API reference

API reference: Support

Cushy customer support API: create and read tickets, reply, and upload/download encrypted attachments. Staff work the cross-org queue in the admin realm.

The customer half of the ticket system (the /support screen). A ticket is visible to its requester and org admins; security-category tickets are admin/Owner-only. Staff internal notes and staff identities are structurally excluded from every customer read.

POST/api/support/ticketsSession

Open a ticket: { subject, body, category, severity (S1–S4) }. Returns the ticket with its human number (SNW-<n>) and the plan/SLA snapshot taken at creation.

Example request

json

{ "category": "cloud-connection", "severity": "S2", "title": "AWS sync failing",
  "description": "The role assume step errors on validate." }

Example response

json

{ "ticket": { "id": 12, "number": "SNW-12", "state": "open", "severity": "S2",
  "category": "cloud-connection", "title": "AWS sync failing", "createdAt": "2026-08-21T09:00:00.000Z" } }

Errors

Status	When
`400`	Missing subject/body, or an invalid category/severity.

GET /api/support/tickets lists your visible tickets; GET …/{id} returns the ticket with its public message timeline; POST …/{id}/messages replies (a reply while waiting_on_customer flips the ticket back to in_progress).

POST/api/support/tickets/{id}/attachmentsSession

Upload an attachment (≤10MB; images/pdf/text-logs/zip allowlist). Bytes are AES-256-GCM encrypted app-side before the object store; GET …/attachments lists, GET …/attachments/{attId} downloads (decrypted server-side after the authorization check). A staff internal-note attachment is invisible to customers.

Example request

json

// multipart/form-data — NOT JSON:
//   file=@screenshot.png        (≤10 MB, content-type allow-list)
//   messageId=45                (optional: attach to a specific message)

Example response

json

{ "attachment": { "id": 5, "filename": "screenshot.png", "contentType": "image/png",
  "sizeBytes": 184320, "createdAt": "2026-08-21T09:00:00.000Z" } }

Errors

Status	When
`400`	Too large or a disallowed content type.
`404`	Cross-org ticket, or an internal attachment.
`503`	No writable storage backend configured.