REST API

The REST API lets your own scripts and tools read clients and tickets and create tickets. Every request uses an API key that you issue in the admin portal.

Issue an API key

Open Access › API Keys and create a key.
Name it after the system that will use it, such as "Monitoring script".
Choose its scopes (below), and optionally an expiry date and a rate limit.
Copy the key straight into the other system's secret store. It is shown once. Only a hash is stored, so it cannot be shown again.

Use one key per integration. Then you can revoke one without breaking the others, and the audit log shows which system did what.

Scopes

Scope	Allows
`read`	Listing clients and tickets
`write`	Creating tickets and posting to the inbound webhook. Use it together with `read`
`full`	Everything above

Authentication

Send the key as a bearer token:

Authorization: Bearer YOUR_API_KEY

The base address is https://your-domain/api/v1.

Endpoints

List clients

GET /api/v1/clients

Optional parameters: q (search), type, per_page (default 25, maximum 100), page. Each client includes its count of open tickets.

List tickets

GET /api/v1/tickets

Optional parameters: status, priority, client_id, unassigned=1 (tickets with no client), q (searches the subject), per_page, page.

Create a ticket

POST /api/v1/tickets
Content-Type: application/json

{
  "subject": "Backup job failed on FS01",
  "body": "Job reported error 0x80070005 at 02:14.",
  "client_id": 12,
  "priority": "high"
}

Field	Required	Notes
`subject`	Yes	Up to 191 characters
`priority`	Yes	`urgent`, `high`, `normal` or `low`
`body`	No	The ticket description
`client_id`	No	Without it, the ticket goes to the unassigned inbox
`billable`	No	`true` or `false`
`source`	No	A short label for where it came from
`sensitive`	No	`true` marks the ticket sensitive, so it is never sent to AI

The new ticket goes through the same triage, SLA and notification steps as a ticket from any other source.

Rate limits

Each key has a limit in requests per minute. The default is 120, and you can set a different limit per key or change the default for all keys. A key over its limit gets HTTP 429 with a Retry-After header saying how many seconds to wait.

Errors

A refused request says which check failed:

Status	Meaning
`401`	The key is missing, wrong, revoked or expired. The message says which, with the date for a revoked or expired key
`403`	The key does not have the scope this endpoint needs
`422`	The request body failed validation
`429`	The key went over its rate limit

Rotate a key without downtime

Create a second key with the same scopes.
Put it into the other system.
Check that requests are arriving on the new key.
Revoke the old key. A revoked key can be restored if you find something still using it.