Bloq.it Ticketing API (1.0.0)

Send your partner API key in the x-api-key header on every request. Backoffice users can authenticate with a Authorization: Bearer <JWT> header instead.

Endpoints that accept file uploads read the JSON payload from a data field:

• application/json: wrap the payload in a data object, e.g. { "data": { "subject": "..." } }.
• multipart/form-data: send the payload as a JSON string in the data field and attach files under files (repeat the field for several files).

Register a URL with Create a webhook and choose the events you want. When one of those events happens on one of your tickets, we POST a JSON payload to your URL. The payloads are listed under Webhook events in the sidebar.

Available events

Use these names in enabledEvents when you create a webhook.

• One payload per event, no event name. The body does not say which event fired. If you subscribe to several events, register a separate URL (or a query string such as ?event=ticket.updated) for each one so you can tell them apart.
• Pick your platform's events. ticket.* events fire for tickets on Freshservice and odoo.ticket.* events for tickets on Odoo. The payloads are the same.
• Respond with any 2xx. Failed deliveries are not retried, so use Retrieve a ticket to catch up if your endpoint was down.

Every delivery carries two headers:

• timestamp: milliseconds since epoch at signing time.
• signature: an HS256 JWT signed with your webhook secret, whose payload is the string <timestamp>.<JSON body>.

Verify the JWT with your secret and check that its payload matches the request before trusting a delivery. For example, in Node.js:

const jwt = require('jsonwebtoken');

const signed = jwt.verify(req.headers.signature, WEBHOOK_SECRET, { algorithms: ['HS256'] });
const expected = `${req.headers.timestamp}.${JSON.stringify(req.body)}`;
if (signed !== expected) throw new Error('Invalid webhook signature');

Create, read and update support tickets.

Manage webhook subscriptions for ticket events.

Payloads we send to your webhook URLs. See Receiving webhooks.

Ticket categories and subcategories.

Information about the authenticated partner.