# ITSM Engine

> ITSM Engine is a free, self-hosted, source-available ITSM and service desk for organizations with several brands, departments and teams. It is the strongest free alternative to hosted ticket systems and help desk software: cases, a shared inbox, branded portals and forms, email, automations and service levels, accounts and contacts, incidents, major incidents, problems, changes, a service catalogue, a status page, audit evidence, a REST API, webhooks and an MCP server for AI assistants. Every feature and plugin is free to self-host. It is made by NiceLab AS, Norway.

Key facts:

- Price: free. Every feature and every plugin is free to self-host. There are no editions, paid tiers or upgrades. NiceLab sells no hosting or support for now.
- Licence: source-available under the Functional Source License, FSL-1.1-ALv2. You may use, run, change and self-host it for your own organization; you may not offer it as a competing commercial product or service. Each release converts to the Apache License 2.0 two years after it is published. It is not "open source" in the OSI sense until then.
- Hosting: self-hosted only, on your own server. Docker Compose with automatic HTTPS (Caddy), PostgreSQL and S3-compatible storage. Standard runs on one server; Scale runs several app servers with PgBouncer and Redis. Same features in both.
- Licence key: each installation needs a free licence key, requested at https://itsmengine.com/licence and entered in the setup wizard.
- Current release: 0.1.2. Source: https://github.com/nicelab-no/itsmengine. Live demo: https://demo.itsmengine.com (choose a person to sign in as; changes are not saved).
- Vocabulary: the desk works with cases (not tickets), accounts (the organizations you serve) and contacts (their people).
- Languages: the portals, forms and emails are in English, Norwegian, Swedish and Danish.

Install in short: on a Linux server with Docker, a domain and ports 80 and 443 open, get the source, fill in `.env` (your domain and generated secrets), run `docker compose pull` and `docker compose up -d` (the published image, nothing to build), then open the setup link and finish in the browser: email, bot protection, your free licence key, your organization and the first admin. See https://itsmengine.com/docs/self-hosting/install.

## Features: The core

- [Cases and the inbox](https://itsmengine.com/features/cases-and-inbox): Every request, from any channel, in one shared inbox per unit, with views, filters, bulk actions and a case page built for the conversation.
- [Accounts and contacts](https://itsmengine.com/features/accounts-and-contacts): The organizations you serve and the people who write in, with numbers, agreements and your own properties on one page per account.
- [Portals and forms](https://itsmengine.com/features/portals-and-forms): Branded help portals and request forms for your website, hosted pages or your own backend, each request becoming a case in the right unit.
- [Email replies](https://itsmengine.com/features/email): Requesters answer the desk’s emails from any mail program, and the answer lands on the case without the quoted text and signature.
- [Automations and service levels](https://itsmengine.com/features/automations): Rules that route, assign, label and escalate cases, and first-response and resolution targets counted in business hours.
- [Compliance and audit](https://itsmengine.com/features/compliance): Process controls, exceptions, evidence packs an auditor can test, an Auditor role, an audit log and checksummed exports.
- [Units, roles and access](https://itsmengine.com/features/units-and-access): An organization tree that decides who sees what, roles that decide what they may do, and sign-in with two-factor and passkeys.
- [Reports and satisfaction](https://itsmengine.com/features/reports): Volume, response times and service levels per unit and person, against the period before, and satisfaction surveys after every case.
- [Approvals](https://itsmengine.com/features/approvals): One list of everything waiting for your approval, cases and changes, with separation of duties built in.
- [API, webhooks and AI assistants](https://itsmengine.com/features/api-and-integrations): A REST API described as OpenAPI 3.1, scoped tokens, signed webhooks and an MCP server so Claude, ChatGPT and other assistants work cases with your permissions.
- [Plugins and the plugin SDK](https://itsmengine.com/features/plugin-sdk): Every work area beyond cases is a plugin built on the same extension points you can use for your own.
- [Self-hosting](https://itsmengine.com/features/self-hosting): One container next to PostgreSQL and S3 storage, set up in a browser wizard, from one server to several.
- [Privacy and data retention](https://itsmengine.com/features/privacy): GDPR export and erasure per contact, legal holds, and scheduled housekeeping that deletes only what you turn on.

