> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Field Effect API

> Work Field Effect MDR AROs from the ticket: find the ARO, add its details and steps, read the endpoint, comment, resolve or ask Field Effect's analysts for help

The common use is a ticket Field Effect's PSA integration opened for an ARO: the agent finds the ARO, adds its details and mitigation steps to the ticket with the endpoint's risk and antivirus status, and, when the work is done, comments on the ARO and resolves it in Field Effect.

<Info>
  Automatically enabled when you configure Field Effect permissions in your agent workflow.
</Info>

## What It Does

* Find the ARO behind a ticket, from the ARO link in the ticket or by organization, time and title
* Read an ARO's type, severity, details, mitigation steps and comments, and list AROs by organization, resolution and time
* Add a comment to an ARO
* Set an ARO to Resolved, Unresolved or Help Requested; Help Requested asks Field Effect's analysts to act, for example to isolate an endpoint
* Set an ARO to Dismissed, in its own permission group
* Read endpoint devices with risk level and antivirus status, and the active response actions Field Effect took
* Read client organizations, their contacts and escalation contact lists

## Permission Groups

| Group | Covers |
| - | - |
| AROs | Reading AROs and comments; adding a comment; setting an ARO to Resolved, Unresolved or Help Requested |
| ARO Dismissal | Setting an ARO to Dismissed, or to any other resolution or option (write only) |
| Organizations and Contacts | Client organizations, their contacts and escalation contact lists (read only) |
| Endpoints | Endpoint devices, antivirus status and active response actions (read only) |
| Other Reads | Reads of Field Effect paths outside the groups above, from the API documentation in your MDR Portal (read only) |

## Access Profiles

| Profile | What runs on its own | What asks a technician |
| - | - | - |
| **Read Only** | Every read | No write is allowed |
| **Helpdesk** | Every read, comments, Resolved, Unresolved and Help Requested | Dismissals are off |
| **IT Admin** | The same as Helpdesk | Every dismissal |
| **Full Automation** | Every read and write | Nothing |

## Safety Controls

| Control | Behavior |
| - | - |
| **Writes** | Neo sends Field Effect two writes: adding a comment to an ARO and setting an ARO's resolution. Every other write is refused |
| **Dismissals** | A resolution change goes to the AROs group only when it is Resolved, Unresolved or Help Requested and carries nothing but a status and a comment. Anything else goes to ARO Dismissal |
| **Secrets** | Fields that carry a credential, such as a key, token or password, are hidden in every answer |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.