> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Keepit API

> Work Keepit backup alert tickets against each connector's health and jobs, start backups, restore items, search backed-up data and check backups across customer accounts

The common use is a ticket from a Keepit notification email in your PSA, such as an unsuccessful backup or a connector whose health changed. The agent finds the connector in the client's Keepit account, reads its health and the reason, then its failed jobs with their state and summary, and notes the cause and the next step on the ticket. When a later backup succeeded, it can close the ticket. A scheduled agent can check every client's connectors and failed jobs once a day.

> [!NOTE]
>
> Automatically enabled when you configure Keepit permissions in your agent workflow.

## What It Does

* Read customer accounts and their connectors (Microsoft 365, Entra ID, Google Workspace, Salesforce, Dynamics 365 and more)
* Read each connector's health with its reason, what it runs now and its error code, and its settings such as the backup interval
* Read backup and restore jobs with their state, errors and summary, and the snapshot history; start a backup
* Search backed-up mail, files, sites and users, and restore items in place
* Read and manage share links, legal holds, products, licences and usage, notifications and their forwarding, users, tokens and who can reach each connector's data
* Read the audit log, and request a connector's compliance report

## Permission Groups

| Group | Covers |
| - | - |
| Customer Accounts | Your account and the customer accounts below it: details, contacts, attributes, adding a customer account, changing or deleting one |
| Connectors | Each connector's health and reason, status and errors, attributes such as the backup interval; adding, renaming, re-authenticating and deleting a connector |
| Backups and Jobs | Backup and restore jobs, their state, errors and statistics, the snapshot history, and starting a backup |
| Restores | Starting a restore job (write only). Restore jobs are read back through Backups and Jobs |
| Backup Data Search | Searching and browsing backed-up data, its categories, and resolving item paths (read only) |
| Share Links | Share links to backed-up items, the account's share policy, and download requests from a share |
| Legal Holds | Legal holds that preserve backed-up data for eDiscovery, and their saved searches |
| Audit Log and Reports | The audit log, and requesting a connector's compliance report |
| Products, Licences and Usage | Each account's product and its properties (service period, retention, quotas), the portfolio, and storage and seat usage |
| Notifications and Mailbox | The messages Keepit sends, their languages and templates, forwarding them to your users, and each user's in-app mailbox |
| Users, Tokens and Access | Sign-in tokens and their contacts, activation emails, who can reach each connector's backup data, and SSO settings |

## Access Profiles

| Profile | What runs on its own | What asks a technician |
| - | - | - |
| **Read Only** | Every read | No write is allowed |
| **Helpdesk** | Reads of accounts, connectors, jobs, backup data, legal holds, the audit log, usage and notifications | Starting a backup, and a restore. Share links and users stay off |
| **IT Admin** | Reads, and changes to connectors, jobs, restores, legal holds, reports and products | Changes to customer accounts, share links, notifications and users |
| **Full Automation** | Reads and writes in every group | Only the writes that always ask (below) |

## Safety Controls

These writes always need a technician's approval, whatever the profile:

| Write | Why it asks |
| - | - |
| Deleting a customer account, or changing more than its external ID | A change can disable the account or move it to another partner |
| Deleting a connector, or changing more than its name | A change can replace its credentials, cut its retention or turn it off |
| Turning off a connector's automatic backups | The connector stops backing up |
| Changing or deleting a sign-in token | It changes a password or what the token can reach |
| Setting or removing a product property | A wrong service period, retention or quota can delete backups or the account |
| Deleting a legal hold | It releases the data the hold preserves |

Neo never sends these operations, whatever the profile:

| Operation | Why |
| - | - |
| Creating a sign-in token | Keepit answers with the new token's password. A technician adds tokens in Keepit |
| Deleting every secondary token at once | It would delete Neo's own token when that is one of them. Delete one token by its name instead |
| Changing or deleting the token Neo signs in with | Neo would be disconnected until you save a new token on the Keepit card |
| Deleting the account Neo's token belongs to | That is your own partner account, with every customer account under it |
| Downloading a backed-up file, or a compliance report's ZIP file | Files cannot reach the agent. It shares an item with a share link, or asks the technician to download it in Keepit |

Other controls:

| Control | Behavior |
| - | - |
| **Hidden credentials** | Connector, share and token passwords, session keys, download link keys and job tokens read `[hidden by Neo]` in every answer, and Neo refuses a write that sends that value back |
| **Ticket scope** | On a ticket, the agent reaches only the customer account mapped to the ticket's company, by a name match or one you confirmed. Calls with no account in them, such as the share link list and the audit log, are for runs with no ticket company, such as a scheduled check or a chat |
| **Connector check** | On every run, a call goes out only when each connector it names is one of the named account's own connectors |

Keepit's API speaks XML. The agent and AI Skill scripts send and read JSON, and Neo converts both ways.

## Example instructions

An agent that works Keepit alert tickets, triggered on new tickets from Keepit's notification emails:

```
When a ticket comes from a Keepit notification email, find the connector the email names in the
client's Keepit account. Read its health with the reason, and its jobs since one day before the email.
Write an internal note with the event, the connector's name, type and health, each job you read
with its time and state, and the next step. If the connector lost its authentication, say that a
technician must re-authenticate it in Keepit. Set the priority to High for critical health, lost
authentication or an anomaly. Close the ticket only when you read a successful backup job that
started after the email.
```

A scheduled agent that checks backups every morning, with no ticket, so it reaches every customer account:

```
List the Keepit customer accounts and their connectors. For each connector
whose health is not healthy, read its failed jobs of the last day. Post one message per client
with each unhealthy connector, its health and reason, and the newest failed job's state, time and
summary. Say that a backup succeeded only when a job you read today shows it.
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.