API - About the Mojo Helpdesk REST API

The Mojo Helpdesk API enables 3rd party developers to create, edit, update, delete, and export tickets, users and comments. It supports building custom workflows and integrations with other tools or systems.

Accessing and using the API requires technical resources and developer experience. API documentation and examples are available here: https://developer.mojohelpdesk.com

API keys

An API key is a credential tied to an agent's account. Each agent manages their own keys, and each agent can hold two:

Key What it can do
Read-write Full API access - read and write.
Read-only Retrieve data only. Any create, update, or delete request is rejected.

A key inherits the permissions of the agent who owns it, including queue access. For an integration that needs to see the whole help desk, generate the key from an admin or owner account.

Generate or copy a key

  1. Click your avatar (upper right) → My profile.
  2. Open the Security tab and scroll to Dev Settings → API keys.
  3. Next to Read-write or Read-only, click Generate, then use the reveal and copy buttons.

Note: you can only see and manage your own keys. Admins cannot view or generate a key for another agent - each agent generates their own.

Expiry, rotation, and revocation

  • Expiry is optional. Leave the date blank and the key never expires; set one and the key stops working after that date.
  • Rotate generates a new value for the same key. The old value stops working immediately.
  • Revoke deletes the key entirely.
  • Rotating or revoking an API key does not log the agent out, and changing your Mojo password does not change your API keys. (API keys are revoked when an account is recovered through the forgot-password email link, or when an admin forces a password reset.)

Read-only keys

A read-only key may only make GET requests. Any POST, PUT, PATCH, or DELETE returns 401 with This API key is read-only and cannot perform write operations. This includes the export endpoints, which are POST requests because they queue a job and email a file.

API keys are available to agents only. Contacts cannot have one.

Turn API access on or off

  • For the whole help desk: admins go to Account administration > Channels > API and use the Enabled switch.
  • For one agent: open the agent in Contacts > Staff, go to the Role and permissions tab, and turn off Enable API access. Their keys stop working until access is turned back on; you can also delete their keys at the same time. Only someone with a higher role than the agent can change this.

A call refused this way gets 403 with the code api_access_disabled.

An agent's Role and permissions tab with the Enable API access, Enable AI tool access through MCP and Allow AI tools to update ticket details switches.

What an API key cannot do

An API key works with help desk data: tickets, users, comments, knowledge base articles and so on. For security, these actions need a person signed in to Mojo in a browser and are refused over an API key:

  • changing sign-in settings: single sign-on, login options, two-factor authentication, temporary access passes, the IP and email allow and block lists, email verification and the session timeout
  • viewing, creating, rotating or deleting API keys
  • setting a staff member's password, making someone an agent or giving them a higher role, or changing a staff member's email address
  • password resets, recovery codes and resending invitations

Allow and block lists, and closed help desks

Every API call is checked against the help desk's IP and email allow and block lists, including the agents' IP list for keys owned by staff. When the help desk is closed or scheduled for deletion, only its admins and owner can still use the API. A refused call gets 403 with one of these codes: ip_not_allowed, email_not_allowed, helpdesk_closed, helpdesk_scheduled_for_deletion. Refused calls do not count toward your quota.

How to view current API usage and limits

Admins can see API usage at Account administration > Channels > API: today's calls against the daily quota, and activity over the last day, 7 days or 30 days, with reads, writes and calls by agent. The figures update every 10 minutes.

The API channel page with the Enabled switch, the daily quota and seven days of activity with reads and writes.

Calls made by AI assistants through MCP count toward the same daily quota.

The plan's limits are also shown at Account administration > Overview.

The Account administration Overview page, where usage meters for agents, Mojo bots, storage and daily API calls are shown.

Scroll down the page, and expand Quotas to view current plan limits and usage.

The expanded Quotas section comparing the Team, Business and Enterprise plans, with each plan's daily API call allowance highlighted.