Overview

AutoElevate's Freshdesk integration turns elevation activity into Freshdesk tickets: when a request comes in, AutoElevate opens a ticket, updates its status as the request is approved / denied / completed, and adds private notes. To do this it needs a Freshdesk API key. This article explains the minimum access that key needs and why — so you can grant only what is required instead of a full Account Administrator.

Freshdesk controls access with two independent dials:

• Agent role — what an agent is allowed to do (create tickets, edit ticket properties, manage admin settings).
• Ticket scope — which tickets an agent may see and act on (All tickets = global, Tickets in a group, or Assigned tickets only).

The API key inherits the role and scope of the agent it belongs to. Least privilege means the smallest role and scope that still lets every operation below succeed.

Prerequisites

• Freshdesk Administrator access — once, to create the custom role, the dedicated agent, and enable its API key. The integration itself never uses your admin login.
• A Full-Time agent seat for the dedicated integration agent (keys on occasional / day-pass seats are not reliable for automation).
• Your Freshdesk subdomain (e.g. acmecorp.freshdesk.com) and the integration agent's API key (in Freshdesk: profile picture → Profile settings → "Your API Key").

Required permissions

* On the plan we tested, these reads succeeded with the minimal custom role — no administrator key was needed at any point. If your Freshdesk plan restricts them, the dropdowns will be empty during setup; see Troubleshooting.

The integration does not touch the contacts, companies, agent-list, or asset APIs at runtime — entity linking is intentionally out of scope for this release. The only contact side-effect: POST /tickets carries a unique_external_id (machine ID) and a name; if Freshdesk finds no matching contact it auto-creates one as part of ticket creation. No separate contact-management permission is exercised.

Company, location, computer, and user linking

No linking is required for Freshdesk. Once the integration is configured (credentials saved and statuses mapped), tickets are generated automatically for elevation requests and elevated sessions. Unlike some of our other ticketing integrations (such as ServiceNow), AutoElevate companies, locations, computers, and users do not need to be linked to Freshdesk records.

For context: in Freshdesk a ticket\u2019s company is derived from its requester contact, and this integration uses auto-created synthetic requesters — so tickets are not attributed to a Freshdesk company in this release. Company, computer, and user details are included as text in the ticket subject, description, and private notes.

Requester behavior

Freshdesk requires a requester on every ticket. AutoElevate elevation events have no real requester mailbox, so the integration synthesizes a stable, non-routable address of the form user@no-reply.company.local. The .local TLD is reserved and never resolves, so these addresses can never receive mail.

Step-by-step configuration (verified least-privilege setup)

1. In Freshdesk, go to Admin → Roles → New Role and create a custom role, e.g. "AutoElevate — Tickets". Under the Tickets permissions, check:
   • Create a ticket
   • Edit ticket properties → Edit specific ticket properties → Edit ticket status
   • Nothing else — no delete, no admin, no automations. (There is no separate "add private note" permission; private notes are a base agent capability.)
2. Go to Admin → Agents → New agent and create a dedicated Full time Support agent, e.g. "AutoElevate Integration", with its own unique email address (a service account, not a person).
3. In the agent's Settings, remove the default "Agent" role and assign only AutoElevate — Tickets.
4. Set Scope for ticket visibility: All tickets is the simplest and always works; Tickets in a group is the least-privilege option if you route AutoElevate tickets to one group (make the agent a member of that group).
5. Under "Security and permission", enable the API Key access toggle. It is off by default — without it the agent has no API key at all.
6. Create the agent. Activate it from the activation email, then log in as that agent, open Profile settings, and copy its API key.
7. In the AutoElevate Admin Portal, open the Freshdesk ticketing setup, enter your *.freshdesk.com subdomain and the API key, verify, map statuses, and save.

What you do NOT need to grant

• Not Account Administrator or Administrator — in our testing, even initial setup completed with the minimal custom role.
• No delete permissions — the integration never deletes tickets or conversations.
• No contact, company, or asset permissions — no entity linking in this release.
• No reply / public-note permissions ("Respond to a ticket") — notes are always private.

AutoElevate Admin Portal setup

With the Freshdesk agent and API key ready, configure the integration in the AutoElevate Admin Portal:

1. Log in to the AutoElevate Admin Portal and go to Settings.
2. On the Ticketing System item, click START SETUP (or open your existing ticketing configuration to edit it).
3. Under Type, select FreshDesk.
4. Step 1 — Host & API Credentials: enter your Freshdesk subdomain (e.g. acmecorp.freshdesk.com) and the integration agent\u2019s API key, then click SAVE CREDENTIALS. A successful save verifies the key and loads your statuses, ticket types, and groups.
5. Step 2 — Default Group, Type & Priority (optional): choose a default assignment group, the ticket type new tickets should use, and a default priority.
6. Step 3 — Status Mapping: map each AutoElevate outcome (new, approved, denied, completed) to the Freshdesk status it should set.
7. Click SAVE. From this point, elevation requests and elevated sessions generate Freshdesk tickets automatically — no additional linking is required.

Verification

1. Save credentials in the portal — a verified result means GET /agents/me succeeded.
2. Confirm the status / ticket type / group dropdowns populate — this confirms the setup reads work under the minimal role.
3. Trigger a test elevation; confirm a ticket appears in Freshdesk tagged autoelevate, then approve / deny it and confirm the status changes and a private note is added.

Troubleshooting

• "Invalid API key" on save — the key is wrong, or the agent's API Key access toggle (Security and permission) is disabled — it is off by default. Enable it and re-copy the key from the agent's profile.
• Status / type / group dropdowns empty during setup — your plan may gate the field/group reads for non-admin agents. Complete the setup step with an Administrator's key, then switch the stored key back to the integration agent — or contact support.
• Tickets are not created at runtime — the role lacks Create a ticket, or the agent's scope excludes the target group. Widen the scope (group membership or All tickets).
• Status never updates, or "closed" fails — the role lacks Edit ticket status, or the mapped status is blocked by a mandatory-on-close field or a Freshdesk automation. Check the mapped status values and any close-time required fields.
• Unexpected new contacts in the directory — expected; these are the synthetic requesters (see Requester behavior).