> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Connecting FortiMail to Neo

> Turn on FortiMail's REST API and save an administrator for Neo

## Before you start

* Neo uses FortiMail's REST API, which Fortinet documents for FortiMail 7.0 and later. It is off until you turn it on (step 1).
* Neo reaches FortiMail over the internet. Its admin interface must answer on **HTTPS** with a certificate from a public certificate authority, at a public address, and accept connections from [Neo's addresses](/integrations/ip-whitelisting).

### Publish only the API

Never publish the whole admin interface to the internet. Either:

* limit Neo's administrator to [Neo's addresses](/integrations/ip-whitelisting) with **Trusted hosts** (step 2), and allow HTTPS administrative access only on the interface and addresses you need; or
* put a reverse proxy at your network edge that answers on a public name over HTTPS with a public certificate, forwards only paths under `/api/v1/` to FortiMail, refuses every other path, accepts connections only from Neo's addresses, and passes cookies through in both directions.

Save the public address in Neo.

## 1. Turn on the REST API

In the FortiMail CLI, run:

```
config system web-service
    set rest-api-status enable
end
```

## 2. Make an administrator for Neo

<Steps>
  <Step title="Pick an access profile">
    Open **System → Administrator → Admin Profile** and pick or make a profile with the access your agents need: **Read** on every area for an agent that only reads, and **Read-Write** on the areas Neo should change, such as policies, profiles, safelists and the quarantine.
  </Step>

  <Step title="Create the administrator">
    Open **System → Administrator → Administrator**, create an administrator for Neo with a strong password, the **Local** authentication type and that profile. Set **Trusted hosts** to [Neo's addresses](/integrations/ip-whitelisting). To limit Neo to some clients, set its domain to one protected domain instead of **System**.
  </Step>
</Steps>

Neo can do only what this administrator may do, whatever the agent's access profile says.

<Warning>
  FortiMail locks an administrator after too many wrong passwords. If the password expires or the account is locked, Neo loses access until you save the new password here.
</Warning>

## 3. Add the administrator in Neo

<Steps>
  <Step title="Open Integrations">
    In the Neo Dashboard, open [**Integrations** → **FortiMail**](https://dashboard.neoagent.io/integrations?open=fortimail), under Security.
  </Step>

  <Step title="Save the address, administrator name and password">
    Enter the address of your FortiMail admin interface (for example `https://fortimail.example.com`), Neo's administrator name and its password, then click **Save settings**. Neo signs in before saving, so a wrong address, a REST API that is off or a refused password is rejected straight away.
  </Step>

  <Step title="Check the client links">
    Open the **Organization Mapping** tab and confirm or correct the client each protected domain belongs to.
  </Step>
</Steps>

## 4. Turn FortiMail on per agent

Open the agent, go to the Integrations section, and configure the FortiMail block.

### Pick an access profile

<CardGroup cols={2}>
  <Card title="Read Only" icon="magnifying-glass">
    Read configuration, policies, profiles, lists, the quarantine and logs. Nothing is changed.
  </Card>

  <Card title="Helpdesk" icon="headset">
    Every change in **Quarantine** (releasing mail, quarantine settings) and in **Safelists, Blocklists and Groups** (lists, address groups, reputation and exempt lists) waits on a technician. Everything else is read only.
  </Card>

  <Card title="IT Admin" icon="user-gear">
    The quarantine, domains, profiles, settings and restarts change without approval, except the changes that always ask. Safelists, blocklists, policies and access rules wait on a technician.
  </Card>

  <Card title="Full Automation" icon="bolt">
    Every change runs without approval, except the [changes that always ask a technician](#changes-that-always-ask-a-technician).
  </Card>
</CardGroup>

### Or set each area by hand

| Area | Notes |
| - | - |
| **System Status and Statistics** | System status, resource usage, licenses, HA and RAID status, mail statistics; restarting or reloading the appliance. |
| **Domains and Users** | Protected domains and their settings, mail users, aliases, address maps, user groups and address books. |
| **Policies and Access Control** | Recipient-based and IP-based policies and access control (relay) rules. |
| **Security Profiles** | Antispam, antivirus, content, DLP, session, TLS, URI filter, impersonation and notification profiles, dictionaries and file filters. |
| **Safelists, Blocklists and Groups** | System, domain and personal safelists and blocklists, session profile sender lists, email and IP address groups, the greylist, reputation and exempt lists. |
| **Quarantine** | The system quarantine: listing and releasing messages, quarantine folders and report settings. |
| **Logs and Reports** | The history log, log settings, alert email and scheduled log reports. |
| **Mail Settings, Archiving and Encryption** | Mail server settings, remote mail servers, storage, disclaimers, archiving, IBE encryption and backups. |
| **Network and System Settings** | Interfaces, routes, DNS, time, HA, SNMPv3 users, FortiGuard, FortiSandbox and global settings. |
| **Administrators and Authentication** | Administrators, admin profiles and PKI users, and the LDAP, RADIUS, IMAP, POP3 and SMTP authentication profiles. Every change here waits on a technician. |

Each area can be Disabled, Read Only or Read/Write, and has its own technician approval setting.

### Changes that always ask a technician

These wait on a technician under every profile, whatever the area's own approval setting:

* Any change to administrators, admin profiles, PKI users or authentication profiles.
* Deleting a protected domain.
* Any change that stores a credential, such as a password or a shared secret.

## Troubleshooting

| Error when you save | What to check |
| - | - |
| No FortiMail REST API answered | The address, and that the REST API is on (step 1). |
| FortiMail rejected the user name or password | The administrator name and password, that the account is not locked, and that **Trusted hosts** includes Neo's addresses. |
| ... redirects elsewhere | Enter the address of the admin interface itself, with `https://`. |
| Could not reach FortiMail | The address, that it is public, that HTTPS administrative access is on for that interface, and that its certificate comes from a public certificate authority. |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.