The REST API

A documented REST API with two authentication methods, cursor pagination and idempotent writes.

Authentication

Either a personal bearer token, created under My Account, or OAuth2 client credentials for a service integration. Tokens are shown once and stored as a hash; if you lose one, create another.

curl https://supportit.in/api/v1/tickets \
  -H 'Authorization: Bearer YOUR_TOKEN'

Conventions

• Cursor pagination — pass the cursor from the previous response, do not compute offsets.
• Sparse fieldsets with ?fields=, filters with ?filter[status]=open.
• Send an Idempotency-Key header on every POST. Replaying the same key returns the original result rather than creating a second record.
• Rate limits are per plan and reported in the X-RateLimit-* headers.
• Errors use one envelope: {"error":{"code","message","field","request_id"}}. Quote the request_id if you write to us.

The specification

OpenAPI 3.1 at /api/v1/openapi.json, rendered at /api/docs, with a Postman collection you can download. The specification is generated from the routes, so it does not drift from the implementation.

Webhooks the other way

Register a URL and a secret, choose your events, and we sign every delivery with HMAC-SHA256. Failed deliveries retry with backoff at 1 minute, 5 minutes, 30 minutes, 2 hours and 6 hours, and the delivery log keeps the request and the response so you can see what we actually sent.