For administrators. This page lists web addresses. If you reached the manual looking for how to find a screen, use the navigation menu in the product instead.
Match a route to the page it opens. Routes belong to this version of the product. A route you can reach is not a route you are allowed to use — see Roles and access matrix.
Bracketed portions such as {TicketIdentifier} are templates. Substitute a real
value.
Entry and shared routes
| Route | Page |
|---|---|
/ |
Redirects: to /setup if setup is incomplete, /login for signed-out internal users, /external for external users, otherwise to the saved or default landing page. |
/login |
Login |
/login/two-factor |
Two-Factor Challenge |
/setup |
Initial Setup. Available only while no active SystemAdmin exists. |
/access-denied |
Access Denied |
/not-found |
Not Found |
/Error |
Error. The framework error boundary, not an operations page. |
/search |
Search Review |
/preferences/landing |
Preferences |
/preferences/security |
Sign-In Security |
/logout |
Signs out. For a Customer Portal SSO requester it also revokes the grant and returns to the configured Customer Area address. |
Default landing order is: SystemAdmin to /admin/system; otherwise any visible
department to /agent/queue; otherwise /portal/tickets. A View-only user
can land on Agent Queue even though the navigation switch for Agent needs
Work. That is a navigation mismatch, not extra authority.
Requester routes
| Route | Page |
|---|---|
/portal/tickets |
My Tickets; Current ticket work |
/portal/tickets/new |
Service Catalog |
/portal/tickets/create |
Quick Ticket |
/portal/tickets/{TicketIdentifier} |
Ticket Details / Ticket Follow-Up |
Agent, project, and approval routes
| Route | Page |
|---|---|
/agent/queue |
Agent Queue |
/agent/tickets/{TicketIdentifier} |
Ticket Details / Ticket Workbench |
/agent/queue/bulk-operations |
Queue Bulk Operations; Bulk operations |
/projects |
Projects |
/projects/{ProjectIdentifier} |
Project Details |
/projects/bulk-staffing |
Project Bulk Staffing; Restaff project roles |
/approvals |
My Approvals; Approval work |
/redaction-reveal-approvals |
Redaction Reveal Approvals |
The approval routes use the generic Workspace / Home masthead. There is no separate approval workspace.
External participant routes
| Route | Page |
|---|---|
/external/login |
External Login |
/external/enroll |
External Enrollment. Requires a valid invitation. |
/external |
External Access; Your linked tickets |
/external/tickets/{TicketIdentifier} |
External Ticket View |
Customer Portal SSO routes
A Customer Portal requester may reach only these. Every other page type is refused.
| Route | Behaviour |
|---|---|
POST /signin-customer-portal-sso |
Anonymous receiver for the signed handoff. Form-encoded, no query string, exactly one sso and one sig value, no files, an 8,192-byte request-size limit. On success, signs in and redirects to /portal/tickets/new. |
/ |
Resolves to /portal/tickets. Does not expose an internal landing preference. |
/portal/tickets/new |
Service Catalog, limited to the effective Customer Requester catalog. |
/portal/tickets |
My Tickets for that requester. |
/portal/tickets/{TicketIdentifier} |
Requester-safe detail and follow-up for a ticket they are authorized on. |
/logout |
Revokes the grant, clears the local cookie, returns to the configured Customer Area address when one is set. |
A refused route shows Page not available, offering Service Catalog, My Tickets, and Return to Customer Area. Quick Ticket, search, preferences, approvals, projects, agent, external, setup, and administration pages are all refused. This allowlist is checked in addition to record-level authorization.
System Administrator routes
Every route below requires SystemAdmin. Individual reads and changes within
them can require step-up as well.
| Area | Routes |
|---|---|
| Settings and diagnostics | /admin/settings, /admin/system, /admin/about |
| Organization and access | /admin/tenant, /admin/departments[/{DepartmentKey}], /admin/department-access[/{DepartmentKey}], /admin/users[/{UserId:guid}], /admin/groups[/{GroupId:guid}], /admin/system-admin-access |
| Identity and external lifecycle | /admin/directory[/{IntegrationKey}], /admin/external-identities[/{ExternalIdentityId:guid}] |
| Mail, web, storage, database, licence | /admin/mail-delivery, /admin/web-access-security, /admin/https-and-certificates, /admin/storage-continuity, /admin/database-connection, /admin/product-license |
| Workflow and catalog | /admin/status-definitions, /admin/workflows[/{WorkflowId:guid}], /admin/project-role-mappings, /admin/sla-policies, /admin/business-calendars, /admin/service-categories, /admin/services[/{RouteServiceId:guid}] |
| Fields and tags | /admin/service-custom-fields, /admin/custom-fields, /admin/project-custom-fields (also answers at /admin/custom-fields/projects), /admin/tags (also answers at /admin/metadata-tags) |
| Governance and data | /admin/import-operations, /admin/audit, /admin/redactions, /admin/demo-data |
Customer Portal SSO is configured under /admin/tenant.
There is one exception to the SystemAdmin rule above: /admin/ping answers to
SystemAdmin and reports only that the application is running. For monitoring,
prefer the anonymous health routes below.
Monitoring routes
These two answer without signing in, and they disclose nothing but a status word. The other routes that answer without a signed-in session are all listed above: the sign-in and error pages, Initial Setup while no active System Administrator exists, External Enrollment with a valid invitation, and the anonymous customer-portal SSO receiver.
| Route | Returns | Proves |
|---|---|---|
/health/live |
{"status":"…"} |
The web process is up and answering. |
/health/ready |
{"status":"…"} |
The process is up and can open a connection to its database, checked with a three-second timeout. |
Point a monitor at /health/ready; it is also the Linux container healthcheck
target. Neither route reports on mail, background work, or whether the product is
behaving correctly. See
Diagnostics and logs.
Retired routes and stale instructions
| Retired item | What to use instead |
|---|---|
/admin/assignment-administration |
This is not an active workspace. Configure routing in Services, Departments, Workflows, Project Role Mappings, and Projects. To route existing tickets, use Agent Queue → Bulk operations → Project-linked role routing → Preview outcomes → Apply changes. |
| The instruction Admin → System Diagnostics | The primary navigation label is Settings. From it, use the System Diagnostics card, which appears after step-up. If already authorized, go to /admin/system directly — an ordinary read there does not itself require step-up. |