Support

Lists support tickets across every organization the caller may see, paginated, enriched with a last-message preview, unread count, and review status (design doc §44.2 -- an organization is a shared workspace, so members see each other's tickets, not only ones they personally opened). Every row carries its own organization_id, so the listing can be grouped by owner; for one organization's tickets alone, read /organizations/{id}/tickets instead.

Gets one support ticket with its messages, from any organization the caller may see (design doc §44.2 -- an organization is a shared workspace, so members see each other's tickets and message threads). Deleted messages are omitted; staff authorship is never exposed (shown only as "Support Team").

Posts a reply into a support ticket owned by the caller or by another member of an organization the caller belongs to (design doc §44.2's shared-workspace model; owner ruling 2026-09-22 / ZC-0424 -- an organization member may reply to a colleague's ticket, not only read it). Staff and a reseller's manager (while their tier holds the ticket) may also reply, from the support side. Answers 404 for an organization the caller does not belong to and for an invented ticket id alike. A real ticket the caller may read but has no right to post into (neither a shared organization membership nor a support-side door) answers 403 rather than 404, since the caller already knows it exists. Answers a business-rule error for a closed ticket. Files uploaded against this ticket through POST .../attachments are carried by listing them in attachments; each is re-validated against the asset it names, and an id that does not resolve to an unsent attachment of this ticket refuses the whole message.

Submits the caller's own CSAT review for one of their closed support tickets, from any organization the caller may see. Answers 404 for an organization the caller does not belong to and for an invented ticket id alike. A real ticket the caller may read but does not own (another organization member's, under design doc §44.2's shared-workspace read model) answers 403 rather than 404, since the caller already knows it exists -- reviewing is owner-only, narrower than the read model above it. Answers a business-rule error for a ticket that is not yet closed, and resource-already-exists for a ticket that already carries a review: a review is immutable once submitted, never replaced by a second call. response_quality and resolution_speed must each be between 1 and 5.

Lists one organization's support tickets, paginated, enriched with a last-message preview, unread count, and review status. An organization is a shared workspace, so every member sees the organization's tickets, not only ones they personally opened (design doc §44.2). Answers 404 for an organization the caller does not belong to, the same way reading that organization directly would.

Opens a new support ticket, owned by the caller, under one organization the caller belongs to, with the given subject and opening message. Answers 404 for an organization the caller does not belong to, the same way reading that organization directly would.

Every access request support has raised on this ticket, in every state, so the customer can see what was asked for, what they agreed to, and what has since expired or been taken back. A pending entry is a decision waiting on the caller: support holding only the ticket-management permission sees nothing of a service until one of these is approved. The requesting agent is deliberately not named -- this surface renders support as one team throughout. Each entry carries max_duration_hours, the longest an approval can last, and expires_at once it has been given.

Gives the requesting agent access to the one service instance named on the request, and to nothing else the caller owns. The grant starts now and stops on its own: it expires after max_duration_hours, it is revoked the moment the ticket is closed, and the caller can withdraw it at any time with DELETE /support/access-requests/{request_id}. Every request made with the grant is audited, and the approval itself is recorded against the organization with the approving user on it. Requires an Owner or Admin membership of the organization that owns the service (or its personal owner): a member who can see the ticket cannot hand over the infrastructure. Answers 422 if the request has already been answered or its ticket has since closed. An access request the caller may not answer answers 404 with exactly the body an invented id gets: whether a request exists, and whether it is still pending, is not something this surface reports to somebody with no business knowing.

Refuses the request. Nothing is granted, no expires_at is written, and the agent keeps seeing exactly what they saw before: nothing of the service. The ticket stays open and the conversation continues -- denying access is not closing the conversation, and support can still be helped with what the customer chooses to describe. Same authority and same refusals as the approval it replaces; the two answer identically to anybody who may not decide. An access request the caller may not answer answers 404 with exactly the body an invented id gets: whether a request exists, and whether it is still pending, is not something this surface reports to somebody with no business knowing.

Takes back a grant the caller gave, or refuses one still pending, in one call. It takes effect on the agent's very next request: a grant is re-read from storage on every authenticated call rather than carried in the agent's token, so there is no session to wait out and nothing cached to catch up. The request row survives as revoked so the audit trail can say consent was withdrawn rather than never given. Same Owner/Admin authority as approving. An access request the caller may not answer answers 404 with exactly the body an invented id gets: whether a request exists, and whether it is still pending, is not something this surface reports to somebody with no business knowing.

Every grant support currently holds on a service belonging to an organization the caller is a member of: approved, not yet expired, and on a ticket that is still open. This is the "is anybody inside my infrastructure right now" read, so it deliberately answers only live grants -- a denied, revoked or expired one is history and belongs on its own ticket. Each entry names the service instance and when the grant lapses; any of them can be withdrawn immediately with DELETE /support/access-requests/{request_id}.

