TridentStack API

The common use is a security, patching, vulnerability or compliance ticket in your PSA: the agent finds the endpoint the ticket names, reads its health, pending and failed updates, deployment status, top CVEs and compliance drift, and writes them in an internal note. Agents also install updates, restart endpoints and rescan them as your settings allow, and read a customer’s numbers for a QBR.

Automatically enabled when you configure TridentStack permissions in your agent workflow.

What It Does

Read endpoints and their details, health score, history, update checks, software, open ports and log collections
Read applicable Windows, Linux, application and driver updates, failed installs and deployment executions
Read vulnerabilities and CVEs per endpoint and per customer, with severity, known-exploited flag and fix
Read compliance scores, failed controls, score history and Endpoint Checks
Install updates and feature upgrades, restart endpoints, push policies, rescan and re-evaluate
Read and change update policies, approvals, deployment rings, application updates, configuration policies, vulnerability exceptions, compliance exemptions, tags, reports, settings and enrollment tokens

Permission Groups

Group	Covers
Organizations	The Organizations the key reaches (read only)
Endpoints	Endpoint details, health, history, update checks, software, network exposure and logs; reboot settings; removing an endpoint
Installs & Restarts	Installing updates and feature upgrades, pre-staging, restarting, pushing policies, a deployment’s reboot
Scans & Log Collection	Vulnerability scans, compliance evaluations, network refreshes and log collections
Update Policies & Rings	The update catalog, update policies, approvals and overrides, deployment rings and executions
Application Updates	Application update configurations and their applications
Configuration Policies	Policy objects, assignments, security and service settings, an endpoint’s policies
Vulnerabilities	Findings and CVEs, a finding’s status, vulnerability exceptions
Compliance	Frameworks, scores, controls, exemptions and Endpoint Checks
Tags & Automation	Agent tags, their members and assignments, tag automation rules
Reports & Dashboards	Reports, dashboards and metrics
Settings, Licensing & Enrollment	Account and health score settings, licences, enrollment tokens

Access Profiles

Profile	What runs on its own	What asks a technician
Read Only	Every read	No write is allowed
Helpdesk	Every read, and scans	Installs, restarts and endpoint changes; no policy or other write is allowed
IT Admin	Every read and almost every write	Vulnerability exceptions and status changes, compliance exemptions, account settings, replacing a settings, application or policy record whole, and removing an endpoint
Full Automation	Every read and write	Removing an endpoint, and replacing a settings, enrollment token, application or policy record whole

Safety Controls

Control	Behavior
The ticket’s customer only	On a run for a ticket that names a company, Neo sends a call only inside the Organization that company is mapped to (the `X-Tenant-Id` header). A call on your main account and the list of Organizations are refused on a ticket run
Always asks a technician	Removing an endpoint from TridentStack, and replacing a whole settings, enrollment token, application or policy record, where a field the change leaves out could clear a stored password. Every other change follows the group’s approval setting
Bulk actions	A bulk install, restart, policy push, approval or exception delete must name each record by id
Not available	Marking a tag sensitive (TridentStack allows it only to a signed-in person), and downloading a log bundle or an application icon (binary files)
Hidden secrets	Each enrollment token’s value, and any stored password or secret in a settings answer, are hidden before the agent or a script reads them. A change that would send a hidden value back is refused, so a stored password is never overwritten with the placeholder

Getting started

Core

Triggered & Scheduled Agents

Chat Agents

Integrations

Product

Workflows

Customizing Neo

What It Does

Permission Groups

Access Profiles

Safety Controls

​What It Does

​Permission Groups

​Access Profiles

​Safety Controls

What It Does

Permission Groups

Access Profiles

Safety Controls