> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Airlock Digital API

> Read agent status, policy groups, blocked files and OTP history on each client's Airlock server, move computers between policy groups, issue OTP codes and allow or block file hashes — each change follows the approval settings you give it

The tool reaches a client's own Airlock Digital server through its REST API, with the API key you save in Neo for that client, so each call is limited twice: by the REST permissions of that key's user group in Airlock and by the agent's permission groups below.

> [!NOTE]
>
> Automatically enabled when you configure Airlock Digital permissions in your agent workflow. No manual toggle needed.

## What It Does

* Read each computer's enforcement agent: status, last check-in, version and policy group
* Read policy groups and their policies: assigned allowlists, baselines and blocklists, exclusions and settings
* Read blocked and audited executions by computer, user, file or date, and activity summaries
* Read OTP history: which codes were granted, to which computer and user, and the files that ran under a code
* Move computers between policy groups
* Issue an OTP code, after a technician approves it, and revoke one
* Look a file up by hash, read its reputation, add it to an allowlist or blocklist or remove it
* Approve or deny exception requests users raise from a blocked computer

The agent calls the Airlock REST API through the [Vendor API](https://docs.neoagent.io/agents/tools/vendor-api.md) tool, with `airlock_digital` as the vendor id and the client's PSA company id. [Sandbox](https://docs.neoagent.io/agents/tools/built-in/sandbox.md) scripts can call Airlock Digital too, under the same permissions, except that a script cannot issue an OTP code.

## Permission Groups

| Group | What it covers |
| - | - |
| **Agents** | Enforcement agents (the protected computers): status, check-in, policy group; move, remove |
| **Policy Groups & Exclusions** | Policy groups, their assigned allowlists, baselines and blocklists, path, process and publisher exclusions, trusted installers, settings |
| **Allowlists, Baselines & Files** | Allowlists, baselines, their metarules and hashes, the file repository and hash reputation |
| **Blocklists** | Blocklists, their metarules and hashes |
| **OTP Codes** | OTP usage history and the files run under a code; issue and revoke |
| **Exception Requests** | Exception requests: list, approve, deny |
| **Execution & Server Logs** | Execution history, activity summaries, policy change history, server activity |
| **Users, Licence & Relays** | Airlock console users and user groups, the licence, relay communication lists |

Every group can be Disabled, Read Only or Read/Write. Neo never sends these calls: `authenticate`, which reads or replaces an account's API key; the agent installer download; `agent/config`, whose configuration file carries the agent's TLS private key; and `group/settings/updateall`, which replaces every setting of a group at once (Neo changes each setting on its own path).

Neo removes these fields from every answer: `otpcode` (except in the answer that issues a code, which the agent tool keeps out of the run log), `agentstopcode`, `proxypass`, `password`, `apikey`, `licensekey` and `verificationcode`, and, in the policy change history, the old and new value of a setting whose name is a credential (a stop code, a proxy password).

## Access Profiles

> **Read Only**
>
> Every group Read Only. The agent reads, and never changes anything.

> **Helpdesk**
>
> Agents, OTP Codes, Exception Requests and Allowlists, Baselines & Files are Read/Write with technician approval. Everything else is Read Only.

> **IT Admin**
>
> Every group Read/Write. Allowlists, Baselines & Files, Policy Groups & Exclusions and Users, Licence & Relays require technician approval, and so do the changes below.

> **Full Automation**
>
> Every group Read/Write without approval, except the changes below, which still require technician approval.

## Safety Controls

These require technician approval under every access profile, whatever the group's own approval setting:

* Issuing an OTP code.
* Audit mode, script control mode and the agent stop code, which stop blocking or let a user stop the agent.
* Removing an agent, and moving a computer to Unmanaged.
* Deleting a policy group, an allowlist, a baseline, a blocklist or an allowlist category, and replacing a group's configuration with another group's.
* Removing a hash from every allowlist, every baseline or every blocklist at once.
* The proxy settings, which store the proxy password.
* Setting the licence key, and any change to console users.
* Any change that stores a credential: a password, a stop code or a licence key.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.