> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# iboss API

> Find why a site is blocked, allow or block domains, read URL logs and reports, and change policies in your clients' iboss accounts

The common uses are blocked-website tickets (find the block in the URL log and add an approved exception), temporary exceptions, blocking a malicious domain, the web activity around a security alert, and the monthly security report.

<Info>
  Automatically enabled when you configure iboss permissions in your agent workflow. iboss is connected per client, so the agent calls the iboss account of the ticket's company, with that client's API key.
</Info>

## What it does

* Read URL event logs, monthly drill-down reports (top blocked domains, categories, visited domains and users) and AI conversation governance
* Add, import and remove domains, URLs and IP ranges on allow list and block list policies, for good or for a set time
* Read, create, change and delete policy layers, SaaS and internet access policies, private access, connector and DLP policies, with their settings
* Read and change policy groups and each group's application, country and file upload controls
* Read and change firewall rules, locations, private networks and private access peers, connector settings, proxy and SSL decryption settings, DLP rules and incident settings
* Add, change and remove proxy users and devices, and the account's own copies of catalog resources

A settings change sends only the fields that change: Neo reads the stored settings first and writes them back whole, because iboss resets every field a settings write leaves out. After a policy's settings change, Neo reads the policy back and names any field iboss did not keep.

## Safety Controls

* **Always asks a technician:** deleting a location, turning the firewall off, and setting a proxy user's password.
* **Never sent:** rotating the API key, which would stop Neo's key at once.
* **Never shown to the agent or a script:** fields that hold a secret, such as a connector's security key or a password, and tokens inside logged URLs and AI conversations. Neo removes them from every answer. On a settings change, Neo reads the stored settings, secret included, and writes the secret back unchanged.

## Permission groups

| Group | Access levels | Covers |
| - | - | - |
| Reports and Logs | Disabled, Read Only | URL event logs, monthly reports and AI conversations |
| Allow and Block Lists | Disabled, Read Only, Read / Write | The entries of each allow list and block list policy |
| Policies | Disabled, Read Only, Read / Write | Policy layers, SaaS and internet access, private access, connector and DLP policies with their settings and resources, and each policy group's web controls |
| Policy Groups | Disabled, Read Only, Read / Write | Default policy groups and reporting groups |
| Firewall | Disabled, Read Only, Read / Write | Firewall rules and turning the firewall on or off |
| Locations and Private Access | Disabled, Read Only, Read / Write | Locations, private networks, private access peers and their DHCP and NAT settings |
| Connector Settings | Disabled, Read Only, Read / Write | Connector settings per policy group |
| Proxy and SSL Decryption | Disabled, Read Only, Read / Write | Proxy settings and logging, SSL decryption settings, bypasses and decrypted apps |
| Data Loss Prevention | Disabled, Read Only, Read / Write | DLP rules, responses, converters and settings, and incident capture settings |
| Proxy Users and Devices | Disabled, Read Only, Read / Write | Static proxy users and devices and their policy group |
| Resource Catalog | Disabled, Read Only, Read / Write | The SaaS apps, private apps and services policies reference |
| Account Settings | Disabled, Read Only, Read / Write | The account, its clusters, alert emails, time zone, release channel and update windows |

## Access profiles

| Profile | What runs on its own | What asks a technician |
| - | - | - |
| **Read Only** | Reads in every group | No write is allowed |
| **Helpdesk** | Reads | Adding or removing allow and block list entries; the other groups are read-only |
| **IT Admin** | Every other change | Allow and block list entries, firewall rules, and proxy and SSL decryption changes |
| **Full Automation** | Every supported call | The changes under Safety Controls |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.