> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# ControlUp API

> Read ControlUp alerts and statistics, add and remove monitored machines, mute and unmute a machine's alerts, and switch triggers and automations — each change follows the approval settings you give it

The tool reaches your ControlUp organization through ControlUp's platform API, with the API key you save in Neo, so each call is limited twice: by the permissions of the key's user in ControlUp and by the agent's permission groups below.

> [!NOTE]
>
> Automatically enabled when you configure ControlUp permissions in your agent workflow. No manual toggle needed.

## What It Does

* Read the trigger and the event behind a ControlUp alert ticket, and the machine it fired on
* Read real-time metrics and history: machine load, logon times, session timelines, host metrics, Windows events
* Add, update, move or remove the machines ControlUp for VDI monitors
* Mute a machine's alerts by moving it into your maintenance folder, and unmute it by moving it back
* Switch a trigger or automation off and on, with a reason in ControlUp's audit log, or create one
* Work with ControlUp for Desktops, Compliance, Synthetic Monitoring, Workflows, DaaS IQ, users and tenants, with the access and approvals you choose

The agent calls the ControlUp API through the [Vendor API](https://docs.neoagent.io/agents/tools/vendor-api.md) tool, with `controlup` as the vendor id. [Sandbox](https://docs.neoagent.io/agents/tools/built-in/sandbox.md) scripts can call ControlUp too, under the same permissions.

## Permission Groups

| Group | What it covers |
| - | - |
| **VDI Machines** | Monitored machines: add, update, move, remove |
| **VDI Triggers & Automations** | Triggers, their scripts and schedules |
| **VDI Metrics & History** | Real-time metrics and history (read only) |
| **Desktops Devices** | Desktops devices, groups and tags |
| **Desktops Device Actions** | Reboot, scripts, commands, processes, user sessions, messages |
| **Desktops Alerts & Events** | Desktops alert rules and system events |
| **Desktops Data & Reports** | Data indices and custom reports |
| **Desktops User Surveys** | End-user surveys and answers |
| **Platform Alerts & Events** | Alerts across products and platform alert rules |
| **Synthetic Monitoring** | Scouts, tests, alerts and alert policies |
| **Compliance** | Devices, apps, CVEs, patches, issues, custom issues and overwrite rules |
| **Compliance Remediation** | Remediation jobs and their progress |
| **Workflows** | Flows, forms and integrations |
| **Users, Roles & Access** | Users, roles, SSO, SAML, IP allowlist, settings, audit log |
| **Tenants, Blueprints & Tags** | Tenant Manager tenants, Blueprints, tags |
| **DaaS Host Pools & Images** | DaaS IQ host pools, session hosts, images, scaling, costs and jobs |
| **DaaS Sessions** | DaaS user sessions and session host actions |
| **DaaS Cloud Tenants & Credentials** | DaaS IQ cloud tenants and Azure credentials (masked) |

Every group can be Disabled, Read Only or Read/Write, except VDI Metrics & History, which is Read Only at most. Neo never downloads a master image's RDP file or reads a streaming credential check, and removes secrets (a Scout's MFA seed, webhook passwords and tokens, Azure credentials) from every answer.

## Access Profiles

> [accordion] Read Only
>
> Every group Read Only. The agent reads, and never changes anything.

> [accordion] Helpdesk
>
> Every group Read/Write with technician approval, except VDI Metrics & History, Users, Roles & Access, Tenants, Blueprints & Tags, and DaaS Cloud Tenants & Credentials, which are Read Only.

> [accordion] IT Admin
>
> Every group Read/Write without approval (VDI Metrics & History Read Only), except Users, Roles & Access, DaaS Cloud Tenants & Credentials and Compliance, which require technician approval.

> [accordion] Full Automation
>
> Every group Read/Write without approval (VDI Metrics & History Read Only), except the change below.

## Safety Controls

* Deleting a DaaS IQ host pool from Azure requires technician approval under every access profile.
* A write that acts on a list of devices, machines or issues must name at least one.
* Neo never sends back a masked Azure secret, and fills the fields a DaaS IQ replacement leaves out from the stored record.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.