> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Nerdio Manager API

> Find a user's Azure Virtual Desktop session and host, fix a stuck session, check FSLogix locks, run scripted actions and manage host pools in Nerdio Manager for MSP, each change following the approval settings you give it

The tool reaches your own Nerdio Manager for MSP through its REST API, with the REST API app you save in Neo, so each call is limited twice: by that app's rights in Nerdio Manager and by the agent's permission groups below.

> [!NOTE]
>
> Automatically enabled when you configure Nerdio Manager permissions in your agent workflow. No manual toggle needed.

## What It Does

* Find the client's account, host pools and session hosts, and who is signed in where, with each session's state and start time
* Read each session host's status, heartbeat, session count and drain mode, and start, stop or restart it
* Log off a user's stuck session with the [log-off scripted action](https://docs.neoagent.io/integrations/nerdio/connecting-to-neo.md#3-add-the-log-off-script-recommended), or restart the host with a technician's approval
* Run Nerdio's **Detect Stale FSLogix File Handles** scripted action and report the locked profiles, and read each host pool's FSLogix settings
* Run a scripted action in a client's account, and read the task's status and log
* Read and change a host pool's auto-scale, read its AVD, RDP and session time-out settings, and power desktop images on or off
* Find a user and their MFA status, read an Intune device's compliance and failed apps, and read backup and billing

The agent calls the Nerdio Manager API through the [Vendor API](https://docs.neoagent.io/agents/tools/vendor-api.md) tool, with `nerdio` as the vendor id. [Sandbox](https://docs.neoagent.io/agents/tools/built-in/sandbox.md) scripts can call Nerdio Manager too, under the same permissions.

## Permission Groups

| Group | What it covers |
| - | - |
| **Accounts & Provisioning** | Client accounts, account provisioning, Nerdio role assignments |
| **Host Pools & Workspaces** | Host pools and their settings, assigned users, workspaces, auto-scale profiles |
| **Session Hosts & User Sessions** | Session hosts, their status and schedules, and user sessions |
| **Desktop Images** | Desktop images, change logs and schedules |
| **Scripted Actions & Tasks** | Scripted actions, schedules, and the tasks they run with their logs |
| **Backup & Recovery** | Protected items, recovery points, recovery vaults and policies |
| **Users, Groups & Devices** | Users and MFA status, groups, Intune devices, app assignments, vulnerabilities |
| **Device Passwords & BitLocker Keys** | A device's LAPS password and BitLocker recovery keys |
| **Networks, Storage & Variables** | Networks, resource groups, AD and FSLogix profiles, variables, reservations |
| **Billing & Usage** | Invoices, usage and cost estimates |

Every group can be Disabled, Read Only or Read/Write. Neo never reads the values of secure variables, never reads a device password or BitLocker key on a ticket, and never gives one to a sandbox script. Neo removes the fields Nerdio keeps credentials in from every answer.

## Access Profiles

> [accordion] Read Only
>
> Every group Read Only, except Device Passwords & BitLocker Keys, which is Disabled. The agent reads, and never changes anything.

> [accordion] Helpdesk
>
> Session Hosts & User Sessions and Scripted Actions & Tasks are Read/Write with technician approval. Device Passwords & BitLocker Keys is Disabled. Everything else is Read Only.

> [accordion] IT Admin
>
> Every group Read/Write. Accounts & Provisioning, Backup & Recovery, Networks, Storage & Variables, and Billing & Usage require technician approval, and so do the changes below.

> [accordion] Full Automation
>
> Every group Read/Write without approval, except the changes below, which still require technician approval.

## Safety Controls

These require technician approval under every access profile, whatever the group's own approval setting:

* Linking a new client tenant to Nerdio Manager, and granting a Nerdio role.
* Restarting or stopping a session host, which signs out every user on it.
* Deleting a host pool, which deletes its session hosts.
* Turning a resource's backup off, unlinking a recovery vault, and deleting a backup policy.
* Creating, changing or deleting a secure variable, and replacing an app's assignments.
* Any change that sends a password, a secret, a token or a storage key, or hands a scripted action a secure variable.

On a ticket, the agent sends only calls in the account the ticket's company maps to on the Organization Mapping tab. MSP-level calls, the account list and task reads are refused there; a chat with no ticket can make them.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.