Routes and Workspaces
For administrators. This page lists web addresses. If you reached the manual looking for how to find a screen, use the navigation menu in the product instead.
Match a route to the page it opens. Routes belong to this version of the product. A route you can reach is not a route you are allowed to use — see Roles and access matrix.
Bracketed portions such as {TicketIdentifier} are
templates. Substitute a real value.
Entry and shared routes
| Route | Page |
|---|---|
/ |
Redirects: to /setup if setup is incomplete,
/login for signed-out internal users,
/external for external users, otherwise to the saved or
default landing page. |
/login |
Login |
/login/two-factor |
Two-Factor Challenge |
/setup |
Initial Setup. Available only while no active SystemAdmin exists. |
/access-denied |
Access Denied |
/not-found |
Not Found |
/Error |
Error. The framework error boundary, not an operations page. |
/search |
Search Review |
/preferences/landing |
Preferences |
/preferences/security |
Sign-In Security |
/logout |
Signs out. For a Customer Portal SSO requester it also revokes the grant and returns to the configured Customer Area address. |
Default landing order is: SystemAdmin to /admin/system;
otherwise any visible department to /agent/queue; otherwise
/portal/tickets. A View-only user can land
on Agent Queue even though the navigation switch for Agent needs
Work. That is a navigation mismatch, not extra
authority.
Requester routes
| Route | Page |
|---|---|
/portal/tickets |
My Tickets; Current ticket work |
/portal/tickets/new |
Service Catalog |
/portal/tickets/create |
Quick Ticket |
/portal/tickets/{TicketIdentifier} |
Ticket Details / Ticket Follow-Up |
Agent, project, and approval routes
| Route | Page |
|---|---|
/agent/queue |
Agent Queue |
/agent/tickets/{TicketIdentifier} |
Ticket Details / Ticket Workbench |
/agent/queue/bulk-operations |
Queue Bulk Operations; Bulk operations |
/projects |
Projects |
/projects/{ProjectIdentifier} |
Project Details |
/projects/bulk-staffing |
Project Bulk Staffing; Restaff project roles |
/approvals |
My Approvals; Approval work |
/redaction-reveal-approvals |
Redaction Reveal Approvals |
The approval routes use the generic Workspace / Home masthead. There is no separate approval workspace.
External participant routes
| Route | Page |
|---|---|
/external/login |
External Login |
/external/enroll |
External Enrollment. Requires a valid invitation. |
/external |
External Access; Your linked tickets |
/external/tickets/{TicketIdentifier} |
External Ticket View |
Customer Portal SSO routes
A Customer Portal requester may reach only these. Every other page type is refused.
| Route | Behaviour |
|---|---|
POST /signin-customer-portal-sso |
Anonymous receiver for the signed handoff. Form-encoded, no query
string, exactly one sso and one sig value, no
files, an 8,192-byte request-size limit. On success, signs in and
redirects to /portal/tickets/new. |
/ |
Resolves to /portal/tickets. Does not expose an
internal landing preference. |
/portal/tickets/new |
Service Catalog, limited to the effective Customer Requester catalog. |
/portal/tickets |
My Tickets for that requester. |
/portal/tickets/{TicketIdentifier} |
Requester-safe detail and follow-up for a ticket they are authorized on. |
/logout |
Revokes the grant, clears the local cookie, returns to the configured Customer Area address when one is set. |
A refused route shows Page not available, offering Service Catalog, My Tickets, and Return to Customer Area. Quick Ticket, search, preferences, approvals, projects, agent, external, setup, and administration pages are all refused. This allowlist is checked in addition to record-level authorization.
System Administrator routes
Every route below requires SystemAdmin. Individual reads
and changes within them can require step-up as well.
| Area | Routes |
|---|---|
| Settings and diagnostics | /admin/settings, /admin/system,
/admin/about |
| Organization and access | /admin/tenant,
/admin/departments[/{DepartmentKey}],
/admin/department-access[/{DepartmentKey}],
/admin/users[/{UserId:guid}],
/admin/groups[/{GroupId:guid}],
/admin/system-admin-access |
| Identity and external lifecycle | /admin/directory[/{IntegrationKey}],
/admin/external-identities[/{ExternalIdentityId:guid}] |
| Mail, web, storage, database, licence | /admin/mail-delivery,
/admin/web-access-security,
/admin/https-and-certificates,
/admin/storage-continuity,
/admin/database-connection,
/admin/product-license |
| Workflow and catalog | /admin/status-definitions,
/admin/workflows[/{WorkflowId:guid}],
/admin/project-role-mappings,
/admin/sla-policies,
/admin/business-calendars,
/admin/service-categories,
/admin/services[/{RouteServiceId:guid}] |
| Fields and tags | /admin/service-custom-fields,
/admin/custom-fields,
/admin/project-custom-fields (also answers at
/admin/custom-fields/projects), /admin/tags
(also answers at /admin/metadata-tags) |
| Governance and data | /admin/import-operations, /admin/audit,
/admin/redactions, /admin/demo-data |
Customer Portal SSO is configured under
/admin/tenant.
There is one exception to the SystemAdmin rule above:
/admin/ping answers to SystemAdmin and reports
only that the application is running. For monitoring, prefer the
anonymous health routes below.
Monitoring routes
These two answer without signing in, and they disclose nothing but a status word. The other routes that answer without a signed-in session are all listed above: the sign-in and error pages, Initial Setup while no active System Administrator exists, External Enrollment with a valid invitation, and the anonymous customer-portal SSO receiver.
| Route | Returns | Proves |
|---|---|---|
/health/live |
{"status":"…"} |
The web process is up and answering. |
/health/ready |
{"status":"…"} |
The process is up and can open a connection to its database, checked with a three-second timeout. |
Point a monitor at /health/ready; it is also the Linux
container healthcheck target. Neither route reports on mail, background
work, or whether the product is behaving correctly. See Diagnostics and
logs.
Retired routes and stale instructions
| Retired item | What to use instead |
|---|---|
/admin/assignment-administration |
This is not an active workspace. Configure routing in Services, Departments, Workflows, Project Role Mappings, and Projects. To route existing tickets, use Agent Queue → Bulk operations → Project-linked role routing → Preview outcomes → Apply changes. |
| The instruction Admin → System Diagnostics | The primary navigation label is Settings. From it,
use the System Diagnostics card, which appears after
step-up. If already authorized, go to /admin/system
directly — an ordinary read there does not itself require step-up. |