> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# usecure API

> Tell usecure's own training, policy and simulation emails from real phishing on a reported-email ticket, keep learners and training in step, and read simulation, policy and breach results

The common use is a ticket from a user who reported an email, often through usecure's Phish Alert Button: the agent checks usecure for a course, policy or phishing simulation it sent that user at that time, notes what it found on the ticket, and answers the user. The other common jobs are onboarding (add the learner, enrol them on courses, send policies) and offboarding (mark the learner inactive).

> [!NOTE]
>
> Automatically enabled when you configure usecure permissions in your agent workflow.

## What It Does

* Find a learner and read their course enrolments and results, policy signatures, phishing simulation results and breaches
* Add, edit, deactivate, reactivate and delete learners; create groups and set group managers
* Enrol learners on courses and the gap analysis, or remove them
* Read simulations and each recipient's results, and simulation metrics
* Read, create, publish and delete policies and policy templates; send a policy to learners to sign
* Read breached accounts and services, and each client's risk score history
* Invite, change and remove the people who sign in to the usecure console for a client
* Read and change a client's plan and settings; suspend, delete or restore a client; add a client or a prospect

## Permission Groups

| Group | Covers |
| - | - |
| Customer Accounts | Client companies with their plan, settings and usage; creating, updating, suspending, deleting and restoring a client or a prospect |
| Learners & Groups | Learners, their groups and managers; adding, editing, deactivating and deleting learners |
| Admin Users | Who signs in to the usecure console for a client, and inviting, changing or removing them |
| Training | The course library, enrolments, results, gap analysis and participation reports; enrolling and unenrolling |
| Phishing Simulations | Simulations and each recipient's results (read only) |
| Policies | Policies and templates with their versions and signatures; creating, publishing, deleting and sending them |
| Breaches & Risk | Breached accounts and services, and risk score history (read only) |

## Access Profiles

| Profile | What runs on its own | What asks a technician |
| - | - | - |
| **Read Only** | Every read | No write is allowed |
| **Helpdesk** | Every read, and enrolling learners on training | Learner and policy changes. Admin user and client account changes are off |
| **IT Admin** | Every read, learners, training and policies | Admin user and client account changes |
| **Full Automation** | Every read and write | Deleting a client account |

## Safety Controls

| Control | Behavior |
| - | - |
| **One call, one field** | Neo writes each GraphQL document from the field the agent names, its arguments and the fields to return. Values travel as typed variables, so the agent never sends GraphQL text |
| **Nested records** | A read that returns another area's records, such as a learner's simulation results, needs that area's permission group too |
| **Ticket scope** | On a ticket, every call must name the usecure company mapped to the ticket's company, by a name match or one you confirmed. Calls for your MSP account, another client, every client, or a client named by external id are for runs with no ticket company, such as a chat |
| **Deleting a client** | Always asks a technician, whatever the preset |
| **Refused** | Creating or changing an MSP account (usecure keeps that for distributors), the prospect sign-up that takes the Client API Key, and file uploads |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.