> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Connecting KnowBe4 to Neo

> Create a client's KnowBe4 API keys and save them in Neo

You connect KnowBe4 once for each client that uses it. KnowBe4 has a separate key for each of its APIs, and you save the ones your client's KnowBe4 subscription includes. At least one is required.

| Key | What it lets Neo do | KnowBe4 plans |
| - | - | - |
| **Reporting API Key** | Read users, groups, training and phishing test results | Platinum, Diamond, SAT Foundation, SAT Advanced |
| **Product API Key** | Add, edit and archive users and groups, and manage training and phishing campaigns | Diamond, SAT Advanced |
| **Partner Product API Key** with the **Account ID** | The same as the Product API Key, for a client you manage from a KnowBe4 partner account | Diamond, SAT Advanced |
| **User Event API Key** | Add security events to a user's record | Platinum, Diamond, SAT Foundation, SAT Advanced |
| **PhishER API Key** | Read reported emails and set their category, status, tags and comments | Accounts with PhishER |

For onboarding and offboarding, the **Product API Key** is the one that adds and archives users. For training reports, the **Reporting API Key** reads the most in the fewest calls.

## 1. Create the keys in KnowBe4

<Steps>
  <Step title="Sign in to the client's KnowBe4 console">
    Sign in as an admin of the client's KnowBe4 account, not your partner console: each key belongs to one account. Note the address the console opens at: `training.knowbe4.com` is the US server, and `eu.`, `ca.`, `uk.` or `de.knowbe4.com` are the others.
  </Step>

  <Step title="Create the Reporting and Product API keys">
    Open **Account Settings** > **Account Integrations** > **API**. Turn on API access if it is off, and create or copy the Reporting API key. Under **Product API**, select **+ Create New API Token**, choose **KSAT** with **Read/Write**, and copy the token: KnowBe4 shows it once.
  </Step>

  <Step title="Create a User Event API key (optional)">
    In the same section, open the **User Event API** management page and create a key.
  </Step>

  <Step title="Create a PhishER API key (optional)">
    If the client has PhishER, create a Product API token in the same place with **PhishER** as its product.
  </Step>
</Steps>

### Clients you manage from a KnowBe4 partner account

KnowBe4 has a partner or multi-account organization create Product API tokens in its management admin account. If that is how you run your clients, create one **KSAT** Product API token there, with **Read/Write**. For each client, enter it as the **Partner Product API Key** together with the client's **Account ID**, the number your partner console shows for the account. Leave the client's own **Product API Key** empty: Neo then reaches that one client's account with a 15-minute token KnowBe4 issues for it. The Reporting, User Event and PhishER keys still come from the client's own account.

<Warning>
  Do not regenerate or delete a key after you save it in Neo. Neo loses access to that API for the client until you save the new key here. Neo's agents never create, regenerate or delete KnowBe4 API keys. For a client connected through a partner key, Neo asks KnowBe4 for a 15-minute token for that client's account each time it needs one; that token is not a key you manage.
</Warning>

## 2. Add the keys in Neo

<Steps>
  <Step title="Open Integrations">
    In the Neo Dashboard, open [**Integrations** → **KnowBe4**](https://dashboard.neoagent.io/integrations?open=knowbe4), under Security.
  </Step>

  <Step title="Pick the client">
    In **Customer**, choose the client this KnowBe4 account belongs to. The client must be on your **Companies** tab. For a second client, click **Add customer**.
  </Step>

  <Step title="Choose the region and paste the keys">
    Pick the **Region** your client's console opens at, paste the keys you created, and click **Save settings**. Neo checks each key against KnowBe4 before saving, so a wrong key or a wrong region is rejected straight away.
  </Step>
</Steps>

## 3. Turn KnowBe4 on per agent

<Steps>
  <Step title="Open the agent's integrations">
    Open the agent in the Neo Dashboard and go to its **Integrations** tab, or ask your Neo Support Agent to add KnowBe4 to it.
  </Step>

  <Step title="Pick an access profile">
    Under **KnowBe4**, pick an access profile, or set each permission group by hand.

    | Profile | What it does |
    | - | - |
    | **Read Only** | Reads users, training, phishing results, events and PhishER; changes nothing |
    | **Helpdesk** | Triages PhishER reports on its own; adding, changing or archiving users, groups and training, and adding user events, ask a technician; reads the rest |
    | **IT Admin** | Every change on its own, except admin rights, security roles, turning MFA off and account settings, which ask a technician |
    | **Full Automation** | Every supported call without approval, except permanently deleting users, which always asks a technician |
  </Step>
</Steps>

<Note>
  Neo never adds a user to a KnowBe4 group that carries a security role, whatever the profile: such a group gives its members console access. Add those memberships in the KnowBe4 console.
</Note>

<Tip>
  If the client's KnowBe4 account syncs users from Active Directory or Entra ID, the sync owns those users. The agent says so and leaves them to the directory, so add the user there.
</Tip>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.