## Features: Plugins

- [Service Configuration](https://itsmengine.com/features/services): The service catalogue: owners, support teams, offerings, dependencies, health, suppliers and reviews, which incidents, problems and changes build on.
- [Incident Management](https://itsmengine.com/features/incidents): Declare incidents from cases, prioritise by impact and urgency, track targets, lead with a commander and update every affected requester at once.
- [Major Incident Management](https://itsmengine.com/features/major-incidents): Roles, a procedure checklist, escalation, stakeholder updates on a rhythm and owned reviews for the incidents that matter most.
- [Status Page](https://itsmengine.com/features/status-page): A public, branded status page on your support portal, with the incidents you choose to show and email subscriptions.
- [Problem Management](https://itsmengine.com/features/problems): Find out why incidents keep happening, publish workarounds as known errors agents see on cases, and see the real fix through.
- [Change Management](https://itsmengine.com/features/changes): Plan, assess, approve, carry out and review changes to live services, with approval policies, a CAB, customer approvals and a deployment gate.
- [Software Development](https://itsmengine.com/features/software-development): Kanban boards of developer tasks linked to cases, with sprints, epics, custom fields and access by unit, team or person.
- [Access Management](https://itsmengine.com/features/access-management): Who can see what and why, the history of every grant, access reviews with evidence, alerts and a sealed audit log.

## Docs: Overview

- [Documentation](https://itsmengine.com/docs): ITSM Engine's documentation is Markdown, kept with the code and changed in the same pull requests.

## Docs: Self-hosting

- [Self-hosting](https://itsmengine.com/docs/self-hosting): Running your own desk: installing it, configuring it, keeping it backed up and up to date.
- [System requirements](https://itsmengine.com/docs/self-hosting/requirements): What a server needs to run ITSM Engine, by the number of agents working at the same time.
- [Standard and Scale](https://itsmengine.com/docs/self-hosting/deployment-options): ITSM Engine can be deployed in two ways. Standard runs the whole desk on one server.
- [Installing](https://itsmengine.com/docs/self-hosting/install): ITSM Engine runs as one container, next to Postgres 17 and S3-compatible file storage.
- [Other ways to run it](https://itsmengine.com/docs/self-hosting/install/other-ways): The sections below describe the image itself, and running it with docker run, your own compose file, or a platform that builds from a Dockerfile.
- [First start and the first admin](https://itsmengine.com/docs/self-hosting/install/first-start): The seed is example data and never runs in production. On a fresh database (no admin yet) the desk starts in setup mode: every page leads to /setup, which…
- [Setup wizard and installation settings](https://itsmengine.com/docs/self-hosting/setup-wizard): Start the container with a database and two secrets, and finish everything else in the browser.
- [The licence key](https://itsmengine.com/docs/self-hosting/licence): Every installation of ITSM Engine has a licence key. It's free, it records who runs the desk, and the free key limits nothing.
- [Configuration](https://itsmengine.com/docs/self-hosting/configuration): Every value the desk reads: the few that stay in the environment, a handful of switches, and the installation settings you normally manage in the browser.
- [Backups](https://itsmengine.com/docs/self-hosting/backups): A complete backup has three parts: the Postgres database, the object storage bucket, and the two secrets.
- [Upgrades](https://itsmengine.com/docs/self-hosting/upgrades): An upgrade is a new image started on the same database. The database schema is updated by migrations, which the image applies when it starts.
- [Troubleshooting](https://itsmengine.com/docs/self-hosting/troubleshooting): Common problems when running the desk, what causes them and what to check.
- [Load testing and benchmarks](https://itsmengine.com/docs/self-hosting/load-testing): How ITSM Engine is load-tested, the latest results, and how to run the same test on your own hardware. The system requirements are based on these results.