Opens a new support ticket owned by the caller, in the caller's own personal organization, with the given subject and opening message.

The organization is never named: it is always the caller's own personal organization, resolved from their token, so there is no organization a caller could get wrong and no 404 for one they do not belong to. Opening a ticket under a shared organization needs POST /api/v2/organizations/{id}/tickets instead; both routes create the same ticket through the same service and differ only in how the organization is named.

The new ticket is returned together with its opening message, so a composer does not have to re-read the ticket to render what it just sent.

Broadcasts a transient "typing" frame to everyone holding this ticket's event stream open. Stores nothing and has no effect other than that frame, so a client may call it as a throttled heartbeat while the composer has focus. A ticket in an organization the caller does not belong to answers 404, the same as an invented id. A real ticket the caller may read but does not own answers 403: the services behind this surface still authorize the ticket's own owner and nobody else (ZC-0424), which is narrower than the shared-workspace read model GET /support/tickets/{id} uses.

Moves the customer side's read cursor to now, which is what clears the ticket's unread_count in the listing and what the other side sees as a read frame on the event stream. Idempotent. A ticket in an organization the caller does not belong to answers 404, the same as an invented id. A real ticket the caller may read but does not own answers 403: the services behind this surface still authorize the ticket's own owner and nobody else (ZC-0424), which is narrower than the shared-workspace read model GET /support/tickets/{id} uses.

Retracts a message the caller wrote themselves. Only the original author may delete. The row is kept and marked deleted rather than removed, but GET /support/tickets/{id} omits it entirely rather than rendering a placeholder, so the thread simply no longer contains it. Deleting an already deleted message succeeds. A ticket in an organization the caller does not belong to answers 404, the same as an invented id. A real ticket the caller may read but does not own answers 403: the services behind this surface still authorize the ticket's own owner and nobody else (ZC-0424), which is narrower than the shared-workspace read model GET /support/tickets/{id} uses.

Rewrites the body of a message the caller wrote themselves. Only the original author may edit, and only while the ticket is open; a closed ticket answers a business-rule error rather than a permission one, because reopening it would make the same call succeed. The superseded body is kept and readable through .../edits, so an edit is never a silent rewrite. A ticket in an organization the caller does not belong to answers 404, the same as an invented id. A real ticket the caller may read but does not own answers 403: the services behind this surface still authorize the ticket's own owner and nobody else (ZC-0424), which is narrower than the shared-workspace read model GET /support/tickets/{id} uses.

Prior versions of one customer-side message in a ticket the caller may see, oldest first, so an edited message can show what it replaced. A staff message's edit history is not served here and answers 404 identically to a message that belongs to another ticket: which words an agent retracted is a support-side record, and this surface never identifies the agent behind "Support Team". A ticket in an organization the caller does not belong to answers 404 as well.

Stores one file against this ticket ahead of the message that will carry it, so a composer can show per-file progress and let the sender drop a file before committing to the message. Send it as multipart/form-data with the file in a part named file; the part's filename and content type are recorded as sent, and anything after the first part is ignored. Answers exactly the four fields TicketMessageAttachmentRequest wants, so the response goes straight into the attachments array of POST .../messages when the message is finally sent -- none of it is trusted there, the asset row is re-read. A file uploaded and never sent stays unreferenced and renders nowhere; removing one before sending is DELETE .../attachments/{asset_id}. The ceiling is 50 MiB, enforced while the body is being read rather than after it is buffered, and a larger upload answers 413. A ticket in an organization the caller does not belong to answers 404, the same as an invented id. A real ticket the caller may read but does not own answers 403: the services behind this surface still authorize the ticket's own owner and nobody else (ZC-0424), which is narrower than the shared-workspace read model GET /support/tickets/{id} uses.

Deletes a file uploaded against this ticket that no message carries yet, both the stored object and its asset row. An attachment a message already references answers a field error instead and is left alone: it is part of the conversation at that point, and removing it is a matter of retracting the message. An asset id that names nothing, or names something that is not an unsent attachment of this ticket, answers 404 indistinguishably. A ticket in an organization the caller does not belong to answers 404, the same as an invented id. A real ticket the caller may read but does not own answers 403: the services behind this surface still authorize the ticket's own owner and nobody else (ZC-0424), which is narrower than the shared-workspace read model GET /support/tickets/{id} uses.

Holds a text/event-stream open for one ticket the caller may see, so the conversation updates without polling. Answers 404 for a ticket in an organization the caller does not belong to, exactly as reading that ticket would. Every frame is one TicketEventResponse object, addressed by the SSE event: name (message_sent, message_edited, message_deleted, typing, read, claim_changed, closed, review_submitted). Frames carry ids, never message bodies, and never identify a staff actor: re-read the ticket to render what changed. The server closes the connection after fifteen minutes and the first frame sets the reconnect interval, so a browser EventSource re-opens it by itself; the caller's access to the ticket is also re-checked periodically while the connection is held.