alerts and Events | Alerts, alert status per workload, dismissing or marking a false positive, custom alert types, the event stream | | Backups, Archives and Vaults | Recovery points, archives and vaults, and deleting backups | | Tasks and Activities | Backup, recovery and scan runs with their result and error (read only) | | Protection Plans | Plans and their status, running, applying and revoking a plan, drafts | | Workloads and Agents | Workloads, groups, agents and their update settings | | Disaster Recovery | Cloud servers, sites, test and production failover | | Customers and Services | Customer tenants and units, services and quotas, edition, branding | | Users | Users of each tenant and their activation | | Roles, MFA and API Clients | A user's roles, MFA, the sign-in provider, API clients without their secrets | | Pricing, Usage and Reports | Usage, prices, price lists, usage reports | | Advanced Automation Service Desk | Acronis PSA tickets, their updates, priorities, statuses and SLAs | | Advanced Automation Sales and Billing | Acronis PSA products, sales items, contracts, taxes and invoices | | File Sync & Share | Files, folders, members, share links, devices, the audit log and settings | | Storage and Infrastructure | Storage infrastructure, locations, storage nodes and directories | ## Access Profiles | Profile | What runs on its own | What asks a technician | | - | - | - | | **Read Only** | Every read | No write is allowed | | **Helpdesk** | Every read outside the Roles, MFA and API Clients, Pricing, Usage and Reports, Advanced Automation Sales and Billing, and Storage and Infrastructure groups; incident triage and alert changes | Response actions, plan changes and runs, and user changes; no other write is allowed | | **IT Admin** | Every read; changes to incidents, alerts, backups, plans, workloads, disaster recovery, users, Advanced Automation tickets and files outside [Safety Controls](#safety-controls) | Response actions, and changes in the Customers and Services, Roles, MFA and API Clients, Pricing, Usage and Reports, Advanced Automation Sales and Billing, and Storage and Infrastructure groups, and the changes in [Safety Controls](#safety-controls) | | **Full Automation** | Every read and write outside [Safety Controls](#safety-controls) | The changes in [Safety Controls](#safety-controls) | ## Safety Controls | Control | Behavior | | - | - | | **The ticket's customer only** | On a run for a ticket that names a company, Neo sends a call only when it names the customer tenant the ticket's company is mapped to: in the path, in the call's own tenant filter, or in `customer_tenant_id`, for which Neo first confirms the alert, task, user, workload or plan belongs to that tenant. A record of a unit inside the customer is acted on outside the ticket | | **No every-customer writes** | A write whose filter reaches every customer under a partner (`descendants(...)`, `direct_children(...)`), and a bulk delete or revoke that names no records by id, are refused | | **Always asks a technician** | Turning a service or an offering item off for a customer (Acronis can then delete that service's data, backups included), changing, deleting or restoring a customer tenant, changing or deleting an API client, reporting usage, unregistering an agent, removing a workload, deleting or revoking a plan, a plan change that turns something off, committing a plan draft, deleting an alert type, deleting a backup, archive, vault, storage, infrastructure record or location, and starting or stopping a production failover | | **Refused** | The sign-in and token endpoints, creating an API client or a registration token (each answer returns a secret), a password reset link, a password check or change, the branding update (it carries the SMTP password Neo hides), replacing a plan draft's whole settings, a vault's password or credentials, adding a storage node, the vault manager's sync, stats and validation writes (Acronis's own agents report them), file downloads and uploads, and the sales item delete, which names no record. A write that sets a password, secret or token is refused too | | **The connection's own API client** | Neo does not change or delete the API client it connects with | | **Secrets** | Fields that carry a credential, such as a registration token or the SMTP password, are hidden in every answer | ## Setup See [Connecting Acronis to Neo](/integrations/acronis/connecting-to-neo). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.