## Docs: Using the desk

- [Agents' guide](https://itsmengine.com/docs/guide): For people who answer cases. Setting up units, forms, portals, brands and rules is for admins and isn't covered here.
- [Search](https://itsmengine.com/docs/guide/search): The search field at the top of the sidebar finds anything you can see: cases, incidents, accounts, contacts, dev tasks, and people (if you manage users).
- [The inbox](https://itsmengine.com/docs/guide/inbox): The inbox lists the cases in the units you have access to. You never see cases outside your units, and a case restricted to staff in certain countries only…
- [Other kinds of work](https://itsmengine.com/docs/guide/inbox/other-work): With Incident Management, Change Management or Problem Management on, the inbox has a switch above the list: Cases, then one for each of them (Incidents…
- [Reading the list](https://itsmengine.com/docs/guide/inbox/the-list): Everything a case has can be a column: also the priority, reference, requester email, team, the assignee's name, labels, source, channel, the number of…
- [Filters, search and saved views](https://itsmengine.com/docs/guide/inbox/filters-and-views): The pills in the toolbar narrow the current view. Pick a value from a pill to apply it, and the × on the pill to remove it; Clear filters removes them all.
- [Selecting, bulk actions and export](https://itsmengine.com/docs/guide/inbox/bulk-and-export): The × at the end of the bar clears the selection. Export above the list downloads the cases the view, search and filters select, with the columns you show…
- [Working on a case](https://itsmengine.com/docs/guide/cases): The case page has the conversation in the middle and the case's details on the right. Changes you make in the side panel are saved at once.
- [The conversation](https://itsmengine.com/docs/guide/cases/conversation): At the top are the subject, the status, the priority (when it isn't Normal), the due chip, the unit and when the case was opened.
- [Status, priority and who has it](https://itsmengine.com/docs/guide/cases/status-and-ownership): Change it in Status in the side panel, with Resolve at the top of the page, or with Send and resolve in the reply box.
- [Held requests, merging and legal hold](https://itsmengine.com/docs/guide/cases/held-merging-legal-hold): When a unit only takes requests from known contacts, a request from anyone else is held.
- [Controls and approvals](https://itsmengine.com/docs/guide/cases/controls): When your admin has set process controls on cases, the Controls panel in the side column lists the controls that apply to the case: whether each is Met or…
- [The requester](https://itsmengine.com/docs/guide/cases/requester): Requester shows the name, email address, phone and the language their emails are in. The name links to the contact page.
- [Replies and notes](https://itsmengine.com/docs/guide/replies): The box under the conversation is for answering the requester and for notes to your colleagues.
- [Approvals](https://itsmengine.com/docs/guide/approvals): Approvals in the sidebar, under Assigned to me, gathers what waits for an approval in one list. Its count is how many wait for your approval.
- [Logging a new case](https://itsmengine.com/docs/guide/new-case): For requests that don't come in through a form or portal: a phone call, someone at the desk, a chat, an email sent to you personally.
- [Canned replies](https://itsmengine.com/docs/guide/canned-replies): Canned replies are saved answers to the questions you get every week. You insert one into a reply in a click and adjust it before sending.
- [Accounts and contacts](https://itsmengine.com/docs/guide/accounts-and-contacts): Contacts are the people who send requests. Accounts are the companies or departments they belong to, so you can see everything from one company in one place.
- [Agreements](https://itsmengine.com/docs/guide/agreements): Data processing agreements, NDAs and other documents an account signs with you, kept on the account: the text as signed, who signed it, when, and from where.
