> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Cove Data Protection API

> Read each Cove device's backup sessions and errors, change devices, customers, profiles and notifications, and report backups across customers

The common use is a backup ticket: the agent finds the device in Cove, reads its last session (status, errors count, last successful backup, per data source), starts the backup again through your RMM when you allow it, and notes on the ticket what it found. A scheduled agent can do the same for every customer and send a daily backup report.

> [!NOTE]
>
> Automatically enabled when you configure Cove Data Protection permissions in your agent workflow.

## What It Does

* List each customer's devices with their backup statistics: last session status and time, errors count, last successful session, selected, processed and sent sizes, active data sources, storage use, profile and retention policy, OS and Backup Manager version
* Read the same statistics per data source: files, System State, SQL Server, Exchange, Network Shares, VMware, Hyper-V, MySQL, Oracle, Microsoft 365 Exchange, OneDrive, SharePoint and Teams
* Read and change a device: its profile, retention policy, customer, labels, custom column values and features; add and remove devices
* Read and change customers, their contacts and notes, and get the command line that installs Backup Manager for a customer
* Read and change profiles, retention policies, notification rules and templates, scheduled reports, console users and storage
* Read Cove's service jobs and the audit log

## Permission Groups

| Group | Covers |
| - | - |
| Devices and Backup Status | Devices and their backup statistics, a device's record, labels, custom column values, features and storage nodes |
| Customers and Deployment | The customer tree, each customer's record, state, history, contacts, notes and partner properties, and automatic deployment |
| Profiles and Retention Policies | Backup profiles, retention policies and their features |
| Notifications and Reports | Notification rules, templates and transports, scheduled report deliveries and unsubscribed addresses |
| Users and Access | Console users, roles, permissions, sign-in times, invitations and dashboard view settings |
| Storage | Storages, storage nodes, storage statistics, regions and locations, and moving a device's data between nodes |
| Service Jobs | Cove's jobs that move, copy, consolidate or delete backup data |
| Account Settings and Audit | Server and environment information, branding, partner URLs, prices, licence agreement information, custom column definitions and the audit log |

## Access Profiles

| Profile | What runs on its own | What asks a technician |
| - | - | - |
| **Read Only** | Every read | No write is allowed |
| **Helpdesk** | Every read | A change to a device |
| **IT Admin** | Every read, and changes to devices, customers, service jobs and account settings | Changes to profiles, retention policies, notifications, users and storage |
| **Full Automation** | Every read and write | Only the changes below |

## Safety Controls

| Control | Behavior |
| - | - |
| **Changes that always ask a technician** | Removing a customer, a device, a device's backup data, a customer's personal data, a storage or a storage node; changing a customer's state; starting, approving, cancelling or restarting a service job; and any change that sends a password, token or other credential |
| **Credentials** | Neo hides every device password and encryption token, user password, session and remote-access link in Cove's answers. Neo never signs in as another user, reads a device's encryption key or reinstall passphrase, looks a record up by its password, or opens remote access to a device |
| **Refused calls** | Neo never sends `ModifyUserOnLogin`, the calls a Backup Manager or a storage node makes to report its own work, or the calls that accept or decline N-able's licence agreement |
| **Ticket scope** | On a ticket, the agent reaches only the Cove customer mapped to the ticket's company, by a name match or one you confirmed. A call that names a device goes out only after Cove's own record shows the device belongs to that customer or one of its sites. Your whole customer tree, users, notification rules, profiles and storage are for runs with no ticket company, such as a scheduled report or a chat |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.