[Gorelo] Create a contact under a client. Provide a JSON object body. Fields: clientId (integer, required — the owning client from gorelo_list_clients), firstName, lastName, clientLocationId (integer, optional — from gorelo_list_client_locations), primaryEmail, secondaryEmail (array of strings), mobilePhone, mobilePhoneCountryCode, officePhone, officePhoneCountryCode, jobTitle, department, timeZone, description. Requires an API key with the contacts edit scope (a 403 means the key lacks it).

[Gorelo] Delete a contact (person) by its numeric id. This is a SOFT delete: the contact is marked inactive so its history on tickets and conversations stays intact, and it disappears from every list. A contact still attached to an unclosed ticket — as its primary contact or among its secondary contacts — is NOT deleted; the 409 says how many tickets are holding it. The Gorelo app detaches the contact from those tickets itself, but this endpoint will not edit a caller's tickets as a side effect, so it refuses and leaves the reassignment to you. Deleting an already-deleted contact succeeds, so a retried request is safe. Requires an API key with the contacts edit scope.

[Gorelo] Get a single contact by its numeric id (from gorelo_list_contacts). Returns the full contact record (name, emails, phones, client/location, job title, etc.). Requires an API key with the contacts read scope.

[Gorelo] List contacts (people) in the Gorelo CRM. Optionally filter by contactIds (a comma-delimited string of numeric contact ids) and/or clientId (a numeric client id from gorelo_list_clients) to return only that client's contacts. With no filters, returns all contacts. Requires an API key with the contacts read scope (a 403 means the key lacks it). Cursor-paginated: pass the Cursor from the previous response to walk pages, and PageSize to size them. Note: Gorelo Public API 1.0.0 no longer documents the contactIds filter, so it may not narrow the result; clientId is still supported.

[Gorelo] Update an existing contact. Provide a JSON object body that MUST include contactId (integer — the contact to update; there is NO id in the URL, Gorelo takes it from the body). Updatable fields: firstName, lastName, clientId (integer), clientLocationId (integer), primaryEmail, secondaryEmail (array of strings), mobilePhone, mobilePhoneCountryCode, officePhone, officePhoneCountryCode, jobTitle, department, timeZone, description. Requires an API key with the contacts edit scope.

[Gorelo] Create a client (company). Provide a JSON object body. Fields: name, billingName, alternateName, domain, and an optional nested location object { name, phoneCountryCode, phone, phoneExt, address1, address2, city, state, country, postalCode, timeZone }. Requires an API key with the clients edit scope (a 403 means the key lacks it).

[Gorelo] Delete a client (company) by its numeric id. This is a SOFT delete: the client is marked inactive so its history stays intact, and it disappears from every list. A client that still has records attached to it is NOT deleted — assets, open tickets, active contacts, contracts, products, bundles or active web domains each block it, and the 409 names what is blocking and how many. The Gorelo app warns about those and deletes anyway; this endpoint refuses instead, so nothing is lost to a request that cannot be undone. Detach or close the blocking records first, then retry. Deleting an already-deleted client succeeds, so a retried request is safe. Requires an API key with the clients edit scope.

[Gorelo] Get a single client (company) by its numeric id (from gorelo_list_clients). Returns id, name, statusId, billingName, alternateName, isDefault, and web domains. Requires an API key with the clients read scope.

[Gorelo] List the locations (sites) for one client. Provide the numeric clientId (from gorelo_list_clients). Each location carries id, name, address, phone, timeZone, and default flags — use a location id as clientLocationId when creating a contact or ticket. Requires an API key with the clients read scope.

[Gorelo] List all clients (companies) in the Gorelo CRM. Each client carries id, name, statusId, billingName, alternateName, and web domains. Use the returned id with gorelo_get_client, gorelo_list_client_locations, or as clientId when creating contacts/tickets. Requires an API key with the clients read scope (this is also the scope the StackJack Test Connection uses, so a ticket-only key will 403 here). Cursor-paginated: pass the Cursor from the previous response to walk pages, and PageSize to size them.

[Gorelo] Update an existing client (company). Provide a JSON object body that MUST include id (integer — the client to update; there is NO id in the URL, Gorelo takes it from the body). Updatable fields: name, statusId (integer), billingName, alternateName. Requires an API key with the clients edit scope.

