# Reply to a support ticket

> Posts a reply on the request as the caller’s support contact, or for Vigilbase staff an internal note customers never see.

Source: https://docs.vigilbase.com/one/api/reference/support/support-ticket-replies-create

`POST https://api.vigilbase.com/one/v1/support-tickets/{ticketId}/replies`

Posts a reply on the request as the caller’s support contact, or for Vigilbase staff an internal note customers never see. Send an Idempotency-Key so a retry never posts twice. Staff must name the customer with customerId; everyone else gets their own organisation’s customer.

> Deprecated aliases: `POST https://one.vigilbase.com/api/support/tickets/{issueId}/reply`. They answer with the same bodies, with a `Deprecation` header and a `successor-version` link to this URL.

## Authorizations

Send one of these:

- `Authorization` (string, header, required): Bearer access token from Vigilbase Identity (`auth.vigilbase.com`), sent as `Authorization: Bearer <token>`. The CLI gets one with `vigilbase login`. Organisation API keys can't call this endpoint: it acts for a signed-in person or changes how people sign in. Scope: `one:api`.
- `Authorization` (string, header, required): Vigilbase Identity access token issued to an MCP client (mcp.vigilbase.com). Scope: `one:write`.
- Permissions checked: `support:access`

## Path parameters

- `ticketId` (string, required): Pattern ^[A-Za-z0-9-]{1,64}$.

## Header parameters

- `Idempotency-Key` (string): A unique key for this write (a UUID is recommended). A retry with the same key and body returns the first answer (draft-ietf-httpapi-idempotency-key-header-08). Min length 1, max length 255.

## Body (application/json)

- `body` (string, required): Min length 1, max length 10000.
- `attachmentUrls` (string[]): Up to five file links from Vigilbase’s support attachment upload (Pylon links only). Max 5 items.
- `internalNote` (boolean): Vigilbase staff only: post an internal note instead of a reply. Default `false`.
- `customerId` (string)

## Responses

Errors are problem details (`application/problem+json`). See [errors](https://docs.vigilbase.com/one/api#errors).

### 201 (application/json)

Success

- `messageId` (string | null, required)

### 400 (application/problem+json)

Problem: `validation_failed`.

- `type` (string, required)
- `title` (string, required)
- `status` (integer, required): Minimum 400, maximum 599.
- `detail` (string, required)
- `instance` (string)
- `code` (string, required): One of `bad_request`, `validation_failed`, `idempotency_key_invalid`, `unauthorized`, `invalid_api_key`, `api_key_revoked`, `api_key_expired`, `forbidden`, `step_up_required`, `staff_only`, `read_only_key`, `not_for_api_keys`, `insufficient_scope`, `not_found`, `method_not_allowed`, `conflict`, `idempotency_in_progress`, `gone`, `length_required`, `precondition_failed`, `payload_too_large`, `unsupported_media_type`, `unprocessable_entity`, `idempotency_key_reused`, `rate_limit_exceeded`, `internal_error`, `upstream_unavailable`, `service_unavailable`.
- `requestId` (string, required)
- `docs` (string)
- `errors` (object[])
  - `pointer` (string, required)
  - `message` (string, required)
- `retryAfterSeconds` (integer): Minimum 0, maximum 9007199254740991.

### 401 (application/problem+json)

Problem: `unauthorized`.

- `type` (string, required)
- `title` (string, required)
- `status` (integer, required): Minimum 400, maximum 599.
- `detail` (string, required)
- `instance` (string)
- `code` (string, required): One of `bad_request`, `validation_failed`, `idempotency_key_invalid`, `unauthorized`, `invalid_api_key`, `api_key_revoked`, `api_key_expired`, `forbidden`, `step_up_required`, `staff_only`, `read_only_key`, `not_for_api_keys`, `insufficient_scope`, `not_found`, `method_not_allowed`, `conflict`, `idempotency_in_progress`, `gone`, `length_required`, `precondition_failed`, `payload_too_large`, `unsupported_media_type`, `unprocessable_entity`, `idempotency_key_reused`, `rate_limit_exceeded`, `internal_error`, `upstream_unavailable`, `service_unavailable`.
- `requestId` (string, required)
- `docs` (string)
- `errors` (object[])
  - `pointer` (string, required)
  - `message` (string, required)
- `retryAfterSeconds` (integer): Minimum 0, maximum 9007199254740991.

