> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# SonicWall Cloud Secure Edge API

> Check Cloud Secure Edge users, their devices and whether each is personal or company-owned, trust levels, roles, services and access events

The SonicWall Cloud Secure Edge API tool gives Neo agents access to a client's CSE org (formerly Banyan Security). The common use is a ticket about a user's access: the agent checks that the user exists in CSE, reads the device they sign in from and whether it is personal or company-owned, and reads the trust level and events behind a denial.

> [!NOTE]
>
> Automatically enabled when you configure SonicWall Cloud Secure Edge permissions in your agent workflow.

## What It Does

* List users, and check whether a user exists, is active, and when they last signed in
* Read a user's devices with their ownership (Employee Owned, Corporate Dedicated, Corporate Shared or Other), platform, MDM state, ban status and trust level. Neo answers "unknown" when CSE records no owner, and never reads ownership from MDM state
* Read access, trust and device events, and the admin audit log
* Read roles, policies, threat profiles, services, SaaS apps, access tiers, connectors and service tunnels
* Remove users and devices, ban or unban a device, cap a user's or device's trust level, and change roles, policies, services and access tiers when you allow it

## One connection per client

Each client's CSE org is connected under that client's company. On a ticket, the agent reaches only the ticket company's org. See [SonicWall Cloud Secure Edge overview](https://docs.neoagent.io/integrations/sonicwall-cloud-secure-edge/overview.md).

## Permission Groups

| Group | Covers |
| - | - |
| Users & Groups | Users, their status, licences, last sign-in, roles and directory groups; remove users |
| Devices & Trust | Devices with their user, ownership, platform, MDM state, ban status, trust and reported location data; remove, ban or unban a device, cap its trust level, recalculate its trust score |
| Roles, Policies & Threat Profiles | Roles, policies and where they are attached, threat profiles; create, change, enable, disable and delete them |
| Services & Apps | Hosted services, SaaS apps, service bundles and cloud resources, and service connection tests |
| Access Tiers, Connectors & Tunnels | Access tiers and their local config, connectors, service tunnels and their policies, support bundles |
| Events & Audit Logs | Events, event counts and summaries, and the admin audit log; submit an event |
| API Keys | The org's API keys and their scopes, without their secrets. Disabled or Read Only |

## Access Profiles

| Profile | What runs on its own | What asks a technician |
| - | - | - |
| **Read Only** | Every read | No write is allowed |
| **Helpdesk** | Every read | Changes to users and devices. Every other area is read only |
| **IT Admin** | Changes to users, devices, services, access tiers and events | Changes to roles, policies and threat profiles, plus the writes that always ask |
| **Full Automation** | Every change except the ones below that always ask | The writes that always ask |

## Writes that always ask a technician

Under every profile, a technician approves each write that replaces a whole record, because a field the agent leaves out may be cleared: replacing a role, policy, threat profile, service bundle, cloud resource, access tier, its local config, a connector or a service tunnel, the v1 calls that create or update a role, policy, service or SaaS app, and a device update, which also bans and unbans.

## Safety Controls

| Control | Behavior |
| - | - |
| API keys | Neo never creates, changes or deletes an API key: it cannot tell which key is its own |
| Secrets | An API key's secret and the client secrets of SaaS apps and services are removed from every answer, and a write that sends one back is refused |
| SaaS app client secret | Creating or updating a SaaS app replaces the whole app, so a body with a client ID and no client secret is refused: the agent asks the technician for the secret |
| Named records | A delete, ban, trust cap, enable or disable must name its user, device, role, policy or service; Neo refuses one that names none |
| Multi-org calls | Neo refuses the multi-org trust sync, which needs SonicWall's own credential |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.