johnnyq ecbb974fff API stage 3, calendar events, trips, accounts and money, contracts, and files and folders: calendars can be read, and calendar events read with their attendees, created once or repeating for a client or nobody, changed, sent as invitations, skipped for a day of a series and deleted, following calendarEventCan(); trips can be read, logged, changed and deleted through tripSave() and tripDelete(), anyone their own and someone else's with Financial; accounts can be read with their balances, added, changed, archived, unarchived and deleted while nothing is on them, other income and transfers read, recorded, changed and deleted, and recurring expenses read, set up, changed, paused and resumed, recorded now, moved on past missed runs and deleted, keeping reconciled lines as they were; contracts can be read with their prepaid hours and signing state, added, changed, made active, renewed, cancelled and deleted, sent for signature or the link sent again, the request withdrawn, prepaid hours added with a draft invoice or deleted, tickets' time drawn or put back, and the billing recurring invoice made, linked or unlinked; a client's files can be read, uploaded as base64, downloaded, renamed, moved, archived, unarchived and deleted once archived, and folders read, made, renamed, moved and deleted with their contents moved up; new api/v1/form_input.php builds a save function's input from the API's field names; the upload allow-list moves from agent/post/file.php into fileUploadExtensions() so Upload Files and the API check the same list; enforce_api_rbac.php maps the new resources, lets events, calendars and trips check their own rules, puts the new state changes at Modify and treats files/download as a read; 26.11.9 changelog entries

2026-11-13 23:51:10 -05:00

..

accounts

API stage 3, calendar events, trips, accounts and money, contracts, and files and folders: calendars can be read, and calendar events read with their attendees, created once or repeating for a client or nobody, changed, sent as invitations, skipped for a day of a series and deleted, following calendarEventCan(); trips can be read, logged, changed and deleted through tripSave() and tripDelete(), anyone their own and someone else's with Financial; accounts can be read with their balances, added, changed, archived, unarchived and deleted while nothing is on them, other income and transfers read, recorded, changed and deleted, and recurring expenses read, set up, changed, paused and resumed, recorded now, moved on past missed runs and deleted, keeping reconciled lines as they were; contracts can be read with their prepaid hours and signing state, added, changed, made active, renewed, cancelled and deleted, sent for signature or the link sent again, the request withdrawn, prepaid hours added with a draft invoice or deleted, tickets' time drawn or put back, and the billing recurring invoice made, linked or unlinked; a client's files can be read, uploaded as base64, downloaded, renamed, moved, archived, unarchived and deleted once archived, and folders read, made, renamed, moved and deleted with their contents moved up; new api/v1/form_input.php builds a save function's input from the API's field names; the upload allow-list moves from agent/post/file.php into fileUploadExtensions() so Upload Files and the API check the same list; enforce_api_rbac.php maps the new resources, lets events, calendars and trips check their own rules, puts the new state changes at Modify and treats files/download as a read; 26.11.9 changelog entries

2026-11-13 23:51:10 -05:00

asset_interfaces

API stage 3a, network IPs, asset interfaces, license seats and keys, notes and racks: a network's documented IP addresses can be read, added one at a time or as a run of up to 256, changed and deleted with the address plan's checks; an asset's interfaces can be read with what each is plugged into, added, changed, made primary, plugged in or unplugged and deleted with the interface window's checks; a license's seats can be set, it can be renewed by a term or to a date, and its keys read, added, handed to the client's devices and users and deleted; asset and contact notes can be read, added with one of your note types, archived, unarchived and deleted once archived, through one shared body in notes_body.php; racks can be read with what is mounted in them, made, changed, archived, unarchived and deleted once archived, and items mounted, moved and taken out with the rack page's checks; new categoryPickedName() checks a posted name for a category kind held by name; enforce_api_rbac.php maps network_ips, asset_interfaces, software_keys, asset_notes, racks and rack_units to Support and contact_notes to Clients, with seats and renew at Modify; software/read.php looked up software_key from the wrong parameter and now finds a license by its own key or any of its keys; 26.11.9 changelog entries

2026-11-13 23:27:51 -05:00

asset_notes

API stage 3a, network IPs, asset interfaces, license seats and keys, notes and racks: a network's documented IP addresses can be read, added one at a time or as a run of up to 256, changed and deleted with the address plan's checks; an asset's interfaces can be read with what each is plugged into, added, changed, made primary, plugged in or unplugged and deleted with the interface window's checks; a license's seats can be set, it can be renewed by a term or to a date, and its keys read, added, handed to the client's devices and users and deleted; asset and contact notes can be read, added with one of your note types, archived, unarchived and deleted once archived, through one shared body in notes_body.php; racks can be read with what is mounted in them, made, changed, archived, unarchived and deleted once archived, and items mounted, moved and taken out with the rack page's checks; new categoryPickedName() checks a posted name for a category kind held by name; enforce_api_rbac.php maps network_ips, asset_interfaces, software_keys, asset_notes, racks and rack_units to Support and contact_notes to Clients, with seats and renew at Modify; software/read.php looked up software_key from the wrong parameter and now finds a license by its own key or any of its keys; 26.11.9 changelog entries

2026-11-13 23:27:51 -05:00

assets

API stage 1, the missing operations on the existing resources: invoices can be created with their lines, updated, sent or reminded, marked sent, cancelled and deleted, and invoice lines updated and deleted; quotes created with their lines, updated, sent, marked sent, accepted, declined, invoiced as Invoice does on the quote page and deleted, with new quote_items read, create, update and delete; recurring invoices updated, paused or resumed and deleted, with new recurring_invoice_items read, create, update and delete including lines that count users or devices; expenses created, refunded, updated and deleted; services created, updated, archived, unarchived and deleted; licenses created, updated and deleted; certificates updated, archived, unarchived and deleted; products created, archived, unarchived and deleted; tickets reopened and deleted, ticket replies edited and archived, assets archived and unarchived, documents, domains, networks, vendors and tags deleted, and client portal invites listed and cancelled; each endpoint calls the same functions as its page handler, the line endpoints share billing_lines.php and the new billingLineFromApi() which recurring_invoices/create now uses too, enforce_api_rbac.php maps quote_items and recurring_invoice_items to the Sales module and puts the state changes at Modify, and every delete needs Full; 26.11.9 changelog entries

2026-11-13 22:51:49 -05:00

calendars

API stage 3, calendar events, trips, accounts and money, contracts, and files and folders: calendars can be read, and calendar events read with their attendees, created once or repeating for a client or nobody, changed, sent as invitations, skipped for a day of a series and deleted, following calendarEventCan(); trips can be read, logged, changed and deleted through tripSave() and tripDelete(), anyone their own and someone else's with Financial; accounts can be read with their balances, added, changed, archived, unarchived and deleted while nothing is on them, other income and transfers read, recorded, changed and deleted, and recurring expenses read, set up, changed, paused and resumed, recorded now, moved on past missed runs and deleted, keeping reconciled lines as they were; contracts can be read with their prepaid hours and signing state, added, changed, made active, renewed, cancelled and deleted, sent for signature or the link sent again, the request withdrawn, prepaid hours added with a draft invoice or deleted, tickets' time drawn or put back, and the billing recurring invoice made, linked or unlinked; a client's files can be read, uploaded as base64, downloaded, renamed, moved, archived, unarchived and deleted once archived, and folders read, made, renamed, moved and deleted with their contents moved up; new api/v1/form_input.php builds a save function's input from the API's field names; the upload allow-list moves from agent/post/file.php into fileUploadExtensions() so Upload Files and the API check the same list; enforce_api_rbac.php maps the new resources, lets events, calendars and trips check their own rules, puts the new state changes at Modify and treats files/download as a read; 26.11.9 changelog entries

2026-11-13 23:51:10 -05:00

categories

Canned responses stage 1: Admin > Canned Responses on the standard list showing what each says, the ticket categories it is offered on, how often it has gone into a reply and when it last did, searched, filtered by where it is offered (a category or every ticket), sorted by name, use or last use, paged, with Active and Archived tabs; a response can be offered on several ticket categories or on every ticket (migration 3.2.2 moves canned_response_category_id into canned_response_categories, one whose category had been deleted staying on every ticket, and adds canned_response_uses); one shared add and edit window with the placeholders under the editor to click in where the cursor is; Copy, Archive and Restore alongside Delete; [Contact], [First Name], [Client], [Ticket], [Subject], [Ticket Link], [Asset], [Site], [Project], [Agent] (the agent replying), [Date], [Month], [Quarter] and [Year] filled in from the ticket as a response goes into a reply after the client access check, anything else in brackets left for the agent to fill in; the picker lists the ticket's own category first then every ticket's, and each reply records which responses went into it; Admin > Categories counts the canned responses on a ticket category, links to them and moves them on merge through link-table support in categoryKinds(); new functions/canned_response.php and js/canned_response_form.js; changelog updated