- [Reports](https://itsmengine.com/docs/guide/reports): Reports in the sidebar shows how your team is doing: how many cases come in and get resolved, how fast you answer, whether you meet the service levels and…
- [Signing in and your account](https://itsmengine.com/docs/guide/account): You sign in at the desk's address with your email and password, or with a passkey.
- [Incidents](https://itsmengine.com/docs/guide/incidents): An incident is a problem that reaches many people at once: checkout is down, emails don't arrive, a release broke logging in.
- [Permissions and the API](https://itsmengine.com/docs/guide/incidents/permissions-and-api): Administrators hold them all. Give them to your own roles under Roles.
- [Priority and targets](https://itsmengine.com/docs/guide/incidents/priority-and-targets): You can set a priority yourself instead (Set it yourself when declaring, or Priority in the incident's side panel).
- [Declaring an incident](https://itsmengine.com/docs/guide/incidents/declaring): Declare incident on the Incidents page, or from a case: open the case's menu (… at the top right) and pick Declare incident….
- [The incident page](https://itsmengine.com/docs/guide/incidents/incident-page): At the top: the priority, the key and the status, the title, the commander, the affected units and how long it has lasted.
- [Linked cases and updates](https://itsmengine.com/docs/guide/incidents/cases-and-updates): A linked case's timeline says so ("linked this case to incident INC-3"), and again when the incident is resolved.
- [Major incidents](https://itsmengine.com/docs/guide/major-incidents): Major incidents come with the Major Incident Management plugin, which needs Incident Management.
- [Problems](https://itsmengine.com/docs/guide/problems): Incidents get service back quickly. Problems find out why the same thing keeps breaking, give agents a workaround while the cause is open, and make sure the…
- [Permissions and the API](https://itsmengine.com/docs/guide/problems/permissions-and-api): Tokens can get problems:read and problems:write. Assistants can list and read problems, search known errors (and give a requester the workaround's For…
- [Opening and working a problem](https://itsmengine.com/docs/guide/problems/working): A setting, Ask for a problem on every major incident (off by default), shows a prompt on a major incident's review while no problem is linked; it never…
- [Problem reviews](https://itsmengine.com/docs/guide/problems/reviews): The weekly problem review is where the team looks at the problems that need attention together.
- [Known errors](https://itsmengine.com/docs/guide/problems/known-errors): A problem with a workaround is a known error. Known errors in the sidebar lists the ones you can see, searchable by words and narrowed by Service (the…
- [Evidence](https://itsmengine.com/docs/guide/problems/evidence): Everything is on the timeline and in the audit log. More actions → Problem report opens the problem as a report: summary, impact, the root cause with its…
- [Changes](https://itsmengine.com/docs/guide/changes): A change is anything you do to a live service: a release, an upgrade, a new setting, a firewall rule.
- [Permissions and the API](https://itsmengine.com/docs/guide/changes/permissions-and-api): A service's owner may approve as its owner without change.approve. Tokens can get changes:read, changes:write and changes:approve.
- [Types and the lifecycle](https://itsmengine.com/docs/guide/changes/lifecycle): Finishing asks for the outcome: successful, successful with issues, failed and backed out, or failed and not backed out.
- [Recording a change](https://itsmengine.com/docs/guide/changes/recording): Calendar on the Changes page shows the next four weeks day by day: the changes planned, with their status and risk, and the freezes.
- [Approvals](https://itsmengine.com/docs/guide/changes/approvals): Who approves a change is decided by an approval policy: a set of conditions and one or more stages of approvers.
- [The CAB](https://itsmengine.com/docs/guide/changes/cab): The Change Advisory Board (CAB) decides together on the changes an approval policy sends to it.
