Authentication

All API requests require authentication using JWT tokens. Include the token in the Authorization header.


Authorization: Bearer <your_jwt_token>

Tickets

GET /api/tickets.php?action=list

List all tickets with pagination and filtering.

GET /api/tickets.php?id=<ticket_id>

Get a single ticket by ID or UID.

POST /api/tickets.php?action=create

Create a new ticket.

                
{
  "subject": "Issue with login",
  "description": "Cannot log in to my account",
  "priority": "high",
  "customer_email": "customer@example.com"
}
                
            

PUT /api/tickets.php?id=<ticket_id>&action=update

Update an existing ticket.

Surveys

GET /api/qa.php?action=survey_settings

Get survey settings for the tenant.

POST /api/qa.php?action=submit_survey

Submit a customer survey response.

GET /api/qa.php?action=survey_stats

Get survey statistics and trends.

Analytics

GET /api/analytics.php?action=dashboard

Get dashboard analytics and metrics.

GET /api/analytics.php?action=agent_stats

Get agent performance statistics.

QA Reviews

GET /api/qa.php?action=list_reviews

List all QA reviews for a tenant.

PUT /api/qa.php?action=update_review&id=<review_id>

Update a QA review (approve/reject).

Outbound Webhooks

Subscribe to lifecycle events and receive a signed POST request to your own endpoint the moment something happens. Configure webhooks from the admin Company & Compliance settings — no code required to start receiving them.

POST {{ your_endpoint_url }}

Sent by NexusX on each subscribed event. Event types:

ticket.created — a new ticket is created
ticket.updated — a ticket's status/details change
lead.created — a new lead is captured
lead.won — a lead is marked as won
dsar.created — a data-subject request is submitted

POST Example payload

                
{
  "event": "ticket.created",
  "tenant_id": 1,
  "occurred_at": "2026-08-20T12:34:56+00:00",
  "data": {
    "ticket_id": 412,
    "subject": "Cannot log in",
    "priority": "high"
  }
}
                
            

POST Verify the signature

Every delivery includes an X-NexusX-Signature header (sha256=HMAC) so you can confirm it originated from NexusX. Recompute the HMAC over the raw request body with your webhook secret and compare using a constant-time check.

                
$secret  = 'your_webhook_secret';
$body    = file_get_contents('php://input');
$sig     = $_SERVER['HTTP_X_NEXUSX_SIGNATURE'] ?? '';
$expected = 'sha256=' . hash_hmac('sha256', $body, $secret);

if (hash_equals($expected, $sig)) {
    // authentic request from NexusX — process it
}
                
            

Live Updates & Automation

The workspace keeps itself current without any extra setup:

Live notifications — the in-app notification center refreshes automatically over HTTPS, so agents and supervisors see new assignments, escalations and SLA breaches as they happen.
Autonomous engine — an always-on engine continuously re-checks SLAs, queue spikes and breaches, raising flags for review in near real time.
Scheduled automation — data-retention enforcement, breach reminders and webhook delivery run automatically on a regular interval (and can also be driven by your host's scheduled tasks pointing at cron.php).

Data Compliance

NexusX bakes NDPA-aligned data protection into the platform, managed from the admin Company & Compliance and Breach Register areas:

Retention policies — per data type (customers, tickets, leads, feedback, surveys, audit logs) with anonymise or delete actions, enforced automatically.
Breach register — declare a security/cyber incident, work through the NDPA breach checklist, and a human sends the NITDA and data-subject notices (the 72-hour clock is tracked and surfaced automatically).
Data-subject requests — customers can submit access, correction, erasure and objection requests via the public Data Request Center, actioned within the NDPA's 30-day window.

API Documentation