> ## Documentation Index > Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt > Use this file to discover all available pages before exploring further. # Override one company's GDAP permissions > Body: `{"granted_app_roles": [...]}`, the whole set to hold in this company's tenant; an empty list grants nothing. The company stops following the MSP-wide default. On a GDAP-connected company `apply` says whether a run started to make Neo's app hold this set, removals included; a tenant that several companies share holds the union of their sets. In a tenant where another connection also uses Neo's app, the run only adds what is missing. Admin or owner only (`403` otherwise). `404` for a company that is not yours, `400` for a permission that is not in the catalog. ## OpenAPI ````yaml https://api.neoagent.io/public-api/openapi.json put /public-api/end-companies/{psa_company_id}/gdap-permissions openapi: 3.1.0 info: description: >- Neo's public contract for the dashboard ChatAgent, partner integrations, and MSP automation. Every response is wrapped in a `{data, meta}` envelope; errors use `{error: {code, message, details?}, meta: {request_id}}`. Authenticate with a `Bearer neo_sk__` API key (service account) or a Microsoft Entra ID JWT (dashboard user). Signed-URL endpoints (end-user feedback links) take a `signature` query parameter instead. title: Neo Public API version: 1.0.0 servers: - url: https://api.neoagent.io security: [] tags: - description: Service metadata — health, OpenAPI. name: Meta - description: Agents and workflows — read, version history, delete, stats. name: Agents - description: Agent/workflow execution history, sub-resources, retry/cancel. name: Executions - description: >- Every tool call the tenant's agents made in the last 30 days, within the caller's workflow access. name: Audit Log - description: PSA webhook events and their workflow-match results. name: Callbacks - description: Technician-in-the-loop approval requests. name: TIL requests - description: RMM script executions triggered by agents. name: RMM scripts - description: Dispatch-agent field-update decisions. name: Dispatch - description: The authenticated tenant. name: Tenant - description: Agent-builder schema catalogs (raw JSON payloads). name: Schemas - description: Escalate to the Neo team (HubSpot ticket). name: Escalation - description: Tenant settings. name: Settings - description: Tenant API-key management (dashboard JWT only). name: API keys - description: End-user feedback links (signed-URL auth). name: Feedback - description: End-client companies (CRUD + bulk-update). name: End companies - description: Channels — bind a CONVERSATIONAL agent to a transport (Teams or Slack). name: Channels - description: PSA/RMM/M365 integration status and connection management. name: Integrations - description: Technician roster (controls TIL routing and paging). name: Technicians - description: Future runs queued for TRIGGERED agents. name: Scheduled work - description: Subscription state and customer-facing credit usage (no provider $). name: Billing - description: Inbox messages and announcements. name: Inbox & Comms - description: Tenant-authored agent skills (CRUD) and the built-in skill catalog. name: Skills paths: /public-api/end-companies/{psa_company_id}/gdap-permissions: put: tags: - End companies summary: Override one company's GDAP permissions description: >- Body: `{"granted_app_roles": [...]}`, the whole set to hold in this company's tenant; an empty list grants nothing. The company stops following the MSP-wide default. On a GDAP-connected company `apply` says whether a run started to make Neo's app hold this set, removals included; a tenant that several companies share holds the union of their sets. In a tenant where another connection also uses Neo's app, the run only adds what is missing. Admin or owner only (`403` otherwise). `404` for a company that is not yours, `400` for a permission that is not in the catalog. operationId: public_api.end_companies_gdap_permissions_update_put parameters: - in: path name: psa_company_id required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/GdapPermissionSelectionRequest' required: true responses: '200': content: application/json: schema: properties: data: $ref: '#/components/schemas/PublicGdapCompanyPermissionsSaved' meta: $ref: '#/components/schemas/SuccessMeta' required: - data - meta type: object description: Success. '400': content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' description: Bad request — malformed input. '401': content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' description: Unauthenticated — missing or invalid credentials. '403': content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' description: Forbidden — authenticated but not