Depot inbox

Registers the cross-client inbox.

This page is generated from the Depot route table. Every operation carries the permission it needs and the anchor an agent can link to.

GET /api/v1/inbox/counts

GETticket:readmsp facemspIdempotent

Source: [object Object]

inboxCounts deliberately ignores clientId.

It is the roster the console builds its client filter FROM, so narrowing it to the current selection would leave a picker holding one option and no way back to the others.

Responses

Status	Body	Description
200	application/json, InboxCountsResponse	Success.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold ticket:read.
500	application/problem+json, ProblemDetails	Could not list clients.
503	application/problem+json, ProblemDetails	The cross-client inbox is not available on this server.

200 response body

Field	Type	Description
clientsrequired	array of InboxClientCount
clients[].breachedrequired	integer
clients[].clientNamerequired	string
clients[].clientPublicIdrequired	string
clients[].openrequired	integer
clients[].unreadrequired	integer
totalBreachedrequired	integer
totalOpenrequired	integer
unavailableClientsrequired	array of string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/inbox/counts' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/inbox/counts' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/inbox/counts"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/inbox/counts", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/inbox/counts";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/inbox/counts");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/inbox/tickets

GETticket:readmsp facemspIdempotent

Source: [object Object]

List inbox tickets

Parameters

Name	In	Type	Required	Description
agentId	query	string	No
assigneeId	query	string	No
breached	query	string	No
category	query	string	No
clientId	query	string	No
createdAfter	query	string	No
createdBefore	query	string	No
page	query	integer	No	One-based page number. Defaults to 1.
pageSize	query	integer	No	Rows per page, 1 to 200. Defaults to 50.
priority	query	string, one of critical, high, normal, urgent	No	Comma-separated set. An unrecognised value is refused.
q	query	string	No
queueId	query	string	No
requesterId	query	string	No
sort	query	string	No
status	query	string	No
statusCategory	query	string	No
statusCategoryNot	query	string	No
subcategory	query	string	No
tag	query	string	No

Responses

Status	Body	Description
200	application/json, InboxPageResponse	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold ticket:read.
500	application/problem+json, ProblemDetails	Could not list clients.
503	application/problem+json, ProblemDetails	The cross-client inbox is not available on this server.

200 response body

Field	Type	Description
itemsrequired	array of InboxTicketView
items[].agentId	string
items[].assigneeId	string
items[].assigneeName	string
items[].channelrequired	string
items[].clientNamerequired	string
items[].clientPublicIdrequired	string
items[].createdAtrequired	string (date-time)
items[].hostname	string
items[].lastPublicReplyAt	string (date-time) or null
items[].messageCountrequired	integer
items[].numberrequired	integer	int64.
items[].parentId	string
items[].priorityrequired	string
items[].publicIdrequired	string
items[].queueId	string
items[].queueName	string
items[].referencerequired	string
items[].requesterConfidencerequired	string
items[].requesterEmail	string
items[].requesterId	string
items[].requesterNamerequired	string
items[].siteName	string
items[].slaBreachedrequired	boolean
items[].slaNextEventAt	string (date-time) or null
items[].statusrequired	string
items[].statusCategoryrequired	string
items[].statusNamerequired	string
items[].subcategory	string
items[].subjectrequired	string
items[].tagsrequired	array of string
items[].typerequired	string
items[].unreadrequired	boolean
items[].updatedAtrequired	string (date-time)
pagerequired	integer
pageSizerequired	integer
totalrequired	integer
unavailableClientsrequired	array of string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/inbox/tickets?agentId=<agentId>&assigneeId=<assigneeId>&breached=<breached>&category=<category>&clientId=<clientId>&createdAfter=<createdAfter>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/inbox/tickets?agentId=<agentId>&assigneeId=<assigneeId>&breached=<breached>&category=<category>&clientId=<clientId>&createdAfter=<createdAfter>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/inbox/tickets"
params = {
    "agentId": "<agentId>",
    "assigneeId": "<assigneeId>",
    "breached": "<breached>",
    "category": "<category>",
    "clientId": "<clientId>",
    "createdAfter": "<createdAfter>",
}
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/inbox/tickets?agentId=<agentId>&assigneeId=<assigneeId>&breached=<breached>&category=<category>&clientId=<clientId>&createdAfter=<createdAfter>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/v1/inbox/tickets");
url.searchParams.set("agentId", "<agentId>");
url.searchParams.set("assigneeId", "<assigneeId>");
url.searchParams.set("breached", "<breached>");
url.searchParams.set("category", "<category>");
url.searchParams.set("clientId", "<clientId>");
url.searchParams.set("createdAfter", "<createdAfter>");

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/inbox/tickets?agentId=<agentId>&assigneeId=<assigneeId>&breached=<breached>&category=<category>&clientId=<clientId>&createdAfter=<createdAfter>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());