API overview

ServiceOps exposes a REST API under /api of your desk’s own address. Two families exist:

• The application API — everything the ServiceOps interface itself uses, authenticated by user session. It powers the product; it is not a stability-guaranteed public contract.
• The platform API (/api/v1/…) — key-authenticated endpoints for your integrations, starting with the Assist API. This is the surface documented here, and the one that grows.

Honesty first

The scopes on an API key already cover tickets and knowledge; the key-authenticated endpoint families exposed today are Assist and the widget’s public endpoints. New /api/v1 families will appear here as they ship — this page will not promise routes that do not exist yet.

Authentication

Pass your organization’s API key as a bearer token:

curl https://YOUR_SERVICEOPS_DOMAIN/api/v1/assist \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"message": "How do I reset my VPN access?"}'

The key alone identifies your organization — every response is scoped to it, and a key can never read another organization’s data whatever parameters are sent.

The error contract

Every error, on every endpoint, has the same JSON shape:

{
  "success": false,
  "error": {
    "code": "ERROR_CODE",
    "message": "A human-readable explanation",
    "details": []
  }
}

HTTP status	Typical codes
400	Validation failed — details lists each field’s problem
401	Missing or invalid API key
403	The key lacks the scope the route requires
404	The object does not exist for your organization
429	Rate limit reached — retry later
5xx	Something on our side; safe to retry idempotent calls

Rate limits

Requests are rate-limited per organization. On 429, back off and retry; steady bulk work should pace itself rather than burst.