Everything an AI agent can do with the Help Scout API.

A reference guide for building AI agents: every method, how to authenticate, and the permissions each one needs.

Endpoints29
API version2.0
Last updated23 June 2026
Orientation

How the Help Scout API works.

The Help Scout API is how an app or AI agent works with a Help Scout account: listing and reading conversations, replying to a customer or adding an internal note, creating and updating customer records, and pulling support reports. Access is granted through an OAuth token, and because Help Scout grants access at the account level rather than per area, a token can reach everything its associated user can. Help Scout can also push events to a webhook URL when something happens, like a conversation being created or a reply being added.

29Endpoints
9Capability groups
17Read
12Write
0Permissions
Authentication
Every call needs an OAuth 2.0 bearer token in the Authorization header. Two flows issue it: the authorization code flow, where a user approves access and the app receives an access token plus a refresh token, for integrations other Help Scout accounts install; and the client credentials flow, where an application ID and secret are exchanged for a token with no user screen, for an internal integration on a single account. Access tokens expire after 2 days.
Permissions
Help Scout does not use granular per-endpoint scopes. An OAuth token grants access at the account level, tied to an active, invited user, and inherits whatever that user's role can reach across conversations, customers, inboxes, users, and reports. There is no way through the API to limit a token to, for example, read-only or to a single inbox. This is why fine-grained control has to be enforced in front of the API, by whatever sits between the agent and Help Scout.
Versioning
The Mailbox API is version 2, a single continuously updated version with no dated version header to pin. Help Scout ships changes additively through its changelog, so new fields and endpoints arrive without a new version number, and the occasional breaking change is announced by date in the changelog. The current naming reflects a rename from Mailbox to Inbox in the product, though the API and many paths keep the mailbox name.
Data model
The API is resource-oriented JSON over HTTPS at https://api.helpscout.net/v2, in the HAL+JSON shape with related resources under _embedded and links under _links. The core resource is the conversation, which holds threads, the individual messages such as a customer reply, an agent reply, or an internal note. Customers, inboxes, users, tags, workflows, and reports sit alongside it, and webhooks push events such as a conversation being created or replied to.
Connect & authenticate

Connection & authentication methods.

How an app or AI agent connects to Help Scout determines what it can reach. There is one main route, the Mailbox API, governed by the OAuth token behind it, and a webhook channel for receiving events.

Ways to connect

Mailbox API

The Mailbox API answers at https://api.helpscout.net/v2 as JSON over HTTPS. It is version 2, continuously updated, and reached with an OAuth bearer token in the Authorization header.

Best forConnecting an app or AI agent to Help Scout.
Governed byThe OAuth token and the account-level access of its associated user.
Docs ↗

Webhooks

Webhooks deliver the chosen events to a receiver URL, and each delivery is signed with an HMAC signature using the webhook secret so the receiver can confirm it came from Help Scout.

Best forReceiving account events without polling.
Governed byThe registered events and the optional inbox restriction on the webhook.
Docs ↗
Authentication

OAuth 2.0 authorization code

The authorization code flow sends a user through Help Scout's approval screen, then returns an access token and a refresh token. It suits an integration that other Help Scout accounts install, acting on behalf of the user who approved it.

TokenOAuth user access token (with refresh token)
Best forIntegrations installed by other Help Scout accounts
Docs ↗

OAuth 2.0 client credentials

The client credentials flow exchanges an application ID and secret for an access token with no user screen, acting as the user the app is tied to. It suits an internal integration on a single account. The token expires after 2 days and is fetched again with the same credentials.

TokenOAuth app access token
Best forInternal integrations on a single account
Docs ↗
Capability map

What an AI agent can do in Help Scout.

The Help Scout Mailbox API is split into areas an agent can act on, such as conversations, threads, customers, inboxes, users, and reports. Each area has its own methods, and because access is granted at the account level, a token reaches every area its associated user can.

Conversations

6 endpoints

List, read, create, update, and delete conversations, and set their tags.

Writes here change real conversation data, and a delete removes a customer's support history.
View endpoints

Threads

5 endpoints

List a conversation's threads and add a reply to the customer, an internal note, a chat, or a phone record.

A reply thread sends an email to the customer.
View endpoints

Customers

4 endpoints

List, read, create, and update the people who contact support.

Writes here change real customer records.
View endpoints

Inboxes

4 endpoints

List and read the shared inboxes, their custom fields, and their folders.

These are read-only methods for inbox configuration.
View endpoints

Users

3 endpoints

List and read the people on the support team, including the authenticated user.

These methods return team member details, including email addresses.
View endpoints

Tags

1 endpoint

List the tags used across all inboxes.

This is a read-only method for the tag list.
View endpoints

Workflows

2 endpoints

List the automated workflows and run a manual workflow on chosen conversations.

Running a workflow applies its actions to real conversations.
View endpoints

Reports

2 endpoints

Pull the conversations overall report and the happiness ratings report.