2026-10-18 11:53:51 -04:00

certificates

API stage 1, the missing operations on the existing resources: invoices can be created with their lines, updated, sent or reminded, marked sent, cancelled and deleted, and invoice lines updated and deleted; quotes created with their lines, updated, sent, marked sent, accepted, declined, invoiced as Invoice does on the quote page and deleted, with new quote_items read, create, update and delete; recurring invoices updated, paused or resumed and deleted, with new recurring_invoice_items read, create, update and delete including lines that count users or devices; expenses created, refunded, updated and deleted; services created, updated, archived, unarchived and deleted; licenses created, updated and deleted; certificates updated, archived, unarchived and deleted; products created, archived, unarchived and deleted; tickets reopened and deleted, ticket replies edited and archived, assets archived and unarchived, documents, domains, networks, vendors and tags deleted, and client portal invites listed and cancelled; each endpoint calls the same functions as its page handler, the line endpoints share billing_lines.php and the new billingLineFromApi() which recurring_invoices/create now uses too, enforce_api_rbac.php maps quote_items and recurring_invoice_items to the Sales module and puts the state changes at Modify, and every delete needs Full; 26.11.9 changelog entries

2026-11-13 22:51:49 -05:00

clients

Make the audit log, notification and history writers safe whatever text they are given, and fix the API client delete that relied on them: logAudit, appNotify, logTicketHistory and logHistory now pass their text through the new logSqlText, which reads it as MySQL reads a quoted string, cuts it to the column by character and escapes it once, so text a caller escaped is stored exactly as before and text passed as read from a row can no longer end the quote; api/v1/clients/delete.php escapes the client name as archive.php does, where a name written for the purpose ran a query when the client was deleted and a name with an apostrophe ended in an error after the delete with nothing logged; logAudit also cuts the session IP and User-Agent to their columns, since a User-Agent over 250 characters failed the insert under strict mode, leaving the action unlogged and failed sign-ins and wrong two-step codes uncounted by the lockout and the code limit, and the User-Agent is cut to 250 where it is written to logs directly or compared with it in login.php, client/login_reset.php, api/v1/validate_api_key.php, guest/includes/inc_all_guest.php and portalSignupRequest; add_invoice_copy, add_invoice_recurring and add_recurring_invoice escape the invoice and recurring invoice prefixes before their inserts, which failed with an apostrophe in the prefix; add the changelog entries

2026-11-11 11:57:09 -05:00

contact_notes

API stage 3a, network IPs, asset interfaces, license seats and keys, notes and racks: a network's documented IP addresses can be read, added one at a time or as a run of up to 256, changed and deleted with the address plan's checks; an asset's interfaces can be read with what each is plugged into, added, changed, made primary, plugged in or unplugged and deleted with the interface window's checks; a license's seats can be set, it can be renewed by a term or to a date, and its keys read, added, handed to the client's devices and users and deleted; asset and contact notes can be read, added with one of your note types, archived, unarchived and deleted once archived, through one shared body in notes_body.php; racks can be read with what is mounted in them, made, changed, archived, unarchived and deleted once archived, and items mounted, moved and taken out with the rack page's checks; new categoryPickedName() checks a posted name for a category kind held by name; enforce_api_rbac.php maps network_ips, asset_interfaces, software_keys, asset_notes, racks and rack_units to Support and contact_notes to Clients, with seats and renew at Modify; software/read.php looked up software_key from the wrong parameter and now finds a license by its own key or any of its keys; 26.11.9 changelog entries

2026-11-13 23:27:51 -05:00

contacts

Let the API raise a ticket from a ticket template - tickets/create takes ticket_template_id, giving the ticket the template's subject and details when none are sent, its category, priority, billing and agent unless sent, and its tags, due time and tasks (the ones the answers call for), with the template's fill-ins answered from ticket_fill_ins and its placeholders filled in, and a missing or archived template, fill-ins that aren't an object, a required fill-in left out or a choice not on a list refused with 400 and the reason; ticket_notify sends the contact and watchers the Ticket Created email when Email clients about their tickets is on, tells the new-ticket address and notifies the assigned agent in the app and by email; the answer now includes ticket_reference, ticket_url (the contact's link to the ticket) and, from a template, ticket_tasks; canned responses now fill in a ticket's template fill-in answers such as [Hostname] alongside [Contact] and [Ticket], never over a built-in placeholder of the same name, and the canned response form says so; contacts/create and locations/create no longer write a PHP warning for each field left out; the new-ticket agent email reads raised through the API; changelog updated

2026-11-05 17:39:22 -05:00

contract_hours

API stage 3, calendar events, trips, accounts and money, contracts, and files and folders: calendars can be read, and calendar events read with their attendees, created once or repeating for a client or nobody, changed, sent as invitations, skipped for a day of a series and deleted, following calendarEventCan(); trips can be read, logged, changed and deleted through tripSave() and tripDelete(), anyone their own and someone else's with Financial; accounts can be read with their balances, added, changed, archived, unarchived and deleted while nothing is on them, other income and transfers read, recorded, changed and deleted, and recurring expenses read, set up, changed, paused and resumed, recorded now, moved on past missed runs and deleted, keeping reconciled lines as they were; contracts can be read with their prepaid hours and signing state, added, changed, made active, renewed, cancelled and deleted, sent for signature or the link sent again, the request withdrawn, prepaid hours added with a draft invoice or deleted, tickets' time drawn or put back, and the billing recurring invoice made, linked or unlinked; a client's files can be read, uploaded as base64, downloaded, renamed, moved, archived, unarchived and deleted once archived, and folders read, made, renamed, moved and deleted with their contents moved up; new api/v1/form_input.php builds a save function's input from the API's field names; the upload allow-list moves from agent/post/file.php into fileUploadExtensions() so Upload Files and the API check the same list; enforce_api_rbac.php maps the new resources, lets events, calendars and trips check their own rules, puts the new state changes at Modify and treats files/download as a read; 26.11.9 changelog entries

2026-11-13 23:51:10 -05:00

contracts

API stage 3, calendar events, trips, accounts and money, contracts, and files and folders: calendars can be read, and calendar events read with their attendees, created once or repeating for a client or nobody, changed, sent as invitations, skipped for a day of a series and deleted, following calendarEventCan(); trips can be read, logged, changed and deleted through tripSave() and tripDelete(), anyone their own and someone else's with Financial; accounts can be read with their balances, added, changed, archived, unarchived and deleted while nothing is on them, other income and transfers read, recorded, changed and deleted, and recurring expenses read, set up, changed, paused and resumed, recorded now, moved on past missed runs and deleted, keeping reconciled lines as they were; contracts can be read with their prepaid hours and signing state, added, changed, made active, renewed, cancelled and deleted, sent for signature or the link sent again, the request withdrawn, prepaid hours added with a draft invoice or deleted, tickets' time drawn or put back, and the billing recurring invoice made, linked or unlinked; a client's files can be read, uploaded as base64, downloaded, renamed, moved, archived, unarchived and deleted once archived, and folders read, made, renamed, moved and deleted with their contents moved up; new api/v1/form_input.php builds a save function's input from the API's field names; the upload allow-list moves from agent/post/file.php into fileUploadExtensions() so Upload Files and the API check the same list; enforce_api_rbac.php maps the new resources, lets events, calendars and trips check their own rules, puts the new state changes at Modify and treats files/download as a read; 26.11.9 changelog entries

2026-11-13 23:51:10 -05:00

credentials

Security sweep of the 26.11 work: API contact lookup by phone or mobile kept to the key's clients; API credentials refuse a wrong decrypt password instead of saving unreadable usernames and passwords, link credential_vendor_id and credential_software_id, and drop another client's contact or asset; Products Receive window lists expenses only with Financial access and only for clients the agent can open; account ledger, reconcile page and ledger export show lines for clients the agent can't open as Another client with only date, kind and amount, with search and the client filter kept to reachable clients; Tax Collected folds unreachable exempt clients into one line; client-limited agents no longer see other clients' names in the export window client filters, Transfer to Client, company vendor expense lists, My Activity or the New Client duplicate check; Stripe switched off stops guest pay links and saving cards, and the Stripe return never books a payment twice; Admin > Cron job window is admins only; records per page needs the CSRF token and takes only the listed sizes; uploads/canned_responses closed to direct access; Admin > Debug no longer stops at the footer; report export audit log no longer double-escapes names; bulk interface network refuses a deleted network; API assets/update keeps the primary interface IP, MAC and network, tickets/resolve reports success, software/read by name works, clients/create takes the company currency, certificates/create returns its error, clients/archive logs as Client, and the 405 response no longer echoes the method; changelog database step count corrected to sixty

2026-10-23 12:09:07 -04:00

custom

Copy crons from /scripts to /cron, added custom directories for api/v1/, /setup, /cron and /scripts

