Keepit API

The common use is a ticket from a Keepit notification email in your PSA, such as an unsuccessful backup or a connector whose health changed. The agent finds the connector in the client’s Keepit account, reads its health and the reason, then its failed jobs with their state and summary, and notes the cause and the next step on the ticket. When a later backup succeeded, it can close the ticket. A scheduled agent can check every client’s connectors and failed jobs once a day.

Automatically enabled when you configure Keepit permissions in your agent workflow.

What It Does

Read customer accounts and their connectors (Microsoft 365, Entra ID, Google Workspace, Salesforce, Dynamics 365 and more)
Read each connector’s health with its reason, what it runs now and its error code, and its settings such as the backup interval
Read backup and restore jobs with their state, errors and summary, and the snapshot history; start a backup
Search backed-up mail, files, sites and users, and restore items in place
Read and manage share links, legal holds, products, licences and usage, notifications and their forwarding, users, tokens and who can reach each connector’s data
Read the audit log, and request a connector’s compliance report

Permission Groups

Group	Covers
Customer Accounts	Your account and the customer accounts below it: details, contacts, attributes, adding a customer account, changing or deleting one
Connectors	Each connector’s health and reason, status and errors, attributes such as the backup interval; adding, renaming, re-authenticating and deleting a connector
Backups and Jobs	Backup and restore jobs, their state, errors and statistics, the snapshot history, and starting a backup
Restores	Starting a restore job (write only). Restore jobs are read back through Backups and Jobs
Backup Data Search	Searching and browsing backed-up data, its categories, and resolving item paths (read only)
Share Links	Share links to backed-up items, the account’s share policy, and download requests from a share
Legal Holds	Legal holds that preserve backed-up data for eDiscovery, and their saved searches
Audit Log and Reports	The audit log, and requesting a connector’s compliance report
Products, Licences and Usage	Each account’s product and its properties (service period, retention, quotas), the portfolio, and storage and seat usage
Notifications and Mailbox	The messages Keepit sends, their languages and templates, forwarding them to your users, and each user’s in-app mailbox
Users, Tokens and Access	Sign-in tokens and their contacts, activation emails, who can reach each connector’s backup data, and SSO settings

Access Profiles

Profile	What runs on its own	What asks a technician
Read Only	Every read	No write is allowed
Helpdesk	Reads of accounts, connectors, jobs, backup data, legal holds, the audit log, usage and notifications	Starting a backup, and a restore. Share links and users stay off
IT Admin	Reads, and changes to connectors, jobs, restores, legal holds, reports and products	Changes to customer accounts, share links, notifications and users
Full Automation	Reads and writes in every group	Only the writes that always ask (below)

Safety Controls

These writes always need a technician’s approval, whatever the profile:

Write	Why it asks
Deleting a customer account, or changing more than its external ID	A change can disable the account or move it to another partner
Deleting a connector, or changing more than its name	A change can replace its credentials, cut its retention or turn it off
Turning off a connector’s automatic backups	The connector stops backing up
Changing or deleting a sign-in token	It changes a password or what the token can reach
Setting or removing a product property	A wrong service period, retention or quota can delete backups or the account
Deleting a legal hold	It releases the data the hold preserves

Neo never sends these operations, whatever the profile:

Operation	Why
Creating a sign-in token	Keepit answers with the new token’s password. A technician adds tokens in Keepit
Deleting every secondary token at once	It would delete Neo’s own token when that is one of them. Delete one token by its name instead
Changing or deleting the token Neo signs in with	Neo would be disconnected until you save a new token on the Keepit card
Deleting the account Neo’s token belongs to	That is your own partner account, with every customer account under it
Downloading a backed-up file, or a compliance report’s ZIP file	Files cannot reach the agent. It shares an item with a share link, or asks the technician to download it in Keepit

Other controls:

Control	Behavior
Hidden credentials	Connector, share and token passwords, session keys, download link keys and job tokens read `[hidden by Neo]` in every answer, and Neo refuses a write that sends that value back
Ticket scope	On a ticket, the agent reaches only the customer account mapped to the ticket’s company, by a name match or one you confirmed. Calls with no account in them, such as the share link list and the audit log, are for runs with no ticket company, such as a scheduled check or a chat
Connector check	On every run, a call goes out only when each connector it names is one of the named account’s own connectors

Keepit’s API speaks XML. The agent and AI Skill scripts send and read JSON, and Neo converts both ways.

Example instructions

An agent that works Keepit alert tickets, triggered on new tickets from Keepit’s notification emails:

When a ticket comes from a Keepit notification email, find the connector the email names in the
client's Keepit account. Read its health with the reason, and its jobs since one day before the email.
Write an internal note with the event, the connector's name, type and health, each job you read
with its time and state, and the next step. If the connector lost its authentication, say that a
technician must re-authenticate it in Keepit. Set the priority to High for critical health, lost
authentication or an anomaly. Close the ticket only when you read a successful backup job that
started after the email.

A scheduled agent that checks backups every morning, with no ticket, so it reaches every customer account:

List the Keepit customer accounts and their connectors. For each connector
whose health is not healthy, read its failed jobs of the last day. Post one message per client
with each unhealthy connector, its health and reason, and the newest failed job's state, time and
summary. Say that a backup succeeded only when a job you read today shows it.

Getting started

Core

Triggered & Scheduled Agents

Chat Agents

Integrations

Product

Workflows

Customizing Neo

What It Does

Permission Groups

Access Profiles

Safety Controls

Example instructions

​What It Does

​Permission Groups

​Access Profiles

​Safety Controls

​Example instructions

What It Does

Permission Groups

Access Profiles

Safety Controls

Example instructions