SupportBee
BUSINESS · CRM & SUPPORT
Tickets, replies, labels, and teams on the desk that person belongs to.
Connecting SupportBee in practice
SupportBee’s Create Ticket endpoint is the only one that works without authentication, and unauthenticated it is capped at 5 requests per hour per IP address to keep spammers out. Authenticated, the same endpoint allows 8 tickets per minute, which is the tightest documented ceiling in the API.
Scopes that draw scrutiny
Authorization: Bearer your_api_tokenOne account-wide token with no scopes. The documentation also shows it as an `auth_token=` query parameter for attachment uploads, which puts the credential into URLs and therefore into logs.
Rate limits
- Create Ticket without authentication: 5 API requests per hour per IP address.
- Create Ticket with authentication: 8 tickets per minute.
- Over either limit the endpoint responds with 429.
- List Tickets pagination: `per_page` defaults to 15 and "must be less than 100".
Worth knowing
- The Accept header must be set to application/json, so a client relying on content negotiation defaults can get the wrong representation.
- All date and time parameters must be supplied in UTC — there is no timezone parameter to lean on.
- Tickets come back sorted by last activity unless you pass `sort_by`, so a pagination pass over a busy inbox can see the same ticket twice as it moves.
- The unauthenticated Create Ticket path is genuinely open, so anything that embeds it client-side is publishing a ticket-creation endpoint.
Checked against SupportBee API reference (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put SupportBee behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.