2025-10-07 13:55:54 -04:00

documents

API stage 1, the missing operations on the existing resources: invoices can be created with their lines, updated, sent or reminded, marked sent, cancelled and deleted, and invoice lines updated and deleted; quotes created with their lines, updated, sent, marked sent, accepted, declined, invoiced as Invoice does on the quote page and deleted, with new quote_items read, create, update and delete; recurring invoices updated, paused or resumed and deleted, with new recurring_invoice_items read, create, update and delete including lines that count users or devices; expenses created, refunded, updated and deleted; services created, updated, archived, unarchived and deleted; licenses created, updated and deleted; certificates updated, archived, unarchived and deleted; products created, archived, unarchived and deleted; tickets reopened and deleted, ticket replies edited and archived, assets archived and unarchived, documents, domains, networks, vendors and tags deleted, and client portal invites listed and cancelled; each endpoint calls the same functions as its page handler, the line endpoints share billing_lines.php and the new billingLineFromApi() which recurring_invoices/create now uses too, enforce_api_rbac.php maps quote_items and recurring_invoice_items to the Sales module and puts the state changes at Modify, and every delete needs Full; 26.11.9 changelog entries

2026-11-13 22:51:49 -05:00

domains

API stage 1, the missing operations on the existing resources: invoices can be created with their lines, updated, sent or reminded, marked sent, cancelled and deleted, and invoice lines updated and deleted; quotes created with their lines, updated, sent, marked sent, accepted, declined, invoiced as Invoice does on the quote page and deleted, with new quote_items read, create, update and delete; recurring invoices updated, paused or resumed and deleted, with new recurring_invoice_items read, create, update and delete including lines that count users or devices; expenses created, refunded, updated and deleted; services created, updated, archived, unarchived and deleted; licenses created, updated and deleted; certificates updated, archived, unarchived and deleted; products created, archived, unarchived and deleted; tickets reopened and deleted, ticket replies edited and archived, assets archived and unarchived, documents, domains, networks, vendors and tags deleted, and client portal invites listed and cancelled; each endpoint calls the same functions as its page handler, the line endpoints share billing_lines.php and the new billingLineFromApi() which recurring_invoices/create now uses too, enforce_api_rbac.php maps quote_items and recurring_invoice_items to the Sales module and puts the state changes at Modify, and every delete needs Full; 26.11.9 changelog entries

2026-11-13 22:51:49 -05:00

events

API stage 3, calendar events, trips, accounts and money, contracts, and files and folders: calendars can be read, and calendar events read with their attendees, created once or repeating for a client or nobody, changed, sent as invitations, skipped for a day of a series and deleted, following calendarEventCan(); trips can be read, logged, changed and deleted through tripSave() and tripDelete(), anyone their own and someone else's with Financial; accounts can be read with their balances, added, changed, archived, unarchived and deleted while nothing is on them, other income and transfers read, recorded, changed and deleted, and recurring expenses read, set up, changed, paused and resumed, recorded now, moved on past missed runs and deleted, keeping reconciled lines as they were; contracts can be read with their prepaid hours and signing state, added, changed, made active, renewed, cancelled and deleted, sent for signature or the link sent again, the request withdrawn, prepaid hours added with a draft invoice or deleted, tickets' time drawn or put back, and the billing recurring invoice made, linked or unlinked; a client's files can be read, uploaded as base64, downloaded, renamed, moved, archived, unarchived and deleted once archived, and folders read, made, renamed, moved and deleted with their contents moved up; new api/v1/form_input.php builds a save function's input from the API's field names; the upload allow-list moves from agent/post/file.php into fileUploadExtensions() so Upload Files and the API check the same list; enforce_api_rbac.php maps the new resources, lets events, calendars and trips check their own rules, puts the new state changes at Modify and treats files/download as a read; 26.11.9 changelog entries

2026-11-13 23:51:10 -05:00

expenses

API stage 1, the missing operations on the existing resources: invoices can be created with their lines, updated, sent or reminded, marked sent, cancelled and deleted, and invoice lines updated and deleted; quotes created with their lines, updated, sent, marked sent, accepted, declined, invoiced as Invoice does on the quote page and deleted, with new quote_items read, create, update and delete; recurring invoices updated, paused or resumed and deleted, with new recurring_invoice_items read, create, update and delete including lines that count users or devices; expenses created, refunded, updated and deleted; services created, updated, archived, unarchived and deleted; licenses created, updated and deleted; certificates updated, archived, unarchived and deleted; products created, archived, unarchived and deleted; tickets reopened and deleted, ticket replies edited and archived, assets archived and unarchived, documents, domains, networks, vendors and tags deleted, and client portal invites listed and cancelled; each endpoint calls the same functions as its page handler, the line endpoints share billing_lines.php and the new billingLineFromApi() which recurring_invoices/create now uses too, enforce_api_rbac.php maps quote_items and recurring_invoice_items to the Sales module and puts the state changes at Modify, and every delete needs Full; 26.11.9 changelog entries

2026-11-13 22:51:49 -05:00

files

API stage 3, calendar events, trips, accounts and money, contracts, and files and folders: calendars can be read, and calendar events read with their attendees, created once or repeating for a client or nobody, changed, sent as invitations, skipped for a day of a series and deleted, following calendarEventCan(); trips can be read, logged, changed and deleted through tripSave() and tripDelete(), anyone their own and someone else's with Financial; accounts can be read with their balances, added, changed, archived, unarchived and deleted while nothing is on them, other income and transfers read, recorded, changed and deleted, and recurring expenses read, set up, changed, paused and resumed, recorded now, moved on past missed runs and deleted, keeping reconciled lines as they were; contracts can be read with their prepaid hours and signing state, added, changed, made active, renewed, cancelled and deleted, sent for signature or the link sent again, the request withdrawn, prepaid hours added with a draft invoice or deleted, tickets' time drawn or put back, and the billing recurring invoice made, linked or unlinked; a client's files can be read, uploaded as base64, downloaded, renamed, moved, archived, unarchived and deleted once archived, and folders read, made, renamed, moved and deleted with their contents moved up; new api/v1/form_input.php builds a save function's input from the API's field names; the upload allow-list moves from agent/post/file.php into fileUploadExtensions() so Upload Files and the API check the same list; enforce_api_rbac.php maps the new resources, lets events, calendars and trips check their own rules, puts the new state changes at Modify and treats files/download as a read; 26.11.9 changelog entries

2026-11-13 23:51:10 -05:00

folders

API stage 3, calendar events, trips, accounts and money, contracts, and files and folders: calendars can be read, and calendar events read with their attendees, created once or repeating for a client or nobody, changed, sent as invitations, skipped for a day of a series and deleted, following calendarEventCan(); trips can be read, logged, changed and deleted through tripSave() and tripDelete(), anyone their own and someone else's with Financial; accounts can be read with their balances, added, changed, archived, unarchived and deleted while nothing is on them, other income and transfers read, recorded, changed and deleted, and recurring expenses read, set up, changed, paused and resumed, recorded now, moved on past missed runs and deleted, keeping reconciled lines as they were; contracts can be read with their prepaid hours and signing state, added, changed, made active, renewed, cancelled and deleted, sent for signature or the link sent again, the request withdrawn, prepaid hours added with a draft invoice or deleted, tickets' time drawn or put back, and the billing recurring invoice made, linked or unlinked; a client's files can be read, uploaded as base64, downloaded, renamed, moved, archived, unarchived and deleted once archived, and folders read, made, renamed, moved and deleted with their contents moved up; new api/v1/form_input.php builds a save function's input from the API's field names; the upload allow-list moves from agent/post/file.php into fileUploadExtensions() so Upload Files and the API check the same list; enforce_api_rbac.php maps the new resources, lets events, calendars and trips check their own rules, puts the new state changes at Modify and treats files/download as a read; 26.11.9 changelog entries

2026-11-13 23:51:10 -05:00

invoice_items

API stage 1, the missing operations on the existing resources: invoices can be created with their lines, updated, sent or reminded, marked sent, cancelled and deleted, and invoice lines updated and deleted; quotes created with their lines, updated, sent, marked sent, accepted, declined, invoiced as Invoice does on the quote page and deleted, with new quote_items read, create, update and delete; recurring invoices updated, paused or resumed and deleted, with new recurring_invoice_items read, create, update and delete including lines that count users or devices; expenses created, refunded, updated and deleted; services created, updated, archived, unarchived and deleted; licenses created, updated and deleted; certificates updated, archived, unarchived and deleted; products created, archived, unarchived and deleted; tickets reopened and deleted, ticket replies edited and archived, assets archived and unarchived, documents, domains, networks, vendors and tags deleted, and client portal invites listed and cancelled; each endpoint calls the same functions as its page handler, the line endpoints share billing_lines.php and the new billingLineFromApi() which recurring_invoices/create now uses too, enforce_api_rbac.php maps quote_items and recurring_invoice_items to the Sales module and puts the state changes at Modify, and every delete needs Full; 26.11.9 changelog entries

