> ## Documentation Index > Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt > Use this file to discover all available pages before exploring further. # Connecting DrayTek VigorACS to Neo > Turn on the VigorACS REST API, create a VigorACS user for Neo and save it ## Before you start Neo calls your VigorACS through its RESTful Web Service, at `/RestfulWebService/rest/` on the address you open VigorACS at. Neo reaches it over the internet, so it must answer on **HTTPS** with a certificate from a public certificate authority, at a public address. A VigorACS a DrayTek distributor hosts for you already does. If you host VigorACS yourself, you can allow only [Neo's addresses](https://docs.neoagent.io/integrations/ip-whitelisting.md) to reach it. ## 1. Turn on the REST API and create a user for Neo **1. Turn on the web service** In VigorACS, open **System** > **System Parameter** and set parameter 38, **EnableWebServices**, to `true`. A hosted VigorACS may have it on already; ask your distributor if you cannot see System Parameter. **2. Create the user** In **User Management**, add a user for Neo with a strong password, and turn on **Enable API Service**. Pick its role: | Role | What Neo can do | | - | - | | **System Administrator** | Everything below, including reading TR-069 values, rebooting, user groups and the wholesale wizard. A System Administrator belongs to every user group. | | **Group Administrator** | Devices, networks, provisioning profiles and users in its own user groups. VigorACS does not let it read TR-069 values or reboot a device. | Reading a router's own values and rebooting it need a System Administrator. ## 2. Add the user in Neo **1. Open Integrations** In the Neo Dashboard, open [**Integrations** → **DrayTek VigorACS**](https://dashboard.neoagent.io/integrations?open=draytek_vigoracs), under Networking. **2. Save the address and user** Enter the address you open VigorACS at, with its port when it is not 443 (for example `https://acs.example.com:8443`), the user name and the password, then click **Save settings**. Neo signs in and counts your devices before saving, so a wrong address or port, a certificate that is not from a public authority, or a refused user is rejected straight away. **3. Check the Organization Mapping tab** Neo maps your VigorACS networks to your PSA companies. Confirm or correct the matches on the **Organization Mapping** tab. ## 3. Turn VigorACS on per agent Open the agent, go to its **Tools & Settings** tab, click **Networking**, and expand the **DrayTek VigorACS** block. ### Pick a preset > [card] Read Only > > Read devices, which are offline, their TR-069 values, networks, user groups and users. Nothing is changed. > [card] Helpdesk > > Reads on its own. A reboot, a setting change or any other device change waits on a technician. Every other area is read only. > [card] IT Admin > > Devices, TR-069 settings, reboots, networks and user groups change without approval. Provisioning profiles and users wait on a technician. > [card] Full Automation > > Every change runs without approval, except the [changes that always ask a technician](#changes-that-always-ask-a-technician). ### Or set each area by hand | Area | Notes | | - | - | | **Devices** | Devices and their details, the device count and offline devices. Enable or disable a device, move it to another network, delete it, and add or remove a serial number for a MAC address. | | **Device Settings (TR-069)** | A device's TR-069 parameters, read live: names, values and attributes. Change values and attributes, and add or remove an object instance on Linux models. | | **Reboot & Factory Reset** | Reboot a device or reset it to factory defaults. A factory reset always waits on a technician. | | **Networks** | The networks devices are filed in. Create, rename, move and delete networks. Deleting a network always waits on a technician. | | **Provisioning Profiles** | Create and delete set-parameter profiles, create or update global profiles, and reset and deploy a profile to a device. | | **User Groups** | User groups with their device limit and expiry date, and the wholesale wizard. Deleting a user group always waits on a technician. | | **Users & Access** | VigorACS users and the users of a group. Every change waits on a technician. | ### Changes that always ask a technician These wait on a technician under every profile, whatever the area's own approval setting: * A factory reset. * Deleting a network or a user group. * Creating, changing or deleting a VigorACS user, adding or removing a user in a group, and the wholesale wizard, which creates a user. * Any change that sends a password or a Wi-Fi key: a network's device sign-in, or a TR-069 value whose name says it is a password or a key. ### What Neo never sends * The wholesale wizard's delete, which removes every network, device and user of a user group in one call. * Deleting the user group `RootGroup`, or deleting a user group by its id: Neo deletes a user group by its name, so it can tell `RootGroup` apart. * A device delete by name or IP address, which can match several devices: Neo deletes one device by its serial number. ## Troubleshooting | Error when you save | What to check | | - | - | | No VigorACS REST API answered | The address and its port, and that System Parameter 38 **EnableWebServices** is `true`. | | VigorACS refused the user name or password | The user, its password, its role (System Administrator or Group Administrator) and **Enable API Service**. If all are right, a proxy in front of VigorACS may drop the `Authorization` header. | | Could not reach VigorACS | That the address answers from the internet over HTTPS with a certificate from a public certificate authority, and that Neo's addresses may reach it. | | ... is a private or reserved address | Use the public address your VigorACS answers at. | This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.