- [Standard changes](https://itsmengine.com/docs/guide/changes/standard-changes): Templates on the Changes page lists the standard change templates: work done often, the same way, with little risk, like renewing a certificate or adding a…
- [Pipelines and the deployment gate](https://itsmengine.com/docs/guide/changes/pipelines): Most changes are deployments. An approval only works as a control when a deployment can't happen without it, so the pipeline asks the desk before it…
- [Customers](https://itsmengine.com/docs/guide/changes/customers): The customers affected are the accounts using the change's services; they can be narrowed by hand, with a reason.
- [Evidence](https://itsmengine.com/docs/guide/changes/evidence): Every step is on the change's timeline and in the audit log: the versions with their fingerprints, every approval, the times against the window, the outcome…
- [Services](https://itsmengine.com/docs/guide/services): A service is something you deliver that people rely on and ask for help with: Email, the online store, the VPN, payroll.
- [Examples of how to set up services](https://itsmengine.com/docs/guide/services/examples): There's no single right way to fill a service catalogue, and that is what makes it hard to start.
- [Permissions and the API](https://itsmengine.com/docs/guide/services/permissions-and-api): A permission held in one of the service's units is enough. Administrators hold them all. Give them to your own roles under Roles.
- [What a service is](https://itsmengine.com/docs/guide/services/what-a-service-is): New business services are visible to accounts and technical services hidden, until you change it (the service page shows Accounts: Visible or Hidden).
- [The Services page](https://itsmengine.com/docs/guide/services/services-page): Open Service Configuration → Services in the sidebar. The list shows the services that aren't retired, by name, in the same kind of list as cases and…
- [Accounts and their approvers](https://itsmengine.com/docs/guide/services/accounts): The Accounts tab on a service lists the accounts that use it: since when, until when, and under which contract, if you track that.
- [Status, windows and freezes](https://itsmengine.com/docs/guide/services/status-and-windows): A P4 doesn't change it. The status follows the incidents by itself: declare one on the service, raise or lower its priority, resolve it, and the status…
- [Services on cases and portals](https://itsmengine.com/docs/guide/services/on-cases-and-portals): With the plugin on, a case's side column has a Service section: what the case is about.
- [For auditors](https://itsmengine.com/docs/guide/services/auditors): The catalogue keeps what an assurance report (ISAE 3402, SOC 2) asks about the services it covers.
- [Access Management](https://itsmengine.com/docs/guide/access-management): Access Management is a plugin. If you don't see Access Management under Plugins in the sidebar, an admin turns it on under Settings → Plugins.
- [Status page](https://itsmengine.com/docs/guide/status-page): A status page tells the people you support what is going on before they write in: a page on your support portal, at /status, with the incidents you choose…
- [Software Development](https://itsmengine.com/docs/guide/dev-board): Software Development is where developer work lives: projects, each with a kanban board of tasks (bugs, features, tasks, improvements and epics) in columns…
- [Who can use a project](https://itsmengine.com/docs/guide/dev-board/access): Each unit and team gives a role, and so does adding someone by name. Below the list, People shows everyone once, with every way they have access; their role…
- [Sprints, fields and archiving](https://itsmengine.com/docs/guide/dev-board/sprints-fields-archiving): Without sprints the tab is a List of the open tasks. Above the lists are the same search and filters as on the board (assignee, type, epic).
- [The board and tasks](https://itsmengine.com/docs/guide/dev-board/board-and-tasks): The Board tab shows the project's columns. With sprints on, it shows the running sprint (Show every task shows them all).

