> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Vendor API

> One tool for every descriptor-backed vendor API — ScalePad, Huntress, ThreatLocker — selected per call by vendor id and gated by that vendor's permission groups

Each call carries an API path, an HTTP method, and — where the endpoint needs them — query
parameters, a request body, and headers from the vendor's allowlist. Neo adds the base URL and
the authentication, so the agent never handles the credentials, and a header outside the
allowlist is rejected. A vendor the agent's permissions do not cover is rejected before any
HTTP call.

<Info>
  Automatically enabled when you configure permissions for any of the covered vendors in your
  agent workflow. No manual toggle needed — and it never appears as a separate tool to configure.
</Info>

<Tip>
  The agent's instructions list the vendors your permissions enable, with a line on what each one
  covers. The endpoint tables, request shapes, and each vendor's quirks live in that vendor's
  skill, which the agent must load before its first call to the vendor.
</Tip>

## What It Does

* Calls the vendor's REST API directly — reads and (where permitted) writes
* Routes each call through the vendor's own permission groups, exactly as the former
  per-vendor tools did
* Applies the vendor's approval rules: operations a vendor always gates (Huntress host
  isolation, ThreatLocker software approvals and policy edits, ScalePad ControlMap writes)
  still require technician approval regardless of automation level

## Covered Vendors

| Vendor       | vendor\_id     | Details                                                                                                                           |
| ------------ | -------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| ScalePad     | `scalepad`     | Read/write asset-lifecycle data across Core, Lifecycle Manager, ControlMap, and Quoter — gated by your ScalePad permission groups |
| Huntress     | `huntress`     | See [Huntress API](/agents/tools/security/huntress-api)                                                                           |
| ThreatLocker | `threatlocker` | See [ThreatLocker API](/agents/tools/security/threatlocker-api)                                                                   |

## Permissions & Billing

Each vendor keeps its own permission groups in the agent's settings — enabling one vendor
never grants another. Calls bill at the vendor's credit tier (Standard for all covered
vendors today), and usage reporting keeps the per-vendor split.