Skip to content

Public API

Authentication

Pro owners and admins create scoped keys in Settings → API & webhooks. The full key is shown once and stored as a SHA-256 hash.

Open API settings

The example requires tickets:read. Replace the placeholder with your key on your server.

curl https://evnao.com/api/v1/tickets \
  -H "Authorization: Bearer evnao_live_YOUR_KEY"

Scoped and revocable

Grant only the ticket, knowledge, analytics, or webhook scopes you need. Choose expiry after 30, 90, or 365 days, or no expiry. Revoke each key independently without changing a user password.

Workspace and plan checks

A key belongs to one workspace. Expired or revoked keys, suspended or unonboarded workspaces, and access without an active Pro plan are rejected. The key must include the scope required by the endpoint.

Limits and writes

Each key is limited to 600 requests per minute. Writes require an Idempotency-Key header. Reuse it when retrying the same operation: a replay returns the stored completed response, while a conflicting body is rejected.

Replace or revoke a key

Create a new key with the required scopes and save it in your server’s secret store; you cannot reveal the full key later.
Update your application to use the new key and verify an authorized read request before revoking the old one.
Revoke the old key in API settings. If a key is exposed, revoke it immediately, then update the systems that used it.