Administration API
This article and the rest of the API documentation in this section are written for a technical audience — integrators and developers connecting external systems to Tickiti. Familiarity with HTTP, REST, JSON and bearer-token authentication is assumed.
The Administration API exposes the Administration screens — system settings, branding, custom domain, AI assistant, users & queue permissions, licence status, storage management and diagnostics. Every endpoint runs as the token’s owner and is gated by the administration ability plus the owner’s admin role; a few are additionally restricted to sysadmin and keep their in-app password re-check.
Abilities and conventions
administration:read— read endpoints.administration:write— create / update / action endpoints. Write implies read.
All endpoints are POST and JSON. Custom-domain and AI-assistant updates require the owner to be a sysadmin and to supply the operator’s current_password in the body, exactly as the screens do. Reads never return secrets (the AI key, mailbox passwords, remote tokens). Seat limits and the sysadmin-only role flags on user changes are enforced as in the UI.
Endpoints
| Method & path | Ability | Purpose |
|---|---|---|
| POST /api/v1/administration/system | administration:read | System settings |
| POST /api/v1/administration/system/update | administration:write | Update system options |
| POST /api/v1/administration/branding | administration:read | Branding settings |
| POST /api/v1/administration/branding/update | administration:write | Update branding (names, colours, logo sizes) |
| POST /api/v1/administration/branding/app-logo | administration:write | Upload the app logo (multipart) |
| POST /api/v1/administration/branding/email-logo | administration:write | Upload the email logo (multipart) |
| POST /api/v1/administration/branding/reset-app-logo | administration:write | Reset the app logo |
| POST /api/v1/administration/branding/reset-email-logo | administration:write | Reset the email logo |
| POST /api/v1/administration/custom-domain | administration:read (sysadmin) | Custom-domain state |
| POST /api/v1/administration/custom-domain/update | administration:write (sysadmin + password) | Set the custom domain |
| POST /api/v1/administration/ai-assistant | administration:read (sysadmin) | AI-assistant settings/stats |
| POST /api/v1/administration/ai-assistant/update | administration:write (sysadmin + password) | Update AI-assistant settings |
| POST /api/v1/administration/users | administration:read | List users + queues |
| POST /api/v1/administration/users/create | administration:write | Create a user (seat-limited) |
| POST /api/v1/administration/users/{user}/update | administration:write | Update a user’s roles |
| POST /api/v1/administration/users/{user}/queues/{queue} | administration:write | Upsert a queue permission |
| POST /api/v1/administration/users/{user}/queues/{queue}/detach | administration:write | Remove a queue permission |
| POST /api/v1/administration/licence | administration:read | Licence status + disk utilisation |
| POST /api/v1/administration/storage/retention | administration:write | Update sent-mail retention |
| POST /api/v1/administration/storage/delete-orphaned | administration:write | Delete orphaned attachment files |
| POST /api/v1/administration/storage/delete-closed | administration:write | Delete attachments on old closed tickets |
| POST /api/v1/administration/diagnostics | administration:read | List/fetch diagnostics (if enabled) |
| POST /api/v1/administration/diagnostics/fetch | administration:read | Fetch a file from a diagnostic bundle |
| POST /api/v1/administration/diagnostics/upload | administration:write | Upload a diagnostic bundle (multipart) |
| POST /api/v1/administration/diagnostics/update | administration:write | Update diagnostic metadata |
Not exposed
Some actions are intentionally unavailable over the API, even role-gated, because the blast radius of a leaked token is too high:
- Licence register / unregister — can deactivate the whole instance. Read-only status is available above.
- Deleting a user — create and role changes are available; deletion is UI-only.
- API-key management — minting tokens via a token is an escalation path; manage keys from Administration → API keys.