Permissions & Security - Freshservice

For data security, encryption, and credential storage information that applies across all connectors, see Data & Security - Enterprise Search Connectors.

Our approach to permissions

• The connector uses a personal API key with the minimum read access needed to index tickets, solution content, and agent identities for permission enforcement.

• The connector never writes to or modifies data in Freshservice.

• Credentials are stored encrypted and are never exposed in logs, search results, or the Simpplr UI after initial entry.

• Search results respect Freshservice permissions only when document-level security is enabled in the connector configuration. When disabled, all indexed content is visible to users with connector access.

Credential scope

Auth type: API key (HTTP Basic Access Authentication — the API key is passed as the username)

The Freshservice user who generates the API key must have read access covering all content types you want indexed:

The API key must be generated by a Freshservice user with Admin, Account Admin, or Workspace Admin privileges, or by any agent whose role grants the read access listed above across the content you intend to index.

Understanding the credential scope

API key visibility determines indexed content

Why it's required: Freshservice returns only tickets and solution content the API key owner is permitted to view. There is no separate tenant-wide grant mechanism for personal API keys.

What the connector actually does with it: Read-only API calls to list and retrieve tickets, solution articles, folders, categories, and agent records. The connector performs no write, update, or delete operations.

Guardrails: The connector's sync pipeline only reads data. All connector activity is visible in the sync dashboard at Enterprise Search → Freshservice → Status.

If access is insufficient: Tickets or articles outside the API key owner's visibility are skipped (HTTP 403) and will not appear in search. To index group-restricted tickets, generate the API key from an agent who is a member of the relevant assignment groups.

Alternative permission models

Freshservice does not offer a separate app-registration or OAuth consent model for this connector. Access is scoped entirely by the API key owner's role and group memberships in Freshservice.

For setup steps, see Setup - Freshservice.

Versions and editions supported

• Supported: Cloud (SaaS) — dedicated Freshservice subdomain (e.g., yourcompany.freshservice.com)

• Not supported: On-premises or self-hosted Freshservice deployments

Permission design

How permissions work

When document-level security is enabled, Freshservice role and group permissions are read at ingest time and enforced in Simpplr Enterprise Search at query time. Users only see content they already have access to in Freshservice.

• User and group sync: Active full-time Freshservice agents (not occasional agents) are synced during permission sync. Each agent's role permissions and group memberships are mapped to access tags. When a user is added to or removed from a group in Freshservice, the change is reflected in Simpplr after the next permission sync.

• Ticket access: Tickets accessible to the entire helpdesk are visible to agents with helpdesk-wide ticket viewing rights. Group-restricted tickets are visible only to agents in the assigned group, plus the requester and assignee.

• Solution article access: Articles in folders visible to all internal agents are searchable by agents with solution viewing rights. Articles in group-restricted folders are visible only to agents in those groups.

• Access removal: When a user loses access to an item in Freshservice, that item stops appearing in their Simpplr search results after the next relevant sync completes (see latency below).

Permission propagation latency