[Gorelo] Delete an RMM agent device by its UUID id (from gorelo_list_agents). This UNINSTALLS the Gorelo agent from the host and deactivates the device — it is the same delete the Gorelo app performs, so the device is deactivated rather than removed and its history on tickets and contacts survives. Deleting a device that is already deleted or already uninstalling succeeds without issuing a second uninstall, so a retried request is safe. Requires an API key with the assets write scope.

[Gorelo] Delete a custom (non-agent) asset by its UUID id (from gorelo_list_custom_assets). The asset is deactivated rather than removed — the same soft delete the Gorelo app performs — so it disappears from every list while its history stays intact. Deleting an already-deleted custom asset succeeds, so a retried request is safe. Requires an API key with the assets write scope.

[Gorelo] Get a single RMM agent device by its UUID id (from gorelo_list_agents). Returns the full device record (OS, hardware, IPs, last-logged-on user, warranty, agent versions, etc.). Requires an API key with the assets read scope.

[Gorelo] List all RMM agent devices. Each agent carries a UUID id, name/displayName, statusId, client/location, OS and hardware details, IP addresses, last-boot / last-logged-on-user, and agent version fields. Use the returned UUID with gorelo_get_agent or as an agentAssetId when creating a ticket. Requires an API key with the assets read scope. Cursor-paginated: pass the Cursor from the previous response to walk pages, and PageSize to size them.

[Gorelo] List custom (non-agent) assets — the equipment tracked in Gorelo without an RMM agent on it, such as switches, printers, firewalls and licences. Newest first (createdOn descending). Cursor-paginated: pass the Cursor from the previous response to walk pages, and PageSize to size them. Every filter is optional and they combine; clientIds is a comma-delimited list of numeric client ids and query is a free-text search. The four timestamp bounds take ISO 8601 UTC instants and are passed through verbatim. Requires an API key with the assets read scope.

[Gorelo] Download the rendered PDF for an invoice by its UUID id. This is the only Gorelo endpoint that answers a file rather than JSON, so instead of the PDF bytes you get a JSON envelope with sasUrl (a short-lived read-only download link, valid for 15 minutes), contentType, suggestedFileName, sizeBytes and expiresAt. Fetch the link before it expires; nothing else in StackJack keeps a copy. Gorelo renders the document on demand from the invoice's current data and template, so it reflects the invoice at request time rather than a stored copy, and each successful download is recorded upstream against the invoice as an export event. Requires an API key with the billing read scope.

[Gorelo] List the billing roles configured for your organization. Use a role's id as billingRoleId when logging time with gorelo_create_time_entry. This is a lookup and declares no query parameters, so it is not paginated. Requires an API key with the billing read scope.

[Gorelo] List billing contracts, each with its service lines inline. A contract is the agreement with a client; a service line is one set of labour terms and products inside it, and most contracts have a single one. A service line's id is what a time entry carries as serviceLineId, so this is where the value for gorelo_create_time_entry comes from. Cursor-paginated: pass the Cursor from the previous response to walk pages, and PageSize to size them. clientIds is an optional comma-delimited list of numeric client ids; a well-formed id that owns no contracts returns an empty page, not an error. Requires an API key with the billing read scope.

[Gorelo] List the work types configured for your organization. Use a work type's id as workTypeId when logging time with gorelo_create_time_entry. A work type carries the minimum and increment that round a logged duration up, which is why a billed duration can exceed the elapsed time between start and end. This is a lookup and declares no query parameters, so it is not paginated. Requires an API key with the billing read scope.

[Gorelo] Log time against a ticket. Body (fieldsJson) is a JSON object taking ticketId (the ticket UUID) plus any two of startedOn, endedOn (single UTC instants) and actualHours (decimal hours) — the third is derived, and sending all three is accepted only when they agree. Optional: billableStatusId, userId, billingRoleId (from gorelo_list_billing_roles), workTypeId (from gorelo_list_work_types), serviceLineId (from gorelo_list_contracts), comment, distance, attachments. The logged duration is rounded up by the work type's minimum and increment, so the billed duration can exceed the elapsed time. Supplying a serviceLineId prices the entry against that contract and moves its hour allowance. The entry is billed to the ticket's client and the client is NOT sent in the request; a ticket with no client is refused with 409. Returns raw JSON.