2026-11-13 22:51:49 -05:00

invoices

API stage 1, the missing operations on the existing resources: invoices can be created with their lines, updated, sent or reminded, marked sent, cancelled and deleted, and invoice lines updated and deleted; quotes created with their lines, updated, sent, marked sent, accepted, declined, invoiced as Invoice does on the quote page and deleted, with new quote_items read, create, update and delete; recurring invoices updated, paused or resumed and deleted, with new recurring_invoice_items read, create, update and delete including lines that count users or devices; expenses created, refunded, updated and deleted; services created, updated, archived, unarchived and deleted; licenses created, updated and deleted; certificates updated, archived, unarchived and deleted; products created, archived, unarchived and deleted; tickets reopened and deleted, ticket replies edited and archived, assets archived and unarchived, documents, domains, networks, vendors and tags deleted, and client portal invites listed and cancelled; each endpoint calls the same functions as its page handler, the line endpoints share billing_lines.php and the new billingLineFromApi() which recurring_invoices/create now uses too, enforce_api_rbac.php maps quote_items and recurring_invoice_items to the Sales module and puts the state changes at Modify, and every delete needs Full; 26.11.9 changelog entries

2026-11-13 22:51:49 -05:00

locations

Let the API raise a ticket from a ticket template - tickets/create takes ticket_template_id, giving the ticket the template's subject and details when none are sent, its category, priority, billing and agent unless sent, and its tags, due time and tasks (the ones the answers call for), with the template's fill-ins answered from ticket_fill_ins and its placeholders filled in, and a missing or archived template, fill-ins that aren't an object, a required fill-in left out or a choice not on a list refused with 400 and the reason; ticket_notify sends the contact and watchers the Ticket Created email when Email clients about their tickets is on, tells the new-ticket address and notifies the assigned agent in the app and by email; the answer now includes ticket_reference, ticket_url (the contact's link to the ticket) and, from a template, ticket_tasks; canned responses now fill in a ticket's template fill-in answers such as [Hostname] alongside [Contact] and [Ticket], never over a built-in placeholder of the same name, and the canned response form says so; contacts/create and locations/create no longer write a PHP warning for each field left out; the new-ticket agent email reads raised through the API; changelog updated

2026-11-05 17:39:22 -05:00

network_ips

API stage 3a, network IPs, asset interfaces, license seats and keys, notes and racks: a network's documented IP addresses can be read, added one at a time or as a run of up to 256, changed and deleted with the address plan's checks; an asset's interfaces can be read with what each is plugged into, added, changed, made primary, plugged in or unplugged and deleted with the interface window's checks; a license's seats can be set, it can be renewed by a term or to a date, and its keys read, added, handed to the client's devices and users and deleted; asset and contact notes can be read, added with one of your note types, archived, unarchived and deleted once archived, through one shared body in notes_body.php; racks can be read with what is mounted in them, made, changed, archived, unarchived and deleted once archived, and items mounted, moved and taken out with the rack page's checks; new categoryPickedName() checks a posted name for a category kind held by name; enforce_api_rbac.php maps network_ips, asset_interfaces, software_keys, asset_notes, racks and rack_units to Support and contact_notes to Clients, with seats and renew at Modify; software/read.php looked up software_key from the wrong parameter and now finds a license by its own key or any of its keys; 26.11.9 changelog entries

2026-11-13 23:27:51 -05:00

networks

API stage 1, the missing operations on the existing resources: invoices can be created with their lines, updated, sent or reminded, marked sent, cancelled and deleted, and invoice lines updated and deleted; quotes created with their lines, updated, sent, marked sent, accepted, declined, invoiced as Invoice does on the quote page and deleted, with new quote_items read, create, update and delete; recurring invoices updated, paused or resumed and deleted, with new recurring_invoice_items read, create, update and delete including lines that count users or devices; expenses created, refunded, updated and deleted; services created, updated, archived, unarchived and deleted; licenses created, updated and deleted; certificates updated, archived, unarchived and deleted; products created, archived, unarchived and deleted; tickets reopened and deleted, ticket replies edited and archived, assets archived and unarchived, documents, domains, networks, vendors and tags deleted, and client portal invites listed and cancelled; each endpoint calls the same functions as its page handler, the line endpoints share billing_lines.php and the new billingLineFromApi() which recurring_invoices/create now uses too, enforce_api_rbac.php maps quote_items and recurring_invoice_items to the Sales module and puts the state changes at Modify, and every delete needs Full; 26.11.9 changelog entries

2026-11-13 22:51:49 -05:00

payments

API stage 2, payments, projects, tasks and recurring tickets: payments can be read, recorded on an invoice that is sent and still owed on with no more than is owed into one of your accounts and the receipt emailed when mail is set up, changed, deleted and their receipt sent again, with reconciled payments keeping their date, amount and account, needing Financial with Sales at Read; projects can be read with their tickets and progress, started for a client or as internal work with a project template's tickets, changed, given a template's tickets, completed once none of their tickets is open, reopened, archived, unarchived and deleted once archived, and tickets/create and tickets/update take ticket_project_id, turning down a project that isn't the client's or internal; a ticket's tasks can be read, added, changed, marked done or not done and deleted, with approvals asked of the client or the team, approved by the key's agent and taken off, and a task waiting on or declined for approval can't be marked done; recurring tickets can be read, made from a ticket template with its fill-ins and tasks, changed, paused and resumed, raised now and deleted; enforce_api_rbac.php maps payments to the Financial module and projects, tasks, task_approvals and recurring_tickets to Support, with complete, approve, raise and apply_template at Modify; 26.11.9 changelog entries

2026-11-13 23:13:11 -05:00

portal_invites

API stage 1, the missing operations on the existing resources: invoices can be created with their lines, updated, sent or reminded, marked sent, cancelled and deleted, and invoice lines updated and deleted; quotes created with their lines, updated, sent, marked sent, accepted, declined, invoiced as Invoice does on the quote page and deleted, with new quote_items read, create, update and delete; recurring invoices updated, paused or resumed and deleted, with new recurring_invoice_items read, create, update and delete including lines that count users or devices; expenses created, refunded, updated and deleted; services created, updated, archived, unarchived and deleted; licenses created, updated and deleted; certificates updated, archived, unarchived and deleted; products created, archived, unarchived and deleted; tickets reopened and deleted, ticket replies edited and archived, assets archived and unarchived, documents, domains, networks, vendors and tags deleted, and client portal invites listed and cancelled; each endpoint calls the same functions as its page handler, the line endpoints share billing_lines.php and the new billingLineFromApi() which recurring_invoices/create now uses too, enforce_api_rbac.php maps quote_items and recurring_invoice_items to the Sales module and puts the state changes at Modify, and every delete needs Full; 26.11.9 changelog entries

2026-11-13 22:51:49 -05:00

products

API stage 1, the missing operations on the existing resources: invoices can be created with their lines, updated, sent or reminded, marked sent, cancelled and deleted, and invoice lines updated and deleted; quotes created with their lines, updated, sent, marked sent, accepted, declined, invoiced as Invoice does on the quote page and deleted, with new quote_items read, create, update and delete; recurring invoices updated, paused or resumed and deleted, with new recurring_invoice_items read, create, update and delete including lines that count users or devices; expenses created, refunded, updated and deleted; services created, updated, archived, unarchived and deleted; licenses created, updated and deleted; certificates updated, archived, unarchived and deleted; products created, archived, unarchived and deleted; tickets reopened and deleted, ticket replies edited and archived, assets archived and unarchived, documents, domains, networks, vendors and tags deleted, and client portal invites listed and cancelled; each endpoint calls the same functions as its page handler, the line endpoints share billing_lines.php and the new billingLineFromApi() which recurring_invoices/create now uses too, enforce_api_rbac.php maps quote_items and recurring_invoice_items to the Sales module and puts the state changes at Modify, and every delete needs Full; 26.11.9 changelog entries

2026-11-13 22:51:49 -05:00

projects

API stage 2, payments, projects, tasks and recurring tickets: payments can be read, recorded on an invoice that is sent and still owed on with no more than is owed into one of your accounts and the receipt emailed when mail is set up, changed, deleted and their receipt sent again, with reconciled payments keeping their date, amount and account, needing Financial with Sales at Read; projects can be read with their tickets and progress, started for a client or as internal work with a project template's tickets, changed, given a template's tickets, completed once none of their tickets is open, reopened, archived, unarchived and deleted once archived, and tickets/create and tickets/update take ticket_project_id, turning down a project that isn't the client's or internal; a ticket's tasks can be read, added, changed, marked done or not done and deleted, with approvals asked of the client or the team, approved by the key's agent and taken off, and a task waiting on or declined for approval can't be marked done; recurring tickets can be read, made from a ticket template with its fill-ins and tasks, changed, paused and resumed, raised now and deleted; enforce_api_rbac.php maps payments to the Financial module and projects, tasks, task_approvals and recurring_tickets to Support, with complete, approve, raise and apply_template at Modify; 26.11.9 changelog entries

