> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# ThreatLocker API

> Read and action ThreatLocker computers, applications, approval requests, and policies — approving software and editing policies always require technician approval

The ThreatLocker API tool gives Neo agents direct access to the ThreatLocker Portal API — read computers, applications, and policies, and resolve pending software-approval requests (the "app won't run" workflow) during ticket resolution.

<Info>
  Automatically enabled when you configure ThreatLocker permissions in your agent workflow. No manual toggle needed.
</Info>

## What It Does

* Find the pending approval request behind an "app won't run" ticket, and the computer/application it's for
* Approve or deny pending software-approval requests (always behind technician approval)
* Look up computers, computer groups, and online status
* Look up applications and application files ThreatLocker has observed
* View and edit allowlist / Config Manager / network access policies (writes always behind technician approval)
* Enumerate ThreatLocker organizations to scope a call to a specific customer

## Permission Groups

| Permission Group      | What It Covers                                                         |
| --------------------- | ---------------------------------------------------------------------- |
| **Computers**         | Computers, computer groups, online status, maintenance mode            |
| **Applications**      | Applications and application files observed across the fleet           |
| **Policies**          | Application Control / Config Manager policies, network access policies |
| **Approval Requests** | Pending Application/Elevation/Storage Control approval requests        |
| **Organizations**     | Organization hierarchy and org scoping — **read-only by API design**   |

Each group has an access level: **Disabled**, **Read Only**, or **Read/Write** (Organizations only ever offers Read Only — no write endpoint exists for it).

## Access Profiles

<AccordionGroup>
  <Accordion title="Read Only">
    All groups Read Only. Agent can look up any resource but cannot modify or act on approval requests.
  </Accordion>

  <Accordion title="Helpdesk">
    Approval Requests at Read/Write (still requires technician approval on every write). Everything else Read Only — enough to resolve the "app blocked" workflow without touching computers, applications, or policies directly.
  </Accordion>

  <Accordion title="IT Admin">
    Computers, Applications, Policies, and Approval Requests all at Read/Write — but every write requires technician approval, not just the mandatorily-forced ones.
  </Accordion>

  <Accordion title="Full Automation">
    Computers and Applications writes run autonomously. Policy edits and approval actions still always require technician approval — that override is never optional.
  </Accordion>
</AccordionGroup>

## Safety Controls

| Control                          | Behavior                                                                                                                 |
| -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| **Technician-in-the-Loop**       | Require human approval for writes — configurable per group                                                               |
| **Approval Requests protection** | Approving or denying software always requires technician approval, regardless of settings                                |
| **Policy protection**            | Editing allowlist / Config Manager / network access policies always requires technician approval, regardless of settings |
| **Read-only areas**              | Organizations has no write endpoint — nothing to approve or restrict there                                               |

## How to Configure

<Steps>
  <Step title="Connect ThreatLocker">
    Connect your ThreatLocker Portal API credentials in the Neo Dashboard under the **Security** integrations category.
  </Step>

  <Step title="Configure permissions">
    In your agent workflow's **Integrations** tab, choose an access profile or customize each permission group.
  </Step>

  <Step title="Set approval requirements">
    Approval Requests and Policies always require technician approval on writes; decide whether Computers/Applications should too.
  </Step>
</Steps>

<Tip>
  Start with **Read Only** or **Helpdesk** and expand once you're confident in the agent's triage — the forced approval on software approvals and policy edits means expanding write access elsewhere is lower-risk than it looks.
</Tip>