> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neo.projectdiscovery.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Team-shared custom toolkits

> Share custom toolkits with your Neo team and control which credentials they use

A **team-shared custom toolkit** makes a toolkit and its tools available to active members of the owner's current Neo team. The owner keeps control of the toolkit definition and chooses how required credentials are supplied.

The standalone `global` toolkit remains personal and cannot be shared. Create a named toolkit for tools your team needs to use.

## Choose how credentials are supplied

Every shared toolkit uses one credential mode:

| Mode       | Credential source                                                                                           | Use when                                                                             |
| :--------- | :---------------------------------------------------------------------------------------------------------- | :----------------------------------------------------------------------------------- |
| `personal` | Each teammate selects their own saved secrets or secrets they are authorized to use in the current project. | Every teammate has separate credentials, or access should follow project membership. |
| `shared`   | The owner explicitly binds their saved secrets to the toolkit's required environment variables.             | The team is authorized to use one shared service account or credential set.          |

In `shared` mode, teammates execute the toolkit with the owner's bound credentials inside their own sandboxes. Treat anyone who can execute the toolkit as able to use those credentials in that environment. The API never returns secret values, and only the owner can see the saved-secret IDs used as bindings.

## Share a toolkit with Neo

For personal credentials, ask Neo:

```text theme={"system"}
Share my asset-inventory toolkit with the team. Each teammate should use their own credentials.
```

For owner-provided shared credentials, name the saved secrets and explicitly authorize their use:

```text theme={"system"}
Share my asset-inventory toolkit with the team using my saved INVENTORY_TOKEN secret.
```

Shared mode requires a saved secret for every environment variable the toolkit declares. Give Neo secret names only, never secret values.

## Share a toolkit through the API

Use `personal` mode when every caller supplies their own credentials:

```bash theme={"system"}
curl -X PATCH \
  https://neo.api.projectdiscovery.io/api/v1/dynamic-toolkits/asset-inventory/sharing \
  --header 'Content-Type: application/json' \
  --header 'X-Api-Key: YOUR_API_KEY' \
  --data '{"credential_mode":"personal"}'
```

Use `shared` mode to bind the owner's saved secrets. Map each required environment-variable name to its saved secret ID:

```bash theme={"system"}
curl -X PATCH \
  https://neo.api.projectdiscovery.io/api/v1/dynamic-toolkits/asset-inventory/sharing \
  --header 'Content-Type: application/json' \
  --header 'X-Api-Key: YOUR_API_KEY' \
  --data '{
    "credential_mode": "shared",
    "secret_bindings": {
      "INVENTORY_TOKEN": "SECRET_UUID"
    }
  }'
```

The first sharing request requires `credential_mode`. On later requests, omitted fields keep their current values. Supplying `secret_bindings` replaces all existing bindings. Switching to `personal` mode clears the shared bindings but does not delete the owner's saved secrets.

The API determines the owner's active team. Do not send a team ID.

## Discover and use shared toolkits

Ask Neo to list or use the team's toolkits:

```text theme={"system"}
Show me the custom toolkits shared with my team.
Attach the team's asset-inventory toolkit to my cloud-audit agent.
```

Through the API, list both owned and accessible team-shared toolkits:

```bash theme={"system"}
curl https://neo.api.projectdiscovery.io/api/v1/dynamic-toolkits \
  --header 'X-Api-Key: YOUR_API_KEY'
```

Shared entries use team-prefixed identifiers when needed to avoid collisions with personal tools. Use the exact toolkit or tool identifier returned by Neo or the API when attaching or running it.

The response reports credential readiness without returning values:

| Status                    | Meaning                                                                                                              |
| :------------------------ | :------------------------------------------------------------------------------------------------------------------- |
| `configured`              | Required shared bindings are present. This does not confirm that the external service still accepts the credentials. |
| `requires_caller_secrets` | Personal mode is active. The caller must select the required personal or project secrets for the task.               |
| `missing_owner_secret`    | A shared binding no longer resolves. The owner must bind the required saved secret again.                            |

## Stop sharing

The owner or an active team administrator can ask Neo to revoke access:

```text theme={"system"}
Stop sharing my asset-inventory toolkit with the team.
```

Or call the API:

```bash theme={"system"}
curl -X DELETE \
  https://neo.api.projectdiscovery.io/api/v1/dynamic-toolkits/asset-inventory/sharing \
  --header 'X-Api-Key: YOUR_API_KEY'
```

Revoking access removes the team share and its credential bindings. It does not delete the toolkit or the owner's saved secrets. Future execution is blocked after sharing is revoked, a member is offboarded, or a bound secret is deleted. A call already in progress is not cancelled.

Replacing a deleted secret with another secret of the same name does not restore the binding. The owner must bind the new saved secret explicitly.

For complete request and response schemas, see the [API reference](/api-reference/overview).