Changelog

Correct ticket timestamps

• Fixed — API-created tickets showed the wrong time (shifted by your desk's timezone offset, e.g. ~4–5 hours). The API module runs on a lightweight bootstrap that skips HESK's common.inc.php — where HESK sets PHP's timezone — so its timestamps were written in UTC while HESK writes local time.
• The API now mirrors HESK's hesk_setTimezone(), anchoring PHP's timezone to your $hesk_settings['timezone'] (with the same UTC fallback) before any write. Every timestamp it records — created, last change, replies, ticket history, and the API log — now matches HESK's own local wall-clock. DST-aware, and correct regardless of your MySQL server's timezone.
• Note: tickets created via the API before updating remain stored in UTC. New tickets are correct immediately; a one-time backfill can realign the older rows (see upgrade notes).
• Also fixed — closing a ticket via the API now sets closedat/closedby like HESK's own close (so "time to close" reporting is accurate), and API-written ticket history now uses your configured timestamp format.

Compatible with HESK 3.7.0+, PHP 8.1+.

Customer email notifications

• Fixed — customers weren't emailed for tickets created via the API. The notifier read the wrong SMTP setting keys (smtp_host/smtp_port/smtp_pass/smtp_ssl) instead of HESK's actual smtp_host_name/smtp_host_port/smtp_password/smtp_enc, so on any SMTP desk the send failed silently and no email went out.
• Notifications now go through HESK's own hesk_notifyCustomer() — your configured email templates, the desk's SMTP transport, and the correct From / Reply-To and ticket tracking links — exactly the path the admin New Ticket page uses when you tick "Send email to customer." Applies to create, reply, and close events.
• Controlled by the existing Admin › API Manager notify toggles (Notify on create / reply / close), which default to on.

Compatible with HESK 3.7.0+, PHP 8.1+. Requires the desk's email (SMTP or PHP mail) to be configured under Settings › Email.

Customer profile linking

• Fixed — blank customer on API-created tickets. Tickets created via the API now link the submitter to a HESK customer record, so the requester's name and email appear in the admin ticket view and the "Create client" dialog. Previously, on HESK 3.7.x's normalized customer model, API-created tickets showed a blank/anonymous customer.
• The submitter is created or reused in hesk_customers and linked via a hesk_ticket_to_customer REQUESTER row, mirroring HESK's own ticket-submission flow.
• Best-effort and backward compatible — installs without the customer tables are unaffected and ticket creation never fails on the link step.

Compatible with HESK 3.7.0+, PHP 8.1+. Tickets created before updating can be backfilled — see the deploy notes.

Initial Release

• 6 REST API endpoints — list_tickets, search_tickets, create_ticket, update_ticket, reply_ticket, close_ticket
• Admin panel — manage API keys, set rate limits, view request logs, toggle API on/off
• Atomic rate limiting — per-key configurable request-per-minute limit with proper 429 responses
• API key authentication — via header or query parameter, rotatable from admin panel
• Attachment support — multipart file uploads on create and reply endpoints
• Native HESK notifications — API actions trigger HESK's built-in email notification system for staff and customers
• IP & email ban enforcement — respects HESK's banned IP ranges and banned email/domain lists
• RSA domain-locked license — asymmetric key validation, no phone-home required
• CSRF-protected admin panel — all admin POST actions protected by CSRF tokens
• XSS-safe output — all user-supplied content sanitized before storage and output
• Sequential ticket IDs — race-safe HESK-format track ID generation
• X-Forwarded-For handling — rightmost IP used to prevent header spoofing

Compatible with HESK 3.7.0, PHP 8.1+, MariaDB 10.4+

Discord Webhook — Initial Release

• Rich Discord embeds for new ticket alerts
• Priority color coding (Critical/High/Medium/Low)
• Category and priority filters
• Watermark-based deduplication (no repeat posts)
• First-run protection (no flood of old tickets)
• Configurable bot name & avatar URL

Slack Webhook — Initial Release

• Slack attachment format with colored priority sidebar
• Priority emoji labels
• Category and priority filters
• Watermark-based deduplication
• First-run protection
• Configurable bot name, icon URL or emoji