> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Connecting Control D to Neo

> Create a Control D API token and save it in Neo

You connect Control D once at the MSP level. One token from your main organization covers every sub-organization you keep for a customer.

## 1. Create the API token

**1. Open API in your main organization**

Sign in to the Control D dashboard as an Admin or Owner of your main (parent) organization, and open **API**. Create the token there, not inside a customer's sub-organization: a token made in a sub-organization reaches only that sub-organization.

**2. Create the token**

Click **+**, name the token "Neo", and choose **Write**. Choose **Read** only if Neo should check and report without changing anything.

**3. Allowed IPs**

If you limit the token to **Allowed IPs**, add [Neo's IP addresses](https://docs.neoagent.io/integrations/ip-whitelisting.md). Otherwise Control D refuses Neo's calls.

**4. Copy the token**

Copy the token. Store it only in Neo.

> [!WARNING]
>
> Deleting the token in Control D cuts Neo off at once. Save the new token here when you replace it.

## 2. Add the token in Neo

**1. Open Integrations**

In the Neo Dashboard, open **Integrations** and find the Control D card, under DNS & Web Filtering.

**2. Save the token**

Paste the token and click **Save settings**. Paste the token alone; Neo adds the `Bearer` prefix. Neo checks it against Control D before saving, so a wrong token is rejected straight away.

Neo then maps your Control D sub-organizations to your PSA companies. Check the **Organization Mapping** tab on the card, and confirm or correct each suggested match.

## 3. Turn on analytics for the Activity Log

To see which query was blocked and why, Neo reads the Activity Log, which needs the endpoint's analytics level set to **Full** in Control D. Statistics work at **Basic**. The Domain Test needs neither.

## 4. Turn Control D on per agent

Open the agent, go to its **Tools & Settings** tab, click **DNS & Web Filtering**, and expand the **Control D** block. Pick one of its **Presets**, or set each area yourself:

| Area | Access levels you can pick | Notes |
| - | - | - |
| **Organization** | Disabled, Read Only, Read / Write | Your organization, its members and sub-organizations; creating a sub-organization. |
| **Billing** | Disabled, Read Only | Payments, products and subscriptions. |
| **Profiles & Filters** | Disabled, Read Only, Read / Write | Profiles with their filters, services, options and default rule. |
| **Custom Rules** | Disabled, Read Only, Read / Write | Block and bypass rules for one domain, and their folders. Turn on Read / Write for allowlisting. |
| **Endpoints & IPs** | Disabled, Read Only, Read / Write | Endpoints and the IPs each one is authorized from. |
| **Internal Domains** | Disabled, Read Only, Read / Write | Domain suffixes resolved outside Control D. |
| **Analytics & Domain Test** | Disabled, Read Only | The Activity Log, statistics and the Domain Test. Turn on for an agent that works blocked-site tickets. |

| Preset | What runs on its own | What asks a technician |
| - | - | - |
| **Read Only** | Every read | No write is allowed |
| **Helpdesk** | Every read | Custom rules and endpoint changes; no other write is allowed |
| **IT Admin** | Every read, endpoint and organization changes | Custom rules, profiles and filters, internal domains, deleting or disabling an endpoint, and turning off required two-factor sign-in |
| **Full Automation** | Every read and write | Deleting or disabling an endpoint, deleting or pausing a profile, turning off required two-factor sign-in |

See [Control D API](https://docs.neoagent.io/agents/tools/security/controld-api.md) for what the agent can read and change.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.