Overview

AutoElevate's native Freshservice integration connects to your Freshservice account with an API key. In Freshservice, an API key always acts as the agent it belongs to — the key can do exactly what that agent can do, and nothing more. The way to keep this integration least-privilege is to create a dedicated integration agent with a custom role scoped to only what the integration actually needs.

This article lists every Freshservice API call the integration makes, the permission each one needs, and why. In short: the integration only needs to read a little configuration when you set it up, and create and update tickets while it runs. It does not need Administrator or Account Admin rights.

Prerequisites

• Administrator access to Freshservice — but only once, to create the dedicated agent, its role, and its API key. The integration itself never uses your admin login.
• Administrative access to the AutoElevate Admin Portal to enter the Freshservice subdomain and API key.
• A full-time agent seat for the integration agent (requester / contact accounts cannot use the ticket APIs).

Required permissions

Every operation below, in the order the integration performs it. Phase tells you whether the permission is needed only while you configure the integration (Setup) or every time it runs (Runtime).

Permission details

• Verify the API key (GET /agents/me): right after you paste the subdomain and API key, AutoElevate calls this to confirm the key is valid and belongs to a real agent. It reads nothing but the agent's own identity.
• Load statuses and ticket types (GET /ticket_form_fields): so you can map AutoElevate outcomes (new, approved, denied, completed) to your Freshservice statuses and pick which ticket type new tickets use, the portal reads your ticket form field definitions. AutoElevate only offers the three ticket types Freshservice accepts on creation — Incident, Service Request, Major Incident — and hides the system "Assigned to AI Agent" status, which Freshservice refuses on update.
• Load groups (GET /groups): lets you choose a default assignment group for created tickets. Optional — if you do not assign a default group, the integration simply omits it.
• Priorities and sources: no permission needed — AutoElevate ships the standard Freshservice priority list (Low / Medium / High / Urgent) and source list, so no API call is made.
• Create tickets (POST /tickets): the core runtime action — every elevation request or elevated session becomes a ticket. This is the one write capability the integration cannot work without.
• Update tickets (PUT /tickets/{id}): when a technician approves, denies, or completes a request in AutoElevate, the matching Freshservice ticket's status is updated. On outcomes that resolve or close the ticket, AutoElevate also writes a resolution note (Freshservice requires one to close).
• Add a private note (POST /tickets/{id}/notes): progress and outcome detail is added as a private note (internal-only), so it never emails the requester.

Requester behavior

Freshservice requires a requester on every ticket (an email or requester_id). AutoElevate elevation events have no real requester mailbox, so the integration synthesizes a stable, non-routable address of the form user@no-reply.company.local. The .local TLD is reserved and never resolves, so these addresses can never receive mail.

Company, location, computer, and user linking

No linking is required for Freshservice. Once the integration is configured (credentials saved and statuses mapped), tickets are generated automatically for elevation requests and elevated sessions. Unlike some of our other ticketing integrations (such as ServiceNow), AutoElevate companies, locations, computers, and users do not need to be linked to Freshservice records.

For context: this integration uses auto-created synthetic requesters (user@no-reply.company.local), so tickets are not attributed to a Freshservice company or requester group in this release. Company, computer, and user details are included as text in the ticket subject, description, and private notes.

Step-by-step: create the least-privilege agent

1. In Freshservice, go to Admin → User Management → Agents and create a new full-time agent (e.g. "AutoElevate Integration").
2. Under Admin → Roles, create a custom role — for example "AutoElevate — Tickets". Grant it:
   • Tickets: Create, and Edit / Reply / Add note.
   • The minimum Groups / ticket-fields read needed for the setup dropdowns (see the note above; you may remove this after setup).
   • Nothing else — no admin, no account settings, no automations.
3. Set the role's scope so the agent can act on the tickets it creates. If created tickets should be visible / editable regardless of group, use a Global scope; otherwise a Group scope that includes your chosen default group is enough.
4. Assign that custom role (and only that role) to the integration agent.
5. In the agent\u2019s settings, make sure API Key access is enabled — on Freshworks agent profiles this toggle can be off by default, and without it the agent has no API key at all.
6. Log in as (or impersonate) that agent, open Profile settings, and copy its API key.
7. In the AutoElevate Admin Portal, open the Freshservice ticketing setup, enter your *.freshservice.com subdomain and paste the API key, then save. The portal verifies the key and loads your statuses, ticket types, and groups.

What you do NOT need to grant

• Not Account Admin or Administrator. The integration never touches account settings, billing, automations, or admin configuration at runtime.
• Not delete permissions on tickets — the integration never deletes.
• Not asset / CMDB, department, or requester-management permissions — no entity linking in this release.
• Not write access to ticket fields, workflows, or automators — it only reads field options at setup.

AutoElevate Admin Portal setup

With the Freshservice agent and API key ready, configure the integration in the AutoElevate Admin Portal:

1. Log in to the AutoElevate Admin Portal and go to Settings.
2. On the Ticketing System item, click START SETUP (or open your existing ticketing configuration to edit it).
3. Under Type, select FreshService.
4. Step 1 — Host & API Credentials: enter your Freshservice subdomain (e.g. acmecorp.freshservice.com) and the integration agent\u2019s API key, then click SAVE CREDENTIALS. A successful save verifies the key and loads your statuses, ticket types, and groups.
5. Step 2 — Default Group, Type & Priority (optional): choose a default assignment group, the ticket type new tickets should use (Incident, Service Request, or Major Incident), and a default priority.
6. Step 3 — Status Mapping: map each AutoElevate outcome (new, approved, denied, completed) to the Freshservice status it should set.
7. Click SAVE. From this point, elevation requests and elevated sessions generate Freshservice tickets automatically — no additional linking is required.

Verification

1. Save credentials in the portal — a verified result means GET /agents/me succeeded (permission #1).
2. The Status, Ticket Type, and Group dropdowns populate — this confirms the setup reads (#2 and #3) work under the role you built. If they are empty or error, the role needs the config-read capability described above.
3. Trigger a test elevation and confirm a ticket is created in Freshservice (#6), then approve / deny it in AutoElevate and confirm the ticket's status updates and a private note appears (#7 and #8).

Troubleshooting