> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Cork API

> Work Cork from Neo: Cyber Score drops, failed controls and coverage gaps as PSA tickets, quarterly risk reviews, vulnerabilities and software installs

The common uses are a scheduled agent that opens PSA tickets for Cork Cyber Score drops, open compliance events and coverage gaps, a client's quarterly risk review for a QBR, and questions in a chat with Neo about a client's score, devices and vulnerabilities.

> [!NOTE]
>
> Automatically enabled when you configure Cork permissions in your agent workflow.

## What It Does

* Read each client's Cork Cyber Score history, with the points coverage, compliance, vulnerabilities and claims deducted
* Read compliance events (failed controls and risk events) with their evidence, and the event types with their cure periods
* Read the devices, inboxes and domains Cork maps to a client, and the tools that see each device
* Read software vulnerabilities per client and device, with CVE, CVSS, EPSS, known-exploited status and the packages that fix them
* Read your connected integrations and the devices, users and tenants each reports; rename, resync or delete one
* Install a package on one device through its RMM, and read past installs
* Read warranties, invoices and their line items, and a distributor's partner accounts

## Permission Groups

| Group | Covers |
| - | - |
| Clients and Cyber Scores | Clients with warranty status and recent scores, each client's score history, and the API key's own user (read only) |
| Devices, Inboxes and Domains | A client's devices with the tools that see each, its inboxes and email domains (read only) |
| Compliance Events | Compliance events, their alerting rules and the event types (read only) |
| Software Vulnerabilities | CVEs per client and device, and the rollup by product (read only) |
| Connected Integrations | Connected tools, what each reports, the tools Cork can connect; renaming, resyncing and deleting one |
| Software Installs | Installable packages, the RMM setup they need, past installs, and installing a package |
| Warranties and Invoices | Warranty packages, invoices and line items (read only) |
| Distributor Partners | A distributor's partner accounts, and creating one |

## Access Profiles

| Profile | What runs on its own | What asks a technician |
| - | - | - |
| **Read Only** | Every read | No write is allowed |
| **Helpdesk** | Every read except distributor partners | Every software install; no other write is allowed |
| **IT Admin** | Every read, software installs, and renaming and resyncing an integration | Creating a distributor partner, and the change that always asks |
| **Full Automation** | Every read and write | The change that always asks |

## Safety Controls

| Control | Behavior |
| - | - |
| **The ticket's client only** | On a run for a ticket that names a company, Neo sends a call only when the Cork client it names is the one the ticket's company is mapped to, in the path or in `client_uuid`, with no device, inbox, domain, tenant or partner filter beside it. Calls that cover the whole account, and software installs, are refused on a ticket run |
| **Always asks a technician** | Deleting a connected integration |
| **Credentials** | Neo does not send another vendor's credentials to Cork, and credential fields are hidden in every answer |
| **Refused** | Connecting a new integration, whose body carries the tool's credentials; reading an integration's stored credentials; an integration's raw data download link |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.