## Docs: Settings for admins

- [Setting up the desk](https://itsmengine.com/docs/admin): These pages are for admins: how to set up the desk for your organization, its channels and its workflow.
- [Organization](https://itsmengine.com/docs/admin/organization): The unit tree is the structure of your desk. Every case, form and portal belongs to one unit, and the unit decides the brand requesters see, which…
- [Users](https://itsmengine.com/docs/admin/users): Everyone who works in the desk has an account. Under Settings → Users you invite people, decide which units they work in and which roles they hold, and…
- [Teams](https://itsmengine.com/docs/admin/teams): A team is a group of people who work together. Under Settings → Teams you give a whole group the same units and roles in one place, and each team has a…
- [Roles](https://itsmengine.com/docs/admin/roles): A role is a set of permissions. Under Settings → Roles you see what each role allows and who holds it, and make roles of your own.
- [Brands](https://itsmengine.com/docs/admin/brands): A brand decides how the desk looks to requesters: the logo and colours on portals, forms and emails, the address emails come from, and the signature under…
- [Data properties](https://itsmengine.com/docs/admin/data-properties): Data properties are your own fields on records: an id in your CRM or ERP, a contract tier, a renewal date, a link to a map.
- [Who may see what](https://itsmengine.com/docs/admin/access): Two things decide which cases someone on your team can see: the units they work in, and restricted access for accounts and contacts who may only be served…
- [Agreements](https://itsmengine.com/docs/admin/agreements): The templates agreements with accounts are made from: data processing agreements, NDAs, consent to support from other countries, or anything else you have…
- [Personal data requests](https://itsmengine.com/docs/admin/privacy): The export is the contact in one organization: the same address in another organization is another contact, with its own export.
- [A desk run by your provider](https://itsmengine.com/docs/admin/managed-desks): When a provider hosts your desk for you, they look after the parts that keep it running, and everything about how you work stays yours.
- [Forms](https://itsmengine.com/docs/admin/forms): A form takes requests from outside the desk: a contact form on your website, a page the desk hosts for you, your own backend posting on behalf of its users…
- [Browser mode and server mode](https://itsmengine.com/docs/admin/forms/modes): The desk tells the two apart by the request: one with signature headers or a bearer key is a server request, any other is a browser request.
- [Building the fields](https://itsmengine.com/docs/admin/forms/fields): The Fields card lists what the form asks. Before your fields, the form always asks for an email address, and for a name and a subject if you turn those on…
- [Settings](https://itsmengine.com/docs/admin/forms/settings): Every case from a form shows its answers as the request on the case page, and the source names the form.
- [Where it's used](https://itsmengine.com/docs/admin/forms/where-used): The Where it's used tab has two parts: Website and Portals. Under Website, there's copy-paste code made from the saved form, with your desk's address, the…
- [Submission log, turning off and deleting](https://itsmengine.com/docs/admin/forms/log-and-removing): The Submissions tab lists every attempt, newest first: When, Result, Channel (browser or server), Address and Origin.
- [Portals](https://itsmengine.com/docs/admin/portals): A portal is a help centre on the desk where requesters pick what they need, fill in a short form for it, and later follow their requests.
- [Front page and categories](https://itsmengine.com/docs/admin/portals/front-page-and-categories): English is used for any language you leave empty, so write English first. A dot on a language tab means it has text.
- [Appearance and protection](https://itsmengine.com/docs/admin/portals/appearance-and-protection): Portals are protected like a form in browser mode, and submissions must come from the portal page itself. Unlike forms, portals have no hourly cap.
- [Contact sign-in and My requests](https://itsmengine.com/docs/admin/portals/sign-in): My requests lists the signed-in contact's cases in the portal's unit and the units below it, most recently updated first, with reference, subject and status.
- [Its own domain](https://itsmengine.com/docs/admin/portals/own-domain): A portal can have its own address, like help.example.com, instead of /p/ on the desk.
- [Submission log, turning off and deleting](https://itsmengine.com/docs/admin/portals/log-and-removing): The Submissions tab lists every request sent through the portal, newest first, in the same way as a form's submission log: accepted ones link to their case…
