> ## Documentation Index > Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt > Use this file to discover all available pages before exploring further. # KnowBe4 API > Add, update and archive your clients' KnowBe4 users and groups, report on training and phishing tests, add user events, and triage PhishER reports The common uses are onboarding and offboarding (add a new hire to KnowBe4 and their training groups; archive a leaver), monthly training and phishing reports, and PhishER Threat tickets. Automatically enabled when you configure KnowBe4 permissions in your agent workflow. KnowBe4 is connected per client, so the agent calls the KnowBe4 account of the ticket's company, with the keys that client's connection holds. ## What it does * Find, create, update, archive, restore and delete users, and manage their group memberships and email aliases * Create, update, clone and archive groups * Read training campaigns, enrollments and completion; enroll a user, extend a due date, and manage campaigns, policies and the content library * Read phishing, callback, QR code and USB test campaigns and who clicked, replied, entered data or reported; manage campaigns and templates * Read risk score history for users, groups and the account * Add, read and delete security events on a user's record (User Event API) * Read reported emails in PhishER and set their category, status, severity, tags and comments; read and manage PhishER rules (Account & Settings) * Read and manage admins, security roles and account settings The Reporting API only reads. The User Event API adds and deletes events and event types, and KnowBe4's GraphQL API reads and changes everything else. It names one GraphQL field per call and the fields it wants back, and Neo writes the query, so each call does exactly one thing and Neo checks its permission group. ## Safety Controls * **Always asks a technician:** permanently deleting users. Archiving a user, which keeps their training and phishing history, is the removal agents use. * **Asks under IT Admin:** a change that grants or removes access (making a user an admin, assigning security roles to a user or a group, turning a user's MFA off, partner access) and account settings. * **Groups with a security role:** before any change that adds users to groups (adding members, creating or importing users into groups, smart-group criteria, cloning a group), Neo reads the target groups' security roles. When a group carries one, Neo does not make the change, because the role gives its members KnowBe4 console access; a person adds that user in the KnowBe4 console. If Neo cannot read the groups, it does not make the change either. * **Never sent:** a password, one-time code or client secret in any call (so a user turns MFA on themselves); creating, regenerating or deleting API, User Event or SCIM tokens; turning the account's API off; and changes that act on every PhishER message or user event a search or filter matches. The agent changes those one at a time by id. * **Never read:** fields that hold a credential, such as a user's MFA secret, an API token's secret, the PST token and the download link of a reported email. ## Permission groups | Group | Access levels | Covers | | - | - | - | | Users | Disabled, Read Only, Read / Write | Users, their email aliases, group memberships, MFA and risk score history; permanently deleting users always asks a technician | | Groups | Disabled, Read Only, Read / Write | Groups, their members and risk scores | | Admins & Security Roles | Disabled, Read Only, Read / Write | Console admin rights, security roles, API token details, partner access, turning MFA off, and any user or group change that sets a role or MFA | | Training | Disabled, Read Only, Read / Write | Training campaigns, enrollments, the content library and policies | | Phishing Tests | Disabled, Read Only, Read / Write | Phishing, callback, QR code and USB test campaigns and their results | | Templates & Content | Disabled, Read Only, Read / Write | Phishing, callback, QR, landing page, notification and message templates, categories, topics and images | | User Events | Disabled, Read Only, Read / Write | Security events on a user's record and event types | | PhishER | Disabled, Read Only, Read / Write | Reported emails, their category, status, severity, tags and comments | | Account & Settings | Disabled, Read Only, Read / Write | The account and subscription, domains, IP ranges, DKIM, SAML, user provisioning, Second Chance, PhishER rules, audit logs and assessments | ## Access profiles | Profile | What runs on its own | What asks a technician | | - | - | - | | **Read Only** | Reads in every group | No write is allowed | | **Helpdesk** | Reads, and PhishER triage | Changes to users, groups, training and user events; the other groups are read-only | | **IT Admin** | Every other change | Admins & Security Roles, and Account & Settings | | **Full Automation** | Every supported call | Permanently deleting users | This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.