> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Avanan API

> Work Avanan email security tickets: allow or block a sender or domain for a client, find a message and quarantine or restore it, and manage engine exceptions

The Avanan API tool gives Neo agents access to the Avanan Smart API (Check Point Harmony Email & Collaboration on the Avanan portal) for each of your client tenants. The common use is an "allowed list request" ticket: the agent finds the client's tenant, checks the allow list, adds the sender or domain the ticket names, and notes the entry on the ticket.

<Info>
  Automatically enabled when you configure Avanan permissions in your agent workflow.
</Info>

## What It Does

* Read a client's anti-phishing allow list, spam allow list and block list
* Add, change and remove an entry by sender address, domain, IP, subject, recipient, link domain or attachment hash
* Search a client's messages and Avanan's security events, and read a message's verdict
* Quarantine or restore a message, and report a wrong verdict to Check Point
* Manage the exceptions of the anti-malware, DLP, URL reputation, anomaly and click-time protection engines
* Read your client tenants, their licenses, add-ons and usage, and your Avanan portal users

## Client tenants

An MSP API key reaches every client tenant in its region. The agent names the client on each call by the tenant's scope, such as `mt-prod-3:contoso`. Each tenant is mapped to a client in your PSA, so the agent knows which scope belongs to the ticket's client: see [Avanan overview](/integrations/avanan/overview#your-client-tenants-are-mapped-to-clients).

On a ticket, Neo checks the scope against that mapping before it sends the call. The agent can reach only the tenant mapped to the ticket's client; Neo refuses any other scope, and a call without a scope, because that call would reach every client the key reaches. When the ticket's client has no mapped tenant, the agent can reach no tenant on that ticket: map the client on the Avanan card's **Organization Mapping** tab. Listing scopes and the MSP calls (tenants, licenses, usage, portal users) are refused on a ticket, because they name other clients. A mapping counts once it is a name match or one you confirmed. Runs with no ticket, such as a chat or a scheduled agent with no ticket, are not limited to one client.

## Permission Groups

| Group | Covers |
| - | - |
| Emails & Security Events | Search messages and security events, read a message's verdict, quarantine or restore, report a wrong verdict, email a message's details |
| Block List | The anti-phishing block list: read, add, change, remove |
| Allow Lists | The anti-phishing allow list and the spam allow list: read, add, change, remove |
| Engine Exceptions | Exceptions of the anti-malware, DLP, URL reputation, anomaly and click-time protection engines |
| Customer Tenants & Licenses | The scopes your key reaches, your client tenants, licenses, add-ons and usage, and creating or licensing a tenant |
| MSP Users & Partners | Your Avanan portal users and child MSPs |

Each group is Disabled, Read Only or Read / Write.

## Access Profiles

| Profile | What runs on its own | What asks a technician |
| - | - | - |
| **Read Only** | Every read | No write is allowed |
| **Helpdesk** | Every read | Quarantine and restore, and every allow-list and block-list change. Engine exceptions, tenants and MSP users are read only |
| **IT Admin** | Quarantine and restore, block-list changes | Allow-list changes and engine exceptions, plus the changes that always ask |
| **Full Automation** | Every change except the ones below that always ask | The changes that always ask |

## Safety Controls

| Control | Behavior |
| - | - |
| **Tenants and licenses** | Creating or licensing a client tenant always asks a technician, under every profile, because it changes what you are billed |
| **MSP users and partners** | Every change to an Avanan portal user or a child MSP always asks a technician, because a portal user administers every client |
| **Engine exceptions** | `POST sectool-exceptions/<engine>` always asks a technician, because Avanan's guide documents it both as "create an exception" and as "delete all exceptions". The agent adds an engine exception with `POST sectool-exceptions/<engine>/exceptions` instead |
| **Deletes that name no records** | Neo refuses a click-time protection delete without item ids and an anomaly delete without a rule id |
| **Client scope** | On a ticket, a call reaches only the tenant mapped to the ticket's client. See [Client tenants](#client-tenants) |
| **Refused** | Neo does not delete a client tenant or a child MSP, delete every exception of an engine or every click-time protection list, download a raw message or its download link, or return an API token |

## How to Configure

<Steps>
  <Step title="Connect Avanan">
    Save your Smart API key's region, Application ID and Client Secret in the Neo Dashboard under the **Security** integrations category. See [Connecting Avanan to Neo](/integrations/avanan/connecting-to-neo).
  </Step>

  <Step title="Configure permissions">
    In your agent workflow's **Integrations** tab, choose an access profile or set each permission group by hand.
  </Step>
</Steps>

<Tip>
  For allowed list requests, **IT Admin** fits: blocks run on their own, and a technician approves each allow-list entry.
</Tip>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.