> ## Documentation Index > Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt > Use this file to discover all available pages before exploring further. # Connecting Airlock Digital to Neo > Publish a client's Airlock REST API and save an API key for Neo ## Before you start * Neo uses the Airlock Digital REST API, which the Airlock server serves at `https://:3129/v1/` unless you changed its port. This holds whether you host the server or Airlock hosts it for the client. * Neo reaches the server over the internet. The REST API must answer on **HTTPS** with a certificate from a public certificate authority, at a public address. * If Airlock's REST IP allowlist is on, add [Neo's addresses](https://docs.neoagent.io/integrations/ip-whitelisting.md) to it. * Neo connects to each client's server on its own. Add the client to your **Companies** tab first. ### If the Airlock server is only on the client's internal network Publish only the REST API, never the Airlock console, through a reverse proxy at the client's network edge that: * answers on a public name over HTTPS, with a certificate from a public certificate authority; * forwards only paths under `/v1/` to the Airlock server's REST port, and refuses every other path; * accepts connections only from [Neo's addresses](https://docs.neoagent.io/integrations/ip-whitelisting.md); * passes the `X-ApiKey` header through. Save the proxy's public address in Neo, with its port (for example `https://airlock-api.example.com:443`). ## 1. Make an Airlock user and API key for Neo **1. Make a user group with REST permissions** In the Airlock console, make a user group for Neo and give it the REST permissions your agents need: for example `agent/find`, `group`, `group/agents`, `group/policies`, `getexechistory`, `otp/usage` and `otp/activities` for an agent that only reads; add `agent/move`, `otp/retrieve`, `otp/revoke`, `hash/query`, `hash/application/add`, `exception/list` and `exception/approve` for the move, OTP and allowlisting jobs. Neo checks the key with `group`, so include it. **2. Make the user** Make a local Airlock user for Neo in that group, such as `neo-api`. **3. Copy its API key** Sign in as that user, or as an administrator, and copy the user's API key from its settings. Neo can do only what this key's user group allows, whatever the agent's access profile says. ## 2. Add the connection in Neo **1. Open Integrations** In the Neo Dashboard, open [**Integrations** → **Airlock Digital**](https://dashboard.neoagent.io/integrations?open=airlock_digital), under Endpoint Security. **2. Pick the client** In **Customer**, choose the client this server belongs to. The client must be on your **Companies** tab. For a second client, click **Add customer**. **3. Save the address and the key** Enter the **Server URL** with its port (for example `https://airlock.example.com:3129`, or the proxy's address) and the **API Key**, then click **Save settings**. Neo lists the policy groups before saving, so a wrong address or a refused key is rejected straight away, with what to fix. A URL with no port is saved with 3129. ## 3. Turn Airlock Digital on per agent Open the agent, go to the Integrations section, and configure the Airlock Digital block. Agents see only what Neo's API key can see. ### Pick an access profile > **Read Only** > > Read agents, policy groups, blocked files, OTP history and exception requests. Nothing is changed. > **Helpdesk** > > Moving computers, OTP codes, exception requests and allowlisting a file wait on a technician. Everything else is read only. > **IT Admin** > > Moving computers, blocklisting, revoking OTP codes and deciding exception requests run without approval, except the changes that always ask. Allowlisting, exclusions, policy settings and users wait on a technician. > **Full Automation** > > Every change runs without approval, except the [changes that always ask a technician](#changes-that-always-ask-a-technician). To allowlist file hashes only after a technician approves, use Helpdesk or IT Admin, or set **Allowlists, Baselines & Files** to Read/Write with technician approval. ### Or set each area by hand | Area | Notes | | - | - | | **Agents** | Enforcement agents (the protected computers): status, check-in, policy group; move between groups, remove. | | **Policy Groups & Exclusions** | Policy groups, their assigned allowlists, baselines and blocklists, path, process and publisher exclusions, trusted installers, and settings. | | **Allowlists, Baselines & Files** | Allowlists, baselines, their metarules and file hashes, the file repository and hash reputation. | | **Blocklists** | Blocklists, their metarules and file hashes. | | **OTP Codes** | OTP usage history and the files run under a code; issue and revoke. Issuing always waits on a technician. | | **Exception Requests** | The requests users raise from a blocked computer: list, approve, deny. | | **Execution & Server Logs** | Blocked, audited, OTP and trusted executions, activity summaries, policy changes and server activity. | | **Users, Licence & Relays** | Airlock console users and user groups, the licence, relay communication lists. Every user change waits on a technician. | Each area can be Disabled, Read Only or Read/Write, and has its own technician approval setting. ### Changes that always ask a technician These wait on a technician under every profile, whatever the area's own approval setting: * Issuing an OTP code. * Audit mode, script control mode and the agent stop code, which stop blocking or let a user stop the agent. * Removing an agent, and moving a computer to Unmanaged. * Deleting a policy group, an allowlist, a baseline, a blocklist or an allowlist category, and replacing a group's configuration with another group's. * Removing a hash from every allowlist, every baseline or every blocklist at once. * The proxy settings, which store the proxy password. * Setting the licence key, and any change to console users. * Any change that stores a credential: a password, a stop code or a licence key. ## Troubleshooting | Error when you save | What to check | | - | - | | No Airlock REST API answered | The address and port: 3129 unless you changed it, or your proxy in front of the server. | | Airlock refused the API key | The key, and that its user group has the REST permission `group`. A web server in front of Airlock must pass the `X-ApiKey` header. | | Airlock's REST IP allowlist refused Neo's address | Add Neo's addresses to the REST API allowlist in the Airlock console. | | Did not show a certificate from a public authority | Give the Airlock server a public certificate, or put a reverse proxy with one in front of the REST API. | | Could not reach the Airlock server | The address, that it is public, and that Neo's addresses can reach it. | This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.