> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Connecting Avanan to Neo

> Get an Avanan Smart API key from Avanan Support and save its application ID, client secret and region in Neo

Neo connects to Avanan through the Avanan Smart API. Avanan Support issues the API key: an **Application ID** and a **Client Secret**. Neo connects to Avanan tenants on the Avanan portal (`<tenant>.avanan.net`).

## 1. Get the API key

<Steps>
  <Step title="Ask Avanan Support for a Smart API key">
    Open a request with Avanan Support (or Check Point support) for a Smart API key. As an MSP, ask for the **MSP API key**: one key reaches every client tenant you manage in one region, so you do not need a key per client.
  </Step>

  <Step title="Choose the region">
    An API key works for one region: United States, Europe, Australia, Canada, United Kingdom or India. If your client tenants are in more than one region, Avanan issues a key per region. Neo connects one key, so connect the region most of your clients are in.
  </Step>

  <Step title="Keep the secret safe">
    Avanan Support sends the Application ID and the Client Secret. Treat the Client Secret like a password.
  </Step>
</Steps>

## 2. Add the key in Neo

<Steps>
  <Step title="Open Integrations">
    In the Neo Dashboard, open [**Integrations** → **Avanan**](https://dashboard.neoagent.io/integrations?open=avanan), under Security.
  </Step>

  <Step title="Save the key">
    Choose the region, paste the Application ID and the Client Secret, and click **Save settings**. Neo asks Avanan for a token with them before saving, so a mistyped key, or a key from another region, is rejected straight away.
  </Step>
</Steps>

## 3. Turn Avanan on per agent

<Steps>
  <Step title="Open the agent">
    In the Neo Dashboard, open the agent and its **Integrations** tab.
  </Step>

  <Step title="Choose an access profile">
    Under **Avanan**, choose a profile, or set each permission group by hand.
  </Step>

  <Step title="Tell the agent what to do">
    Add a line to the agent's instructions, for example: "When a ticket is an allowed list request, add the sender or domain it names to the client's Avanan allow list and note the entry on the ticket."
  </Step>
</Steps>

| Profile | Runs on its own | Asks a technician |
| - | - | - |
| **Read Only** | Every read | No write is allowed |
| **Helpdesk** | Every read | Quarantine and restore, and every allow-list and block-list change. Engine exceptions, tenants and MSP users are read only |
| **IT Admin** | Quarantine and restore, block-list changes | Allow-list changes and engine exceptions, plus the changes that always ask |
| **Full Automation** | Every change except the ones below that always ask | The changes that always ask |

Under every profile, a technician approves creating or licensing a client tenant, every change to your Avanan portal users and child MSPs, and the engine call `POST sectool-exceptions/<engine>`, which Avanan's guide documents both as "create an exception" and as "delete all exceptions". The [Avanan API](/agents/tools/security/avanan-api) page lists the permission groups and what Neo never sends.

## Client tenants

Each client tenant is mapped to a client in your PSA on the Avanan card's **Organization Mapping** tab; see [Avanan overview](/integrations/avanan/overview#your-client-tenants-are-mapped-to-clients). On a ticket, an agent reaches only the tenant mapped to the ticket's client, so map every client you want agents to work on.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.