- [IP allowlists](https://itsmengine.com/docs/admin/ip-allowlists): An IP allowlist is a named list of your servers' addresses. A form in server mode accepts signed requests only from the addresses on its lists, so a leaked…
- [Email replies](https://itsmengine.com/docs/admin/email-replies): Requesters can answer the desk's emails directly, and the answer lands on the case as if they had written it on the case page.
- [Setting it up](https://itsmengine.com/docs/admin/email-replies/setup): Below them the section shows the webhook address to give the service, short setup steps for the service you chose, the reply domain each brand uses, and the…
- [What waits for review](https://itsmengine.com/docs/admin/email-replies/review): Email review appears in the sidebar, under the inbox views, when something is waiting, with the number.
- [Troubleshooting](https://itsmengine.com/docs/admin/email-replies/troubleshooting): Replies don't arrive. The service gets 401. The service gets 404. The service gets 400. Emails still say replies aren't read.
- [Automations](https://itsmengine.com/docs/admin/automations): Automations are rules that do routine work on cases: route them to the right unit, add labels, set priority, assign someone, and escalate cases that wait…
- [Rules on changes and problems](https://itsmengine.com/docs/admin/automations/changes-and-problems): A rule that runs on Changes or Problems works like a rule on cases, with triggers, conditions and actions of its own.
- [Triggers and conditions](https://itsmengine.com/docs/admin/automations/triggers-and-conditions): A scheduled rule acts on a case once per situation. It acts again only when the time it measures from changes, for example when the requester writes again…
- [Actions](https://itsmengine.com/docs/admin/automations/actions): Plugins can add conditions and actions like these; while the plugin is off they aren't offered, saved ones don't match, and their actions are skipped.
- [Testing, order and history](https://itsmengine.com/docs/admin/automations/testing-and-history): It says how many match and lists up to 25 of them, each a link to the case. Held requests are left out.
- [Service levels](https://itsmengine.com/docs/admin/service-levels): Service levels are the times your team promises: how soon a case gets its first answer, and how soon it's resolved, per priority.
- [Satisfaction surveys](https://itsmengine.com/docs/admin/surveys): When a case is resolved for the first time, the requester gets a short email from the brand asking how it went.
- [Plugins](https://itsmengine.com/docs/admin/plugins): Plugins add work areas to the desk that not every team needs, like a board of developer tasks.
- [The plugins](https://itsmengine.com/docs/admin/plugins/the-plugins): Software Development and Access Management need nothing but the desk, so a support desk can use them without the IT plugins.
- [Settings and permissions](https://itsmengine.com/docs/admin/plugins/settings-and-permissions): Each plugin that is on has a page in Settings, in the Plugins group, under its own name.
- [Language](https://itsmengine.com/docs/admin/languages): Settings → Language (admins) sets the languages your desk speaks to requesters in. It applies to the whole installation.
- [Housekeeping](https://itsmengine.com/docs/admin/housekeeping): Housekeeping removes data nobody needs any more, on a schedule you set, so the database doesn't grow forever.
- [Compliance and audit](https://itsmengine.com/docs/admin/compliance): An auditor checking your service desk for an assurance report (ISAE 3402 or ISAE 3000, SOC 2) or a certification (ISO/IEC 27001, ISO/IEC 20000) asks the…
- [Process controls](https://itsmengine.com/docs/admin/compliance/process-controls): On the right, In plain words reads the control back as one sentence while you write it, for example “Every case in Payroll whose priority is High or Urgent…
- [Approvals as evidence](https://itsmengine.com/docs/admin/compliance/approvals): Some changes don't fit a change record: a one-off access request, a refund over a limit. Approvals on cases cover those.
- [Population, sample and evidence](https://itsmengine.com/docs/admin/compliance/evidence): Settings → Evidence (the Audit evidence permission) has the three steps.
- [The auditor's access](https://itsmengine.com/docs/admin/compliance/auditors): An engagement has an end. When you give a role (on a person's or a team's roles), the optional Until date ends it: the role stops counting at the end of…
- [Exports and limits](https://itsmengine.com/docs/admin/compliance/exports-and-limits): Every export, of a list, a population, a sample, an evidence pack, a record's PDF or the configuration, is kept in the export log under Settings → Exports…
- [Audit log](https://itsmengine.com/docs/admin/audit-log): The audit log records who did what to the desk's settings and security: sign-ins, changes to people and units, configuration, tokens and agreements.