allowed. '404': content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' description: Not found. '409': content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' description: Conflict — the resource is in a state that blocks this operation. '422': content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' description: Request validation failed. '429': content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' description: Rate limited — see Retry-After. '500': content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' description: Internal server error. security: - bearerAuth: [] components: schemas: GdapPermissionSelectionRequest: description: The whole selection to hold. An empty list grants nothing. properties: granted_app_roles: items: $ref: '#/components/schemas/GdapPermissionKey' title: Granted App Roles type: array required: - granted_app_roles title: GdapPermissionSelectionRequest type: object PublicGdapCompanyPermissionsSaved: properties: application_access_granted: title: Application Access Granted type: boolean apply: $ref: '#/components/schemas/PublicGdapPermissionApply' consent_method: anyOf: - enum: - DIRECT - GDAP type: string - type: 'null' title: Consent Method granted_app_roles: items: $ref: '#/components/schemas/PublicGdapGrantedPermission' title: Granted App Roles type: array overridden: title: Overridden type: boolean psa_company_id: title: Psa Company Id type: string required: - psa_company_id - overridden - consent_method - application_access_granted - granted_app_roles - apply title: PublicGdapCompanyPermissionsSaved type: object SuccessMeta: properties: pagination: $ref: '#/components/schemas/Pagination' request_id: format: uuid type: string timings_ms: additionalProperties: type: number type: object warnings: description: >- Non-fatal warnings about the created/updated resource (e.g. an unhealthy PSA callback). items: type: string type: array required: - request_id - timings_ms type: object ErrorEnvelope: properties: error: properties: code: description: Stable machine-readable error code. type: string details: additionalProperties: true type: object message: type: string required: - code - message type: object meta: properties: request_id: format: uuid type: - string - 'null' type: object required: - error - meta type: object GdapPermissionKey: description: >- A permission to grant, as `resource_app_id` and `app_role_id` from the catalog. Other fields of a catalog or selection entry are ignored, so a read entry can be sent back as it is. properties: app_role_id: title: App Role Id type: string resource_app_id: title: Resource App Id type: string required: - resource_app_id - app_role_id title: GdapPermissionKey type: object PublicGdapPermissionApply: description: >- What a save started in the customer tenants. `STARTED`: a run is making Neo's app hold the selection, removals included; `run_id` names it. In a tenant where another connection also uses Neo's app, the run only adds what is missing, and its detail says so. `ALREADY_RUNNING`: a run for the same companies is in progress (`run_id`); save again after it ends. `NOT_CONNECTED`: saved, and it applies when the company connects through GDAP. `DIRECT_CONSENT`: the company's admin approved Neo's full set, and this selection changes nothing there. `NOTHING_TO_APPLY`: no GDAP-connected company follows the default. `START_FAILED`: saved, but the run did not start; save again. `companies_queued` counts the companies the run covers. properties: companies_queued: title: Companies Queued type: integer run_id: anyOf: - type: string - type: 'null' title: Run Id status: enum: - STARTED - ALREADY_RUNNING - NOT_CONNECTED - DIRECT_CONSENT - NOTHING_TO_APPLY - START_FAILED title: Status type: string required: - status - run_id - companies_queued title: PublicGdapPermissionApply type: object PublicGdapGrantedPermission: description: >- One permission in a selection. `value`, `display_name` and `resource_name` are null for a permission Neo's app no longer declares. properties: app_role_id: title: App Role Id type: string display_name: anyOf: - type: string - type: 'null' title: Display Name elevated: title: Elevated type: boolean resource_app_id: title: Resource App Id type: string resource_name: anyOf: - type: string - type: 'null' title: Resource Name value: anyOf: - type: string - type: 'null' title: Value required: - resource_app_id - app_role_id - resource_name - value - display_name - elevated title: PublicGdapGrantedPermission type: object Pagination: properties: has_more: type: boolean next_cursor: type: - string - 'null' required: - next_cursor - has_more type: object securitySchemes: bearerAuth: description: >- `Authorization: Bearer ` where `` is either a `neo_sk__` API key (service account) or a Microsoft Entra ID access token (dashboard user). scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.