[Gorelo] Delete a time entry by its numeric id. Only an entry that is still open can be deleted: one that has been approved, completed, voided or invoiced is refused with 409, as is one logged against a closed ticket. This mirrors the app and is a TWO-STEP — an entry waiting for approval is first returned to unclosed and stays where it is, and deleting it again deactivates it and reverts its billing ledger. The response's outcome field says which happened, Reopened or Deleted. Deleting an already-deleted entry is accepted and reports Deleted without touching the ledger again, so a retried request is safe. Requires an API key with the time write scope.

[Gorelo] Get a single time entry by its numeric id (from gorelo_list_time_entries). Same shape as one row of the list, so a caller can follow a page with a single read or re-read an entry after changing it. The entry is addressed by id alone and the lookup is scoped by the authenticated organization, so another organization's entry and a deleted one both read as not found. Requires an API key with the time read scope.

[Gorelo] List logged time across every ticket and task. Pass ticketIds to get a single ticket's time. Cursor-paginated: pass the Cursor from the previous response to walk pages, and PageSize to size them. Every filter is optional and combining two narrows to the entries satisfying both; each id filter is a comma-delimited list, and a value that is not an id is rejected with 400 while a well-formed value matching nothing returns an empty page. The timestamp bounds take ISO 8601 UTC instants and are passed through verbatim: each Since bound includes the instant it names and each Before bound excludes it, so two windows sharing an edge tile instead of double-counting. Each row carries actualHours (what was logged) and adjustedHours (after the work type's minimum and increment rounding). Requires an API key with the time read scope.

[Gorelo] Partially update a time entry by its numeric id. Send only the fields to change: every field is optional, a field left out keeps its current value, and re-supplying a value the entry already holds writes nothing. startedOn, endedOn and actualHours are merged with the entry's current values before the same any-two-of-three rule the create applies, so sending actualHours alone keeps startedOn and moves endedOn. The response is the updated entry in the same shape gorelo_get_time_entry returns. Body (fieldsJson) is a JSON object; the id is the tool argument, not a body field. The ticket an entry is logged against cannot be changed and neither can its attachments: a body carrying ticketId or attachments is rejected with 400, as any unknown field is. To move time to another ticket, delete the entry and log it again.

[Gorelo] Raise an alert for a client. Provide a JSON object body. Fields: clientId (integer, required — the owning client from gorelo_list_clients), name, resource (the affected resource string), severity (integer 1-4 — the alert level; the vendor spec does not label the levels), description. The endpoint returns HTTP 200 with an empty body on success (surfaced as ). Note: the public API has no alert list or get endpoint — this is a create-only surface. Requires an API key with the alerts edit scope (a 403 means the key lacks it).

[Gorelo] Create a PSA ticket. Provide a JSON object body. Common fields: title, description, clientId (integer, from gorelo_list_clients), locationId (integer), contactId (integer), groupId (integer, required — the owning team/group), typeId (integer, from gorelo_list_ticket_types), statusId (integer, from gorelo_list_ticket_statuses), priorityId (integer 0-4), sourceId (integer 1-6 — the ticket origin), tagIds (array of integers, from gorelo_list_ticket_tags), ccContactIds / watcherIds / assistingAssigneeIds (arrays of integers), leadAssigneeId (integer), agentAssetIds / customAssetIds / uptimeIds (arrays of UUIDs), createdByName, sendTicketCreatedEmail (bool), isUnread (bool). Returns . Read the created ticket back with gorelo_get_ticket. Requires an API key with the tickets edit scope.

[Gorelo] Delete a ticket by its UUID. THIS DELETES THE TICKET AND ITS TIME ENTRIES. It is the same soft delete the Gorelo app performs: the ticket is deactivated and recoverable from the Recycle Bin, never removed; its delayed actions are cleared, scheduled automation is cancelled, and it leaves the search index. The ticket's time entries are deleted with it and any contract hours they consumed are returned to the contract. If ANY of those time entries has already been approved, completed, voided or invoiced, the WHOLE request is refused with 409 and nothing is deleted - the message lists the blocking entries. Deleting an already-deleted ticket succeeds without repeating any of that, so a retried request is safe. Requires an API key with the tickets edit scope.

