> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Control D API

> Work Control D from Neo: confirm why a site was blocked, allowlist it with a bypass rule, report blocked queries per customer, manage endpoints and profiles

The common uses are a ticket that says a site is blocked, where the agent reads the customer's Activity Log and runs a Domain Test on the user's endpoint to confirm Control D blocked it and why, then adds a bypass rule once a technician approves it; and a quarterly business review, where the agent counts the queries Control D blocked for a customer by domain, filter and service.

> [!NOTE]
>
> Automatically enabled when you configure Control D permissions in your agent workflow.

## What It Does

* Run a Domain Test: ask a customer's endpoint how its policy decides a domain, and which filter, service or rule decided it
* Read the Activity Log for the blocked queries of a domain, with the filter, service or rule behind each
* Add, change or remove custom rules that block, bypass (allow), spoof or redirect a domain, and their folders
* Count blocked, bypassed and redirected queries, and rank the blocked domains, filters and services, for any window
* Read and change profiles, filters, services, options, restrictions and the default rule
* Read and change endpoints, the IPs they are authorized from, and internal domains
* Read your sub-organizations, members and billing, and create a sub-organization for a new customer

## Permission Groups

| Group | Covers |
| - | - |
| Organization | Your organization, its members and sub-organizations; changing an organization's details and creating a sub-organization |
| Billing | Payments, products and subscriptions (read only) |
| Profiles & Filters | Profiles, their filters, services, options, restrictions and default rule, the service catalog and redirect locations |
| Custom Rules | Custom rules and rule folders of each profile |
| Endpoints & IPs | Endpoints, endpoint types and the IPs each endpoint used or is authorized from |
| Internal Domains | Domain suffixes managed endpoints resolve outside Control D |
| Analytics & Domain Test | The Activity Log, statistics, analytics regions and levels, Control D's network status, and the Domain Test (read only) |

## Access Profiles

| Profile | What runs on its own | What asks a technician |
| - | - | - |
| **Read Only** | Every read | No write is allowed |
| **Helpdesk** | Every read | Every change in Custom Rules and Endpoints & IPs; no other write is allowed |
| **IT Admin** | Every read, and Endpoints & IPs and Organization changes outside Safety Controls | Changes in Custom Rules, Profiles & Filters and Internal Domains, and the changes in Safety Controls |
| **Full Automation** | Every read and write outside Safety Controls | The changes in Safety Controls |

## Safety Controls

| Control | Behavior |
| - | - |
| **The ticket's customer only** | On a run for a ticket that names a company, Neo sends a call only when it names, in the `X-Force-Org-Id` header, the Control D sub-organization the ticket's company is mapped to. Calls about your whole account (the sub-organization list, billing, the token's user, creating a sub-organization) are refused there |
| **The customer's own profiles** | A change to a profile, its rules, filters or services in a sub-organization goes out only when that sub-organization lists the profile and your main organization does not, so a global profile you share with every customer is never changed for one |
| **Domain Test on the customer's endpoint** | Neo runs a Domain Test only on an endpoint listed in the sub-organization the call names, and asks Control D not to log it |
| **Always asks a technician** | Deleting an endpoint, setting an endpoint's status to disabled, deleting a profile, pausing a profile, and turning off an organization's required two-factor sign-in. Every other change follows the group's approval setting |
| **Refused** | Unlocking a locked profile, which takes your Control D account password, setting or clearing an endpoint's deactivation PIN, and an endpoint's custom ctrld configuration, which can replace its upstream. An endpoint write carries only the fields Control D documents for it |
| **Scripts only read** | A sandbox script reads Control D and changes nothing; the agent makes every change with the Control D API tool, whose approval names the sub-organization |
| **Secrets** | An endpoint's deactivation PIN is hidden in every answer |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.