API Endpoints: Configuration

Configure the osTicket API Endpoints plugin: the plugin settings, the per-API-key permissions and which endpoint each permission unlocks, plus practical advice.

Deutsche Version

Back to overview

API Endpoints: Configuration

This documentation always describes the latest published version.

Plugin Settings

Open Admin Panel → Manage → Plugins → API Endpoints and click Configure.

Setting	Description	Default
Enable API Endpoints	Controls the two routes the plugin registers in osTicket's API: `POST /api/tickets.json` (extended creation) and `PATCH`/`PUT /api/tickets/{number}.json` (update). When disabled, these routes behave like osTicket core. The standalone endpoints `/api/tickets-*.php` are not affected, access to them is controlled by the API key permissions only	enabled
Require Markdown Plugin	When enabled, creating a ticket with `format=markdown` is rejected with `400` as long as the Markdown Support plugin is not active. When disabled, the value is passed through without that check	disabled
Installed Version	Maintained by the plugin itself, do not edit	automatic

Below the settings, the page lists the available endpoints with their permissions and the table of API key permissions.

API Key Permissions

The plugin adds six permission columns to osTicket's API key table. They are all disabled by default. can_create_tickets is osTicket's own permission.

Setting Permissions

Open Admin Panel → Manage → Plugins → API Endpoints → Configure
In the section API Key Permissions, find the API key. The table shows IP address, shortened key, status and creation date
Click Manage Permissions next to the key and tick the permissions
Save the settings page

Saving applies the checkboxes of all listed API keys in one go.

Permissions

Permission	Column	Unlocks
Create Tickets	`can_create_tickets`	osTicket's own create permission. The plugin's route `POST /api/tickets.json` does not check it itself, see API Documentation
Update Tickets	`can_update_tickets`	`PATCH`/`PUT /api/tickets-update.php/{number}.{format}`, `PATCH`/`PUT /api/tickets/{number}.{format}`
Read Tickets	`can_read_tickets`	`GET /api/tickets-get.php/{number}.{format}`, `GET /api/tickets-attachment-download.php/{file_id}.{format}`, and also the search, statistics and status list endpoints
Search Tickets	`can_search_tickets`	`GET /api/tickets-search.php`
Delete Tickets	`can_delete_tickets`	`DELETE /api/tickets-delete.php/{number}.{format}`
Read Stats	`can_read_stats`	`GET /api/tickets-stats.php`, `GET /api/tickets-statuses.php`
Manage Subtickets	`can_manage_subtickets`	The four `/api/tickets-subtickets-*.php` endpoints, requires the Subticket Manager plugin

The exact paths and parameters are on the page API Documentation.

can_read_tickets is the only permission with a broader effect: it also covers search, statistics and the status list. Every other permission of the standalone endpoints is checked on its own, and a missing or disabled value means access is denied. There is no fallback to osTicket's own create permission.

Existing API Keys

Existing keys get no access to the new endpoints after installation, because every new permission starts disabled. Enable the permissions each integration needs.

Best Practices

Enable only the permissions an integration needs, for example only can_read_stats for a dashboard.
Use a separate API key per integration.
can_delete_tickets is disabled by default. Often a PATCH to a closed status is the better choice than deleting.
To restrict a key by IP address with wildcards, use the API Key Wildcard plugin. When it is installed, the standalone endpoints and the update route use its key validation. The create route POST /api/tickets.json does not call it.
Rotate keys regularly and deactivate keys you no longer need.