> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# SolarWinds Orion API

> Read Orion nodes, alerts and statistics; acknowledge alerts, mute and unmanage, add and remove devices, and change the other Orion modules — each change follows the approval settings you give it

An agent with this tool answers a monitoring ticket from your Orion data: which node it is about, whether Orion can still reach it, which alerts are active on it, and what its values looked like when the alert started.

> [!NOTE]
>
> Automatically enabled when you configure SolarWinds Orion permissions in your agent workflow. No manual toggle needed.

## What It Does

* Find the node by caption, IP address, DNS name, custom property or group
* Read the node's status, response time, packet loss, CPU and memory, and its active alerts with their severity, trigger time and message
* Find the alert behind a ticket an Orion alert opened, by node, alert name and trigger time, or by the incident number Orion's own incident integration recorded
* Acknowledge an alert, add a note or clear it, with the ticket number in the note
* Read CPU, memory, disk, interface traffic, response time, application and hardware health over time
* Mute and unmute a node's alerts for a change window, and unmanage or remanage a node, interface, volume or application
* Add a device to monitoring by ping, SNMP or WMI, let Orion find its interfaces and volumes, set its custom properties and groups, poll it now, and remove a retired device
* Change the other Orion modules (alert definitions, applications, network configurations, virtualization, IP addresses, dashboards and settings), with the access and approvals you choose

The agent calls Orion through the [Vendor API](https://docs.neoagent.io/agents/tools/vendor-api.md) tool, with `solarwinds_orion` as the vendor id. Every read is a SWQL query through SWIS. [Sandbox](https://docs.neoagent.io/agents/tools/built-in/sandbox.md) scripts can call Orion too, under the same permissions.

## Permission Groups

| Group | What it covers |
| - | - |
| **Monitoring Data** | Every read: SWQL queries, a record read by its Uri, and the verbs that only read |
| **Alerts and Events** | Acknowledge, note and clear alerts; acknowledge events and notifications |
| **Mute and Unmanage** | Mute and unmute alerts; unmanage and remanage nodes, interfaces, volumes, applications and arrays |
| **Alert Definitions and Actions** | Alert definitions, actions, schedules, SMTP servers and incident integrations |
| **Nodes and Monitoring** | Nodes, interfaces, volumes, custom properties, pollers, groups, dependencies, discovery, thresholds, hardware health, NetFlow, NetPath and wireless. Deleting a node always requires technician approval |
| **Agents** | Orion agents and packet analysis probes |
| **Applications and Server Monitoring** | Application monitors and templates, server configuration, patch, web transaction, database, log and container monitoring |
| **Server, VM and Cloud Actions** | Services, IIS sites and pools, server reboots, VM power, snapshots, size and placement, cloud instances |
| **Network Configuration (NCM)** | Configuration backups and uploads, device scripts, firmware, compliance and jobs |
| **Virtualization, Storage and Cloud** | Hypervisors, storage arrays and cloud accounts |
| **IP Addresses, DHCP and DNS** | IP address management, DHCP, DNS and user device tracking |
| **Dashboards, Reports and Maps** | Dashboards, views, reports, maps and banners |
| **Security and Compliance** | Vulnerabilities, security tool connections and policies |
| **Credentials** | Stored credentials. Every change requires technician approval |
| **Accounts and Access** | Orion accounts, limitations, identity providers and NCM change approvals. Every change requires technician approval |
| **Administration** | Orion settings, polling engines, high availability, licences, federation and the platform connection |

Monitoring Data can be Disabled or Read Only; every other group holds changes only and can be Disabled or Read/Write. Neo removes passwords, SNMP communities, keys, tokens and device configuration text from every answer, refuses a query that names one, and never sends the calls listed under [What Neo never sends](https://docs.neoagent.io/integrations/solarwinds-orion/connecting-to-neo.md#what-neo-never-sends).

## Access Profiles

> **Read Only**
>
> Monitoring Data Read Only, every other group Disabled. The agent reads, and never changes anything.

> **Helpdesk**
>
> Alerts and Events is Read/Write without approval. Mute and Unmanage and Nodes and Monitoring are Read/Write with technician approval. Every other group is Disabled.

> **IT Admin**
>
> Every group Read/Write. Alert Definitions and Actions, Agents, Server, VM and Cloud Actions, Network Configuration, Security and Compliance, Credentials, Accounts and Access, and Administration require technician approval, and so does deleting a node.

> **Full Automation**
>
> Every group Read/Write without approval, except the [changes that always ask a technician](https://docs.neoagent.io/integrations/solarwinds-orion/connecting-to-neo.md#changes-that-always-ask-a-technician).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.