2026-11-13 23:13:11 -05:00

quote_items

API stage 1, the missing operations on the existing resources: invoices can be created with their lines, updated, sent or reminded, marked sent, cancelled and deleted, and invoice lines updated and deleted; quotes created with their lines, updated, sent, marked sent, accepted, declined, invoiced as Invoice does on the quote page and deleted, with new quote_items read, create, update and delete; recurring invoices updated, paused or resumed and deleted, with new recurring_invoice_items read, create, update and delete including lines that count users or devices; expenses created, refunded, updated and deleted; services created, updated, archived, unarchived and deleted; licenses created, updated and deleted; certificates updated, archived, unarchived and deleted; products created, archived, unarchived and deleted; tickets reopened and deleted, ticket replies edited and archived, assets archived and unarchived, documents, domains, networks, vendors and tags deleted, and client portal invites listed and cancelled; each endpoint calls the same functions as its page handler, the line endpoints share billing_lines.php and the new billingLineFromApi() which recurring_invoices/create now uses too, enforce_api_rbac.php maps quote_items and recurring_invoice_items to the Sales module and puts the state changes at Modify, and every delete needs Full; 26.11.9 changelog entries

2026-11-13 22:51:49 -05:00

quotes

API stage 1, the missing operations on the existing resources: invoices can be created with their lines, updated, sent or reminded, marked sent, cancelled and deleted, and invoice lines updated and deleted; quotes created with their lines, updated, sent, marked sent, accepted, declined, invoiced as Invoice does on the quote page and deleted, with new quote_items read, create, update and delete; recurring invoices updated, paused or resumed and deleted, with new recurring_invoice_items read, create, update and delete including lines that count users or devices; expenses created, refunded, updated and deleted; services created, updated, archived, unarchived and deleted; licenses created, updated and deleted; certificates updated, archived, unarchived and deleted; products created, archived, unarchived and deleted; tickets reopened and deleted, ticket replies edited and archived, assets archived and unarchived, documents, domains, networks, vendors and tags deleted, and client portal invites listed and cancelled; each endpoint calls the same functions as its page handler, the line endpoints share billing_lines.php and the new billingLineFromApi() which recurring_invoices/create now uses too, enforce_api_rbac.php maps quote_items and recurring_invoice_items to the Sales module and puts the state changes at Modify, and every delete needs Full; 26.11.9 changelog entries

2026-11-13 22:51:49 -05:00

rack_units

API stage 3a, network IPs, asset interfaces, license seats and keys, notes and racks: a network's documented IP addresses can be read, added one at a time or as a run of up to 256, changed and deleted with the address plan's checks; an asset's interfaces can be read with what each is plugged into, added, changed, made primary, plugged in or unplugged and deleted with the interface window's checks; a license's seats can be set, it can be renewed by a term or to a date, and its keys read, added, handed to the client's devices and users and deleted; asset and contact notes can be read, added with one of your note types, archived, unarchived and deleted once archived, through one shared body in notes_body.php; racks can be read with what is mounted in them, made, changed, archived, unarchived and deleted once archived, and items mounted, moved and taken out with the rack page's checks; new categoryPickedName() checks a posted name for a category kind held by name; enforce_api_rbac.php maps network_ips, asset_interfaces, software_keys, asset_notes, racks and rack_units to Support and contact_notes to Clients, with seats and renew at Modify; software/read.php looked up software_key from the wrong parameter and now finds a license by its own key or any of its keys; 26.11.9 changelog entries

2026-11-13 23:27:51 -05:00

racks

API stage 3a, network IPs, asset interfaces, license seats and keys, notes and racks: a network's documented IP addresses can be read, added one at a time or as a run of up to 256, changed and deleted with the address plan's checks; an asset's interfaces can be read with what each is plugged into, added, changed, made primary, plugged in or unplugged and deleted with the interface window's checks; a license's seats can be set, it can be renewed by a term or to a date, and its keys read, added, handed to the client's devices and users and deleted; asset and contact notes can be read, added with one of your note types, archived, unarchived and deleted once archived, through one shared body in notes_body.php; racks can be read with what is mounted in them, made, changed, archived, unarchived and deleted once archived, and items mounted, moved and taken out with the rack page's checks; new categoryPickedName() checks a posted name for a category kind held by name; enforce_api_rbac.php maps network_ips, asset_interfaces, software_keys, asset_notes, racks and rack_units to Support and contact_notes to Clients, with seats and renew at Modify; software/read.php looked up software_key from the wrong parameter and now finds a license by its own key or any of its keys; 26.11.9 changelog entries

2026-11-13 23:27:51 -05:00

recurring_expenses

API stage 3, calendar events, trips, accounts and money, contracts, and files and folders: calendars can be read, and calendar events read with their attendees, created once or repeating for a client or nobody, changed, sent as invitations, skipped for a day of a series and deleted, following calendarEventCan(); trips can be read, logged, changed and deleted through tripSave() and tripDelete(), anyone their own and someone else's with Financial; accounts can be read with their balances, added, changed, archived, unarchived and deleted while nothing is on them, other income and transfers read, recorded, changed and deleted, and recurring expenses read, set up, changed, paused and resumed, recorded now, moved on past missed runs and deleted, keeping reconciled lines as they were; contracts can be read with their prepaid hours and signing state, added, changed, made active, renewed, cancelled and deleted, sent for signature or the link sent again, the request withdrawn, prepaid hours added with a draft invoice or deleted, tickets' time drawn or put back, and the billing recurring invoice made, linked or unlinked; a client's files can be read, uploaded as base64, downloaded, renamed, moved, archived, unarchived and deleted once archived, and folders read, made, renamed, moved and deleted with their contents moved up; new api/v1/form_input.php builds a save function's input from the API's field names; the upload allow-list moves from agent/post/file.php into fileUploadExtensions() so Upload Files and the API check the same list; enforce_api_rbac.php maps the new resources, lets events, calendars and trips check their own rules, puts the new state changes at Modify and treats files/download as a read; 26.11.9 changelog entries

2026-11-13 23:51:10 -05:00

recurring_invoice_items

API stage 1, the missing operations on the existing resources: invoices can be created with their lines, updated, sent or reminded, marked sent, cancelled and deleted, and invoice lines updated and deleted; quotes created with their lines, updated, sent, marked sent, accepted, declined, invoiced as Invoice does on the quote page and deleted, with new quote_items read, create, update and delete; recurring invoices updated, paused or resumed and deleted, with new recurring_invoice_items read, create, update and delete including lines that count users or devices; expenses created, refunded, updated and deleted; services created, updated, archived, unarchived and deleted; licenses created, updated and deleted; certificates updated, archived, unarchived and deleted; products created, archived, unarchived and deleted; tickets reopened and deleted, ticket replies edited and archived, assets archived and unarchived, documents, domains, networks, vendors and tags deleted, and client portal invites listed and cancelled; each endpoint calls the same functions as its page handler, the line endpoints share billing_lines.php and the new billingLineFromApi() which recurring_invoices/create now uses too, enforce_api_rbac.php maps quote_items and recurring_invoice_items to the Sales module and puts the state changes at Modify, and every delete needs Full; 26.11.9 changelog entries

2026-11-13 22:51:49 -05:00

recurring_invoices

API stage 1, the missing operations on the existing resources: invoices can be created with their lines, updated, sent or reminded, marked sent, cancelled and deleted, and invoice lines updated and deleted; quotes created with their lines, updated, sent, marked sent, accepted, declined, invoiced as Invoice does on the quote page and deleted, with new quote_items read, create, update and delete; recurring invoices updated, paused or resumed and deleted, with new recurring_invoice_items read, create, update and delete including lines that count users or devices; expenses created, refunded, updated and deleted; services created, updated, archived, unarchived and deleted; licenses created, updated and deleted; certificates updated, archived, unarchived and deleted; products created, archived, unarchived and deleted; tickets reopened and deleted, ticket replies edited and archived, assets archived and unarchived, documents, domains, networks, vendors and tags deleted, and client portal invites listed and cancelled; each endpoint calls the same functions as its page handler, the line endpoints share billing_lines.php and the new billingLineFromApi() which recurring_invoices/create now uses too, enforce_api_rbac.php maps quote_items and recurring_invoice_items to the Sales module and puts the state changes at Modify, and every delete needs Full; 26.11.9 changelog entries

2026-11-13 22:51:49 -05:00

recurring_tickets

API stage 2, payments, projects, tasks and recurring tickets: payments can be read, recorded on an invoice that is sent and still owed on with no more than is owed into one of your accounts and the receipt emailed when mail is set up, changed, deleted and their receipt sent again, with reconciled payments keeping their date, amount and account, needing Financial with Sales at Read; projects can be read with their tickets and progress, started for a client or as internal work with a project template's tickets, changed, given a template's tickets, completed once none of their tickets is open, reopened, archived, unarchived and deleted once archived, and tickets/create and tickets/update take ticket_project_id, turning down a project that isn't the client's or internal; a ticket's tasks can be read, added, changed, marked done or not done and deleted, with approvals asked of the client or the team, approved by the key's agent and taken off, and a task waiting on or declined for approval can't be marked done; recurring tickets can be read, made from a ticket template with its fill-ins and tasks, changed, paused and resumed, raised now and deleted; enforce_api_rbac.php maps payments to the Financial module and projects, tasks, task_approvals and recurring_tickets to Support, with complete, approve, raise and apply_template at Modify; 26.11.9 changelog entries

