Skip to main content
The ThreatLocker API tool gives Neo agents direct access to the ThreatLocker Portal API — read computers, applications, and policies, and resolve pending software-approval requests (the “app won’t run” workflow) during ticket resolution.
Automatically enabled when you configure ThreatLocker permissions in your agent workflow. No manual toggle needed.

​
What It Does

  • Find the pending approval request behind an “app won’t run” ticket, and the computer/application it’s for
  • Approve or deny pending software-approval requests (always behind technician approval)
  • Look up computers, computer groups, and online status
  • Look up applications and application files ThreatLocker has observed
  • View and edit allowlist / Config Manager / network access policies (writes always behind technician approval)
  • Enumerate ThreatLocker organizations to scope a call to a specific customer

​
Permission Groups

Each group has an access level: Disabled, Read Only, or Read/Write (Organizations only ever offers Read Only — no write endpoint exists for it).

​
Access Profiles

All groups Read Only. Agent can look up any resource but cannot modify or act on approval requests.
Approval Requests at Read/Write (still requires technician approval on every write). Everything else Read Only — enough to resolve the “app blocked” workflow without touching computers, applications, or policies directly.
Computers, Applications, Policies, and Approval Requests all at Read/Write — but every write requires technician approval, not just the mandatorily-forced ones.
Computers and Applications writes run autonomously. Policy edits and approval actions still always require technician approval — that override is never optional.

​
Safety Controls

​
How to Configure

1

Connect ThreatLocker

Connect your ThreatLocker Portal API credentials in the Neo Dashboard under the Security integrations category.
2

Configure permissions

In your agent workflow’s Integrations tab, choose an access profile or customize each permission group.
3

Set approval requirements

Approval Requests and Policies always require technician approval on writes; decide whether Computers/Applications should too.
Start with Read Only or Helpdesk and expand once you’re confident in the agent’s triage — the forced approval on software approvals and policy edits means expanding write access elsewhere is lower-risk than it looks.