| Standard API | Wildcard endpoint | |
|---|---|---|
| URL | /api/tickets.json |
/api/wildcard/tickets.json |
| IP check | Key IP must match the caller's IP | Key IP is the caller's IP or 0.0.0.0 |
| Purpose | Production | Development and testing |
The standard endpoint stays unchanged and keeps working with IP-bound keys.
curl -X POST \
-H "X-API-Key: YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"name":"Test User","email":"test@example.com","subject":"Test Ticket via Wildcard","message":"Message via the wildcard endpoint"}' \
http://localhost/osTicket/api/wildcard/tickets.json
The wildcard endpoint has exactly one route: POST /tickets.json, POST /tickets.xml and POST /tickets.email, each below /api/wildcard. The ticket is created by osTicket's ticket controller, the plugin only replaces the API key check.
| Standard endpoint | Wildcard endpoint |
|---|---|
/api/tickets.json |
/api/wildcard/tickets.json |
/api/tickets.xml |
/api/wildcard/tickets.xml |
/api/tickets.email |
/api/wildcard/tickets.email |
Other methods and other paths (for example ticket queries) are not passed through the wildcard check by the wildcard endpoint. Use the standard API with an IP-bound key for those.
The wildcard endpoint sends the api signal with its dispatcher so that other plugins can attach routes. Such routes check the API key with their own logic and do not know the wildcard rule. A 0.0.0.0 key is not automatically valid for any IP there.
The responses with status 401 and their causes are listed under Troubleshooting.
A wildcard key allows anyone who knows the key to create tickets from any IP. Use it only where that is acceptable.
Wildcard keys (
0.0.0.0) are meant for development environments. In production, bind every key to a fixed IP.
Wildcard API Key Used entries.