Deutsche Version

Back to overview

API Key Wildcard: Installation

Provide the plugin files

The plugin folder must be named exactly api-key-wildcard and live under include/plugins/ of your osTicket installation. The endpoint loads its helper file through the hard-coded path include/plugins/api-key-wildcard/api.wildcard.inc.php, so any other folder name breaks the endpoint.

/path/to/osticket/include/plugins/api-key-wildcard/

ZIP download

1. Download the latest release from GitHub Releases.
2. Extract the ZIP file.
3. Upload the api-key-wildcard folder to include/plugins/ on your osTicket server.

Git clone

cd /path/to/osticket/include/plugins
git clone https://github.com/markus-michalski/osticket-api-key-wildcard.git api-key-wildcard

The plugin needs neither Composer nor any other dependency. The target folder api-key-wildcard in the clone command matters, because the repository name would otherwise create a different folder.

Enable the plugin

1. Log in to the osTicket Admin Panel.
2. Open Manage → Plugins.
3. Select API Key Wildcard Support and enable the plugin.

On activation enable() runs and does the following in order:

• Singleton instance: The plugin is a singleton. If no instance exists yet, enable() automatically creates an active instance with the plugin name. If that fails, enable() stops at this point and returns the error messages of the instance creation.
• Endpoint file: wildcard.php is copied from the plugin folder to api/wildcard.php and set to chmod 0755.
• api/.htaccess: The plugin adds Options -MultiViews and the wildcard rewrite rule to the file (details below).
• Version: The plugin version is stored as installed_version in the plugin configuration.

If a step fails, enable() returns the error messages:

• Source file not found: ...
• Failed to copy wildcard.php to ... Please copy manually.
• Failed to set permissions on ...
• .htaccess file not found at ...
• Failed to add Options -MultiViews to .htaccess
• Failed to add wildcard rewrite rule. Could not find osTicket API rewrite pattern.
• the error messages of the instance creation (they come from osTicket, enable() then returns early)

What changes in api/.htaccess

The plugin only modifies api/.htaccess in the osTicket root directory, not the .htaccess in the plugin folder. The file in the plugin folder is just a reference.

• MultiViews: The plugin replaces every occurrence of RewriteEngine On in the file (not just the first one) with RewriteEngine On, a blank line, the comment # Disable MultiViews for wildcard endpoint (prevents mod_negotiation) indented by two spaces, and below it Options -MultiViews, also indented by two spaces. If Options -MultiViews is already anywhere in the file, the plugin changes nothing at this point.
• Wildcard rule: The wildcard rule is inserted before osTicket's default API block (recognized by two !-f/!-d conditions followed by the condition on .../api in the request URI):

# Wildcard API endpoint (must come BEFORE the default rule)
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^wildcard/(.*)$ wildcard.php/$1 [L]

# Default API endpoint (standard osTicket)

If wildcard/ already appears in the file, the rule is not inserted again. If the plugin cannot find the default block, the rule is not inserted and the error message above is returned.

The plugin does not change any osTicket PHP files. It copies wildcard.php to api/ and extends api/.htaccess.

Create an API key with 0.0.0.0

1. Open Manage → API Keys.
2. Add a new API key.
3. Enter 0.0.0.0 as the IP address.
4. Enable Can Create Tickets.
5. Save and copy the generated key.

Only keys with the IP 0.0.0.0 are valid for any caller IP on the wildcard endpoint. A key bound to the caller's own IP is accepted there as well.

Manual installation (fallback)

If automatic installation fails (for example because of file permissions), do the steps by hand.

1. Copy the endpoint file:

cp /path/to/osticket/include/plugins/api-key-wildcard/wildcard.php /path/to/osticket/api/wildcard.php
chmod 755 /path/to/osticket/api/wildcard.php

2. In api/.htaccess, add after RewriteEngine On:

Options -MultiViews

3. In api/.htaccess, add before the default API block:

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^wildcard/(.*)$ wildcard.php/$1 [L]

Web server

The plugin only automates Apache via api/.htaccess (with mod_rewrite enabled). With any other web server .htaccess is not evaluated and you have to set up the redirect yourself.

• Requests to /api/wildcard/<path> must be rewritten internally to /api/wildcard.php/<path>.
• The part after wildcard.php must reach PHP as PATH_INFO, because the endpoint derives the route (/tickets.json) from it.

Deactivate and remove

On deactivation disable() deletes api/wildcard.php and removes the wildcard rule and Options -MultiViews from api/.htaccess. The plugin folder stays in place. If deleting the file fails, this is only written to the PHP error log and disable() still reports success. In that case check whether api/wildcard.php still exists.

Deactivate the plugin before you take an environment into production. Afterwards the wildcard endpoint no longer exists.