Tickets from your own systems

• ticket:createOpen tickets
• ticket:readRead tickets, messages and panels
• ticket:replyWrite into a ticket as the team
• stats:readRead aggregate numbers

A missing permission returns 403, not 401. The key is fine — it simply lacks that tick.

Only send fields documented here. An unknown field name is not silently ignored but rejected with 422 — a typo should show up straight away, not as an empty ticket.

{
  "event": "message.created",
  "sent_at": "2026-08-01T12:34:56Z",
  "guild_id": "1470847667327471738",
  "ticket": {
    "id": 42, "number": 17,
    "panel_id": 3, "panel_name": "Support",
    "status": "open", "priority": 2,
    "opener_id": "234...", "metadata": null
  },
  "message": {
    "id": 8891,
    "discord_message_id": "13...",
    "origin": "discord",
    "is_staff": true,
    "is_ai": false,
    "author_id": "234...",
    "author_bot": false,
    "author_name": "Lisa",
    "content": "Ich schaue mir das an.",
    "created_at": "2026-08-01T12:34:56Z"
  }
}

X-Ticketanizer-Event: message.created
X-Ticketanizer-Delivery: 90183
X-Ticketanizer-Timestamp: 1785600896
X-Ticketanizer-Signature: t=1785600896,v1=9f2c…

Verifying the signature

Compute HMAC-SHA256 over <timestamp>.<rawBody> with your secret and compare the result against one of the v1 values. Two things that are easy to miss: the header can carry several v1 values (during a secret rotation), and the comparison should run in constant time.

const crypto = require("crypto");

function verify(rawBody, header, secret) {
  const parts = header.split(",").map(p => p.split("="));
  const ts = parts.find(([k]) => k === "t")?.[1];
  // v1 kann MEHRFACH vorkommen — waehrend einer Secret-Rotation
  const sigs = parts.filter(([k]) => k === "v1").map(([, v]) => v);
  if (!ts || Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;

  const expected = crypto.createHmac("sha256", secret)
    .update(ts + "." + rawBody)
    .digest("hex");

  return sigs.some(s => s.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(s), Buffer.from(expected)));
}

We sign the raw body — exactly the bytes that arrive. Verifying after parsing and re-serialising the JSON produces a different signature and nothing but failures.

The events

You tick what you want when you create the endpoint. With no selection you get every event — with one exception, see below.

What to know about delivery

• RetriesAnswer with a 2xx status. Anything else counts as a failure and we try again — after 1, 5, 15 and 60 minutes, then no more.
• Loop guardEvery message carries an origin (discord, web, inbox, relay). If you answer in response to an event, filter out your own — otherwise your reply triggers the next event.
• DuplicatesAnswer too slowly and the same delivery arrives again. That is deliberate: twice beats not at all. The delivery ID is what protects you from processing it twice.
• Dead endpointsAfter 20 deliveries in a row that fail for good, we switch the endpoint off and write the reason into the dashboard. A brief outage will not do it — counting starts only once all retries are exhausted.
• Rotating the secretWhen you rotate, the old secret stays valid for 7 days and we sign with both. That lets you switch over calmly without losing a delivery.

Deliveries are visible in the dashboard — including the payload sent and your server's response. From there you can also replay a delivery by hand, as long as it is still in the log.