### 403 (application/problem+json)

Problem: `forbidden`, `read_only_key`.

- `type` (string, required)
- `title` (string, required)
- `status` (integer, required): Minimum 400, maximum 599.
- `detail` (string, required)
- `instance` (string)
- `code` (string, required): One of `bad_request`, `validation_failed`, `idempotency_key_invalid`, `unauthorized`, `invalid_api_key`, `api_key_revoked`, `api_key_expired`, `forbidden`, `step_up_required`, `staff_only`, `read_only_key`, `not_for_api_keys`, `insufficient_scope`, `not_found`, `method_not_allowed`, `conflict`, `idempotency_in_progress`, `gone`, `length_required`, `precondition_failed`, `payload_too_large`, `unsupported_media_type`, `unprocessable_entity`, `idempotency_key_reused`, `rate_limit_exceeded`, `internal_error`, `upstream_unavailable`, `service_unavailable`.
- `requestId` (string, required)
- `docs` (string)
- `errors` (object[])
  - `pointer` (string, required)
  - `message` (string, required)
- `retryAfterSeconds` (integer): Minimum 0, maximum 9007199254740991.

### 404 (application/problem+json)

Problem: `not_found`.

- `type` (string, required)
- `title` (string, required)
- `status` (integer, required): Minimum 400, maximum 599.
- `detail` (string, required)
- `instance` (string)
- `code` (string, required): One of `bad_request`, `validation_failed`, `idempotency_key_invalid`, `unauthorized`, `invalid_api_key`, `api_key_revoked`, `api_key_expired`, `forbidden`, `step_up_required`, `staff_only`, `read_only_key`, `not_for_api_keys`, `insufficient_scope`, `not_found`, `method_not_allowed`, `conflict`, `idempotency_in_progress`, `gone`, `length_required`, `precondition_failed`, `payload_too_large`, `unsupported_media_type`, `unprocessable_entity`, `idempotency_key_reused`, `rate_limit_exceeded`, `internal_error`, `upstream_unavailable`, `service_unavailable`.
- `requestId` (string, required)
- `docs` (string)
- `errors` (object[])
  - `pointer` (string, required)
  - `message` (string, required)
- `retryAfterSeconds` (integer): Minimum 0, maximum 9007199254740991.

### 409 (application/problem+json)

Problem: `conflict`.

- `type` (string, required)
- `title` (string, required)
- `status` (integer, required): Minimum 400, maximum 599.
- `detail` (string, required)
- `instance` (string)
- `code` (string, required): One of `bad_request`, `validation_failed`, `idempotency_key_invalid`, `unauthorized`, `invalid_api_key`, `api_key_revoked`, `api_key_expired`, `forbidden`, `step_up_required`, `staff_only`, `read_only_key`, `not_for_api_keys`, `insufficient_scope`, `not_found`, `method_not_allowed`, `conflict`, `idempotency_in_progress`, `gone`, `length_required`, `precondition_failed`, `payload_too_large`, `unsupported_media_type`, `unprocessable_entity`, `idempotency_key_reused`, `rate_limit_exceeded`, `internal_error`, `upstream_unavailable`, `service_unavailable`.
- `requestId` (string, required)
- `docs` (string)
- `errors` (object[])
  - `pointer` (string, required)
  - `message` (string, required)
- `retryAfterSeconds` (integer): Minimum 0, maximum 9007199254740991.

### 422 (application/problem+json)

Problem: `unprocessable_entity`.

- `type` (string, required)
- `title` (string, required)
- `status` (integer, required): Minimum 400, maximum 599.
- `detail` (string, required)
- `instance` (string)
- `code` (string, required): One of `bad_request`, `validation_failed`, `idempotency_key_invalid`, `unauthorized`, `invalid_api_key`, `api_key_revoked`, `api_key_expired`, `forbidden`, `step_up_required`, `staff_only`, `read_only_key`, `not_for_api_keys`, `insufficient_scope`, `not_found`, `method_not_allowed`, `conflict`, `idempotency_in_progress`, `gone`, `length_required`, `precondition_failed`, `payload_too_large`, `unsupported_media_type`, `unprocessable_entity`, `idempotency_key_reused`, `rate_limit_exceeded`, `internal_error`, `upstream_unavailable`, `service_unavailable`.
- `requestId` (string, required)
- `docs` (string)
- `errors` (object[])
  - `pointer` (string, required)
  - `message` (string, required)
- `retryAfterSeconds` (integer): Minimum 0, maximum 9007199254740991.

