Acronis Email Security API

Two jobs are common. A user asks for an email that never arrived: the agent finds it in quarantine, asks the user to confirm they expect it, and releases it. A user reports a suspicious email or link: the agent finds it, adds its verdict to the ticket, and reports it to the IR team or blocks the sender.

Automatically enabled when you configure Acronis Email Security permissions in your agent workflow.

What It Does

Search the scans of your clients’ email by recipient, sender, subject, Message-ID, link, file, verdict or what happened to the email
Read a scan’s details and report: verdict, evidence, the engines that flagged it, and the links and files inside it
Release an email from quarantine, and change a scan’s verdict
Ask the IR team to investigate a scan, or to reclassify it as malicious, spam or clean
Send a link, or a file by its download link, to be scanned
Add, change and remove sender, IP and URL entries on a client’s allowlist or blocklist
Read admin users and their permission groups, invite, change or delete an admin user, add a client organization, and read the audit log
Check whether scanning is running

Permission Groups

Group	Covers
Scans	Every scan of your clients’ email, links and files, its verdict, report and evidence, and the service status (read only)
Quarantine and Verdicts	Releasing an email from quarantine, and changing a scan’s verdict (write only)
Investigations and Scan Requests	Asking the IR team to investigate or reclassify a scan, and sending a link or a file to be scanned (write only)
Allowlists	Sender address and domain, IP and URL allowlists
Blocklists	Sender address and domain, IP and URL blocklists
Organizations and Admin Users	Admin users and their permission groups, inviting, changing or deleting one, adding a client organization, and the audit log

Access Profiles

Profile	What runs on its own	What asks a technician
Read Only	Every read	No write is allowed
Helpdesk	Every read, investigation requests and scan requests	Quarantine release, verdict changes, allowlist and blocklist changes. Admin user and organization changes are off
IT Admin	Every read, quarantine release, verdict changes, investigation and scan requests, and blocklist changes	Allowlist changes, admin user changes and new organizations
Full Automation	Every read and write	Nothing

Safety Controls

Control	Behavior
Calls	Neo sends only the calls the vendor’s API pages document, each with its own method, and never deletes a scan. Every other call is refused
Scan requests	A link or file sent to be scanned never names a callback address; the agent reads the scan instead
Invitations	The registration link in an invitation’s answer never reaches the agent; the invited admin gets it by email
Release and investigation	Both are requests that read like a lookup but act. Neo treats them as changes: they need their own permission group, follow its approval setting, are simulated in test mode, and are never sent twice after a timeout
Confirmation	The agent releases an email only after the user confirms they expect it, and leaves a malicious one to a technician
List entries	A new allowlist or blocklist entry must name the client’s organization. Neo refuses one that does not, because the vendor would put it in your parent organization, where it applies to every client
Client scope	The API has no list of client organizations, so Neo cannot tie a ticket’s company to one. The agent finds a client’s email by the user’s address; one API key reaches every client, so the approval settings above are your control over what the agent changes

Getting started

Core

Triggered & Scheduled Agents

Chat Agents

Integrations

Product

Workflows

Customizing Neo

Acronis Email Security API

What It Does

Permission Groups

Access Profiles

Safety Controls

​What It Does

​Permission Groups

​Access Profiles

​Safety Controls

What It Does

Permission Groups

Access Profiles

Safety Controls