> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Lexful API
> Read and write Lexful resources — organizations, asset types, documentation assets, file attachments, and tags
The Lexful API tool gives Neo agents direct access to the Lexful REST API — read, create, update, and delete Lexful records during ticket resolution.
Automatically enabled when you configure Lexful permissions in your agent. No manual toggle needed.
## What It Does
* Look up customer organizations and the documentation stored against them
* Read documentation pages, configurations, contacts, and locations — including custom asset types you've defined
* Create and update documentation from ticket resolutions
* Read asset type schemas to understand what each kind of record holds
* Download file attachments when the answer lives in an attached diagram or export
* Access any Lexful API endpoint with permission-group-based access control
For "what do we know about X", Neo's own **Find Documentation** tool is usually the better first stop — Neo syncs your Lexful documentation into its search index daily, and that search spans every documentation source you've connected. Reach for the Lexful API tool when you need something the sync doesn't carry: a live value, a non-document asset type, file attachments, or a write.
## Permission Groups
| Permission Group | What It Covers |
| --------------------- | -------------------------------------------------------------------------------------------- |
| **Organizations** | Customer organizations, their hierarchy and website domains, plus the account user directory |
| **Asset Types** | Asset type definitions — which properties each kind of record carries |
| **Assets** | The records themselves: documentation, configurations, contacts, locations, custom types |
| **Asset Files** | File attachments on assets — metadata, download, upload |
| **Tags** | Tags used to classify assets |
| **Search** | Lexful's own cross-entity search |
| **Secure Properties** | Retrieving a stored secret or TOTP code in plaintext |
Each group has an access level: **Disabled**, **Read Only**, or **Read/Write**. Secure Properties is read-only by design — storing a secret happens through **Assets** like any other property.
## Access Profiles
All groups Read Only, except Secure Properties which stays off. The agent can look up any record but cannot modify anything or read a stored secret.
Assets, Asset Files, and Tags at Read/Write — the surfaces where documentation lives. Organizations, Asset Types, and Search stay Read Only. Secure Properties stays off.
Every group Read/Write with delete enabled, except organizations and asset types (which can never be deleted). Secure Properties still stays off — reading credentials in plaintext is always a separate, deliberate decision.
## Safety Controls
| Control | Behavior |
| --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Secrets are masked** | Secret and TOTP values come back as `` on every ordinary read, so an agent reading documentation never sees a credential by accident |
| **Reading a secret needs its own permission** | Plaintext comes only from two endpoints, both behind the Secure Properties group — the same way ITGlue and Hudu gate their Passwords group |
| **Storing a secret always needs approval** | Lexful has no separate "save a password" endpoint, so Neo inspects the request itself and asks a technician to approve any write that sets a credential |
| **Secrets are off by default** | Secure Properties is in no access profile; an admin has to enable it deliberately |
| **Structural safety** | Agents can never delete an organization or an asset type — both would take every record beneath them |
| **Recoverable deletes** | Asset deletes are soft and restorable, and are off unless you enable them per group |
| **Technician-in-the-Loop** | Require human approval for writes — configurable per group |
| **Historical secrets** | Past values of a rotated credential sit behind the same Secure Properties group, never behind ordinary record access |
| **Authentication is Neo's** | Neo mints and caches the access token; auth endpoints are blocked to the agent |
## How to Configure
Connect your Lexful account in the Neo Dashboard's **Integrations** page with your API key ID, secret, and account ID.
In your agent's **Integrations** tab, choose an access profile or customize each permission group.
Decide which permission groups require technician approval for writes. Writes that set a credential always require approval, whatever you choose here.
Only enable **Secure Properties** if an agent genuinely needs to read stored credentials — including the historical values of rotated ones. It is in no access profile, so leaving it alone means the capability isn't there at all.