API & webhooks

Open tickets from your order system. Hear back when they change.

Create, read and update Axonave tickets with an API key. Get a signed webhook when a ticket is created, assigned, close to its SLA or resolved. The API covers tickets, and this page lists exactly what it does.

Start free trialSee pricing
  • Covers
  • Tickets
  • Replies
  • Tags
  • Webhooks

POST /api/ticketsbash

curl -X POST https://<your-api-host>/api/tickets \
  -H "Authorization: Bearer axv_<your key>" \
  -H "Content-Type: application/json" \
  -d '{
    "subject": "Order TH-104377: table top cracked on arrival",
    "priority": "high",
    "category": "delivery_damaged",
    "requesterType": "contact",
    "contactId": "<contact id>",
    "tags": ["order-system"],
    "sourceMetadata": { "externalSystem": "order-system", "externalId": "TH-104377" }
  }'
Example. Create a ticket from your order system. The fields are the API’s own; the host and ids are placeholders.

Integrations today

Your order system knows the sofa arrived broken. Your helpdesk finds out from the customer.

  • “We copy order problems into the helpdesk by hand.”

    Every claim your warehouse logs becomes a ticket only when someone remembers to make one.

  • “We check every five minutes whether a ticket changed.”

    Polling is slow, and it still misses the ticket that changed in between.

  • “Anyone could post to that webhook address.”

    A webhook without a signature is a door with no lock.

API keys

One key per integration, with only the scopes it needs.

Create a key in Settings → API & webhooks. It’s shown once, then stored as a hash. Give it read, write or delete on tickets, an expiry of 30, 90 or 365 days or none, and revoke it the moment you don’t need it.

  1. Scopes: tickets:read, tickets:write, tickets:delete
  2. Expiry, or never; revoked at once
  3. Up to 25 live keys per workspace
Tickets from WhatsApp, live chat, email and the support form, with categories, subcategories, teams and priorities

Teras Home’s tickets: what a key with tickets:read can list, with status, priority, team and source on each.

What it covers

Tickets only, and we list every call.

With a key you can list, read, create and edit tickets, change their status and priority, resolve, close or reopen them, add tags and messages, read the timeline and the survey score, list categories, and delete. Every other part of Axonave refuses a key.

  1. Status, priority, tags and messages
  2. The timeline and the survey score
  3. Assignment, merge and exports stay in the app
The message left after hours became a ticket with its category, source and SLA, linked to the WhatsApp chat

TKT-1201 with its status history and conversation: what GET /api/tickets/<id> and its timeline describe.

Webhooks

Thirteen ticket events, from created to SLA breached.

Pick the events you want: created, updated, assigned, status or priority changed, resolved, closed, reopened, SLA warning, SLA breached, deleted, merged, and a new message. Internal notes are sent only if you ask for them.

  1. Up to 20 webhooks per workspace
  2. A fixed public body, never the stored record
  3. The change that happened, when there is one
API & webhooks: a key with tickets:read and tickets:write, and a webhook on ticket.created and ticket.sla_breached with its deliveries

Settings → API & webhooks in our demo workspace: a webhook to the order desk’s endpoint and its delivery log, six ticket.created deliveries answered with HTTP 200, each with a redeliver button.

Delivery

Eight tries over a day, and a log of every one.

Each delivery waits up to 10 seconds for a 2xx. Without one, Axonave tries again, further apart each time, with the same body and event id. Redeliver anything from the last 30 days. A webhook that fails for three days switches itself off and tells your admins.

  1. HTTPS only; private addresses refused
  2. No redirects followed
  3. A test ping from the settings page

ticket.created · TKT-1282

Fridge door dented on delivery

  1. At once

    A signed POST to your HTTPS address

    X-Axonave-Event, X-Axonave-Delivery and X-Axonave-Signature. Any 2xx within 10 seconds counts as delivered.

  2. No 2xx

    Seven more tries, further apart each time

    Eight tries over about 24 hours, each with the same body and the same event id.

    Waits between tries:1 min5 min30 min2 h5 h8 h8 h

  3. Any time

    Every try is in the delivery log

    Send a test ping, or redeliver any delivery from the last 30 days.

  4. Failing for 3 days

    The webhook switches itself off

    Your admins get a bell. Switch it back on when your endpoint is fixed.

A ticket.created event for TKT-1282 is sent at once as a signed POST to your HTTPS address. Without a 2xx answer within 10 seconds it is tried again after 1 minute, 5 minutes, 30 minutes, 2 hours, 5 hours, 8 hours and 8 hours. Every try is in the delivery log, where you can redeliver. A webhook failing for 3 days switches itself off and your admins are told.
Illustration. One delivery of TKT-1282’s ticket.created and what happens if your endpoint doesn’t answer, from Axonave’s webhook sender.

Signatures

Check the signature, and you know it came from your workspace.

Every delivery is signed with your webhook’s secret: an HMAC-SHA256 of the timestamp and the raw body. When you rotate the secret, deliveries carry both signatures for 24 hours, so you can switch without missing one.

  1. X-Axonave-Signature, -Event and -Delivery headers
  2. A secret shown once, rotate any time
  3. Both signatures for 24 hours after a rotation

verify.jsjs

import crypto from 'node:crypto'

// X-Axonave-Signature: t=<unix>,v1=<hex>[,v1=<hex>]
// (two v1 values for 24 hours after you rotate the secret)
export function isFromAxonave(rawBody, header, secret) {
  const parts = header.split(',')
  const t = parts.find((p) => p.startsWith('t='))?.slice(2)
  if (!t || Math.abs(Date.now() / 1000 - Number(t)) > 300) return false
  const expected = crypto.createHmac('sha256', secret).update(`${t}.${rawBody}`).digest('hex')
  return parts
    .filter((p) => p.startsWith('v1='))
    .map((p) => p.slice(3))
    .some((v1) => v1.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(v1), Buffer.from(expected)))
}
Example. Checking a delivery in Node.js. The five-minute window is your choice; the header format is Axonave’s.

