HelpDesk.com
BUSINESS · CRM & SUPPORT
Tickets, agents, canned responses, macros, mailboxes, and rules in the account they connected.
Connecting HelpDesk.com in practice
HelpDesk.com shares its authorization system with LiveChat, so tokens are minted in the LiveChat Developers Console, and its read model surprises people: any authenticated user on a licence can read that licence’s settings and admin-managed resources through the API — rules and shared macros included — even when the matching page is hidden from their role in the app. Only the Administrator role can modify them.
Scopes that draw scrutiny
accounts--my:roThe scope HelpDesk tells you to generate a Personal Access Token with. The account id then becomes the Basic-auth username and the token the password.Administrator (owner) roleHelpDesk defines modification rights by role rather than by scope: only owner can change licence settings and admin-managed resources, while normal and viewer see the same resources read-only.resource--access:level scope namingScopes on this platform combine a resource with an access breadth — my, access or all — and a level of ro, rw or rc, so the same resource name can mean a personal grant or an organization-wide one.
Worth knowing
- Non-administrator roles can read admin-managed configuration through the API even when the matching page is hidden from them in the app, and the docs call this intentional — so "they cannot see it in the UI" is not an access control.
- Tickets live in four silos — tickets, archive, spam and trash — and listing anything outside tickets requires naming the silo, so a search that omits it silently misses archived conversations.
- spam is purged 60 days after a ticket last changed and trash after 30 days, so a soft delete is a countdown rather than a state an agent can rely on.
- Relative date filters use case to change meaning: lowercase units are relative to now and uppercase to the start of the truncated period, so -0M is the start of this month while -10n is ten minutes ago.
Checked against HelpDesk.com API (2026-09-29), Scopes and permissions (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put HelpDesk.com behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.