Open HelpDesk API — Open HelpDesk API

The REST API of a single workspace. Authentication is by API key, minted in Settings → API & webhooks; the key carries its own workspace, so a call works whatever host it lands on and only ever sees that one workspace.

The mobile app authenticates differently, and the Mobile section says how: an agent signs in on a phone (POST /auth/login) and gets a token bound to that device, which their role — not a scope list — decides the reach of. A phone cannot carry a workspace key: it would be shared with every integration, and unable to say whose tickets these are.

Customer app is the third credential and the narrowest surface: a customer signs in by emailed link and may read and answer their own requests, under /portal. It is a separate namespace on purpose — the answer a customer is owed is narrow, and that is easier to guarantee by routing than by filtering.

Conventions

Every collection returns { data, next_cursor }. Keep calling with cursor until next_cursor is null — never count pages, rows move while you read.
Timestamps are ISO 8601 in UTC. Money and durations are integers.
Errors always carry { error: { code, message } }: branch on code, show message.
Writing a ticket runs the same rules, SLA policies and webhooks as the product itself. There is no quiet back door.

Rate limit

600 requests per minute per key or device session. Over it, 429 with a Retry-After header. Signing in is tighter, and counted per address and per source: see POST /auth/login.

Conventions

Every collection returns { data, next_cursor }. Keep calling with cursor until next_cursor is null — never count pages, rows move while you read.
Timestamps are ISO 8601 in UTC. Money and durations are integers.
Errors always carry { error: { code, message } }: branch on code, show message.
Writing a ticket runs the same rules, SLA policies and webhooks as the product itself. There is no quiet back door.

Rate limit

600 requests per minute per key or device session. Over it, 429 with a Retry-After header. Signing in is tighter, and counted per address and per source: see POST /auth/login.