DNSFilter API

The common uses are a quarterly business review, where the agent totals the threats DNSFilter blocked for a customer by category, and a ticket asking to unblock a site, where the agent checks the domain’s category, finds the customer’s policy and, once approved, adds the domain to its allow list.

Automatically enabled when you configure DNSFilter permissions in your agent workflow.

What It Does

Report the threats blocked for each customer over any period: totals and trend, top threat categories, domains, users and roaming clients
Read the query log to explain one block: when, which domain, which category and policy, which network or roaming client
Add or remove a domain on a policy’s allow or block list, and change blocked categories and applications
Read end users’ unblock requests and record the decision
Read networks, roaming clients and their protection status, policies, block pages and report schedules, and change them
Read your customer organizations and their console users

Permission Groups

Group	Covers
Reports and Query Logs	Threat and traffic reports, query logs, usage metrics and CSV exports (read only)
Policies, Allow and Block Lists	Policies, their allow and block lists, blocked categories and applications, scheduled policies, block pages, domain notes
Unblock Requests	End users’ unblock requests and their decisions
Networks	Networks and their IP addresses, subnets, LAN IPs and MAC addresses
Roaming Clients	Roaming clients and relays, local users, collections, bulk updates and deletes
Scheduled Reports	Report schedules DNSFilter emails to their recipients
Customer Organizations	Your customer organizations and their settings
Users, SSO and API Keys	Console users, SSO connections, API keys without their tokens, the connected user’s dashboards
Billing and Invoices	Billing details and address, invoices, trials
Categories and Domain Lookups	Content categories, applications, and a domain’s categories (read only)

Access Profiles

Profile	What runs on its own	What asks a technician
Read Only	Every read	No write is allowed
Helpdesk	Every read outside the Users, SSO and API Keys and the Billing and Invoices groups	Every change in the Policies, Allow and Block Lists and the Unblock Requests groups; no other write is allowed
IT Admin	Every read, and Networks, Roaming Clients and Scheduled Reports changes outside Safety Controls	Changes in the Policies, Allow and Block Lists, Unblock Requests, Customer Organizations, Users, SSO and API Keys, and Billing and Invoices groups, and the changes in Safety Controls
Full Automation	Every read and write outside Safety Controls	The changes in Safety Controls

Safety Controls

Control	Behavior
The ticket’s customer only	On a run for a ticket that names a company, Neo sends a call only when every DNSFilter organization it names is the one the ticket’s company is mapped to. A call to one record (a policy, network or roaming client) names its organization, and Neo reads the record first to confirm it belongs there
No every-customer writes	A write that names `msp_id`, a bulk change or delete that lists no records, and a network bulk change on `all` are refused
Always asks a technician	Deleting or canceling a customer organization, promoting an organization to an MSP, deleting a network, deleting or uninstalling a roaming client (one, in bulk, or by an inactivity cleanup), and changing a policy’s permissive mode, which stops its blocking
Refused	Creating an API key or a network secret key, rotating a network secret key (each answer returns a secret, which Neo hides), deleting or revoking an API key (the key Neo uses could be among them), updating an SSO connection (it carries the client secret Neo hides), changing a password, the distributor calls (they take a distributor’s key, not a user’s API key), setting a payment card, and reading the roaming clients’ uninstall PIN
Secrets	Fields that carry a credential, such as a network’s secret key or an SSO client secret, are hidden in every answer
Allowing a site	The agent checks the domain’s categories and recent blocked queries first, and never allows one DNSFilter puts in a security category

Getting started

Core

Triggered & Scheduled Agents

Chat Agents

Integrations

Product

Workflows

Customizing Neo

What It Does

Permission Groups

Access Profiles

Safety Controls

​What It Does

​Permission Groups

​Access Profiles

​Safety Controls

What It Does

Permission Groups

Access Profiles

Safety Controls