API Key Wildcard

Additional osTicket API endpoint /api/wildcard/tickets.json on which API keys with IP 0.0.0.0 are accepted from any caller IP. Intended for development environments only.

Deutsche Version

Back to osTicket Plugins

API Key Wildcard

This documentation always describes the latest published version.

Overview

Next to osTicket's standard API the plugin provides an additional endpoint: /api/wildcard/tickets.json (likewise .xml and .email). On this endpoint osTicket accepts API keys with the IP address 0.0.0.0 from any caller IP. The standard endpoint stays unchanged.

Without this plugin: osTicket's API requires a fixed IP address per API key. With dynamic IPs (home office, changing locations, CI/CD) you have to keep adjusting the key.

With this plugin: A key with the IP 0.0.0.0 works on the wildcard endpoint from any IP. The standard endpoint keeps checking strictly.

Wildcard keys (0.0.0.0) are meant for development environments only. In production, bind every key to a fixed IP.

graph LR
    A["POST /api/wildcard/tickets.json"] --> B["api/.htaccess redirects to wildcard.php"]
    B --> C["WildcardApiController checks the key"]
    C -->|"valid"| D["osTicket creates the ticket"]
    C -->|"invalid"| E["401"]

Documentation

Page	Contents
Installation	Plugin folder, activation, changes to `api/.htaccess`, manual installation, deactivation
Configuration	The two fields and logging
Usage	Endpoint, curl example, limits, security notes
Technical Details	Flow, classes, SQL check, auto-update, file structure
Troubleshooting	404 and 401, logging, updates, frequently asked questions

Features

Feature	Description
Separate endpoint	`/api/wildcard/tickets.json`, `.xml` and `.email` (POST only), standard API unchanged
Automatic installation	Enabling copies `wildcard.php` to `api/` and extends `api/.htaccess`
Auto-update	On startup the installed version is compared with `plugin.php` and the endpoint file is replaced if needed
Logging	Optional debug entry when a wildcard key is used
Clean-up	Deactivating deletes `api/wildcard.php` and removes the rules from `api/.htaccess`

Requirements

Requirement	Version	Notes
osTicket	1.18.x	Uses osTicket's API classes
PHP	7.4 or newer	The CI checks 7.4 to 8.3
Web server	Apache with `mod_rewrite`	The redirect is only set up automatically for Apache
File permissions	Write access to `api/` and `api/.htaccess`	For the automatic installation

License

GNU General Public License v2, compatible with osTicket. See LICENSE.

Support

Report bugs and questions in the issue tracker. Please include the osTicket version, PHP version, web server, error messages from the logs and the plugin version.