> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# 3CX API

> Add a new starter's user and extension and remove a leaver's on your clients' 3CX phone systems, and work with departments, desk phones, call routing, contacts, live calls, call history, trunks and system settings

The common use is onboarding and offboarding: when a new starter ticket comes in, the agent creates the user on the client's 3CX with the next free extension in the right department and sends their welcome email; when a leaver ticket comes in, it finds the leaver by email and disables or deletes their extension, as your instructions say.

> [!NOTE]
>
> Automatically enabled when you configure 3CX permissions in your agent workflow. 3CX is connected per client, so the agent calls the PBX of the company it works on.

## What it does

* Find users by email, extension number or name, with their departments and roles
* Create, change, disable and delete users and their extensions, and send their welcome email
* Read and change departments, queues, ring groups, digital receptionists, inbound and outbound rules, parking, holidays and office hours
* Read desk phones and their registration, and reboot or reprovision a phone
* Read and change the company and personal phone books
* See calls in progress, place a call from a user's phone and end a call
* Read call and chat history and every report's data
* Read and change recordings and voicemail settings, trunks, integrations and system settings

Neo does not return files, such as a recording, a greeting or a report as a download: the agent reads the same records with the list or report data calls. Neo does not read access tokens, API keys or provisioning links: the agent sends a new user their welcome email instead.

Neo replaces passwords, PINs, keys, tokens, one-time tickets, provisioning links, meeting join links and a backup's download link in every 3CX answer, so the agent never reads one. So is the value of a setting whose name says it is a credential (a parameter such as `SMTP_PASSWORD`), and every value of a CRM integration's settings, since 3CX does not mark which of them are passwords or tokens. A write that sends Neo's placeholder back is refused, so 3CX keeps the value it has, and a filter, sort or search on such a field is refused too.

## Roles

A user's role in a department (user, receptionist, manager, department admin or owner, system admin or owner) is set in the user's own record. A write that gives a user, a department or an API client any role other than user, or any other right, needs the **Roles & Admin Rights** group at Read / Write as well, and asks a technician when that group asks.

## Related records

An agent can ask 3CX for related records in one read, such as a user's departments with the user. Each related record needs its own permission group: a user's desk phones need Phones & Devices, and a call flow app's trunk needs Trunks. The same holds for a filter or a sort on a related record, such as users filtered by their desk phone's MAC address.

## Permission groups

| Group | Access levels | Covers |
| - | - | - |
| Users & Extensions | Disabled, Read Only, Read / Write | Users and their extensions, department memberships, forwarding profiles and greetings, welcome emails, new passwords sent to the user, DN properties, fax extensions and hotel rooms |
| Roles & Admin Rights | Disabled, Read Only, Read / Write | The rights of each role in a department, and any write that gives a role other than user |
| Departments | Disabled, Read Only, Read / Write | Departments (a company on a multi-company PBX), their members, office hours routing and live chat links |
| Phones & Devices | Disabled, Read Only, Read / Write | Desk phones and their registration, provisioning, reboot and firmware, FXS gateways, phone templates and logos, phone settings and SBCs |
| Call Routing | Disabled, Read Only, Read / Write | Queues, ring groups, digital receptionists, inbound and outbound rules, parking, holidays, office hours, DIDs, call flow apps, blocked numbers, music on hold and prompts |
| Contacts | Disabled, Read Only, Read / Write | The company and personal phone books |
| Live Calls | Disabled, Read Only, Read / Write | Calls in progress, placing a call from a user's phone and ending a call |
| Call History & Reports | Disabled, Read Only, Read / Write | Call and chat history with numbers and names, every report's data, scheduled reports and queue statistics |
| Recordings & Voicemail | Disabled, Read Only, Read / Write | Call recordings and their transcription, archive and storage, voicemail settings and remote archiving |
| Trunks | Disabled, Read Only, Read / Write | SIP trunks, their templates and routes, registration, analysis and test calls |
| Integrations & API Access | Disabled, Read Only, Read / Write | API clients, OAuth clients and their tokens, MCP servers, CRM, Microsoft 365, Teams, Google, Amazon, data connector and AI settings |
| System & Security | Disabled, Read Only, Read / Write | System status, services, backups, updates, licence, firewall, IP blocklist, anti-hacking, network, mail, logging, parameters and every other system setting |

## Access profiles

| Profile | What runs on its own | What asks a technician |
| - | - | - |
| **Read Only** | Reads in every group but Recordings & Voicemail | No write is allowed |
| **Helpdesk** | The same reads | Adding, changing or removing a user, a desk phone or a contact |
| **IT Admin** | Every read and write in every group but Recordings & Voicemail | A role or admin right, an integration or API client, and a system setting |
| **Full Automation** | Every 3CX call Neo sends, in every group | Only the changes in Safety Controls |

Read Only, Helpdesk and IT Admin keep Recordings & Voicemail off. Turn it on by hand for an agent that needs it.

## Safety Controls

These changes always ask a technician, whatever the agent's settings:

* Restoring a backup, which replaces the PBX's whole configuration
* Deleting a department, which deletes a company on the PBX with the extensions, queues and rules in it
* Deleting every record of a kind at once: purging logs, calls, chats, faxes, local backups, recordings, every user's voicemail, outbound rules, or every contact of a type
* Any write that stores a password, PIN, key or token


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.