Product · Free download

HESK API

A REST API and staff token portal that sits beside your existing HESK 3.7 help desk. Automations talk to the API. Staff keep using HESK. The help-desk PHP is not patched.

Download v1.8.0 Install Upgrade Features

SHA-256 3b34f0b33e04f3925bd8bfb430de5f8d4f78a96a5a58f1448b895439c73f6559 · checksum file

Tickets, replies, files

List, create, update, and close tickets by id or tracking id. Staff replies, time worked, internal notes (with files), related-ticket links, and attachments.

Tokens are staff accounts

Sign in at the API host with a HESK staff username and password. Each token inherits that user’s categories, privileges, and admin flag.

Your branding, your host

Local config overlays paths, CORS, rate limits, token prefix, and the vendor name shown in the portal and live OpenAPI spec.

Quick start

unzip hesk-api-1.8.0.zip
cd hesk-api-1.8.0
php bin/install.php \
  --hesk-path=/var/www/hesk \
  --api-url=https://api.help.example.com \
  --create-token --user=admin --name=Bootstrap

Point a TLS vhost at public/. Then GET /health should return status: ok and version: 1.8.0.

What you get

OpenAPI 3.0 for tickets, replies (including time worked and readable formatting), notes (including note attachments), links, attachments, customers, categories, users, knowledgebase, and canned replies
Reply and note bodies stay readable in the HESK staff UI: optional format (auto, plain, html, markdown). Markdown includes GitHub-style pipe tables. Log timestamps such as <2026-08-19T21:58:12.969Z> are not treated as HTML tags
Optional updater: check the TDC channel for a newer zip, open a HESK ticket when one is available, or auto-install (opt-in, SHA-256 gated). Mode, ticket owner + category, and allow_auto_install can be set from the portal Updates page. Upgrade instructions
Staff portal: /login, /tokens, /updates, Swagger UI at /docs. Header, footer, and the token dashboard show this install’s version versus the latest TDC package, with a link to upgrade instructions when behind
Live /openapi.json rewritten for this install’s public URL
Optional customer/staff email via HESK’s own templates (notify: true|false)
Two extra tables only: {prefix}api_tokens and {prefix}api_audit_log

It is not a replacement help-desk UI. Customer portal users cannot mint API tokens.

Requirements

HESK 3.7.x (developed against 3.7.11)
PHP 8.1+ with pdo_mysql, json, mbstring, openssl
PHP curl and zip extensions if you enable the optional updater
The same MySQL database HESK already uses
A hostname and TLS certificate for the API (a second vhost is the usual layout)

Full install and customization → · Upgrade an existing install →