> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Connecting AutoElevate to Neo

> Save your AutoElevate API key in Neo, and decide what each agent can do

You connect AutoElevate once at the MSP level, then turn it on per agent.

<Info>
  AutoElevate uses a single API key per MSP. Save it once and every agent that has AutoElevate permissions can use it.
</Info>

## 1. Create an API key in AutoElevate

<Steps>
  <Step title="Open a service user">
    In the AutoElevate admin portal, open a **service user** and add an **API Key**.
  </Step>

  <Step title="Pick the API Token (AE-BEARER) scheme">
    AutoElevate offers two schemes at creation. Pick **API Token (AE-BEARER)** — the value starts with `aeb_`.

    <Warning>
      Do not pick **HMAC (AE-HMAC-SHA256)**. That scheme signs every request with a separate key held on your side, and Neo cannot use it. Its values start with `aeh_`.
    </Warning>
  </Step>

  <Step title="Give the key its scopes">
    An AutoElevate key carries an explicit scope list.

    **Grant `companyView`.** Neo reads the company list on every PSA sync to keep the client mapping current, so this one is needed whatever your agents do.

    Then grant the view scopes for each area your agents read, and `requestEdit` as well if any agent will approve or deny.

    <Tip>
      Copy the key somewhere safe once it is generated — AutoElevate shows it only once.
    </Tip>
  </Step>
</Steps>

## 2. Add the key in Neo

<Steps>
  <Step title="Open Integrations">
    In the Neo Dashboard, open **Integrations** and find the AutoElevate card, under Security.
  </Step>

  <Step title="Save the API Key">
    Paste the key and click **Save**. Neo checks it against AutoElevate before saving, so a wrong or mistyped key is rejected straight away.
  </Step>
</Steps>

## 3. Turn AutoElevate on per agent

Each agent decides whether it uses AutoElevate and which areas it can touch. Open the agent, go to the Integrations section, and configure the AutoElevate block.

### Pick an access profile

<CardGroup cols={2}>
  <Card title="Read Only" icon="magnifying-glass">
    Every area set to read only. The agent can find elevation requests, read the evidence behind them, and report — but never decides one.
  </Card>

  <Card title="Helpdesk" icon="headset">
    Elevation Requests set to read and write — still requires technician approval on every decision. Everything else read only. Fits a helpdesk agent working the "I need admin rights to install this" ticket.
  </Card>
</CardGroup>

There is no Full Automation profile for AutoElevate. The only write this API has is the one that can never go through unattended.

### Or set each area by hand

| Area                      | Access levels you can pick          | Notes                                                                             |
| ------------------------- | ----------------------------------- | --------------------------------------------------------------------------------- |
| **Elevation Requests**    | Disabled, Read Only, Read and Write | Pending and historic requests. Approving and denying always wait on a technician. |
| **Elevation Events**      | Disabled, Read Only                 | The file, path, hashes, publisher, signing state and user behind a request.       |
| **Elevated Sessions**     | Disabled, Read Only                 | Just-in-time admin sessions: who, when, how long.                                 |
| **Elevation Rules**       | Disabled, Read Only                 | Auto-approval and auto-denial rules and their scope.                              |
| **Computers**             | Disabled, Read Only                 | Machine name, OS, elevation mode, last check-in.                                  |
| **Companies & Locations** | Disabled, Read Only                 | Your client hierarchy, used to scope every other lookup.                          |
| **Account & Audit**       | Disabled, Read Only                 | Partner usage figures and the admin audit log.                                    |

Every area except Elevation Requests is read only, because AutoElevate's Partner API has no write endpoint for it.

## Safety controls

* **Approving and denying always wait on a technician.** This holds regardless of the agent's automation level or the access profile you picked. It is not a setting you can turn off. A decision is final: once a request leaves `PENDING` AutoElevate refuses any further decision on it, and there is no un-approve.
* **Neo does not create rules on its own.** Both approve and deny can also create an auto-approval or auto-denial rule, and at account scope that rule decides every future matching elevation across every client you manage. Neo's agents are told to leave that off unless a technician asked for it in so many words, and the technician sees it in the approval either way.
* **Every other area is read only.** Neo cannot change a rule, a computer, a company or a location through this integration, whatever the agent is set to.
* **Path safety.** Suspicious URL paths (anything containing `..`, for example) are rejected before they reach AutoElevate.
* **Neo sets the authentication itself.** The API key and AutoElevate's required beta header are added by Neo on every call. An agent cannot set, replace or read either one.

## If AutoElevate refuses Neo's requests

| What comes back                                                                                         | Cause                                                                                       | Fix                                                                                                                                                                                                                                               |
| ------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `401`                                                                                                   | The key was revoked or deleted, or it was created with the HMAC scheme instead of AE-BEARER | Create a new key on a service user with the **API Token (AE-BEARER)** scheme and save it in Neo. A key starting `aeh_` will never work                                                                                                            |
| `403`                                                                                                   | The key's scope list does not cover the operation                                           | Widen the key's scopes in AutoElevate. Reading requests, reading events and deciding a request are separate scopes, so a key that lists requests fine can still be refused on approve                                                             |
| A failed **AutoElevate Company Mapping** row saying the key's scope list does not include `companyView` | Exactly that                                                                                | Add `companyView` to the key in AutoElevate. The next PSA sync rebuilds the mapping                                                                                                                                                               |
| A failed **AutoElevate Company Mapping** row saying AutoElevate rejected the key                        | The key was revoked or deleted, or created with the HMAC scheme                             | Recreate it on a service user with the AE-BEARER scheme and save it in Neo. Widening scopes cannot help — the key never authenticated                                                                                                             |
| A failed **AutoElevate Company Mapping** row saying anything else                                       | A rate limit, an AutoElevate outage, or an error inside the mapping itself                  | Read the row's detail before changing anything. The next PSA sync retries on its own                                                                                                                                                              |
| `409` on an approve or deny                                                                             | The request is no longer pending — a technician, or a rule, already decided it              | Nothing to fix. The agent re-reads the request and reports its current state                                                                                                                                                                      |
| `429`                                                                                                   | The hourly limit for that operation is spent                                                | Wait. AutoElevate allows 100 requests per hour per operation during beta and the wait can be up to a full hour. Neo paces its own calls to stay inside the limit, so this normally means something else is also calling the API with the same key |

Until a `401` or `403` is fixed, agents that use AutoElevate report the failure on the ticket they were working. The rest of Neo keeps running.

## Security

* The API key lives in Azure Key Vault. It is never stored in plaintext.
* All traffic to AutoElevate goes over HTTPS, to `partner-api.autoelevate.com`.
* Write access is opt in per agent, and it is only ever available on Elevation Requests.

Once your key is saved and an agent has permissions, the AutoElevate tool is added to that agent automatically.