> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# TridentStack API

> Work TridentStack Control from Neo: read an endpoint's health, updates, CVEs and compliance on its ticket, and install or restart with approval

The common use is a security, patching, vulnerability or compliance ticket in your PSA: the agent finds the endpoint the ticket names, reads its health, pending and failed updates, deployment status, top CVEs and compliance drift, and writes them in an internal note. Agents also install updates, restart endpoints and rescan them as your settings allow, and read a customer's numbers for a QBR.

> [!NOTE]
>
> Automatically enabled when you configure TridentStack permissions in your agent workflow.

## What It Does

* Read endpoints and their details, health score, history, update checks, software, open ports and log collections
* Read applicable Windows, Linux, application and driver updates, failed installs and deployment executions
* Read vulnerabilities and CVEs per endpoint and per customer, with severity, known-exploited flag and fix
* Read compliance scores, failed controls, score history and Endpoint Checks
* Install updates and feature upgrades, restart endpoints, push policies, rescan and re-evaluate
* Read and change update policies, approvals, deployment rings, application updates, configuration policies, vulnerability exceptions, compliance exemptions, tags, reports, settings and enrollment tokens

## Permission Groups

| Group | Covers |
| - | - |
| Organizations | The Organizations the key reaches (read only) |
| Endpoints | Endpoint details, health, history, update checks, software, network exposure and logs; reboot settings; removing an endpoint |
| Installs & Restarts | Installing updates and feature upgrades, pre-staging, restarting, pushing policies, a deployment's reboot |
| Scans & Log Collection | Vulnerability scans, compliance evaluations, network refreshes and log collections |
| Update Policies & Rings | The update catalog, update policies, approvals and overrides, deployment rings and executions |
| Application Updates | Application update configurations and their applications |
| Configuration Policies | Policy objects, assignments, security and service settings, an endpoint's policies |
| Vulnerabilities | Findings and CVEs, a finding's status, vulnerability exceptions |
| Compliance | Frameworks, scores, controls, exemptions and Endpoint Checks |
| Tags & Automation | Agent tags, their members and assignments, tag automation rules |
| Reports & Dashboards | Reports, dashboards and metrics |
| Settings, Licensing & Enrollment | Account and health score settings, licences, enrollment tokens |

## Access Profiles

| Profile | What runs on its own | What asks a technician |
| - | - | - |
| **Read Only** | Every read | No write is allowed |
| **Helpdesk** | Every read, and scans | Installs, restarts and endpoint changes; no policy or other write is allowed |
| **IT Admin** | Every read and almost every write | Vulnerability exceptions and status changes, compliance exemptions, account settings, replacing a settings, application or policy record whole, and removing an endpoint |
| **Full Automation** | Every read and write | Removing an endpoint, and replacing a settings, enrollment token, application or policy record whole |

## Safety Controls

| Control | Behavior |
| - | - |
| **The ticket's customer only** | On a run for a ticket that names a company, Neo sends a call only inside the Organization that company is mapped to (the `X-Tenant-Id` header). A call on your main account and the list of Organizations are refused on a ticket run |
| **Always asks a technician** | Removing an endpoint from TridentStack, and replacing a whole settings, enrollment token, application or policy record, where a field the change leaves out could clear a stored password. Every other change follows the group's approval setting |
| **Bulk actions** | A bulk install, restart, policy push, approval or exception delete must name each record by id |
| **Not available** | Marking a tag sensitive (TridentStack allows it only to a signed-in person), and downloading a log bundle or an application icon (binary files) |
| **Hidden secrets** | Each enrollment token's value, and any stored password or secret in a settings answer, are hidden before the agent or a script reads them. A change that would send a hidden value back is refused, so a stored password is never overwritten with the placeholder |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.