API keys and the developer API

Overview

Every dashboard action in Inquiru is backed by the same REST API you can call directly. An API key lets a script, CI pipeline, or third-party tool authenticate as a real user of your account without a human logging in — useful for bulk operations, scheduled jobs, or integrating Inquiru into your own internal tools.

Creating a key

Go to Developers in the sidebar (Owner and Admin roles only) and click New Key. Give it a descriptive name — e.g. CI pipeline or Zapier integration — and an optional expiry date.

The raw key is shown exactly once, immediately after creation. Copy it somewhere safe: Inquiru stores only a hash of the key, not the key itself, so it can never be shown again. If you lose it, revoke it and create a new one.

Permissions

A key inherits the role of whoever creates it at the moment of creation — an Owner-created key has Owner-level access, an Admin-created key has Admin-level access. There is no separate scopes or permissions system: a key can do anything its creator's role can do in the dashboard, including billing and account-level actions for Owner-minted keys. Choose who creates each key accordingly.

A key's role is snapshotted at creation and does not change if the creating user's own role changes later. To narrow or widen what a key can do, revoke it and create a new one under the role you want.

Using a key

Send the key as a bearer token on every request, exactly like a session token:

Authorization: Bearer inq_<your key>

From the Developers page you can copy three working examples against your own account:

List open tickets
Reply to a ticket
Resolve a ticket

Every request made with a key is attributed to the human who created it — replies, status changes, and audit log entries all show that person's name, the same as if they'd taken the action in the dashboard themselves.

Rate limits

API keys have their own rate-limit bucket, separate from the creating user's own dashboard session — a script running under a key will not consume that person's normal browsing quota, and vice versa.

Revoking a key

On the Developers page, click the status pill next to a key to temporarily disable it without losing its configuration, or the trash icon to permanently revoke it. A disabled or revoked key is rejected immediately on its next request.

Full API reference

The Developers page links to the complete interactive API reference, covering request and response shapes for tickets, conversations, the knowledge base, agents, canned replies, and outbound webhooks.

A few other Inquiru features use their own narrower, purpose-built credentials rather than a general API key — each documented separately:

The Events API pushes customer behaviour signals into Inquiru using a single per-tenant ingest key, not a general API key.
Outbound webhooks deliver ticket events out of Inquiru to your own systems, the reverse direction of an API key.
Custom API Skills let your AI agent call external REST APIs on your behalf — a different concern from a human or script calling into Inquiru.