> ## Documentation Index > Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt > Use this file to discover all available pages before exploring further. # FortiManager API > Read your clients' FortiGates, policies and web filters through FortiManager, ask a FortiGate how it rates a website, and change and install policies and filters > [!NOTE] > > Automatically enabled when you configure FortiManager permissions in your agent workflow. ## What It Does * Find the client's ADOM, and its FortiGates with model, firmware, connection and sync status, HA and VDOMs * Ask a client's own FortiGate, through FortiManager, how FortiGuard rates a website for it, and read its status, sessions, interfaces, VPN tunnels and logs * Find why a site was blocked: the policy, the web filter profile, its category actions and its URL filter * Allow or block a website in the client's URL filter * Read and change policy packages, firewall policies, addresses, services and other objects, templates, and a FortiGate's settings in FortiManager's device database * Preview and install a policy package or a FortiGate's settings, and report the install task per FortiGate * Report which FortiGates are out of sync with FortiManager, and upgrade a FortiGate's firmware from FortiGuard Neo changes a FortiGate's configuration in FortiManager and installs it, never on the FortiGate directly. A change reaches the FortiGate when its install finishes. ## How the agent handles a blocked website The agent finds the client's ADOM and the FortiGate the ticket is about, and asks that FortiGate how it rates the site, because FortiManager's rating can differ from the FortiGate's own. It reads the policy and web filter that apply, and reports the category and what blocked it. When asked to allow the site, it adds one entry to the profile's URL filter, installs the policy package to that FortiGate, reads the install task, and reports what changed. ## Permission Groups | Group | Access levels | Covers | | - | - | - | | Devices, ADOMs and Groups | Disabled, Read Only, Read / Write | ADOMs, managed FortiGates and their VDOMs and HA members, device groups and folders | | Status, Tasks and Logs | Disabled, Read Only, Read / Write | FortiManager status, tasks, policy hit counts, package status, and a FortiGate's own status, sessions and logs | | Policy Packages, Firewall Policies and Objects | Disabled, Read Only, Read / Write | Policy packages, firewall policies, addresses, services, schedules, VIPs and their per-device mappings | | Security Profiles and Web Filter | Disabled, Read Only, Read / Write | Web filter, URL filters, FortiGuard categories and local ratings, antivirus, IPS, application control, DNS filter and email filter | | VPN | Disabled, Read Only, Read / Write | IPsec and SSL VPN settings, VPN Manager communities, and each tunnel's status | | Network, SD-WAN, Wireless and Switching | Disabled, Read Only, Read / Write | Interfaces and their per-device mappings, zones, routing, SD-WAN templates, DHCP, FortiSwitches and FortiAPs | | Firmware, Revisions and Restarts | Disabled, Read Only, Read / Write | Firmware images and upgrades of managed FortiGates, configuration revisions, and a FortiGate's restart | | FortiGate System Settings and Templates | Disabled, Read Only, Read / Write | A FortiGate's global settings in FortiManager's device database, system templates, DNS, NTP, SNMP and replacement messages | | Users, Certificates and Administration | Disabled, Read Only, Read / Write | Local and remote users, user groups, authentication servers, certificates and a FortiGate's administrators | | Installs, Scripts and Workspace | Disabled, Read Only, Read / Write | Installing policy packages and device settings to FortiGates, install previews, workspace locks and commits, CLI scripts and templates | | Workflow Approvals | Disabled, Read Only, Read / Write | Approving or rejecting a workflow session in FortiManager's workflow mode | | FortiManager Settings | Disabled, Read Only, Read / Write | FortiManager's own settings, FortiGuard distribution, metadata fields and ADOM options | In an ADOM in workspace mode, a change is wrapped in a lock and a commit. These steps need **Read / Write** on **Installs, Scripts and Workspace** and never ask on their own: each change follows its own group's approval setting, and the install follows the Installs group's. ## Access Profiles | Profile | What runs on its own | What asks a technician | | - | - | - | | **Read Only** | Every read | No write is allowed | | **Helpdesk** | Every read; monitoring writes | Every other write and every install; workflow approvals and FortiManager's settings stay read-only | | **IT Admin** | Installs, firmware, VPN, network, system and inventory writes, and the Helpdesk writes | Policy, security profile, administration and FortiManager settings writes, and every write under Safety Controls | | **Full Automation** | Every write except those below | Only the writes under Safety Controls | ## Safety Controls | Control | Behavior | | - | - | | **Always ask** | A write that sets a password, key or other secret, or changes a user's two-factor sign-in; any change to FortiManager's administrators, their profiles or how they sign in; a CLI script or CLI template, and running a script on FortiGates; deleting an ADOM or a policy package; removing a FortiGate from FortiManager, and replacing its serial number; restarting FortiManager, and upgrading an ADOM or FortiManager's database; a firmware upgrade from an image that is not FortiGuard's; and, on a FortiGate's own configuration in FortiManager or through it, any change to its administrators, API users and their access profiles, its automation stitches, triggers and actions, its SNMP communities, a password or FortiToken change, and shutting it down. These always ask a technician, whatever the profile | | **Secrets** | Every password, pre-shared key, shared secret, private key, encrypted value and SNMP community comes back as `[hidden by Neo]`. A write that leaves the field out keeps the stored value; a write that sends the marker back is refused, and so is a filter or sort on a hidden field | | **Whole records** | Neo creates with `add` and changes only the fields it sends with `update`; FortiManager's `set`, which replaces a whole record and would blank its hidden secrets, is refused. Before a change that sends a list, Neo reads the record: when the field is a child table (a URL filter's entries, BGP neighbors), the change is refused, because it would replace every entry; the agent changes one entry at a time. When the read fails, the change is not sent | | **Deletes** | A change or delete must name one entry; one on a whole table, or one that selects entries with a filter, is refused | | **FortiGate configuration** | A FortiGate's configuration is changed in FortiManager and installed; a configuration change sent to the FortiGate directly through FortiManager is refused. Any other action sent to a FortiGate through FortiManager names one FortiGate, never a group | | **Right client** | On a ticket whose company is mapped to an ADOM, every call must name that ADOM, and every FortiGate or task it names must be in it. Writes to the global database every ADOM shares, and calls that reach every client or FortiManager itself, are refused on such a ticket | | **Refused** | Sign-in and sign-out calls; FortiManager's configuration backup and other file downloads; resetting FortiManager's global database | ## How to Configure **1. Connect FortiManager** Save your FortiManager's address and API key in the Neo Dashboard under the **Networking** integrations category. See [Connecting FortiManager to Neo](https://docs.neoagent.io/integrations/fortimanager/connecting-to-neo.md). **2. Configure permissions** On the agent's **Tools & Settings** tab, click **Networking** and expand the **FortiManager** block. Pick one of its **Presets**, which are the access profiles above, or set each permission group yourself. > [!TIP] > > Start with **Read Only**. Checking a site's category, finding why it was blocked and install reports need only reads. To allow a site, the agent needs **Read / Write** on **Security Profiles and Web Filter** and on **Installs, Scripts and Workspace**. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.