# Support ticket endpoints

> List, open and reply to your organisation's Vigilbase support tickets over the One API, and what to expect when support isn't set up.

Source: https://docs.vigilbase.com/one/api/support

These endpoints work with your organisation's [support tickets](https://docs.vigilbase.com/one/requests/support). The CLI's `vigilbase support tickets` uses the list. They are v1 operations, on `https://api.vigilbase.com/one/v1`. Sign-in, permissions and error shapes are on [Vigilbase One API](https://docs.vigilbase.com/one/api).

| Method and path | Permission | CLI command |
| --- | --- | --- |
| `GET /support-tickets` | `support:access` | `vigilbase support tickets` |
| `POST /support-tickets` | `support:access` | |
| `GET /support-tickets/{ticketId}/messages` | `support:access` | |
| `POST /support-tickets/{ticketId}/replies` | `support:access` | |

`support:access` is held by owners, admins and Read Only members, not Members. Opening a ticket and replying are attributed to the signed-in person, so [organisation API keys](https://docs.vigilbase.com/one/api#organisation-api-keys) can't send them.

Each takes an optional `customerId`. Leave it out for your own organisation.

On top of One's per-IP [rate limits](https://docs.vigilbase.com/one/api#rate-limits), reading tickets and messages allows 60 requests a minute per organisation, opening tickets 5 every 10 minutes per person, and replies 10 a minute per person. Over that, the answer is a `429` problem with `Retry-After`.

## List tickets

`GET /support-tickets` lists your organisation's open tickets, as a [cursor page](https://docs.vigilbase.com/one/api#pagination). Send `includeClosed=true` to include closed ones. It reads at most the newest 100.

```json
{
  "items": [
    {
      "id": "…",
      "number": 1042,
      "title": "…",
      "state": "waiting_on_you",
      "priority": "high",
      "tags": [],
      "requester": { "name": "…", "email": "…" },
      "assignee": { "name": "…", "email": "…" },
      "bodyText": "…",
      "createdAt": "2026-10-30T09:12:44.000Z",
      "updatedAt": "2026-10-30T10:01:02.000Z",
      "closedAt": null
    }
  ]
}
```

`bodyText` is the request's text without markup or file links. When your organisation has no customer record, or support isn't set up for it, the list is empty.

## Open a ticket

`POST /support-tickets` opens a support request with Vigilbase:

```json
{
  "subject": "DNS change for example.com",
  "description": "Please add a CNAME for status.example.com pointing to …",
  "priority": "medium"
}
```

| Field | Description |
| --- | --- |
| `subject` | 5 to 200 characters |
| `description` | 20 to 40,000 characters |
| `priority` | `low`, `medium` (the default), `high` or `urgent` |
| `serviceCategory` | Optional |
| `ccEmails` | Optional; up to 20 email addresses |

Send an `Idempotency-Key` header so a retry never opens a second request. The answer is `201` with `ticketId`, `ticketNumber` and `replayed`; `replayed` is `true`, with `200`, when an earlier request with the same key already opened it.

## Messages and replies

`GET /support-tickets/{ticketId}/messages` lists the conversation on one ticket, oldest first, up to the newest 200 messages. Each message has `id`, `authorName`, `fromVigilbase`, `isInternalNote` (always `false` for you), `source`, `text`, `attachments` (each file's `index`, `name` and `kind`: `image`, `pdf` or `file`) and `createdAt`.

`POST /support-tickets/{ticketId}/replies` posts a reply as your support contact:

```json
{ "body": "Thanks, that fixed it." }
```

`body` is 1 to 10,000 characters. Send an `Idempotency-Key` so a retry never posts twice. The answer is `201` with `messageId`.

If the support system can't be reached, the answer is a `503` problem. Retry later.

## Older paths

Each operation here also answers at an older path on `https://one.vigilbase.com/api`, such as `GET /api/support/tickets` for `GET /support-tickets`. The older paths are deprecated aliases and will be retired with `410 Gone`. Each operation's page in the [API reference](https://docs.vigilbase.com/one/api/reference) names its older path. See [hosts](https://docs.vigilbase.com/one/api#hosts).