> ## Documentation Index > Fetch the complete documentation index at: https://docs.firetone.com.au/llms.txt > Use this file to discover all available pages before exploring further. # List tickets > Requires tickets:read AND the tickets app enabled for the organisation. A disabled app answers 403 rather than an empty list — absent, not merely hidden in the nav. Sort keys: created_at, updated_at, ref, status, priority. ## OpenAPI ````yaml /api-reference/openapi-public.json get /tickets openapi: 3.0.3 info: description: >- The API your own systems use: place and follow calls, have an AI agent call someone, run campaigns and get their results, keep contacts in step with your CRM, and receive signed webhooks. Authenticate with an integration key (Authorization: Bearer ft_...), used only from the IP addresses it allows. title: FireTone API version: 0.1.0 servers: - description: Your platform's API host url: https://{host}/api/v1 variables: host: default: api.firet.one security: - bearerAuth: [] tags: - name: Auth - description: >- Live calls and what can be done to them: hang up, hold, transfer, park, merge, monitor, whisper; the Desk's own call. name: Calls - description: 'Outbound campaigns: contacts, attempts, outcomes.' name: Campaigns - description: 'Customers: who called, what is known about them, and their memory.' name: Contacts - description: What was said on an AI call, and the review of it. name: Conversations - description: >- Your own systems: HTTP connections an IVR calls mid-call, and webhooks for call events. Tenant URLs must be public https addresses. name: Integrations - name: Live - name: Provisioning - name: Reporting - description: Tickets raised by people, agents and the API. name: Tickets - description: Messages left for an extension or a queue. name: Voicemail paths: /tickets: get: tags: - Tickets summary: List tickets description: >- Requires tickets:read AND the tickets app enabled for the organisation. A disabled app answers 403 rather than an empty list — absent, not merely hidden in the nav. Sort keys: created_at, updated_at, ref, status, priority. operationId: getTickets parameters: - $ref: '#/components/parameters/limit' - $ref: '#/components/parameters/offset' - $ref: '#/components/parameters/sort' - $ref: '#/components/parameters/order' - $ref: '#/components/parameters/q' responses: '200': content: application/json: schema: $ref: '#/components/schemas/TicketPage' description: OK '400': $ref: '#/components/responses/BadRequest' '403': $ref: '#/components/responses/Forbidden' components: parameters: limit: in: query name: limit schema: default: 50 maximum: 500 type: integer offset: in: query name: offset schema: default: 0 type: integer sort: description: >- Sort key. Each list accepts its own allow-list of keys, given in that endpoint's description; anything else is a 400. ORDER BY cannot be parameterised, so the key is looked up rather than interpolated. Every sort carries a tiebreak on the primary key, so paging stays disjoint when the sort column has duplicates. in: query name: sort schema: type: string order: description: >- Sort direction. Defaults to ascending, except the call log, which reads newest first. in: query name: order schema: enum: - asc - desc type: string q: description: >- Free-text search across the list's searchable columns (case-insensitive substring). % and _ in the term match themselves. in: query name: q schema: type: string schemas: TicketPage: properties: items: items: $ref: '#/components/schemas/Ticket' type: array limit: type: integer offset: type: integer total: type: integer type: object Ticket: properties: body: type: string call_uuid: format: uuid type: string contact_e164: type: string contact_id: format: uuid type: string created_at: format: date-time type: string id: format: uuid type: string organisation_id: format: uuid type: string priority: enum: - low - normal - high - urgent type: string ref: description: >- Per-organisation, so a customer can read it out. Not a global sequence, which would leak one tenant's volume into another's numbering. type: integer resolved_at: format: date-time nullable: true type: string source: description: >- Who raised it: a model mid-call, a person in the panel, or an IVR flow node. enum: - agent - human - flow type: string status: enum: - open - pending - resolved - closed type: string subject: type: string team_id: format: uuid type: string update_count: type: integer updated_at: format: date-time type: string type: object Error: properties: error: properties: code: enum: - invalid_request - invalid_credentials - unauthenticated - forbidden - not_found - conflict - internal type: string message: type: string required: - code - message type: object required: - error type: object responses: BadRequest: content: application/json: schema: $ref: '#/components/schemas/Error' description: The request is not valid. The message names every field that is wrong. Forbidden: content: application/json: schema: $ref: '#/components/schemas/Error' description: Outside the caller's scope, or insufficient role securitySchemes: bearerAuth: bearerFormat: JWT or API key description: >- Every request sends `Authorization: Bearer `. The token is either a panel session (a JWT from /auth/login, 12 hours) or an API key `ft__`. An API key is accepted only from an address on its IP allowlist (403 ip_not_allowed otherwise; 403 ip_allowlist_required for an old key that has none), is limited to its rate per minute (429 rate_limited with Retry-After; X-RateLimit-Limit/Remaining/Reset on every response), and at most 60 call placements a minute. scheme: bearer type: http ````