> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Connecting Nutanix to Neo

> Save your Prism Central address and an API key for a Neo service account

## Before you start

* Neo needs **Prism Central pc.2024.3 or later**: the release with the v4 API and service account API keys. Neo connects to Prism Central, not to a single cluster's Prism Element.
* Neo reaches Prism Central over the internet. Its API must answer on **HTTPS** with a certificate from a public certificate authority, at a public address. If a firewall or reverse proxy limits who can reach it, allow [Neo's addresses](/integrations/ip-whitelisting) to reach `/api/`.

### If Prism Central is only on your internal network

Most are. Publish only the API, never the whole console. Put a reverse proxy at your network edge that:

* answers on a public name over HTTPS, with a certificate from a public certificate authority;
* forwards only paths under `/api/` to Prism Central (port 9440), and refuses every other path;
* accepts connections only from [Neo's addresses](/integrations/ip-whitelisting);
* passes the `X-ntnx-api-key`, `If-Match` and `NTNX-Request-Id` request headers, and the `ETag` response header, through unchanged.

Save the proxy's public address in Neo.

## 1. Make a service account for Neo

**1. Create the service account**

In Prism Central, open **Admin Center → IAM → Service Accounts** and create a service account for Neo, such as `neo-agent`.

**2. Give it roles**

Assign the account the roles your agents need: **Prism Viewer** for an agent that only reads; a role with VM update and power permissions, such as **Virtual Machine Admin**, to resize and manage VMs; and the roles for anything else Neo should change. Scope each role to the clusters, projects or categories Neo should reach.

**3. Create an API key**

On the service account, create an API key and copy it. Prism Central shows it once.

Neo can do only what this service account may do, whatever the agent's access profile says.

> [!WARNING]
>
> If the API key expires or you revoke it, Neo loses access until you save a new key here.

## 2. Add the key in Neo

**1. Open Integrations**

In the Neo Dashboard, open [**Integrations** → **Nutanix**](https://dashboard.neoagent.io/integrations?open=nutanix), under Networking.

**2. Save the address and the API key**

Enter the address you open Prism Central at, with its port (for example `https://pc.example.com:9440`), and the API key, then click **Save settings**. Neo lists one VM with the key before saving, so a wrong address, an older Prism Central or a refused key is rejected straight away.

## 3. Turn Nutanix on per agent

Open the agent, go to its **Tools & Settings** tab, click **Networking**, and expand the **Nutanix** block. Agents see only what Neo's service account can see.

### Pick a preset

> **Read Only**
>
> Read VMs, clusters, storage, networks, alerts, tenants and statistics. Nothing is changed.

> **Helpdesk**
>
> Resolve alerts and follow tasks without approval. Any change to a VM, such as power, CPU, memory or disks, waits on a technician. Everything else is read only.

> **IT Admin**
>
> VMs, images, clusters, storage, networking, data protection and alerts change without approval, except the changes that always ask. Network security policies, users and access, Prism Central settings, upgrades and licensing, and tenants wait on a technician.

> **Full Automation**
>
> Every change runs without approval, except the [changes that always ask a technician](#changes-that-always-ask-a-technician).

### Or set each area by hand

| Area | Notes |
| - | - |
| **Virtual Machines** | VMs on AHV and ESXi: create, clone, CPU, memory, disks and network cards, power, migrate, guest tools, VM recovery points, categories on a VM, VM policies and VM statistics. |
| **Images and Templates** | Disk images, ISOs, OVAs and VM templates, and their placement and rate-limit policies. |
| **Clusters and Hosts** | Clusters, hosts, controller VMs, GPUs, cluster profiles, SNMP, syslog and IP pools, with cluster and host statistics. |
| **Storage** | Storage containers, physical disks, volume groups, storage policies, external storage, Nutanix Files and Nutanix Objects. |
| **Networking** | Subnets, VLANs, virtual switches, VPCs, floating IPs, routing, gateways, VPN and load balancer sessions. |
| **Network Security Policies** | Flow network security policies and the address, service and entity groups they use. |
| **Data Protection and Recovery** | Protection policies, recovery points, recovery plans, failovers and restores. |
| **Alerts, Events and Reports** | Alerts, events, audits, health checks, log collection, reports, capacity runway and what-if scenarios. |
| **Categories and Tasks** | Categories, and the tasks every change runs as. |
| **Users, Roles and Access** | Users, groups, roles, authorization policies, directory services, SAML providers, API key records, stored credentials and the cluster's own account passwords. Every change here waits on a technician. |
| **Upgrades and Licensing** | Life Cycle Manager inventory, prechecks, upgrades and node imaging, and licenses. |
| **Prism Central, Security and Encryption** | Prism Central's registration, backups and scaling, multi-domain management, certificates, key management servers, encryption, security profiles, approval policies and security reports. Every change here waits on a technician. |
| **Tenants** | SP Central tenants, their domains, users and projects, and the CPU, memory and storage allocated to each. |

Each area can be Disabled, Read Only or Read/Write, and has its own technician approval setting.

### Changes that always ask a technician

These wait on a technician under every profile, whatever the area's own approval setting:

* Deleting a VM, a VM disk, a recovery point, an image, OVA or template, a storage container, a volume group or its disk, a physical disk, a file share, an object store, a node or an SP Central tenant, removing a node from a cluster, and clearing a container's reserved space.
* Uninstalling guest tools from a VM, and unregistering the vCenter extension.
* Any change to users, roles, access, directory services, API key records, stored credentials or the cluster's own account passwords.
* Any change to Prism Central's settings, backups, registration, certificates, encryption, key management servers, security profiles or approval policies.
* Any change to alert policies or alert email, because a changed policy can silence the alert that would show a problem. Acknowledging or resolving an alert does not ask on its own.
* Any change that stores a credential: a password, a secret, a private key, a token, an API key, an SNMP key, a guest's Sysprep or cloud-init script, or the user name and password in a URL.

## Troubleshooting

| Error when you save | What to check |
| - | - |
| Prism Central refused the API key | The key, that it is not expired or revoked, and that a web server in front of Prism Central passes the `X-ntnx-api-key` header. |
| ... did not let its service account list VMs | Give the service account a role that can view VMs, such as Prism Viewer. |
| No Nutanix v4 API answered | The address and port, and that it is Prism Central pc.2024.3 or later, not Prism Element. |
| ... redirects elsewhere | Enter the address that serves Prism Central itself, with its port. |
| Could not reach Prism Central | The address and port, that it is public, and that its certificate comes from a public certificate authority. |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.