2026-11-13 23:13:11 -05:00

revenues

API stage 3, calendar events, trips, accounts and money, contracts, and files and folders: calendars can be read, and calendar events read with their attendees, created once or repeating for a client or nobody, changed, sent as invitations, skipped for a day of a series and deleted, following calendarEventCan(); trips can be read, logged, changed and deleted through tripSave() and tripDelete(), anyone their own and someone else's with Financial; accounts can be read with their balances, added, changed, archived, unarchived and deleted while nothing is on them, other income and transfers read, recorded, changed and deleted, and recurring expenses read, set up, changed, paused and resumed, recorded now, moved on past missed runs and deleted, keeping reconciled lines as they were; contracts can be read with their prepaid hours and signing state, added, changed, made active, renewed, cancelled and deleted, sent for signature or the link sent again, the request withdrawn, prepaid hours added with a draft invoice or deleted, tickets' time drawn or put back, and the billing recurring invoice made, linked or unlinked; a client's files can be read, uploaded as base64, downloaded, renamed, moved, archived, unarchived and deleted once archived, and folders read, made, renamed, moved and deleted with their contents moved up; new api/v1/form_input.php builds a save function's input from the API's field names; the upload allow-list moves from agent/post/file.php into fileUploadExtensions() so Upload Files and the API check the same list; enforce_api_rbac.php maps the new resources, lets events, calendars and trips check their own rules, puts the new state changes at Modify and treats files/download as a read; 26.11.9 changelog entries

2026-11-13 23:51:10 -05:00

roles

Roles stage 3: roles and agents in the API and Admin > API Keys rebuilt; new api/v1/roles/read.php where an admin key reads every role with its level per module and agent count, archived on request, and any other key reads only its own user's role, and new api/v1/technicians/read.php listing agents with their role under Support at Read; API role refusals now say what the call needs and what the key's user has, naming the module, level and role, and technicians/time.php needs Read instead of Modify; Admin > API Keys shows each key's agent and role, what it can open and for which clients, whether it works (works until, expires in N days, expired, or won't work with the reason when its agent is disabled, archived, has no role or is missing) and when it was last used, with search by key or agent name; New and Edit windows show the picked agent's access as they are picked and offer only active agents, Create before ticking the copied box opens the Key tab, new keys default to a year and must end after today, and an expired key can be renamed and stay expired; handlers moved to functions/api_keys.php with validation, escaped messages and audit entries naming the agent and what an edit changed, fixing empty names on revoke, delete and bulk delete, a backslash shown for apostrophes in names, the bulk count of keys ticked rather than deleted, keys created already expired and expired keys that could not be renamed; database 3.1.7 adds api_keys.api_key_last_used_at, set at most once a minute in the configured timezone; changelog updated

2026-10-17 21:10:48 -04:00

services

API stage 1, the missing operations on the existing resources: invoices can be created with their lines, updated, sent or reminded, marked sent, cancelled and deleted, and invoice lines updated and deleted; quotes created with their lines, updated, sent, marked sent, accepted, declined, invoiced as Invoice does on the quote page and deleted, with new quote_items read, create, update and delete; recurring invoices updated, paused or resumed and deleted, with new recurring_invoice_items read, create, update and delete including lines that count users or devices; expenses created, refunded, updated and deleted; services created, updated, archived, unarchived and deleted; licenses created, updated and deleted; certificates updated, archived, unarchived and deleted; products created, archived, unarchived and deleted; tickets reopened and deleted, ticket replies edited and archived, assets archived and unarchived, documents, domains, networks, vendors and tags deleted, and client portal invites listed and cancelled; each endpoint calls the same functions as its page handler, the line endpoints share billing_lines.php and the new billingLineFromApi() which recurring_invoices/create now uses too, enforce_api_rbac.php maps quote_items and recurring_invoice_items to the Sales module and puts the state changes at Modify, and every delete needs Full; 26.11.9 changelog entries

2026-11-13 22:51:49 -05:00

software

API stage 3a, network IPs, asset interfaces, license seats and keys, notes and racks: a network's documented IP addresses can be read, added one at a time or as a run of up to 256, changed and deleted with the address plan's checks; an asset's interfaces can be read with what each is plugged into, added, changed, made primary, plugged in or unplugged and deleted with the interface window's checks; a license's seats can be set, it can be renewed by a term or to a date, and its keys read, added, handed to the client's devices and users and deleted; asset and contact notes can be read, added with one of your note types, archived, unarchived and deleted once archived, through one shared body in notes_body.php; racks can be read with what is mounted in them, made, changed, archived, unarchived and deleted once archived, and items mounted, moved and taken out with the rack page's checks; new categoryPickedName() checks a posted name for a category kind held by name; enforce_api_rbac.php maps network_ips, asset_interfaces, software_keys, asset_notes, racks and rack_units to Support and contact_notes to Clients, with seats and renew at Modify; software/read.php looked up software_key from the wrong parameter and now finds a license by its own key or any of its keys; 26.11.9 changelog entries

2026-11-13 23:27:51 -05:00

software_keys

API stage 3a, network IPs, asset interfaces, license seats and keys, notes and racks: a network's documented IP addresses can be read, added one at a time or as a run of up to 256, changed and deleted with the address plan's checks; an asset's interfaces can be read with what each is plugged into, added, changed, made primary, plugged in or unplugged and deleted with the interface window's checks; a license's seats can be set, it can be renewed by a term or to a date, and its keys read, added, handed to the client's devices and users and deleted; asset and contact notes can be read, added with one of your note types, archived, unarchived and deleted once archived, through one shared body in notes_body.php; racks can be read with what is mounted in them, made, changed, archived, unarchived and deleted once archived, and items mounted, moved and taken out with the rack page's checks; new categoryPickedName() checks a posted name for a category kind held by name; enforce_api_rbac.php maps network_ips, asset_interfaces, software_keys, asset_notes, racks and rack_units to Support and contact_notes to Clients, with seats and renew at Modify; software/read.php looked up software_key from the wrong parameter and now finds a license by its own key or any of its keys; 26.11.9 changelog entries

2026-11-13 23:27:51 -05:00

tags

API stage 1, the missing operations on the existing resources: invoices can be created with their lines, updated, sent or reminded, marked sent, cancelled and deleted, and invoice lines updated and deleted; quotes created with their lines, updated, sent, marked sent, accepted, declined, invoiced as Invoice does on the quote page and deleted, with new quote_items read, create, update and delete; recurring invoices updated, paused or resumed and deleted, with new recurring_invoice_items read, create, update and delete including lines that count users or devices; expenses created, refunded, updated and deleted; services created, updated, archived, unarchived and deleted; licenses created, updated and deleted; certificates updated, archived, unarchived and deleted; products created, archived, unarchived and deleted; tickets reopened and deleted, ticket replies edited and archived, assets archived and unarchived, documents, domains, networks, vendors and tags deleted, and client portal invites listed and cancelled; each endpoint calls the same functions as its page handler, the line endpoints share billing_lines.php and the new billingLineFromApi() which recurring_invoices/create now uses too, enforce_api_rbac.php maps quote_items and recurring_invoice_items to the Sales module and puts the state changes at Modify, and every delete needs Full; 26.11.9 changelog entries

2026-11-13 22:51:49 -05:00

task_approvals

API stage 2, payments, projects, tasks and recurring tickets: payments can be read, recorded on an invoice that is sent and still owed on with no more than is owed into one of your accounts and the receipt emailed when mail is set up, changed, deleted and their receipt sent again, with reconciled payments keeping their date, amount and account, needing Financial with Sales at Read; projects can be read with their tickets and progress, started for a client or as internal work with a project template's tickets, changed, given a template's tickets, completed once none of their tickets is open, reopened, archived, unarchived and deleted once archived, and tickets/create and tickets/update take ticket_project_id, turning down a project that isn't the client's or internal; a ticket's tasks can be read, added, changed, marked done or not done and deleted, with approvals asked of the client or the team, approved by the key's agent and taken off, and a task waiting on or declined for approval can't be marked done; recurring tickets can be read, made from a ticket template with its fill-ins and tasks, changed, paused and resumed, raised now and deleted; enforce_api_rbac.php maps payments to the Financial module and projects, tasks, task_approvals and recurring_tickets to Support, with complete, approve, raise and apply_template at Modify; 26.11.9 changelog entries

2026-11-13 23:13:11 -05:00

tasks

API stage 2, payments, projects, tasks and recurring tickets: payments can be read, recorded on an invoice that is sent and still owed on with no more than is owed into one of your accounts and the receipt emailed when mail is set up, changed, deleted and their receipt sent again, with reconciled payments keeping their date, amount and account, needing Financial with Sales at Read; projects can be read with their tickets and progress, started for a client or as internal work with a project template's tickets, changed, given a template's tickets, completed once none of their tickets is open, reopened, archived, unarchived and deleted once archived, and tickets/create and tickets/update take ticket_project_id, turning down a project that isn't the client's or internal; a ticket's tasks can be read, added, changed, marked done or not done and deleted, with approvals asked of the client or the team, approved by the key's agent and taken off, and a task waiting on or declined for approval can't be marked done; recurring tickets can be read, made from a ticket template with its fill-ins and tasks, changed, paused and resumed, raised now and deleted; enforce_api_rbac.php maps payments to the Financial module and projects, tasks, task_approvals and recurring_tickets to Support, with complete, approve, raise and apply_template at Modify; 26.11.9 changelog entries

