> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# UniFi API

> Read UniFi consoles, sites, devices and clients, and change networks, WiFi and firewall rules — device restarts and any network or firewall change always require technician approval

The UniFi API tool gives Neo agents direct access to Ubiquiti's Site Manager cloud API and, through Ubiquiti's cloud Connector, to each console's Network API — pull a site's gateway, switch and AP status into the ticket, find the client behind a connectivity complaint, issue a guest voucher, and, with your approval, restart the access point that stopped responding.

<Info>
  Automatically enabled when you configure UniFi permissions in your agent workflow. No manual toggle needed.
</Info>

<Tip>
  Agents load the UniFi API skill first, which carries the endpoint tables, pagination and filter syntax, and the pacing rule that matters most: **the Connector allows 100 requests per minute per console**.
</Tip>

## What It Does

* List the consoles and sites the connected account manages, and every device across the fleet with its online state
* Read ISP latency, packet-loss, throughput and uptime per site
* Read a site's adopted devices with live statistics, and the clients connected to them
* Restart a device or power-cycle a PoE port (always behind technician approval)
* Generate hotspot vouchers; authorize or revoke guest access for a client and delete vouchers (always behind technician approval)
* Read and change networks/VLANs, SSIDs, WANs, VPNs, DNS policies, firewall policies and ACL rules (writes always behind technician approval)

## Permission Groups

| Permission Group     | What It Covers                                                                                 |
| -------------------- | ---------------------------------------------------------------------------------------------- |
| **Consoles & Sites** | Consoles, sites, fleet-wide device inventory, ISP health, SD-WAN — **read-only by API design** |
| **Devices**          | Adopted and pending devices, statistics, restart, PoE power-cycle, adopt/unadopt               |
| **Clients**          | Connected wired and wireless clients, guest authorization                                      |
| **Networks & WiFi**  | Networks/VLANs, SSIDs, WANs, VPNs, RADIUS, switching, DNS policies                             |
| **Firewall & ACLs**  | Firewall policies and zones, ACL rules, traffic matching lists                                 |
| **Hotspot Vouchers** | Guest hotspot vouchers                                                                         |

Each group has an access level: **Disabled**, **Read Only**, or **Read/Write** (Consoles & Sites only ever offers Read Only).

## Access Profiles

<AccordionGroup>
  <Accordion title="Read Only">
    All groups Read Only. The agent can look up any resource but never changes anything.
  </Accordion>

  <Accordion title="Helpdesk">
    Hotspot Vouchers and Clients at Read/Write — issuing a voucher runs autonomously; authorizing a guest still requires technician approval on every call. Everything else Read Only.
  </Accordion>

  <Accordion title="IT Admin">
    Every writable group at Read/Write, but every write requires technician approval — not just the mandatorily-forced ones.
  </Accordion>

  <Accordion title="Full Automation">
    Issuing vouchers runs autonomously. Device actions, network/firewall changes, guest authorization and voucher deletion still always require technician approval — that override is never optional.
  </Accordion>
</AccordionGroup>

## Safety Controls

| Control                     | Behavior                                                                                                           |
| --------------------------- | ------------------------------------------------------------------------------------------------------------------ |
| **Technician-in-the-Loop**  | Require human approval for writes — configurable per group                                                         |
| **Device protection**       | Restart, PoE power-cycle, adopt and unadopt always require technician approval, regardless of settings             |
| **Network protection**      | Creating, editing or deleting networks, SSIDs, WANs, VPNs and DNS policies always requires technician approval     |
| **Firewall protection**     | Any firewall policy, zone, ACL rule or traffic-matching-list change always requires technician approval            |
| **Guest access protection** | Authorizing or revoking a client's guest access always requires technician approval                                |
| **Voucher deletion**        | Deleting vouchers (single or by filter) always requires technician approval; issuing them does not                 |
| **Read-only areas**         | Consoles & Sites has no write endpoint — nothing to approve or restrict there                                      |
| **Application scope**       | Only the Network application is reachable through the Connector; Protect and other UniFi applications are rejected |
| **Rate limiting**           | Calls are paced to Ubiquiti's 100 requests/minute per console                                                      |

## How to Configure

<Steps>
  <Step title="Connect UniFi">
    Save your Site Manager API key in the Neo Dashboard under the **Networking** integrations category. See [Connecting UniFi to Neo](/integrations/unifi/connecting-to-neo).
  </Step>

  <Step title="Configure permissions">
    In your agent workflow's **Integrations** tab, choose an access profile or customize each permission group.
  </Step>

  <Step title="Set approval requirements">
    Every write except issuing a hotspot voucher already requires technician approval; decide whether voucher issue should too.
  </Step>
</Steps>

<Tip>
  Start with **Read Only** — most network tickets are answered by reading the gateway's WAN status, the AP's client count and the client's signal, with no write at all.
</Tip>