> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# ScoutDNS API

> Work ScoutDNS from Neo: research domain review requests, look up roaming clients and locations, read query logs and threats, change allow and block lists

The common uses are a "ScoutDNS Domain Review Request" ticket, where the agent reads the query log and the lists for the domain, writes its findings and a recommendation on the ticket, and allows the domain on the customer's list once approved, and questions in a chat with Neo about a customer's roaming clients, locations and organizations.

> [!NOTE]
>
> Automatically enabled when you configure ScoutDNS permissions in your agent workflow.

## What It Does

* Read the query log for a customer: each lookup with its decision, categories, policy, reason, location, user and device
* Read threats blocked, top domains and categories, request totals and the statistics reports
* Read and change allow and block lists, and find the policies that use each
* Look up organizations, their locations, networks, roaming client profiles and roaming clients
* Read and change policies, TLD filters, block pages, locations, networks, roaming clients and profiles, organizations, console users and log streams
* Read usage per organization for billing
* Get the roaming client installer and install bundles for your RMM

## Permission Groups

| Group | Covers |
| - | - |
| Reports and Query Logs | Query logs, threats, top domains and categories, statistics and ScoutDNS's category list (read only) |
| Allow and Block Lists | The lists and the policies that use each; adding a domain to one, creating, editing and deleting lists |
| Policies, TLD Filters and Block Pages | Policies, TLD filters and block pages, and where each block page is shown |
| Locations, Networks and Relays | Locations, their networks and status, and the network relays |
| Roaming Clients and Profiles | Roaming clients, their sessions and counts, client profiles and the client export |
| Roaming Client Installers | Installers and install bundles |
| Customer Organizations | Organizations and the locations and profiles in each |
| Console Users | Console users and the API key's own user |
| Log Streams | Log streams to a SIEM, their types and field mappings |
| Usage and Billing | Query and seat usage per organization (read only) |

## Access Profiles

| Profile | What runs on its own | What asks a technician |
| - | - | - |
| **Read Only** | Every read except installers | No write is allowed |
| **Helpdesk** | Every read except installers, console users and log streams | Every allow and block list change; no other write is allowed |
| **IT Admin** | Every read, and location, network, roaming client, installer and organization changes | List, policy, console user and log stream changes, and the changes that always ask |
| **Full Automation** | Every read and write | The changes that always ask |

## Safety Controls

| Control | Behavior |
| - | - |
| **The ticket's customer only** | On a run for a ticket that names a company, Neo sends a call only when the ScoutDNS organization it names is the one the ticket's company is mapped to. A report names the organization in its filter, with no other id filter beside it; a call about one record names it too, and Neo reads the record first to confirm it belongs to that organization. Calls that name no organization are refused on a ticket run |
| **Always asks a technician** | Deleting an organization, location or network; disabling a location's networks or a roaming client, uninstalling a roaming client, or a network edit that turns filtering off; deleting a roaming client profile; creating or editing a log stream |
| **Whole-record edits** | An edit replaces the whole record, so Neo sends it only with every field of its form, and refuses a network edit when the network holds more than one WAN address |
| **Secrets** | Passwords, tokens and other credential fields are hidden in every answer, and a change that sends a hidden value back is refused |
| **Installers** | The install key and link are kept out of the run log, and a sandbox script cannot read them |
| **Refused** | Uploading a block page logo, which is an image file; editing a roaming client profile, whose local forwarding domains Neo cannot read back; editing a log stream whose SIEM settings hold a secret Neo hides |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.