2026-11-13 23:13:11 -05:00

taxes

Taxes stage 2: Tax Collected report rebuilt for filing with an Invoiced basis (each sent invoice in the month of its date) or Paid basis (each payment carrying its share of its invoice), tax by part of each rate with registration numbers so a state's and a county's parts count apart and parts named alike add up in one row, sales before tax and net of discounts split into taxable, exempt and non-taxable, tax paid on purchases by part and net tax collected less paid, exempt sales by client with certificate and expiry, quarterly or monthly with a chart and CSV export of the tax table or the exempt sales, archived payments left out; expenses and recurring expenses record the tax included in them with a rate worked out from the amount as typed or typed over from the receipt, a tax amount with no rate allowed, refunds giving their tax back, recurring expenses copying it to each expense recorded, vendor defaults filling it in, and the list and quick looks showing it; exports gain invoice subtotal, discount, tax and tax by part, quote and recurring invoice tax, expense before tax, tax and tax rate, and client tax rate and exemption columns; API adds a taxes read endpoint with each rate's parts, subtotal, tax, tax by part and registration numbers on invoice and quote reads, and each line's rate on invoice item reads; Admin > Taxes explains naming parts alike and links the report; demo data names Allegheny County's state part PA Sales Tax and taxes the company's own-use purchases; removes the unused getMonthlyTax and getQuarterlyTax; database 3.1.2 adds expense and recurring expense tax rate and amount; changelog updated

2026-10-17 13:27:53 -04:00

technicians

Roles stage 3: roles and agents in the API and Admin > API Keys rebuilt; new api/v1/roles/read.php where an admin key reads every role with its level per module and agent count, archived on request, and any other key reads only its own user's role, and new api/v1/technicians/read.php listing agents with their role under Support at Read; API role refusals now say what the call needs and what the key's user has, naming the module, level and role, and technicians/time.php needs Read instead of Modify; Admin > API Keys shows each key's agent and role, what it can open and for which clients, whether it works (works until, expires in N days, expired, or won't work with the reason when its agent is disabled, archived, has no role or is missing) and when it was last used, with search by key or agent name; New and Edit windows show the picked agent's access as they are picked and offer only active agents, Create before ticking the copied box opens the Key tab, new keys default to a year and must end after today, and an expired key can be renamed and stay expired; handlers moved to functions/api_keys.php with validation, escaped messages and audit entries naming the agent and what an edit changed, fixing empty names on revoke, delete and bulk delete, a backslash shown for apostrophes in names, the bulk count of keys ticked rather than deleted, keys created already expired and expired keys that could not be renamed; database 3.1.7 adds api_keys.api_key_last_used_at, set at most once a minute in the configured timezone; changelog updated

2026-10-17 21:10:48 -04:00

ticket_replies

API stage 1, the missing operations on the existing resources: invoices can be created with their lines, updated, sent or reminded, marked sent, cancelled and deleted, and invoice lines updated and deleted; quotes created with their lines, updated, sent, marked sent, accepted, declined, invoiced as Invoice does on the quote page and deleted, with new quote_items read, create, update and delete; recurring invoices updated, paused or resumed and deleted, with new recurring_invoice_items read, create, update and delete including lines that count users or devices; expenses created, refunded, updated and deleted; services created, updated, archived, unarchived and deleted; licenses created, updated and deleted; certificates updated, archived, unarchived and deleted; products created, archived, unarchived and deleted; tickets reopened and deleted, ticket replies edited and archived, assets archived and unarchived, documents, domains, networks, vendors and tags deleted, and client portal invites listed and cancelled; each endpoint calls the same functions as its page handler, the line endpoints share billing_lines.php and the new billingLineFromApi() which recurring_invoices/create now uses too, enforce_api_rbac.php maps quote_items and recurring_invoice_items to the Sales module and puts the state changes at Modify, and every delete needs Full; 26.11.9 changelog entries

2026-11-13 22:51:49 -05:00

tickets

API stage 2, payments, projects, tasks and recurring tickets: payments can be read, recorded on an invoice that is sent and still owed on with no more than is owed into one of your accounts and the receipt emailed when mail is set up, changed, deleted and their receipt sent again, with reconciled payments keeping their date, amount and account, needing Financial with Sales at Read; projects can be read with their tickets and progress, started for a client or as internal work with a project template's tickets, changed, given a template's tickets, completed once none of their tickets is open, reopened, archived, unarchived and deleted once archived, and tickets/create and tickets/update take ticket_project_id, turning down a project that isn't the client's or internal; a ticket's tasks can be read, added, changed, marked done or not done and deleted, with approvals asked of the client or the team, approved by the key's agent and taken off, and a task waiting on or declined for approval can't be marked done; recurring tickets can be read, made from a ticket template with its fill-ins and tasks, changed, paused and resumed, raised now and deleted; enforce_api_rbac.php maps payments to the Financial module and projects, tasks, task_approvals and recurring_tickets to Support, with complete, approve, raise and apply_template at Modify; 26.11.9 changelog entries

2026-11-13 23:13:11 -05:00

transfers

API stage 3, calendar events, trips, accounts and money, contracts, and files and folders: calendars can be read, and calendar events read with their attendees, created once or repeating for a client or nobody, changed, sent as invitations, skipped for a day of a series and deleted, following calendarEventCan(); trips can be read, logged, changed and deleted through tripSave() and tripDelete(), anyone their own and someone else's with Financial; accounts can be read with their balances, added, changed, archived, unarchived and deleted while nothing is on them, other income and transfers read, recorded, changed and deleted, and recurring expenses read, set up, changed, paused and resumed, recorded now, moved on past missed runs and deleted, keeping reconciled lines as they were; contracts can be read with their prepaid hours and signing state, added, changed, made active, renewed, cancelled and deleted, sent for signature or the link sent again, the request withdrawn, prepaid hours added with a draft invoice or deleted, tickets' time drawn or put back, and the billing recurring invoice made, linked or unlinked; a client's files can be read, uploaded as base64, downloaded, renamed, moved, archived, unarchived and deleted once archived, and folders read, made, renamed, moved and deleted with their contents moved up; new api/v1/form_input.php builds a save function's input from the API's field names; the upload allow-list moves from agent/post/file.php into fileUploadExtensions() so Upload Files and the API check the same list; enforce_api_rbac.php maps the new resources, lets events, calendars and trips check their own rules, puts the new state changes at Modify and treats files/download as a read; 26.11.9 changelog entries

2026-11-13 23:51:10 -05:00

trips

API stage 3, calendar events, trips, accounts and money, contracts, and files and folders: calendars can be read, and calendar events read with their attendees, created once or repeating for a client or nobody, changed, sent as invitations, skipped for a day of a series and deleted, following calendarEventCan(); trips can be read, logged, changed and deleted through tripSave() and tripDelete(), anyone their own and someone else's with Financial; accounts can be read with their balances, added, changed, archived, unarchived and deleted while nothing is on them, other income and transfers read, recorded, changed and deleted, and recurring expenses read, set up, changed, paused and resumed, recorded now, moved on past missed runs and deleted, keeping reconciled lines as they were; contracts can be read with their prepaid hours and signing state, added, changed, made active, renewed, cancelled and deleted, sent for signature or the link sent again, the request withdrawn, prepaid hours added with a draft invoice or deleted, tickets' time drawn or put back, and the billing recurring invoice made, linked or unlinked; a client's files can be read, uploaded as base64, downloaded, renamed, moved, archived, unarchived and deleted once archived, and folders read, made, renamed, moved and deleted with their contents moved up; new api/v1/form_input.php builds a save function's input from the API's field names; the upload allow-list moves from agent/post/file.php into fileUploadExtensions() so Upload Files and the API check the same list; enforce_api_rbac.php maps the new resources, lets events, calendars and trips check their own rules, puts the new state changes at Modify and treats files/download as a read; 26.11.9 changelog entries

2026-11-13 23:51:10 -05:00

vendors

API stage 1, the missing operations on the existing resources: invoices can be created with their lines, updated, sent or reminded, marked sent, cancelled and deleted, and invoice lines updated and deleted; quotes created with their lines, updated, sent, marked sent, accepted, declined, invoiced as Invoice does on the quote page and deleted, with new quote_items read, create, update and delete; recurring invoices updated, paused or resumed and deleted, with new recurring_invoice_items read, create, update and delete including lines that count users or devices; expenses created, refunded, updated and deleted; services created, updated, archived, unarchived and deleted; licenses created, updated and deleted; certificates updated, archived, unarchived and deleted; products created, archived, unarchived and deleted; tickets reopened and deleted, ticket replies edited and archived, assets archived and unarchived, documents, domains, networks, vendors and tags deleted, and client portal invites listed and cancelled; each endpoint calls the same functions as its page handler, the line endpoints share billing_lines.php and the new billingLineFromApi() which recurring_invoices/create now uses too, enforce_api_rbac.php maps quote_items and recurring_invoice_items to the Sales module and puts the state changes at Modify, and every delete needs Full; 26.11.9 changelog entries

