Create a ticket from a public contact form

Open a ticket from a contact form on a public page.

No credential is required or consulted. tenant_id in the body names the workspace the form belongs to, which is what lets an anonymous visitor's post reach the right inbox. An unknown workspace is 404.

The ticket is created with source web_widget, is stamped with the SLA policy for its priority, and records the page the form was on when the embedding page sends it in metadata.

A customer is matched on customer_email and created if there is none.

There is no idempotency key here. Posting the same form twice creates two tickets, so a client that retries should guard against a double submit itself.

Rate limited per workspace and per visitor address, not per workspace alone, because the visitor is the actor here and one abusive visitor must not spend the allowance the workspace's real customers need. A 429 means come back later and nothing was created.

Tenancy: public and unauthenticated by design. No credential and no role is required or consulted; the workspace is resolved from the request itself (a body tenant_id, a URL token, or an agent id).

Access: no credential.

Response Body

curl -X POST "https://example.com/v1/widget/tickets" \  -H "Content-Type: application/json" \  -d '{    "tenant_id": "73fc37a9-8235-56c7-a296-772adf8f6dbe",    "customer_email": "sam.okafor@northwind.example",    "customer_name": "Sam Okafor",    "subject": "Card declined at checkout",    "description": "My Visa is declined every time since Tuesday.",    "priority": "normal",    "metadata": {      "page": "/checkout"    }  }'

{  "ticket_id": "5e8b0c31-7a4d-4f92-b6c8-1d3e2a5f7b90",  "customer_id": "9f1d6c4e-6b6e-4b31-9a5b-2f1c9a4d5e60"}