> ## Documentation Index > Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt > Use this file to discover all available pages before exploring further. # Commvault API > Work Commvault backup tickets on a client's own CommServe: read why a job failed, control jobs and servers, check storage, and start restores and workflows The common use is a ticket from a Commvault alert email in your PSA: the agent finds the job on the client's CommServe, reads why it failed, resubmits it, reads the result, and then closes the ticket or escalates it with the cause. It can also pause a server's backups for maintenance, check storage space, and start a restore or a workflow, which asks a technician first under the Helpdesk and IT Admin profiles. > [!NOTE] > > Automatically enabled when you configure Commvault permissions in your agent workflow. ## What It Does * Read jobs, their failed items, details and events, and the CommServe's triggered alerts * Suspend, resume, kill and resubmit jobs, and start a backup of a subclient, a VM or a plan * Read servers, agents and subclients; add a server by installing the Commvault software, retire or delete one, and turn its backup, restore and data aging activity off or on * Read storage pools with their capacity and free space, and their media agents * Browse backed-up data, start a file or virtual machine restore, and run a Commvault workflow * Read plans, schedules, companies, licence use and the CommServe's version ## Permission Groups | Group | Covers | | - | - | | Jobs & Events | Jobs and their details, failed items, task details, logs and history, CommServe events; suspend, resume, kill and resubmit a job, start a backup | | Alerts & Monitoring | Triggered alerts and console alerts, alert definitions and rules, anomaly reports, syslog, SNMP and SIEM connectors | | Clients & Agents | Servers and server groups, agents, instances, backup sets and subclients, hypervisors and VM groups, Kubernetes, Microsoft 365 and SaaS apps, software installs; add, retire or delete a server, activity control | | Plans & Schedules | Plans, backup destinations, RPO and retention, schedules and schedule policies, blackout windows and operation rules | | Restores & Recovery | Browsing backed-up data; file, database, VM and Microsoft 365 restores; recalls; failover, replication and recovery groups, runbooks and clean rooms | | Storage & Media Agents | Storage pools, backup locations, libraries and tape, media agents, storage policies and copies, deduplication databases, storage arrays and snapshots | | Workflows & Commands | Workflows, running a workflow as a job or through its API, webhooks, external endpoints and QCommands | | Data Insights & Compliance | Data insights and eDiscovery projects, data sources and crawls, compliance searches and exports, data rooms, cyber resilience, threat scans and cost assessments | | Users, Roles & Security | Users and user groups, roles and security associations, access tokens, stored credentials, key management servers, encryption and sign-in settings | | CommCell, Companies & Reports | The CommServe and CommCell settings, CommCell-wide activity control, companies, licences, DR backups, reports, regions, network topologies and email server | ## Access Profiles | Profile | What runs on its own | What asks a technician | | - | - | - | | **Read Only** | Every read | No write is allowed | | **Helpdesk** | Reads; job control, starting backups and working alerts | Changes to servers and their activity, a restore and a workflow. Every other group stays read only | | **IT Admin** | Every read and every write but the next column | A restore, a workflow, data insights, and users and security | | **Full Automation** | Every read and write | Only the writes that always ask (below) | ## Safety Controls | Control | Behavior | | - | - | | **Always ask** | These always need a technician's approval, whatever the profile: every delete but a light one (alerts and alert rules, alert definitions, triggered alerts, event and grid filters, tags, schedule policies and their associations, operation and blackout windows, regions, webhooks, external endpoints, SIEM connectors, data cube entities, eDiscovery requests, plan rules, Kubernetes restore modifiers and a server group's data classification plan), such as deleting a server, a server group, an agent, an instance, a backup set, a subclient, a VM or VM group, a hypervisor, a plan or a backup destination, storage, a backup location, a media agent, a failover, recovery or replication group, a company, a user, a user group, a role, a credential or a workflow; retiring, deconfiguring or offboarding a server, a VM or a company; releasing a licence; a failover group's DR operation and its schedules, and the CommServe's LiveSync failover settings; stopping backups, restores or any other activity for the whole CommCell (its activity switches and its activity properties); turning data aging on; encryption, data privacy (allowing or denying it) and password encryption settings; a QCommand; importing, deploying or deleting a workflow or a report; restarting services or changing the CommServe's host name; stored credentials and a hypervisor's credentials, deleting a key management server, S3 access keys, company authorization codes, and the sign-in settings (SAML, OpenID Connect, LDAP and Active Directory domains, a company's local sign-in); a multi-job operation and a backup destination's job operations; tape media operations and WORM retention; uploading a file to a server; an uninstall, data aging or an admin task run as a task, and a task Neo cannot read; a write that sends a password, key or token | | **Hidden credentials** | Passwords, pass-keys, secrets, private, SSH and encryption keys, API keys, tokens, authorization codes and connection strings read `[removed by Neo]` in every answer. Neo refuses a write that sends the marker, and a credential in a query string | | **Refusals in a success** | Commvault answers some refused calls with HTTP 200 and an error code; Neo reports them as refused, never as done | | **One CommServe per client** | A call reaches the CommServe of the client it names, which on a ticket is the ticket's company | | **Never sent** | Neo signs in and out itself, does not create access tokens or one-time passwords, and does not download files | | **Your server** | Neo sends the password only over HTTPS to the web server address you saved, which must be a public address, and never follows a redirect | This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.