> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# FortiMail API

> Find out why a message was quarantined or blocked, release it, manage safelists and blocklists, and read and change policies, profiles, protected domains and settings on your own FortiMail email gateway

A common use is a user missing an email: the agent finds the message in the FortiMail quarantine, reads which policy and profile held it, and releases it when it is safe.

<Info>
  Automatically enabled when you configure FortiMail permissions in your agent workflow.
</Info>

## What It Does

* Read system status, licenses, HA and disk status, and mail statistics
* Read protected domains, their settings, mail users, aliases and address maps
* Read recipient and IP policies and access control rules, in the order FortiMail applies them
* Read antispam, antivirus, content, session, TLS, impersonation and DLP profiles
* Read and change system, domain and personal safelists and blocklists, and email and IP address groups
* List the system quarantine and release a message
* Read the history log
* Change domains, users, policies, profiles and settings, and restart or reload the appliance

## How the agent works a missing email

The agent finds the recipient's protected domain and looks for the message in the quarantine folders. It reads why FortiMail held it: the lists, the access rules, the policy that matched and the profile it applied. It explains this on the ticket, and releases the message when the sender is known and FortiMail did not class it as a virus, malware or impersonation. A release follows the Quarantine area's approval setting.

## Permission Groups

| Group | Access levels | Covers |
| - | - | - |
| System Status and Statistics | Disabled, Read Only, Read / Write | Status, licenses, HA and RAID, mail statistics, restart and reload |
| Domains and Users | Disabled, Read Only, Read / Write | Protected domains, mail users, aliases, address maps, user groups, address books |
| Policies and Access Control | Disabled, Read Only, Read / Write | Recipient and IP policies, access control rules |
| Security Profiles | Disabled, Read Only, Read / Write | Antispam, antivirus, content, DLP, session, TLS, URI filter, impersonation and notification profiles |
| Safelists, Blocklists and Groups | Disabled, Read Only, Read / Write | Safelists and blocklists, address groups, greylist, reputation and exempt lists |
| Quarantine | Disabled, Read Only, Read / Write | The system quarantine, releasing a message, quarantine settings |
| Logs and Reports | Disabled, Read Only, Read / Write | History log, log settings, alert email, log reports |
| Mail Settings, Archiving and Encryption | Disabled, Read Only, Read / Write | Mail server settings, storage, disclaimers, archiving, IBE encryption, backups |
| Network and System Settings | Disabled, Read Only, Read / Write | Interfaces, routes, DNS, HA, SNMPv3, FortiGuard, global settings |
| Administrators and Authentication | Disabled, Read Only, Read / Write | Administrators, admin profiles, PKI users, authentication profiles |

## Access Profiles

| Profile | What runs on its own | What asks a technician |
| - | - | - |
| **Read Only** | Every read | No write is allowed |
| **Helpdesk** | Every read | Every change in Quarantine (releasing mail, quarantine settings) and in Safelists, Blocklists and Groups (lists, address groups, reputation and exempt lists); nothing else may change |
| **IT Admin** | The quarantine, domains, profiles, logs, mail and system settings, restarts | Safelists, blocklists, policies and access rules, and every write under Safety Controls |
| **Full Automation** | Every write except those below | Only the writes below |

## Safety Controls

| Control | Behavior |
| - | - |
| **Administrators** | Every change to administrators, admin profiles, PKI users and authentication profiles always asks a technician |
| **Protected domains** | Deleting a protected domain always asks a technician |
| **Credentials** | A change that stores a password or shared secret always asks a technician, and Neo removes every credential field from what FortiMail returns |
| **Right client** | On a ticket, a call that names a protected domain goes out only for a domain linked to the ticket's client on the Organization Mapping tab, and the list of every domain is refused, and so is any domain association read or change, which a technician makes. A quarantine release that also sends the message to other addresses goes out only when each is in the client's linked domains |
| **Unknown actions** | A request with an action FortiMail does not document, and a write to a resource Neo does not list, are refused |
| **Refused** | Neo signs in itself with the administrator you saved and never gives an agent the session; an agent cannot call the sign-in or sign-out endpoints, upload files (firmware, configuration or list restores), restore mail data from a backup, or read or change SNMP communities, or shut the appliance down |

## How to Configure

<Steps>
  <Step title="Connect FortiMail">
    Save your FortiMail address and Neo's administrator in the Neo Dashboard under the **Security** integrations category. See [Connecting FortiMail to Neo](/integrations/fortimail/connecting-to-neo).
  </Step>

  <Step title="Configure permissions">
    In your agent workflow's **Integrations** tab, choose an access profile or set each permission group by hand.
  </Step>
</Steps>

<Tip>
  Start with **Read Only**. Explaining why a message was quarantined, reviewing a client's policies and correlating an incident need only reads; add the Quarantine area when you want the agent to release mail.
</Tip>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.