> ## Documentation Index > Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt > Use this file to discover all available pages before exploring further. # Liongard API > Read Liongard Actionable Alerts, change detections, inspected systems and their data, metric values, inventory, launchpoints and agents per client; run an inspection again; manage environments, launchpoints, agents, users and webhooks — each area follows the approval setting you give it An agent with this tool turns Liongard's Actionable Alerts into PSA tickets, one per alert, and answers a ticket from the client's Liongard data: what the alert found, what changed on the client's systems, and whether the alert cleared after the fix. > [!NOTE] > > Automatically enabled when you configure Liongard permissions in your agent workflow. No manual toggle needed. ## What It Does * Find the client's environments from the [Organization Mapping](/integrations/liongard/overview#your-clients-are-mapped-automatically) * Read Actionable Alerts: number, title, finding and action, priority, status, client, and the inspection that raised them * Raise a ticket in your PSA for each new alert, once per alert, with the finding and the action (a ServiceNow incident or request, or a ticket in your other PSA) * Read change detections: what changed, on which system, and when * Read a system's latest inspection data, its timeline, metric values and the client dashboard's numbers * Run an inspection again, and manage launchpoints, agents, asset inventory, environments, metrics, users and webhooks The agent calls Liongard through the [Vendor API](/agents/tools/vendor-api) tool, with `liongard` as the vendor id. [Sandbox](/agents/tools/built-in/sandbox) scripts can call Liongard too, under the same permissions. ## Permission Groups | Group | Access levels | What it covers | | - | - | - | | **Alerts & Change Detections** | Disabled, Read Only, Read/Write | Actionable Alerts and change detections, their counts and single records. Every call here is a read | | **Systems & Inspection Data** | Disabled, Read Only, Read/Write | Systems and a system's latest data, the timeline and its raw data, metric values, an environment's dashboard queries, and an inspection's log. Every call here is a read | | **Launchpoints & Inspections** | Disabled, Read Only, Read/Write | Launchpoints and the inspector catalog (inspectors, their templates and versions). Write runs an inspection now (one or many), and creates, edits, schedules and deletes launchpoints | | **Agents** | Disabled, Read Only, Read/Write | Liongard agents. Write edits or removes an agent, empties its job queue, and makes an agent installer | | **Asset Inventory** | Disabled, Read Only, Read/Write | Device and identity inventory. Write edits one record or many | | **Environments & Groups** | Disabled, Read Only, Read/Write | Environments, their related agents, launchpoints and integration mappings, and environment groups. Write creates, edits and deletes them | | **Metrics** | Disabled, Read Only, Read/Write | Metric definitions and the environments that use them. Write deletes a custom metric | | **Users, Access Keys & Webhooks** | Disabled, Read Only, Read/Write | Users, roles, the calling user's access keys (without their secrets), and webhooks. Write creates, edits and removes users and webhooks | Liongard's lists and queries that take a body are sent as POST, but Neo treats them as reads. Running an inspection is sent as a GET, but Neo treats it as a change: it follows the group's approval setting, and a read-only agent or script cannot send it. ## Access Profiles > **Read Only** > > Every group Read Only. The agent can read any alert, change, system or record, but never changes anything. > **Helpdesk** > > Reads on its own. Every change, a new inspection run included, waits on a technician. > **IT Admin** > > Edits asset inventory on its own. Launchpoints and inspection runs, agents, environments, metrics, users and webhooks wait on a technician. > **Full Automation** > > Nothing waits on a technician, except the changes below. ## Changes that always ask a technician These always wait on a technician, whatever the settings: deleting an environment, and any write whose body sets a value on a field whose name holds `password`, `passwd`, `passphrase`, `secret`, `token`, `privatekey`, `apikey`, `sharedkey`, `credential` or `secureconfig`, or is `key`, `psk`, `pwd` or `pin`, unless another word in the name says it describes the secret (`PasswordNeverExpires`, `TokenLifetime`). ## Ticket runs stay on the client's environments On a run for a ticket, Neo sends only calls about an environment mapped to the ticket's company: a path that names the environment (`v1/environments/`), or a call on the client's alerts, detections, systems, timeline, launchpoints, agents or inventory that carries the environment in Neo's `environment_id` parameter. Neo then keeps only that environment's rows of a list, returns a record only when it belongs to that environment, and sends a change to a record only after reading that the record belongs to it. Calls that reach every client (the environment list, counts, users, metrics, webhooks and every bulk call) run only without a ticket, for example in a scheduled agent or a chat. ## Not available through Neo Neo refuses these before it calls Liongard: * Signing in with a user's name and password, and its MFA step, because the response is a session token * Creating an access key, because the response is a working key and secret, and deleting one, because the list is the calling user's own keys and one of them is the key Neo calls with * Generating the webhook signing key, because the response is a secret and a new key breaks the check your webhook receivers make * Evaluating an expression over an inspection, and creating or changing a metric, because the expression picks values out of raw inspection data, where a password can arrive with no field name beside it. Read the system's latest data instead, and write metrics in Liongard Neo also replaces the value of every such field (by the same name rule) in each Liongard response before an agent or a script sees it, inside a launchpoint's configuration text too. A change that sends that placeholder back is refused, and so is a filter or sort that names such a field. ## Setup See [Connecting Liongard to Neo](/integrations/liongard/connecting-to-neo). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.