[Gorelo] Get a single ticket by its UUID (from gorelo_list_tickets, or the ticketId gorelo_create_ticket returns). Returns every field the list returns, with the same values, PLUS the ones the list leaves out because each costs a further read: the ticket's description, the assets and uptime checks linked to it, its logged time and product totals, any ticket-level billing override, its shipments, and its banner. Requires an API key with the tickets read scope.

[Gorelo] List the configured ticket statuses (id, name, baseStatusId, color, sortOrder, description). Use a status id as statusId when creating a ticket with gorelo_create_ticket. Requires an API key with the tickets read scope. This lookup declares no query parameters, so it is not paginated.

[Gorelo] List the configured ticket tags (id, name, description, isAiTag). Use tag ids in the tagIds array when creating a ticket with gorelo_create_ticket. Requires an API key with the tickets read scope. This lookup declares no query parameters, so it is not paginated.

[Gorelo] List the configured ticket types (id, name, description, isAiType). Use a type id as typeId when creating a ticket with gorelo_create_ticket. Requires an API key with the tickets read scope. This lookup declares no query parameters, so it is not paginated.

[Gorelo] List tickets. Cursor-paginated: pass the Cursor from the previous response to walk pages, and PageSize to size them (1-200, default 50). Default sort is updatedOn descending. Every filter is optional; each id filter is a comma-delimited list and a ticket matches if it carries any of the values, while two filters combine to narrow. sortBy accepts ONLY updatedOn or createdOn and sortOrder ONLY asc or desc (case-insensitive) - any other value is rejected with 400, unlike an unrecognized filter value, which simply matches nothing. priorityIds is the PUBLIC priority scale: None=0, Urgent=1, High=2, Normal=3, Low=4. query is a keyword matched against the ticket title, number and display number, up to 200 characters. The row shape omits the description and the ticket's linked assets, time and product totals - read one ticket with gorelo_get_ticket for those. Requires an API key with the tickets read scope.

[Gorelo] Partially update a ticket by its UUID. Send only the fields to change; a field left out keeps its current value. Each supplied field is applied by its own internal update path, so the same notifications, timeline entries and cache refreshes fire as when the field is changed in the Gorelo app. WATCH OUT: changing clientId RESETS the ticket's contact, cc contacts and billing override and unlinks its assets - supply those fields in the SAME request to give them new values. Common fields: title, description, statusId, priorityId (public scale 0-4), typeId, clientId, locationId, contactId, groupId, leadAssigneeId, tagIds, ccContactIds. The id is the tool argument, not a body field; unlike clients and contacts, tickets have a real per-id update route.

[Gorelo] Add a comment to a ticket. Body (fieldsJson) is a JSON object requiring body (the comment as HTML - mentions go inside the HTML) and conversationTypeId (1 Public, 2 Private, 3 Side Conversation, 4 Approval). conversationId is REQUIRED for Side Conversation and Approval and REJECTED for Public and Private, which are the ticket's own main thread. Optional: createdByName (a display name to show the comment as), createdOn (backdate for importing history from another system - it must not be in the future or earlier than the ticket's own createdOn), and attachments (files as returned by gorelo_upload_ticket_attachment). The comment is ALWAYS recorded as coming from the API: a caller cannot post as a specific real user, and the To and Cc lists are taken from the conversation rather than the request. Posting into an approval with conversationTypeId 4 is also what sends its approvers their confirmation email.

[Gorelo] Create an approval on a ticket. Body (fieldsJson) is a JSON object requiring name (a short label) and contactIds (an array of contact ids asked to approve; at least one). Every id must be Active, belong to this ticket's client (any client when the ticket has none) and carry a contact tag marked as an approver - the same restriction the Gorelo app's own approver picker applies. Optional attachPublicConversation (bool) attaches the ticket's existing public comments the first time a comment is posted into this approval. The approval is created EMPTY and every listed contact starts Pending; post into it afterwards with gorelo_add_ticket_comment using the returned id as conversationId and conversationTypeId 4, which is also what sends the approvers their confirmation email. Read its status back with gorelo_get_ticket_approval.

[Gorelo] Create a side conversation on a ticket - a thread aimed at someone outside the ticket's main correspondence, such as a vendor. Body (fieldsJson) is a JSON object requiring name (a short label, up to 250 characters) and email (the address the conversation is directed to, up to 50 characters). Optional: ccEmails (an array of addresses, each up to 50 characters) and attachPublicConversation (bool - attaches the ticket's existing public comments the first time a comment is posted into this conversation). Post into it afterwards with gorelo_add_ticket_comment using the returned id as conversationId and conversationTypeId 3.

