> ## Documentation Index > Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt > Use this file to discover all available pages before exploring further. # DNSFilter API > Work DNSFilter from Neo: report the threats it blocked for each customer, allow or block a domain on a policy, decide unblock requests, check roaming clients The common uses are a quarterly business review, where the agent totals the threats DNSFilter blocked for a customer by category, and a ticket asking to unblock a site, where the agent checks the domain's category, finds the customer's policy and, once approved, adds the domain to its allow list. Automatically enabled when you configure DNSFilter permissions in your agent workflow. ## What It Does * Report the threats blocked for each customer over any period: totals and trend, top threat categories, domains, users and roaming clients * Read the query log to explain one block: when, which domain, which category and policy, which network or roaming client * Add or remove a domain on a policy's allow or block list, and change blocked categories and applications * Read end users' unblock requests and record the decision * Read networks, roaming clients and their protection status, policies, block pages and report schedules, and change them * Read your customer organizations and their console users ## Permission Groups | Group | Covers | | - | - | | Reports and Query Logs | Threat and traffic reports, query logs, usage metrics and CSV exports (read only) | | Policies, Allow and Block Lists | Policies, their allow and block lists, blocked categories and applications, scheduled policies, block pages, domain notes | | Unblock Requests | End users' unblock requests and their decisions | | Networks | Networks and their IP addresses, subnets, LAN IPs and MAC addresses | | Roaming Clients | Roaming clients and relays, local users, collections, bulk updates and deletes | | Scheduled Reports | Report schedules DNSFilter emails to their recipients | | Customer Organizations | Your customer organizations and their settings | | Users, SSO and API Keys | Console users, SSO connections, API keys without their tokens, the connected user's dashboards | | Billing and Invoices | Billing details and address, invoices, trials | | Categories and Domain Lookups | Content categories, applications, and a domain's categories (read only) | ## Access Profiles | Profile | What runs on its own | What asks a technician | | - | - | - | | **Read Only** | Every read | No write is allowed | | **Helpdesk** | Every read outside the Users, SSO and API Keys and the Billing and Invoices groups | Every change in the Policies, Allow and Block Lists and the Unblock Requests groups; no other write is allowed | | **IT Admin** | Every read, and Networks, Roaming Clients and Scheduled Reports changes outside Safety Controls | Changes in the Policies, Allow and Block Lists, Unblock Requests, Customer Organizations, Users, SSO and API Keys, and Billing and Invoices groups, and the changes in Safety Controls | | **Full Automation** | Every read and write outside Safety Controls | The changes in Safety Controls | ## Safety Controls | Control | Behavior | | - | - | | **The ticket's customer only** | On a run for a ticket that names a company, Neo sends a call only when every DNSFilter organization it names is the one the ticket's company is mapped to. A call to one record (a policy, network or roaming client) names its organization, and Neo reads the record first to confirm it belongs there | | **No every-customer writes** | A write that names `msp_id`, a bulk change or delete that lists no records, and a network bulk change on `all` are refused | | **Always asks a technician** | Deleting or canceling a customer organization, promoting an organization to an MSP, deleting a network, deleting or uninstalling a roaming client (one, in bulk, or by an inactivity cleanup), and changing a policy's permissive mode, which stops its blocking | | **Refused** | Creating an API key or a network secret key, rotating a network secret key (each answer returns a secret, which Neo hides), deleting or revoking an API key (the key Neo uses could be among them), updating an SSO connection (it carries the client secret Neo hides), changing a password, the distributor calls (they take a distributor's key, not a user's API key), setting a payment card, and reading the roaming clients' uninstall PIN | | **Secrets** | Fields that carry a credential, such as a network's secret key or an SSO client secret, are hidden in every answer | | **Allowing a site** | The agent checks the domain's categories and recent blocked queries first, and never allows one DNSFilter puts in a security category | This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.