### 429 (application/problem+json)

Problem: `rate_limit_exceeded`.

- `type` (string, required)
- `title` (string, required)
- `status` (integer, required): Minimum 400, maximum 599.
- `detail` (string, required)
- `instance` (string)
- `code` (string, required): One of `bad_request`, `validation_failed`, `idempotency_key_invalid`, `unauthorized`, `invalid_api_key`, `api_key_revoked`, `api_key_expired`, `forbidden`, `step_up_required`, `staff_only`, `read_only_key`, `not_for_api_keys`, `insufficient_scope`, `not_found`, `method_not_allowed`, `conflict`, `idempotency_in_progress`, `gone`, `length_required`, `precondition_failed`, `payload_too_large`, `unsupported_media_type`, `unprocessable_entity`, `idempotency_key_reused`, `rate_limit_exceeded`, `internal_error`, `upstream_unavailable`, `service_unavailable`.
- `requestId` (string, required)
- `docs` (string)
- `errors` (object[])
  - `pointer` (string, required)
  - `message` (string, required)
- `retryAfterSeconds` (integer): Minimum 0, maximum 9007199254740991.

### 503 (application/problem+json)

Problem: `service_unavailable`.

- `type` (string, required)
- `title` (string, required)
- `status` (integer, required): Minimum 400, maximum 599.
- `detail` (string, required)
- `instance` (string)
- `code` (string, required): One of `bad_request`, `validation_failed`, `idempotency_key_invalid`, `unauthorized`, `invalid_api_key`, `api_key_revoked`, `api_key_expired`, `forbidden`, `step_up_required`, `staff_only`, `read_only_key`, `not_for_api_keys`, `insufficient_scope`, `not_found`, `method_not_allowed`, `conflict`, `idempotency_in_progress`, `gone`, `length_required`, `precondition_failed`, `payload_too_large`, `unsupported_media_type`, `unprocessable_entity`, `idempotency_key_reused`, `rate_limit_exceeded`, `internal_error`, `upstream_unavailable`, `service_unavailable`.
- `requestId` (string, required)
- `docs` (string)
- `errors` (object[])
  - `pointer` (string, required)
  - `message` (string, required)
- `retryAfterSeconds` (integer): Minimum 0, maximum 9007199254740991.

### default (application/problem+json)

Problem details (RFC 9457).

- `type` (string, required)
- `title` (string, required)
- `status` (integer, required): Minimum 400, maximum 599.
- `detail` (string, required)
- `instance` (string)
- `code` (string, required): One of `bad_request`, `validation_failed`, `idempotency_key_invalid`, `unauthorized`, `invalid_api_key`, `api_key_revoked`, `api_key_expired`, `forbidden`, `step_up_required`, `staff_only`, `read_only_key`, `not_for_api_keys`, `insufficient_scope`, `not_found`, `method_not_allowed`, `conflict`, `idempotency_in_progress`, `gone`, `length_required`, `precondition_failed`, `payload_too_large`, `unsupported_media_type`, `unprocessable_entity`, `idempotency_key_reused`, `rate_limit_exceeded`, `internal_error`, `upstream_unavailable`, `service_unavailable`.
- `requestId` (string, required)
- `docs` (string)
- `errors` (object[])
  - `pointer` (string, required)
  - `message` (string, required)
- `retryAfterSeconds` (integer): Minimum 0, maximum 9007199254740991.

## Example request

```bash
# Token from `vigilbase login`. API keys can't call this.
curl --request POST \
  --url 'https://api.vigilbase.com/one/v1/support-tickets/{ticketId}/replies' \
  --header "Authorization: Bearer $VIGILBASE_TOKEN" \
  --header 'Content-Type: application/json' \
  --data '{"body":"<string>","attachmentUrls":["<string>"],"internalNote":false,"customerId":"<uuid>"}'
```

## Example response (201)

```json
{
  "messageId": "<string>"
}
```

See also the [guide](https://docs.vigilbase.com/one/api/support).