> ## Documentation Index > Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt > Use this file to discover all available pages before exploring further. # Kemp LoadMaster API > Read virtual services, real servers, statistics and appliance health on a client's LoadMaster; enable and disable real servers and virtual services; change the configuration — each change follows the approval settings you give it An agent with this tool answers a load balancer ticket from the client's LoadMaster: which virtual service it is about, which real servers behind it are up, how busy the appliance is, and when its licence ends. It also takes a real server out of service for maintenance and puts it back. > [!NOTE] > > Automatically enabled when you configure Kemp LoadMaster permissions in your agent workflow. No manual toggle needed. ## What It Does * List virtual services, SubVSs and real servers with their status, and the up, down and disabled totals * Read statistics per virtual service, and the appliance's CPU, memory, disk, network, RAID and HA state * Read the licence type, its end date and the support end date * Disable a real server on one virtual service or on all of them, so its sessions drain, and enable it again after the work * Enable or disable a virtual service * Ping or traceroute a real server from the LoadMaster, and read top and memory * Change virtual services, real servers, rules, health checks, limits, certificates, WAF, GEO, network, HA, users and system settings, with the access and approvals you choose The agent calls the LoadMaster through the [Vendor API](https://docs.neoagent.io/agents/tools/vendor-api.md) tool, with `kemp_loadmaster` as the vendor id. [Sandbox](https://docs.neoagent.io/agents/tools/built-in/sandbox.md) scripts can call it too, under the same permissions. Each client's LoadMaster is its own connection (see [Kemp LoadMaster](https://docs.neoagent.io/integrations/kemp-loadmaster/overview.md)). ## Permission Groups | Group | What it covers | | - | - | | **Status, Statistics and Licence** | Up, down and disabled totals, statistics, RAID, the licence, and any system parameter by name | | **Enable and Disable Services** | Enabling and disabling a real server (on one virtual service or all) and a virtual service. Nothing else | | **Virtual Services and Real Servers** | Virtual services, SubVSs, real servers, templates, cache and compression exceptions, Kubernetes ingress. Deleting a virtual service always requires technician approval | | **Rules and Health Checks** | Content rules and health check settings | | **QoS and Limits** | Client connection, rate and bandwidth limits, URL-based limiting rules | | **Web Application Firewall** | WAF rules per virtual service, OWASP and custom rules, updates, remote logging, intrusion detection rules | | **Edge Security and SSO** | SSO domains, their sessions and locked users, LDAP endpoints, RSA SecurID, SAML | | **Certificates and TLS** | Certificates, intermediates, ACME certificates and cipher sets | | **Global Balancing (GEO)** | FQDNs, clusters, IP ranges, locations, the IP access list, DNSSEC and statistics | | **Network, Routing and Access Lists** | Interfaces, bonds, VLANs, routes, DNS and hosts, the packet filter's allow and block lists, VPNs | | **High Availability** | HA settings on premises, in Azure and in AWS, and a sync to the partner | | **Logs and Diagnostics** | Log lists, ping, traceroute, top, memory, clearing logs and statistics | | **Users and Remote Access** | Local users, remote user groups, user certificates and the partner secret | | **System Administration** | System parameters, the licence, reboot and shutdown, firmware rollback and add-on packs | Every group can be Disabled, Read Only or Read/Write. Neo never sends these commands: `addapikey`, `listapikeys` and `delapikey` (API keys stay out of the agent's context), `set_initial_passwd`, `usersetsyspassword` and `accepteula` (first start), `setadminaccess` (it moves the address Neo calls), `backup`, `restore`, `backupcert` and `restorecert` (whole configurations and private keys), `userreadcert` and `userdownloadcert` (a private key), and `logging.savelogs`, `logging.saveextlogs`, `logging.savemlogcdata` and `tcpdump` (binary archives). Neo also never changes the API switch, the API or web interface port and interface, session management or basic authentication, because those carry Neo's own connection. Neo removes passwords, secrets, pre-shared keys, session cookies and private keys from every answer. ## Access Profiles > **Read Only** > > Every group Read Only. The agent reads, and never changes anything. > **Helpdesk** > > Enable and Disable Services and Edge Security and SSO are Read/Write with technician approval. Everything else is Read Only. > **IT Admin** > > Every group Read/Write. Web Application Firewall, Edge Security and SSO, Network, Users and Remote Access, and System Administration require technician approval. > **Full Automation** > > Every group Read/Write without approval, except the changes below, which still require technician approval. ## Changes that always ask a technician These require technician approval under every access profile, whatever the group's own approval setting: * Deleting a virtual service, an FQDN or a GEO cluster, and turning GEO off. * A reboot or a shutdown, a firmware rollback, and adding or removing an add-on pack. * A licence change, and the commands that deactivate the licence. * Adding, changing or removing a local user or a remote user group, its permissions, password or certificate. * Adding, changing or removing an SSO domain, an LDAP endpoint, RSA SecurID settings or a SAML identity provider. * Removing a WAF rule set from a virtual service, disabling WAF rules, turning a virtual service's WAF off, and turning the packet routing filter off. * Changing a remote access setting: web interface, SSH, session or RADIUS access, password rules and certificates for sign-in. * Any change that stores a credential, such as a password, a secret, a VPN pre-shared key or a certificate with its private key. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.