> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# SonicWall API

> Report firewall inventory, status, licences and firmware across your clients' SonicWall tenants, schedule firmware upgrades and restarts, read VPN and WAN link status, access rules, NAT policies and security data, and change them through Network Security Manager

<Info>
  Automatically enabled when you configure SonicWall permissions in your agent workflow.
</Info>

## What It Does

* Pick the client's MySonicWall tenant by name from the tenants your key sees
* List each client's firewalls with model, serial, firmware, online status, HA state and tags
* Report licences that have expired or expire within a number of days, and which security services are on
* List newer firmware for a firewall, schedule a firmware upgrade or a restart for a maintenance window, change or cancel the schedule, and read the result
* Read WAN and interface link status, when a link went down, and VPN tunnel status
* Return a firewall's access rules, security policies, NAT policies and the address and service objects they use
* Add, change or remove a rule, object or VPN policy, and commit the pending change to the firewall now or at a set time
* Read security and traffic data: top applications, users, addresses, threats, viruses, intrusions, botnets and blocked traffic over 15 minutes to 30 days
* Read NSM alerts, events and logs, and run a ping, traceroute or DNS lookup from the firewall

Neo works through Network Security Manager (NSM), so it reaches firewalls that NSM manages. A firewall that is not in NSM is out of reach.

## How the agent handles a licence report

The agent lists your MySonicWall tenants, then for each tenant the firewalls and their services that expire within the window you asked for. It names each client, firewall and service with its expiry date, and leaves out tenants with nothing to report.

## Permission Groups

| Group | Access levels | Covers |
| - | - | - |
| Tenants, Devices and Licences | Disabled, Read Only, Read / Write | Tenants, firewalls, device groups, online status, licences and expiry, HA, connections |
| Monitoring, Logs and Reports | Disabled, Read Only, Read / Write | Alerts, events, logs, flow analytics, traffic and security reports, diagnostics |
| Firewall Rules and Objects | Disabled, Read Only, Read / Write | Access rules, security and NAT policies, address and service objects, zones, schedules |
| Security Services | Disabled, Read Only, Read / Write | Gateway Anti-Virus, IPS, Anti-Spyware, Capture ATP, content filtering, botnet and Geo-IP, DPI-SSL |
| VPN | Disabled, Read Only, Read / Write | Site-to-site VPN policies and tunnel status, SSL VPN, tunnel interfaces, NSM VPN topologies |
| Network, Wireless and Switching | Disabled, Read Only, Read / Write | Interfaces and links, DHCP, DNS, routing, SD-WAN, HA, wireless, access points, switches |
| Firmware, Restarts and Backups | Disabled, Read Only, Read / Write | Firmware versions and upgrades, scheduled restarts, configuration backups |
| Commits and Templates | Disabled, Read Only, Read / Write | Pending changes, commits and commit approval, templates and variables |
| Users and Administration | Disabled, Read Only, Read / Write | NSM users and roles, firewall local users and authentication servers, certificates, SNMP |

## Access Profiles

| Profile | What runs on its own | What asks a technician |
| - | - | - |
| **Read Only** | Every read, including reports and diagnostic lookups | No write is allowed |
| **Helpdesk** | Every read; alert and report writes | Every other write |
| **IT Admin** | Inventory, firmware, restart, VPN and network writes, and the Helpdesk writes | Rule, security service, commit and administration writes, and every write under Safety Controls |
| **Full Automation** | Every write except those below | Only the writes under Safety Controls |

## Safety Controls

| Control | Behavior |
| - | - |
| **Always ask** | A free-form SonicOS CLI, raw or threat command, or a raw configuration post; setting the administrator's password; removing the administrator's or a firewall user's two-factor key; a bulk reset of firewall users' passwords and two-factor keys; turning the management console off; factory-resetting access points and restoring access rules to their defaults; deleting an NSM tenant, deleting or erasing a SonicOS tenant, and removing a firewall from NSM. These always ask a technician, whatever the profile |
| **Secrets** | Every secret in a response (pre-shared keys, shared secrets, passwords, auth and registration codes) comes back blank. A `PUT` that would send a blank secret back is refused; the agent changes such a record with `PATCH` |
| **Commits** | A rule, object or VPN change waits in NSM until it is committed; the agent commits only the firewall it changed, and stops when other changes wait on it |
| **Deletes** | A delete must name its records: a delete that names none, such as every VPN policy, rule, certificate, backup or log file, is refused, and so is a flush or reset for every device. Clearing caches, capture buffers, statistics and VPN monitor state, and cancelling a scheduled restart or auto-upgrade, are allowed |
| **Right tenant** | On a ticket whose company is mapped to a SonicWall tenant, every call must name that tenant |
| **Refused** | Neo signs in to NSM itself, so an agent cannot call NSM's sign-in, two-factor or password-reset endpoints. Neo also does not read key pairs, configuration backups, VPN client policies or auth codes, pass on a file a read answers (a backup, a report, a packet capture; logs exported as csv or txt and the content filter's category and URI lists pass), send a mail or packet capture or an NSM backup to an FTP or SCP server, boot a firewall to factory defaults, reset or restore NSM, or deregister a firewall |

## How to Configure

<Steps>
  <Step title="Connect SonicWall">
    Save your MySonicWall API key in the Neo Dashboard under the **Networking** integrations category. See [Connecting SonicWall to Neo](/integrations/sonicwall/connecting-to-neo).
  </Step>

  <Step title="Configure permissions">
    In your agent workflow's **Integrations** tab, choose an access profile or set each permission group by hand.
  </Step>
</Steps>

<Tip>
  Start with **Read Only**. Inventory, licence, firmware, VPN and rule reports need only reads.
</Tip>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.