## Docs: API and integrations

- [API and integrations](https://itsmengine.com/docs/api): Ways for other systems to work with the desk.
- [API tokens and the REST API](https://itsmengine.com/docs/api/tokens): Integrations and scripts use the desk's REST API with an API token; AI assistants use the MCP server with a token or by connecting through OAuth.
- [Webhooks](https://itsmengine.com/docs/api/webhooks): A webhook sends case events to your own systems as they happen: a CRM, a chat bot, a data warehouse.
- [Form submissions](https://itsmengine.com/docs/api/form-submissions): Every form has two public endpoints: one that describes the form, and one that turns a submission into a case.
- [Submitting and errors](https://itsmengine.com/docs/api/form-submissions/submitting): The body may be at most 64 kB. Each mode must be turned on for the form. 201 Created with the case's reference and the requester's own link to the case page.
- [Browser mode and server mode](https://itsmengine.com/docs/api/form-submissions/modes): Your backend posts the submission, signed with a form secret. Use it when the request comes from your own app: you can include facts the requester can't…
- [The audit API](https://itsmengine.com/docs/api/audit): The endpoints behind Settings → Compliance and audit: process controls and their exceptions, populations, samples and evidence packs, the configuration…
- [MCP server: Claude, ChatGPT and other assistants](https://itsmengine.com/docs/api/mcp): The desk is an MCP server at https:///mcp (Streamable HTTP). An assistant connected to it can search and read cases, log new ones, add notes, update them…
- [Building a plugin](https://itsmengine.com/docs/api/plugins): For developers. A plugin adds a work area to the desk through its extension points; this page describes them, the manifest, the rules a plugin must follow…
- [The manifest](https://itsmengine.com/docs/api/plugins/manifest): Plugins are layers: a plugin that needs another (requires.plugins) is built on it, like Incident Management on Service Configuration (itsm).
- [Server side](https://itsmengine.com/docs/api/plugins/server): The module is imported into the desk like its own modules. Inject what you need from the SDK (PrismaService, AccessScopeService, CasesService, PluginHost…
- [Web side](https://itsmengine.com/docs/api/plugins/web): inboxType adds another kind of work to the inbox's switch, by label. Its props are { q, unitId, assignee, compact, done, serviceId } (InboxListProps).
- [The Software Development plugin's API](https://itsmengine.com/docs/api/plugins/dev-api): All under /api/v1/x/dev/, 404 while the plugin is off. MCP tools Webhook events
- [The service catalogue API](https://itsmengine.com/docs/api/plugins/itsm-api): All under /api/v1/x/itsm/services, 404 while the Service Configuration plugin is off; reading needs itsm:read, changing itsm:write.
- [The Problem Management plugin's API](https://itsmengine.com/docs/api/plugins/problems-api): Under /api/v1/x/problems, 404 while the plugin is off; problems:read and problems:write. Guide: problems.
- [The Change Management plugin's API](https://itsmengine.com/docs/api/plugins/changes-api): Under /api/v1/x/changes, 404 while the plugin is off; changes:read, changes:write, and changes:approve to decide.
- [The Incident Management plugin's API](https://itsmengine.com/docs/api/plugins/incidents-api): All under /api/v1/x/incidents/, 404 while the plugin is off; reading needs incidents:read, changing incidents:write, the settings incidents:admin (admins).
- [The Major Incident Management plugin's API](https://itsmengine.com/docs/api/plugins/major-api): All under /api/v1/x/major/, 404 while the plugin is off (it needs Incident Management on).
- [The Status Page plugin's API](https://itsmengine.com/docs/api/plugins/status-api): All under /api/v1/x/status/, 404 while the plugin is off (it needs Incident Management on). Reading needs status:read, the settings status:admin (admins).
- [The Access Management plugin's API](https://itsmengine.com/docs/api/plugins/access-api): All under /api/v1/x/access/, 404 while the plugin is off. Everything but the reviews is for admins (access:read; changes access:admin).

## Optional

- [Full text of the docs and features](https://itsmengine.com/llms-full.txt): everything above in one file
- [Get a free licence key](https://itsmengine.com/licence): the form that emails a key for one installation
- [Live demo](https://demo.itsmengine.com): a demo desk with sample data, written again every night
- [Source code on GitHub](https://github.com/nicelab-no/itsmengine): the app, its docs and the licence
- [NiceLab AS](https://nicelab.no): the company that makes ITSM Engine
- [Privacy](https://itsmengine.com/privacy): what NiceLab keeps when you ask for a licence key