Changelog

Spam Queue, code verification & a safer confirmation email

• New — Spam Queue. A tab in Admin › API Manager to review every submission still awaiting email confirmation. An inline panel shows the full message, the submitter’s IP and the calling server’s IP, category/priority and any custom fields. Per row: Approve (create the ticket now), Ban (add the sender’s email + IP to HESK’s ban lists and clear their queued items), or Delete — plus one-click “Purge expired”.
• New — 6-digit code verification (optional). Alongside the confirmation-link method, you can now verify by code: create_ticket returns a confirmation_id and emails a 6-digit code, which your integration submits back to the new confirm_ticket endpoint to create the ticket. Single-use with capped attempts. The link method and the existing create_ticket contract are unchanged.
• Security — the confirmation email no longer echoes the submitter’s name or subject. Bots put spam payloads in those fields to relay them through the trusted confirmation email; the default template now omits them (and they’re stripped even from a customized template). Existing installs migrate automatically.

Tested on HESK 3.7.12. New columns are applied automatically on upgrade — just open Admin › API Manager once.

Spam protection & real submitter IPs

• New — email verification (double opt-in). When enabled in Admin › API Manager, a ticket submitted through the API is held and a confirmation email is sent to the submitter; it only becomes a real ticket after they click the link. Modes: Off, All tickets, or Unknown emails only (returning customers skip it). Editable email template, configurable link expiry (default 72h) and success-redirect URL, with per-address rate limiting so it can’t be used to mail-bomb anyone. Kills automated contact-form spam.
• New — real submitter IP passthrough. create_ticket accepts a client_ip field so a caller behind a CDN/Cloudflare can pass the actual end-user IP. It’s stored on the ticket and checked against HESK’s banned-IP list, so bans block the real abuser instead of the calling server.
• The heskapi.com contact form now passes each visitor’s true IP and shows a “check your email” confirmation step when verification is on.

Compatible with HESK 3.7.0+, PHP 8.1+. New tables/columns are applied automatically on upgrade.

Correct ticket timestamps

• Fixed — API-created tickets showed the wrong time (shifted by your desk's timezone offset, e.g. ~4–5 hours). The API module runs on a lightweight bootstrap that skips HESK's common.inc.php — where HESK sets PHP's timezone — so its timestamps were written in UTC while HESK writes local time.
• The API now mirrors HESK's hesk_setTimezone(), anchoring PHP's timezone to your $hesk_settings['timezone'] (with the same UTC fallback) before any write. Every timestamp it records — created, last change, replies, ticket history, and the API log — now matches HESK's own local wall-clock. DST-aware, and correct regardless of your MySQL server's timezone.
• Note: tickets created via the API before updating remain stored in UTC. New tickets are correct immediately; a one-time backfill can realign the older rows (see upgrade notes).
• Also fixed — closing a ticket via the API now sets closedat/closedby like HESK's own close (so "time to close" reporting is accurate), and API-written ticket history now uses your configured timestamp format.

Compatible with HESK 3.7.0+, PHP 8.1+.

Customer email notifications

• Fixed — customers weren't emailed for tickets created via the API. The notifier read the wrong SMTP setting keys (smtp_host/smtp_port/smtp_pass/smtp_ssl) instead of HESK's actual smtp_host_name/smtp_host_port/smtp_password/smtp_enc, so on any SMTP desk the send failed silently and no email went out.
• Notifications now go through HESK's own hesk_notifyCustomer() — your configured email templates, the desk's SMTP transport, and the correct From / Reply-To and ticket tracking links — exactly the path the admin New Ticket page uses when you tick "Send email to customer." Applies to create, reply, and close events.
• Controlled by the existing Admin › API Manager notify toggles (Notify on create / reply / close), which default to on.

Compatible with HESK 3.7.0+, PHP 8.1+. Requires the desk's email (SMTP or PHP mail) to be configured under Settings › Email.

Customer profile linking

• Fixed — blank customer on API-created tickets. Tickets created via the API now link the submitter to a HESK customer record, so the requester's name and email appear in the admin ticket view and the "Create client" dialog. Previously, on HESK 3.7.x's normalized customer model, API-created tickets showed a blank/anonymous customer.
• The submitter is created or reused in hesk_customers and linked via a hesk_ticket_to_customer REQUESTER row, mirroring HESK's own ticket-submission flow.
• Best-effort and backward compatible — installs without the customer tables are unaffected and ticket creation never fails on the link step.

Compatible with HESK 3.7.0+, PHP 8.1+. Tickets created before updating can be backfilled — see the deploy notes.

Initial Release

• 6 REST API endpoints — list_tickets, search_tickets, create_ticket, update_ticket, reply_ticket, close_ticket
• Admin panel — manage API keys, set rate limits, view request logs, toggle API on/off
• Atomic rate limiting — per-key configurable request-per-minute limit with proper 429 responses
• API key authentication — via header or query parameter, rotatable from admin panel
• Attachment support — multipart file uploads on create and reply endpoints
• Native HESK notifications — API actions trigger HESK's built-in email notification system for staff and customers
• IP & email ban enforcement — respects HESK's banned IP ranges and banned email/domain lists
• RSA domain-locked license — asymmetric key validation, no phone-home required
• CSRF-protected admin panel — all admin POST actions protected by CSRF tokens
• XSS-safe output — all user-supplied content sanitized before storage and output
• Sequential ticket IDs — race-safe HESK-format track ID generation
• X-Forwarded-For handling — rightmost IP used to prevent header spoofing

Compatible with HESK 3.7.0, PHP 8.1+, MariaDB 10.4+

Discord Webhook — Initial Release

• Rich Discord embeds for new ticket alerts
• Priority color coding (Critical/High/Medium/Low)
• Category and priority filters
• Watermark-based deduplication (no repeat posts)
• First-run protection (no flood of old tickets)
• Configurable bot name & avatar URL

Slack Webhook — Initial Release

• Slack attachment format with colored priority sidebar
• Priority emoji labels
• Category and priority filters
• Watermark-based deduplication
• First-run protection
• Configurable bot name, icon URL or emoji