> ## Documentation Index > Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt > Use this file to discover all available pages before exploring further. # Cisco Umbrella API > Work Cisco Umbrella from the ticket: answer access requests, allow or block a destination, read why a site was blocked, check roaming computers The common use is an Umbrella access request ticket: the agent finds the block in the customer's activity report, checks the destination with Umbrella Investigate, and once the request is approved, adds the destination to the customer's allow list and reads it back. Automatically enabled when you configure Cisco Umbrella permissions in your agent workflow. ## What It Does * Work in the ticket company's own Umbrella organization, from the company mapping * Read DNS, web, firewall and intrusion activity, filtered by destination, identity, verdict and time * Check a domain, IP or URL with Umbrella Investigate: status, categories and security scores * Add or remove domains, URLs and IPs on allow and block lists, and create or rename lists * Read roaming computers, networks, sites, virtual appliances, tunnels, policies and application lists, and change them * Read console users and API keys, and your console's customer organizations ## Permission Groups | Group | Covers | | - | - | | Destination Lists and Internal Domains | Allow and block lists and their destinations; internal domains | | Policies and Applications | Policies and their identities, application lists, App Discovery, Secure Web Gateway overrides | | Deployments | Networks, internal networks, sites, virtual appliances, roaming computers, network devices, tags, tunnels | | Reports | Activity, summary, top and deployment status reports (read only) | | Investigate | Domain, IP, URL and file intelligence (read only) | | Users and API Keys | Console users and roles, API keys without their secrets, API usage | | Provider Console | Customer organizations, seats, trials, deals and access requests, the console's contacts, cross-customer reports | ## Access Profiles | Profile | What runs on its own | What asks a technician | | - | - | - | | **Read Only** | Every read | No write is allowed | | **Helpdesk** | Every read outside the Users and API Keys group | Every change in the Destination Lists and Internal Domains group; no other write is allowed | | **IT Admin** | Every read, and Deployments changes outside Safety Controls | Changes in the Destination Lists and Internal Domains, Policies and Applications, Users and API Keys, and Provider Console groups, and the changes in Safety Controls | | **Full Automation** | Every read and write outside Safety Controls | The changes in Safety Controls | ## Safety Controls | Control | Behavior | | - | - | | **One organization per call** | Neo gets a token for the customer organization a call names, so the call acts in that organization only | | **The ticket's customer only** | On a run for a ticket, Neo sends a call only for the organization the ticket's company is mapped to, and no provider-console call | | **Always asks a technician** | Deleting a network, site, network device, virtual appliance, tunnel, roaming computer or customer organization; changing or deleting an API key; a customer password reset; and a Secure Web Gateway override that may turn the gateway off | | **Refused** | Creating or refreshing an API key, rotating the S3 bucket key, and creating a tunnel or rotating its credentials (each answer returns a secret once, which Neo hides), and uploading a provider console logo | | **Secrets** | Fields that carry a credential, such as a key secret, a tunnel's pre-shared key or a password, are hidden in every answer | | **Allowing a site** | The agent checks the destination with Umbrella Investigate first and never allows one Umbrella marks as malicious | This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.