Dark Web ID API

The common use is a compromise ticket: the agent reads the compromise in Dark Web ID (what leaked, when, from which breach, and whether the password matched your rules), adds it to the ticket, and marks the compromise resolved once the user’s password was reset. Agents can also run a live search for an address a ticket names, and onboard or offboard a client.

Automatically enabled when you configure Dark Web ID permissions in your agent workflow.

What It Does

Run a live dark web search for one email address or domain
Read each client organization’s compromises, filtered by organization, monitored feed and date
Set a compromise’s status (New, In Progress, Resolved, 3rd Party Tracking), and create or delete a compromise record
Create, rename, deactivate and delete a client organization, and add a monitored email domain
Set an organization’s alert emails, Clean Bill of Health emails, report sections and automated monthly and quarterly reports
Read, create, change and delete Dark Web ID users and their notification preferences
Read your reseller accounts and the supply-chain companies you watch

Permission Groups

Group	Covers
Organizations	Client organizations with their monitored domains, IP addresses and email addresses, compromise counts and notification settings, reseller accounts and supply-chain companies; creating, changing, deactivating and deleting an organization
Monitored Domains	Adding an email domain to an organization’s monitoring (write only)
Compromises	Each organization’s compromises; setting a status, creating and deleting a compromise record
Live Search	A live search for one email address or domain (read only)
Users	Dark Web ID users and their notification preferences; creating, changing and deleting a user
User Roles	Any user write that sets a role, other than the Standard role on a new user. Users must allow it too (write only)
Alerts and Reports	An organization’s alert and Clean Bill of Health emails, its report sections and its automated reports (write only)

Access Profiles

Profile	What runs on its own	What asks a technician
Read Only	Every read and live search	No write is allowed
Helpdesk	Every read and live search	Compromise status changes and user changes. Onboarding, roles, alerts and reports are off
IT Admin	Every read, compromises, users, organizations and monitored domains	Role changes, alert and report settings, and deleting an organization
Full Automation	Every read and write	Deleting an organization

Safety Controls

Control	Behavior
Writes	Neo sends only the writes Dark Web ID’s API documents, each with its own method. Every other write is refused
Deleting an organization	Always asks a technician, whatever the profile: it ends the client’s monitoring and deletes its records
Ticket scope	On a ticket, the agent reaches only the Dark Web ID organization mapped to the ticket’s company, by a name match or one you confirmed, and a call to one compromise is sent only after Neo reads it and sees it belongs to that organization. Calls that span organizations (lists, onboarding, offboarding, alert and report settings, users) run without a ticket company, such as in a chat
Roles	A user write that sets a role needs User Roles as well as Users, and asks for approval when either asks
Leaked data	Neo removes each leaked password, and the leaked personal values a live search returns, from every answer before the agent or a script sees it

Getting started

Core

Triggered & Scheduled Agents

Chat Agents

Integrations

Product

Workflows

Customizing Neo

What It Does

Permission Groups

Access Profiles

Safety Controls

​What It Does

​Permission Groups

​Access Profiles

​Safety Controls

What It Does

Permission Groups

Access Profiles

Safety Controls