Huntress uses one API key pair (a public key and a secret key) per Huntress account. There is no per-customer URL — organizations are scoped inside the API, so one key pair covers every customer in the account.
1. Generate an API key pair in Huntress
1
Open API Credentials
Sign in at
<your-subdomain>.huntress.io as a user with Admin privileges, open the hamburger menu in the top-right corner, and choose API Credentials. If you don’t see the option, you’re signed in as a non-Admin user — an Admin on your account can create the key, or grant you the role.2
Decide which key you need
Huntress offers an account key and user-based keys. The default account API key is read-only. If you want Neo to isolate hosts, approve remediations, resolve incidents, or manage organizations and users, generate a user-based key whose Huntress user holds those portal permissions.
3
Generate and copy both values
Click Setup, then Generate. Huntress shows the API Secret Key only once — copy both the public key and the secret before leaving the page. If you lose the secret, regenerate the pair; you cannot retrieve it later.
2. Add the keys in Neo
1
Open Integrations
In the Neo Dashboard, open Integrations and find the Huntress card under Security.
2
Save both values
Paste the API Key and the API Secret, then click Save.
Neo tests the pair by reading the Huntress account the credentials belong to. If either value is wrong, the save fails so you can fix it before moving on.
3. Turn Huntress on per agent
Each agent decides whether it uses Huntress and which areas it can touch. Open the agent, go to the Integrations section, and configure the Huntress block.Pick an access profile
Read Only
Every area read only. The agent can investigate any alert, host, or report but never changes anything. Best for triage, reporting, and QBR agents.
Helpdesk
Incidents at read/write — still behind technician approval on every write — and read-only everywhere else. Enough to work an alert to resolution without touching hosts, access rules, or users.
IT Admin
Every writable area at read/write, with technician approval required on all writes. The cautious rollout tier.
Full Automation
Access rules and organization changes run autonomously. Host isolation, remediation approval, incident resolution, and portal access changes still require technician approval — that cannot be turned off.
Or set each area yourself
Detections and Reporting & Billing are read-only because the Huntress API has no write endpoint for them.
Changing a customer’s Huntress subscription is deliberately not exposed to agents, even though the Huntress API supports it. Reporting & Billing is read-only for reconciliation and QBRs, not for buying.