The REST API and API keys

The REST API lets your own scripts and tools read and change what is in your helpdesk: tickets and their messages, customers, tags, macros, rules, views, fields, teams and settings. The helpdesk's own pages use the same endpoints, so anything an agent can do on screen, a script with a key can do too, within that person's role.

The full reference, with every endpoint, its parameters and examples, is at cs.growthdept.ai/docs/api. This article covers the settings side.

Your connection details#

Open Settings > REST API. Under Connection details you find three things, each with a copy button:

Send the username and key with HTTP Basic authentication, or send the key alone as a Bearer token. Either way the key decides which helpdesk the request reaches, so the helpdesk's name never appears in the URL. Example request shows a ready-made call to GET /api/account, the quickest way to check a key works. Authentication in the reference has both forms.

Create a key#

Only admins can create API keys.

1. Under Your API keys, select Create API key.

2. Give it a Name that says what it is for, such as the tool it connects.

3. Select Create key.

4. Copy the key straight away. It is shown only this once; the helpdesk keeps only a scrambled copy and cannot show it again.

Create one key per tool. Then you can revoke one without breaking the others, and Last used tells you which tool is still calling.

A key acts as you, with your role, in this helpdesk only. Changes made with it appear in the audit log, and every read of customer data it makes appears in the data access log with The REST API as the route.

Reset or revoke a key#

Each key's row shows its Name, the start of the Key, when it was Created and when it was Last used.

• Reset makes a new key with the same name and stops the old one at once. Use it when a key may have leaked. Paste the new key into the tool before you need it again.

• Revoke stops the key for good after you confirm with Revoke key. The next request with it gets a 401 error.

Any agent can revoke their own keys. Admins also see Other agents' keys and can revoke any of them, for example when someone leaves. Deactivating a user stops all of their keys too.

Rules and imports run as the helpdesk's automation agent, which has no keys of its own. The AI agent has its own account and key, managed under AI Agent; see Link or unlink the AI agent account.

Limits and conventions#

Tools written for Gorgias#

The API follows the shape of Gorgias's REST API, so a script or tool written for it usually works after two changes: point its base URL at https://cs.growthdept.ai/api/ and give it your email and a key from this page. Compatibility lists what matches and what differs.

Third-party apps#

There is no app marketplace and no OAuth sign-in for third-party apps. A tool connects with an API key that someone on your team creates, as above. To send ticket events to your own service as they happen, use an HTTP integration instead of calling the API over and over.