[Gorelo] Delete a comment from a ticket. PRIVATE COMMENTS ONLY: Gorelo has no delete for public comments, so a public comment id is refused with 409. The comment is deactivated rather than removed, the same soft delete the Gorelo app performs. Deleting an already-deleted comment succeeds, so a retried request is safe. Requires an API key with the tickets edit scope.

[Gorelo] Get a single approval on a ticket, with its approvers. THIS IS WHERE APPROVAL STATUS LIVES - gorelo_list_ticket_conversations stays lean and does not carry it. The status is worked out from the approvers: Disapproved as soon as anyone disapproves, Approved once everyone approves, Pending otherwise. Take the approvalId from gorelo_list_ticket_conversations (the Approval row's id) or from what gorelo_create_ticket_approval returns. Requires an API key with the tickets read scope.

[Gorelo] Get a single comment on a ticket. The same shape as one row of gorelo_list_ticket_comments EXCEPT that the full bodyHtml is always included, so there is no bodyTruncated field - this is the read to follow a truncated list row with. Both ids are UUIDs. Requires an API key with the tickets read scope.

[Gorelo] List the comments on a ticket. Cursor-paginated (PageSize 1-200, default 50) and read oldest-first by default, like a conversation top to bottom. Filter from broadest to narrowest: send nothing for every comment on the ticket; send conversationType alone (comma-delimited) to select kinds; or send a SINGLE conversationType together with conversationId to read one specific conversation. Conversation types are 1 Public, 2 Private, 3 Side Conversation, 4 Approval; get a conversationId from gorelo_list_ticket_conversations. Row bodies can be truncated - each row carries a bodyTruncated flag, and gorelo_get_ticket_comment always returns the full bodyHtml. Requires an API key with the tickets read scope.

[Gorelo] List the conversations on a ticket. Public and Private are the ticket's own main thread and come back with a NULL id; Side Conversation and Approval carry a real id that can be passed to gorelo_list_ticket_comments as conversationId. Every row has the same lean shape - type-specific detail lives on each type's own read, so an approval's status comes from gorelo_get_ticket_approval, not from here. This route declares no query parameters, so it is not paginated. Requires an API key with the tickets read scope.

[Gorelo] Upload a single file to a ticket. Provide the file EITHER as base64 in contentBase64 OR as a public https URL in sourceUrl - exactly one of the two, never both. StackJack downloads an https URL server-side and refuses anything over 25 MB, a non-https URL, or a redirect to a different host. Any file type is accepted. Returns the stored file's name and a TEMPORARY secure link. THIS DOES NOT PUT THE FILE ON THE TICKET BY ITSELF: pass the returned name and link in the attachments array of gorelo_add_ticket_comment to make it visible. Gorelo enforces no size rule on this endpoint of its own, so an oversized file is refused by the infrastructure in front of it with a bare 413 rather than a readable validation error. Requires an API key with the tickets edit scope.

[Gorelo] Delete an uptime check by its UUID. This is the same delete the Gorelo app performs: the check is DEACTIVATED rather than removed, its monitoring schedule is cancelled in the region that runs it, and its cached status is cleared - so monitoring stops and the check disappears from the app. Deleting an already-deleted check succeeds, so a retried request is safe. The public API exposes no uptime list or get, so take the id from a ticket's linked uptime checks (gorelo_get_ticket) or from the Gorelo app. Requires an API key with the assets edit scope.

[Gorelo] List the groups (teams) in your Gorelo organization. Useful for resolving the groupId required when creating a ticket with gorelo_create_ticket. The public spec declares no response schema, so the raw JSON is returned verbatim. Requires an API key with the organization read scope. This endpoint declares no query parameters, so it is not paginated.

[Gorelo] List the users in your Gorelo organization (your MSP's technicians/staff, not client contacts). Useful for resolving assignee ids used when creating a ticket (leadAssigneeId, assistingAssigneeIds, watcherIds). The public spec declares no response schema, so the raw JSON is returned verbatim. Requires an API key with the organization read scope. Cursor-paginated: pass the Cursor from the previous response to walk pages, and PageSize to size them.