> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Blackpoint API

> Work Blackpoint Cyber from Neo: read detections, work Blackpoint alert tickets, add travel windows in Cloud Response

The common use is a Blackpoint ticket in your PSA: the agent reads the detection behind it, checks the facts, adds a user's travel window when a customer asked for one, and resolves the PSA ticket as your instructions allow. Agents also read each customer's assets, vulnerabilities, exposures and posture for a QBR.

> [!NOTE]
>
> Automatically enabled when you configure Blackpoint permissions in your agent workflow.

## What It Does

* Read a customer's detections (alert groups) with their alerts, hosts, users, IPs and the SOC's status, and detection counts and trends
* Read assets, vulnerabilities, scans, dark web and external exposures, the posture rating and reports
* Read Microsoft 365 connections and users, approved countries and travel windows, and add or remove one
* Read Google Workspace and Cisco Duo onboardings; complete, re-sync or remove a Duo one. Neo does not start a Duo onboarding, because its request carries your Duo secret key: start it in the CompassOne portal
* Read and change escalation contact groups, their members and the tenants each covers

Blackpoint's API has no write on a detection. The SOC closes its own ticket in Blackpoint; the agent works the PSA ticket. Allowing a blocked application happens in the Blackpoint portal.

## Permission Groups

| Group | Covers |
| - | - |
| Accounts & Tenants | The partner account, its customer tenants and the portal's users (read only) |
| Detections | Detections, their alerts, counts and trends (read only) |
| Assets | Devices, users, software and sources, and their links (read only) |
| Vulnerabilities & Exposures | Vulnerabilities, scans, dark web and external exposures (read only) |
| Posture & Reports | The posture rating and reports (read only) |
| Cloud Response | Microsoft 365 connections and users, approved countries and travel windows; adding or removing one |
| Cloud Onboarding | Google Workspace and Cisco Duo onboardings; completing, re-syncing and removing a Duo one |
| Escalation Contacts | The contact groups Blackpoint's SOC calls, their members and tenants |

## Access Profiles

| Profile | What runs on its own | What asks a technician |
| - | - | - |
| **Read Only** | Every read | No write is allowed |
| **Helpdesk** | Every read | Adding or removing an approved country or a travel window; no other write is allowed |
| **IT Admin** | Every read, contact groups and onboardings | Approved countries and travel windows, and removing a Duo onboarding |
| **Full Automation** | Every read and write | Removing a Duo onboarding |

## Safety Controls

| Control | Behavior |
| - | - |
| **The ticket's customer only** | On a run for a ticket that names a company, Neo sends a call only for the Blackpoint tenant the ticket's company is mapped to, whether the call names it in the `x-tenant-id` header, the `tenantId` parameter or the path. Calls that reach every customer (the tenant list, contact groups) are refused on a ticket run |
| **The tenant in one place** | Each call must name its tenant where its operation takes it, and only there; Neo refuses a call that names it twice or not at all |
| **Always asks a technician** | Removing a Cisco Duo onboarding. Every other change follows the group's approval setting |
| **Bulk delete** | Deleting contact groups in bulk must name each group by id |
| **Hidden secrets** | Breached passwords in dark web exposures and each tenant's SNAP agent install link are hidden before the agent or a script reads them. Neo never takes your Duo secret key: a Duo onboarding starts in the CompassOne portal |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.