Skip to main content

Two-way ticketing sync (ITSM)

Keep CloudSEK and your ticketing tool showing the same state. An alert arrives, your system opens a ticket, and ticket transitions flow back into CloudSEK so analysts on both sides see the same status.

Endpoints​

OperationEndpoint
Update incident (status, priority, assignee, comment)PATCH /v2/incidents/{id}
Post a commentPOST /v2/incidents/{id}/comments
Verify your own writeGET /v2/changelog?operation_id=...

Write the ticket state back​

Pass external_reference so the CloudSEK timeline links to your ticket:

curl -s -X PATCH "https://api.cloudsek.com/v2/incidents/XVA-24388918" \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{
    "status": "Acknowledged",
    "priority": "P1",
    "comment": "Ticket PROJ-123 opened in Jira.",
    "external_reference": { "system": "jira", "ticket_id": "PROJ-123", "url": "https://acme.atlassian.net/browse/PROJ-123" }
  }'

Every write returns the standard envelope with an operation_id (UUID v7):

{
  "success": true,
  "data": { "incident_display_id": "XVA-24388918", "status": "Acknowledged", "priority": "P1", "...": "..." },
  "operation_id": "019fa850-09bb-7114-9ed4-bb8c88999475",
  "request_id": "req-1785235245499-1c0pms",
  "timestamp": "2026-07-28T10:39:53.051Z"
}

Close the loop​

Store the operation_id with the ticket. To confirm the change landed, or to fetch exactly what your integration changed, query the changelog by that ID:

curl -s "https://api.cloudsek.com/v2/changelog?operation_id=019fa850-09bb-7114-9ed4-bb8c88999475" \
  -H "Authorization: Bearer $TOKEN"

Avoid the echo loop​

When your changelog consumer encounters rows whose operationId is one your integration produced, mark the ticket update as already applied instead of writing it back again. Without this check, your two systems will bounce the same change back and forth forever.

Safety properties you can rely on​

  • Blind retries are safe. Repeating an identical PATCH against an unchanged incident returns a no-op success (a slim payload with a message, no error).
  • Duplicate comments are collapsed. Posting a comment with identical text to the same record from the same integration returns the prior write's operation_id instead of a duplicate. Append a timestamp to the text if you genuinely want the same content twice.
  • Missing comments get a fallback. If a status transition requires a comment and you omit one, a fallback comment is generated and attributed to the integration.

Next​

For automated triage rather than mirroring a ticketing tool, see SOAR playbooks.