One of our customer want to request our Freshdesk and make some process on its tickets. It is not a Freshdesk agent.
We know an API feature exists for the Freshdesk agent, accessible through a main key located under user profile. But we did not found any similar keys for a contact or an enterprise.
We cannot provide the main key the customer because:
They will not be able to see or modify other customer tickets.
The API should be limited to the actions they can realize through the user interface (front end).
Any privilege’s elevation of the concerned customer is excluded.
How provide a restricted external access to Freshdesk ?
API keys are tied to agents.
So every agent has their own API key and that’s the only API keys that exist in Freshdesk.
If you limit the access that the agent has, by creating a specific role and assign that role to the agent, the API key from that agent will only have access to those specific parts of Freshdesk.
As explain, we do not want promote the customer to an agent.
Roles for agent are very limited, and not allow as many restricts as contact.
Our need is to get lists of tickets of an enterprise (ie a set of contact) , and eventually modify some field as they use as contact.
Nothing more, no extra feature or freshdesk administration.
Basically, I can decompose freshdesk in three level
Level 0: Administrator, full access to freshdesk and configuration
Level 1: Agents/Collaborators, Able to administrate tickets, respond to Contact and bring solution to the customer
Level 2: Contacts / Customers, Peoples asking for help and solution.
Our customer is located in “Level 2” on this hierarchy model. It use Freshdesk through the developer portal, using a web browser. They want interface their information system with the portal. So their need a non interactive interface, like REST Apis coding in xml/json to do the same thing as their do with their web browser, staying in “level 2”.
As Flow mentioned above, I do not think this is possible today. API keys to the Freshdesk REST API have the same level of access as the account to which the API key belongs.