2026-11-13 22:51:49 -05:00

billing_lines.php

API stage 1, the missing operations on the existing resources: invoices can be created with their lines, updated, sent or reminded, marked sent, cancelled and deleted, and invoice lines updated and deleted; quotes created with their lines, updated, sent, marked sent, accepted, declined, invoiced as Invoice does on the quote page and deleted, with new quote_items read, create, update and delete; recurring invoices updated, paused or resumed and deleted, with new recurring_invoice_items read, create, update and delete including lines that count users or devices; expenses created, refunded, updated and deleted; services created, updated, archived, unarchived and deleted; licenses created, updated and deleted; certificates updated, archived, unarchived and deleted; products created, archived, unarchived and deleted; tickets reopened and deleted, ticket replies edited and archived, assets archived and unarchived, documents, domains, networks, vendors and tags deleted, and client portal invites listed and cancelled; each endpoint calls the same functions as its page handler, the line endpoints share billing_lines.php and the new billingLineFromApi() which recurring_invoices/create now uses too, enforce_api_rbac.php maps quote_items and recurring_invoice_items to the Sales module and puts the state changes at Modify, and every delete needs Full; 26.11.9 changelog entries

2026-11-13 22:51:49 -05:00

create_output.php

API - Add app logging when auth is fine but queries fail

2026-09-01 13:18:02 +00:00

delete_output.php

API - Add app logging when auth is fine but queries fail

2026-09-01 13:18:02 +00:00

enforce_api_rbac.php

API stage 3, calendar events, trips, accounts and money, contracts, and files and folders: calendars can be read, and calendar events read with their attendees, created once or repeating for a client or nobody, changed, sent as invitations, skipped for a day of a series and deleted, following calendarEventCan(); trips can be read, logged, changed and deleted through tripSave() and tripDelete(), anyone their own and someone else's with Financial; accounts can be read with their balances, added, changed, archived, unarchived and deleted while nothing is on them, other income and transfers read, recorded, changed and deleted, and recurring expenses read, set up, changed, paused and resumed, recorded now, moved on past missed runs and deleted, keeping reconciled lines as they were; contracts can be read with their prepaid hours and signing state, added, changed, made active, renewed, cancelled and deleted, sent for signature or the link sent again, the request withdrawn, prepaid hours added with a draft invoice or deleted, tickets' time drawn or put back, and the billing recurring invoice made, linked or unlinked; a client's files can be read, uploaded as base64, downloaded, renamed, moved, archived, unarchived and deleted once archived, and folders read, made, renamed, moved and deleted with their contents moved up; new api/v1/form_input.php builds a save function's input from the API's field names; the upload allow-list moves from agent/post/file.php into fileUploadExtensions() so Upload Files and the API check the same list; enforce_api_rbac.php maps the new resources, lets events, calendars and trips check their own rules, puts the new state changes at Modify and treats files/download as a read; 26.11.9 changelog entries

2026-11-13 23:51:10 -05:00

form_input.php

API stage 3, calendar events, trips, accounts and money, contracts, and files and folders: calendars can be read, and calendar events read with their attendees, created once or repeating for a client or nobody, changed, sent as invitations, skipped for a day of a series and deleted, following calendarEventCan(); trips can be read, logged, changed and deleted through tripSave() and tripDelete(), anyone their own and someone else's with Financial; accounts can be read with their balances, added, changed, archived, unarchived and deleted while nothing is on them, other income and transfers read, recorded, changed and deleted, and recurring expenses read, set up, changed, paused and resumed, recorded now, moved on past missed runs and deleted, keeping reconciled lines as they were; contracts can be read with their prepaid hours and signing state, added, changed, made active, renewed, cancelled and deleted, sent for signature or the link sent again, the request withdrawn, prepaid hours added with a draft invoice or deleted, tickets' time drawn or put back, and the billing recurring invoice made, linked or unlinked; a client's files can be read, uploaded as base64, downloaded, renamed, moved, archived, unarchived and deleted once archived, and folders read, made, renamed, moved and deleted with their contents moved up; new api/v1/form_input.php builds a save function's input from the API's field names; the upload allow-list moves from agent/post/file.php into fileUploadExtensions() so Upload Files and the API check the same list; enforce_api_rbac.php maps the new resources, lets events, calendars and trips check their own rules, puts the new state changes at Modify and treats files/download as a read; 26.11.9 changelog entries

2026-11-13 23:51:10 -05:00

notes_body.php

API stage 3a, network IPs, asset interfaces, license seats and keys, notes and racks: a network's documented IP addresses can be read, added one at a time or as a run of up to 256, changed and deleted with the address plan's checks; an asset's interfaces can be read with what each is plugged into, added, changed, made primary, plugged in or unplugged and deleted with the interface window's checks; a license's seats can be set, it can be renewed by a term or to a date, and its keys read, added, handed to the client's devices and users and deleted; asset and contact notes can be read, added with one of your note types, archived, unarchived and deleted once archived, through one shared body in notes_body.php; racks can be read with what is mounted in them, made, changed, archived, unarchived and deleted once archived, and items mounted, moved and taken out with the rack page's checks; new categoryPickedName() checks a posted name for a category kind held by name; enforce_api_rbac.php maps network_ips, asset_interfaces, software_keys, asset_notes, racks and rack_units to Support and contact_notes to Clients, with seats and renew at Modify; software/read.php looked up software_key from the wrong parameter and now finds a license by its own key or any of its keys; 26.11.9 changelog entries

2026-11-13 23:27:51 -05:00

read_output.php

Assets: add NAS, UPS, PDU, Modem/ONT and NVR/DVR types from a new registry in functions/asset_type.php that sets each type's icon, tone, group, fields and details; the asset form shows only the fields a type uses (fields that already hold a value stay shown) and adds a Details section per type (CPU/RAM/storage, VM host/vCPUs, switch ports/SFP/PoE/management, NAS drives/capacity/RAID, UPS capacity/output/runtime/outlets/battery dates, PDU kind/outlets/input, modem circuit ID/ISP account, printer, phone, mobile, display, camera and NVR details) stored in a new asset_specs table (database 3.4.9); new or changed port and SFP counts add the missing interfaces, continuing the asset's numbering, skipping Wi-Fi, VLAN and management ports and never deleting any; the asset page and quick look show the details, a server or NAS lists the VMs that run on it, and Assigned and Warranty show only on types that use them; the list gets Servers & NAS and Power tabs, an optional Details column, a UPS battery badge, an Assigned picker only on assigned types, and New buttons named for what they add; nightly UPS Battery Due notifications at 45, 7 and 1 days as a Support notification; copy leaves out per-unit details, Transfer to Client carries details and interface types, export adds per-detail columns, import reads detail columns after the standard twelve (VM hosts by name, resolved after every row is in) and reports values it could not keep, and the API reads and writes asset_specs; racks, client portal, client export, overview, document templates and AI lists group the new types; fix asset import carrying physical location and notes into the next row, saving 0000-00-00 for a missing purchase date and warning on an unknown contact or location, save API and import types in the list's spelling, and keep interface types on transfer; changelog updated

2026-10-27 15:59:03 -04:00

require_get_method.php

API

2023-02-12 15:50:45 +00:00

require_post_method.php

API - Add client create endpoint

2024-02-04 14:51:58 +00:00

update_output.php

API - Add app logging when auth is fine but queries fail

2026-09-01 13:18:02 +00:00

validate_api_key.php

Make the audit log, notification and history writers safe whatever text they are given, and fix the API client delete that relied on them: logAudit, appNotify, logTicketHistory and logHistory now pass their text through the new logSqlText, which reads it as MySQL reads a quoted string, cuts it to the column by character and escapes it once, so text a caller escaped is stored exactly as before and text passed as read from a row can no longer end the quote; api/v1/clients/delete.php escapes the client name as archive.php does, where a name written for the purpose ran a query when the client was deleted and a name with an apostrophe ended in an error after the delete with nothing logged; logAudit also cuts the session IP and User-Agent to their columns, since a User-Agent over 250 characters failed the insert under strict mode, leaving the action unlogged and failed sign-ins and wrong two-step codes uncounted by the lockout and the code limit, and the User-Agent is cut to 250 where it is written to logs directly or compared with it in login.php, client/login_reset.php, api/v1/validate_api_key.php, guest/includes/inc_all_guest.php and portalSignupRequest; add_invoice_copy, add_invoice_recurring and add_recurring_invoice escape the invoice and recurring invoice prefixes before their inserts, which failed with an apostrophe in the prefix; add the changelog entries

2026-11-11 11:57:09 -05:00