ArrowSphere API

Automatically enabled when you configure ArrowSphere permissions in your agent workflow.

What It Does

Find the customer’s ArrowSphere reference from the company mapping, or by Microsoft tenant ID

Read a customer’s licences with seats, seats in use, term, auto-renew and renewal date

Schedule a term or billing-frequency change on a licence, and read the changes already scheduled

Turn auto-renew on or off, suspend and reactivate a licence, convert a trial

Place orders for new products and add-ons, and follow them

Read and send quotes, read statements and consumption, and open support cases with Arrow

Permission Groups

Group	Covers
Customers	End customers, their contacts, agreements, provisioning and migration
GDAP and Customer Access	GDAP relationships with customers’ Microsoft tenants, and GDAP links
Licenses	Licences, seats in use, renewals, scheduled changes and licence lifecycle
Pricing and Rates	Resale rates on licences, special bids and billing comments
Orders	Orders for new products and add-ons
Quotes	Quotes with Arrow and your customers
Catalog	Products, offers, add-ons and prices (read-only)
Statements and Consumption	Billing statements, ERP exports, consumption and usage reports
Partner Account	Your programs, organization units, custom fields and campaigns
Partner Users	The people who sign in to your ArrowSphere account
Support Issues	Your cases with Arrow support

Access Profiles

Profile	What runs on its own	What asks a technician
Read Only	Every read	No write is allowed
Helpdesk	Every read	Every write
IT Admin	Every read, and customers, licences, orders, quotes and the rest	GDAP links and partner user changes
Full Automation	Every read and every write	Deleting a customer, cancelling a licence, removing MFA, anonymizing users, and bulk changes from an uploaded file

Safety Controls

Control	Behavior
Seat counts	Only Change License Seats changes a seat count. This tool refuses every seat write, so a change always goes through the licence lock
Calls	Neo sends only the operations the ArrowSphere API documents. Every other call is refused
Always asks	Deleting a customer, cancelling a licence, removing a partner user’s MFA, anonymizing partner users, and bulk changes from an uploaded file always ask a technician, whatever the profile
Credentials	The two reads that return a sign-in credential (a customer’s vendor account, a licence’s sign-in) are refused
Callbacks	An export that would send data to an outside address (`callbackUrl`) is refused

What It Does