Permissions

A key can only do what the person who made it can do.

A key acts as its maker, within their role. If their role loses a permission, so does the key. If they’re deactivated or signed out everywhere, the key stops. Each key gets 120 requests a minute, and the tickets it creates are marked as coming from the API.

  1. The maker’s role, checked on every call
  2. 120 requests a minute per key
  3. Every change in the audit log
An urgent ticket with its SLA clock, assignment and the conversation with the customer

TKT-1282: status, priority and category a key with tickets:write can change. Assigning it stays in the app.

Connected to everything else in Axonave

The API writes the same tickets your team works on.

A ticket made through the API has an SLA, a team and a place on the customer’s timeline, like any other. The webhook tells your system what your team did next.

One customer recordchats · tickets · deals · AI answers

  • Omnichannel InboxWeb chat and WhatsApp
  • Chatbot & Flow BuilderAnswers saved to the CRM
  • AICited answers, hand-over
  • Knowledge Base & Help CentreWhat the AI answers from
  • HelpdeskTickets with SLAs
  • CRMLeads from every chat

  • Helpdesk

    API tickets get categories, SLAs and automations like the rest.

  • SLA management

    SLA warning and breach events, the moment they happen.

  • Email

    Replies on email tickets go out from your own mailbox.

  • Routing

    Rules assign API tickets by category, priority and source.

See how it connects

One delivery

TKT-1282 opens at 9:39 am. This is what your endpoint receives.

Farah Nadia Ismail reports a dented fridge door on WhatsApp, and Priya Ramasamy opens TKT-1282. Every webhook subscribed to ticket.created gets this request, signed, in the shape Axonave’s webhook code builds.

  • The event id stays the same in every retry and redelivery.
  • The ticket comes with its requester, assignee, team, tags and SLA.
  • Status and priority changes add a change block with the before and after.
  • A new message adds the message, its channel and its attachments.

ticket.createdhttp

POST /hooks/axonave HTTP/1.1
Content-Type: application/json
User-Agent: Axonave-Webhooks/1
X-Axonave-Event: ticket.created
X-Axonave-Delivery: <delivery id>
X-Axonave-Signature: t=1794042120,v1=<hex>

{
  "id": "<event id>",
  "type": "ticket.created",
  "createdAt": "2026-11-07T09:02:00.000Z",
  "tenantId": "<your workspace id>",
  "data": {
    "ticket": {
      "id": "<ticket id>",
      "ticketNumber": "TKT-1282",
      "subject": "Fridge door dented on delivery",
      "status": "open",
      "priority": "urgent",
      "category": "delivery_damaged",
      "source": "whatsapp",
      "requester": {
        "type": "contact",
        "contactId": "<contact id>",
        "name": "Farah Nadia Ismail",
        "email": "farah.ismail@example.my"
      },
      "team": { "id": "<team id>", "name": "Orders & Delivery" },
      "tags": ["fridge"],
      "sla": { "name": "Urgent & high", "status": "on_track" }
    }
  }
}
Example. TKT-1282’s ticket.created delivery, from the real ticket and shortened: ids and the signature are placeholders, and some fields are left out.

What teams build with it

  • Order problems as tickets

    A damaged-delivery claim in your order system opens a ticket with the order number on it.

  • SLA alerts in your own tools

    ticket.sla_warning and ticket.sla_breached go wherever your team already looks.

  • Status back to the order

    When the ticket is resolved, your system marks the order’s claim as done.

Questions about the API and webhooks

What does the API cover?

Tickets: list, read, create, edit, status, resolve, close, reopen, priority, tags, messages, the timeline, the survey score, categories and delete. Other parts of Axonave, such as contacts, leads and chats, don’t accept an API key.

Which events can a webhook receive?

Thirteen ticket events: created, updated, assigned, status changed, priority changed, resolved, closed, reopened, SLA warning, SLA breached, deleted, merged, and a new message. Internal notes are included only if you switch them on.

How do I know a webhook really came from Axonave?

Check the X-Axonave-Signature header: an HMAC-SHA256 of the timestamp and the raw body, made with your webhook’s secret. The secret is shown once when you create the webhook or rotate it.

What happens if our endpoint is down?

Axonave tries again after 1 minute, 5 minutes, 30 minutes, 2 hours, 5 hours, 8 hours and 8 hours. Every try is in the delivery log for 30 days, and you can redeliver any of them. A webhook failing for three days switches off and your admins get a bell.

Is there a rate limit?

120 requests a minute per key, inside your workspace’s overall limit.

Can I connect Shopify, Slack or Zapier?

Not with a ready-made connector. There’s no marketplace. If a tool can call an HTTPS API or receive a webhook, you can connect it to tickets yourself.

Which plan has the API?

Every plan. Basic is $59 a month with 3 seats, and includes the helpdesk the API works with.

Is there a free trial?

Yes. Try Pro free for 14 days, API keys included. No card needed.

Keep exploring

  • Helpdesk

    The tickets the API reads and writes.

  • SLA management

    The policies behind the SLA events.

  • Platform

    Roles, audit logs and how the modules connect.

  • Pricing

    The API in every plan, from $59 a month.

Guides

Tell us what you want to connect.

A 30-minute call about your order system, your tickets and the events you need. No slides.
Start free trialSee pricing

We reply within one business day by email or WhatsApp.

Can we use analytics cookies? Google Analytics and Microsoft Clarity show us which pages help. They load only if you say yes. How we use cookies