> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# IRONSCALES API

> Find, check and release the email a user reports as blocked, and work IRONSCALES incidents, the allow list, mailboxes and training

The common use is a ticket where a user reports a blocked or quarantined email: the agent finds the IRONSCALES incident that holds it, checks the sender, links and attachments, releases it when it is safe, and notes what it found on the ticket.

> [!NOTE]
>
> Automatically enabled when you configure IRONSCALES permissions in your agent workflow.

## What It Does

* Find incidents by release request, end-user report, recipient, sender, subject or date, and read each one's sender, SPF result, reputation, link and attachment scans, AI verdict and affected mailboxes
* Classify an incident safe to put its mail back in every affected mailbox, or phishing to remove it, and release one user's copy only
* Read what was removed from each mailbox, and the company's statistics
* Add, change and remove allow list entries
* Read, add and tag protected mailboxes, and run the directory auto-sync
* Act on account takeover incidents: mark them safe, or sign the user out of Microsoft 365 or disable the account
* Read and run awareness training campaigns, and each user's training record
* Set who is emailed about incidents, and read and manage the companies under your partner account

## Permission Groups

| Group | Access levels | Covers |
| - | - | - |
| Incidents and Release Requests | Disabled, Read Only, Read/Write | Incidents, release requests and end-user reports, the emails in them, classifying an incident and moving emails between incidents |
| Remediation History and Statistics | Disabled, Read Only | What was removed from each mailbox, impersonation attempts, and statistics |
| Allow List | Disabled, Read Only, Read/Write | The company's allow list |
| Mailboxes | Disabled, Read Only, Read/Write | Protected mailboxes and the directory auto-sync |
| Account Takeover and Deepfake | Disabled, Read Only, Read/Write | Takeover incidents and their remediation, deepfake events, the takeover sensitivity |
| Awareness Training | Disabled, Read Only, Read/Write | Phishing simulation and training campaigns, and each user's training record |
| Alert Recipients | Disabled, Read Only, Read/Write | Who is emailed about incidents and challenged incidents, and the 911 address |
| Companies and Licenses | Disabled, Read Only, Read/Write | The companies under your partner account, their licences, licensed domains and features |
| Email Platform Connection | Disabled, Read Only, Read/Write | Connecting a company's Microsoft 365 or Google Workspace |

Neo always asks a technician before it disables a company, changes its features, removes a licensed domain, disconnects its email platform or turns protection off for mailboxes, whatever the group's approval setting. It never turns off a company's API access, and never edits mailboxes without naming them. On a ticket, the agent works only on the IRONSCALES company mapped to the ticket's company.

## Setup

See [Connecting IRONSCALES to Neo](https://docs.neoagent.io/integrations/ironscales/connecting-to-neo.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.