> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Connecting DNSFilter to Neo

> Create a DNSFilter API key and save it in Neo

You connect DNSFilter once at the MSP level. One API key from a user of your MSP organization covers every customer organization under it.

## 1. Create the API key

A DNSFilter API key acts with the permissions of the user who creates it, and each user can hold five. DNSFilter advises against keys made by the account owner. Use a user of your MSP organization with the access Neo should have: read access is enough for reports, and changing policies needs a user who may edit them.

<Steps>
  <Step title="Open API Keys">
    Sign in to the [DNSFilter dashboard](https://app.dnsfilter.com) as that user, open the account icon, choose **Account Settings**, and open the **Security** tab. Scroll to **API Keys**.
  </Step>

  <Step title="Create the key">
    Click **+ Create Key**, name it Neo, and pick an expiration. Click **Generate Key**.
  </Step>

  <Step title="Copy the key">
    Copy the key and click **Save**. DNSFilter shows the key only once.
  </Step>
</Steps>

<Warning>
  DNSFilter sends no warning before a key expires. When it expires, or the user who made it loses access, Neo loses access until you save a new key here.
</Warning>

## 2. Add the key in Neo

<Steps>
  <Step title="Open Integrations">
    In the Neo Dashboard, open **Integrations** and find the DNSFilter card, under Security.
  </Step>

  <Step title="Save the key">
    Paste the API key and click **Save settings**. Neo checks it against DNSFilter before saving, so a wrong or expired key is rejected straight away.
  </Step>
</Steps>

## 3. Turn DNSFilter on per agent

Open the agent, go to the Integrations section, and pick an access profile for the DNSFilter block, or set each area yourself:

| Area | Access levels you can pick | Notes |
| - | - | - |
| **Reports and Query Logs** | Disabled, Read Only | Threat and traffic reports per customer, query logs and usage. Turn on for a QBR agent. |
| **Policies, Allow and Block Lists** | Disabled, Read Only, Read / Write | Policies, allow and block lists, blocked categories and applications, scheduled policies and block pages. |
| **Unblock Requests** | Disabled, Read Only, Read / Write | End users' unblock requests; an allow decision writes the policy's allow list. |
| **Networks** | Disabled, Read Only, Read / Write | Networks and their IP addresses, subnets and MAC addresses. |
| **Roaming Clients** | Disabled, Read Only, Read / Write | Roaming clients and relays, their local users and collections. |
| **Scheduled Reports** | Disabled, Read Only, Read / Write | Report schedules DNSFilter emails to their recipients. |
| **Customer Organizations** | Disabled, Read Only, Read / Write | Your customer organizations and their settings. |
| **Users, SSO and API Keys** | Disabled, Read Only, Read / Write | Console users, SSO connections, API keys without their tokens. |
| **Billing and Invoices** | Disabled, Read Only, Read / Write | Billing details and address, invoices and trials. |
| **Categories and Domain Lookups** | Disabled, Read Only | Content categories, applications and a domain's categories. Keep it on: the agent checks a domain here before it allows it. |

| Profile | What runs on its own | What asks a technician |
| - | - | - |
| **Read Only** | Every read | No write is allowed |
| **Helpdesk** | Every read outside the Users, SSO and API Keys and the Billing and Invoices groups | Every change in the Policies, Allow and Block Lists and the Unblock Requests groups; no other write is allowed |
| **IT Admin** | Every read, and Networks, Roaming Clients and Scheduled Reports changes outside [Safety Controls](/agents/tools/security/dnsfilter-api#safety-controls) | Changes in the Policies, Allow and Block Lists, Unblock Requests, Customer Organizations, Users, SSO and API Keys, and Billing and Invoices groups, and the changes in [Safety Controls](/agents/tools/security/dnsfilter-api#safety-controls) |
| **Full Automation** | Every read and write outside [Safety Controls](/agents/tools/security/dnsfilter-api#safety-controls) | The changes in [Safety Controls](/agents/tools/security/dnsfilter-api#safety-controls) |

See [DNSFilter API](/agents/tools/security/dnsfilter-api) for what the agent can read and change.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.