Reports are read-only and available only on Plus and Pro plans.
View endpoints

Webhooks

2 endpoints

List the registered webhooks and create a new one for chosen events.

A new webhook starts streaming account events to an external URL.
View endpoints
Endpoint reference

Every Help Scout API method.

Filter by method, access, or permission, or search any path. Select a row for version detail, rate limits, the related webhook event, and the source.

MethodEndpointWhat it doesAccessPermissionVersion

Conversations

List, read, create, update, and delete conversations, and set their tags.6

Help Scout has no per-endpoint scopes; the OAuth token reaches every conversation its associated user can see. List Conversations paginates at 25 per page rather than the usual 50.

Acts onconversation
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Help Scout has no per-endpoint scopes; access follows the token's associated user.

Acts onconversation
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Counts as 2 requests against the per-minute rate limit, as all writes do. Returns 201 with a Resource-Id header for the new conversation.

Acts onconversation
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventconvo-created
Rate limitCounts as 2 against the per-minute account limit

Takes a JSON Patch body, such as a replace operation on /status or /assignTo. Counts as 2 requests against the per-minute rate limit.

Acts onconversation
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitCounts as 2 against the per-minute account limit

Removes the conversation and its threads. Counts as 2 requests against the per-minute rate limit.

Acts onconversation
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventconvo-deleted
Rate limitCounts as 2 against the per-minute account limit

The payload is the complete tag list; any tag not in it is removed, and new tag names are created automatically. Returns 204 No Content. Counts as 2 requests against the rate limit.

Acts onconversation
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitCounts as 2 against the per-minute account limit

Threads

List a conversation's threads and add a reply to the customer, an internal note, a chat, or a phone record.5

Returns 404 if the conversation has been merged into another. Help Scout has no per-endpoint scopes.

Acts onthread
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Setting draft true creates an unpublished reply instead of sending. Counts as 2 requests against the rate limit. Returns 201 with a Resource-Id header.

Acts onthread
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventconvo-agent-reply-created
Rate limitCounts as 2 against the per-minute account limit

A note is internal and is not emailed to the customer. Counts as 2 requests against the rate limit. Returns 201 with a Resource-Id header.

Acts onthread
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventconvo-note-created
Rate limitCounts as 2 against the per-minute account limit

A conversation is capped at 100 threads. Counts as 2 requests against the rate limit. Returns 201 with a Resource-Id header.

Acts onthread
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitCounts as 2 against the per-minute account limit

A conversation is capped at 100 threads. Counts as 2 requests against the rate limit. Returns 201 with a Resource-Id header.

Acts onthread
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitCounts as 2 against the per-minute account limit

Customers

List, read, create, and update the people who contact support.4

Returns customer profiles, including email addresses and other contact details. Help Scout has no per-endpoint scopes.

Acts oncustomer
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Returns the full customer profile, including contact details. Help Scout has no per-endpoint scopes.

Acts oncustomer
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Counts as 2 requests against the rate limit. Returns 201 with a Resource-Id header for the new customer.

Acts oncustomer
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventcustomer-created
Rate limitCounts as 2 against the per-minute account limit

PUT replaces the whole record; a PATCH on the same path updates only the fields supplied. A customer with 5000 or more conversations cannot be modified and returns 423 Locked. Counts as 2 requests against the rate limit.

Acts oncustomer
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventcustomer-updated
Rate limitCounts as 2 against the per-minute account limit

Inboxes

List and read the shared inboxes, their custom fields, and their folders.4

The internal path keeps the original mailboxes name, while the product calls these inboxes. Help Scout has no per-endpoint scopes.

Acts oninbox
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Help Scout has no per-endpoint scopes.

Acts oninbox
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Custom field definitions are needed to set custom field values on a conversation. Help Scout has no per-endpoint scopes.

Acts oninbox
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Help Scout has no per-endpoint scopes.

Acts oninbox
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Users

List and read the people on the support team, including the authenticated user.3

Returns team member details including email and role, and includes users who have not yet accepted their invitation. Help Scout has no per-endpoint scopes.

Acts onuser
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Help Scout has no per-endpoint scopes.

Acts onuser
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Identifies which user the token acts as, which determines what the token can reach. Help Scout has no per-endpoint scopes.

Acts onuser
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Tags

List the tags used across all inboxes.1

Each tag includes its name, slug, and ticket count. Help Scout has no per-endpoint scopes.

Acts ontag
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Workflows

List the automated workflows and run a manual workflow on chosen conversations.2

Help Scout has no per-endpoint scopes.

Acts onworkflow
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Applies the workflow's actions to the conversation IDs supplied. Only manual workflows can be run this way. Counts as 2 requests against the rate limit.

Acts onworkflow
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitCounts as 2 against the per-minute account limit

Reports

Pull the conversations overall report and the happiness ratings report.2

Reporting endpoints are available only to Plus and Pro plans. A start and end time range is required, and a second range can be supplied for comparison.

Acts onreport
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Reporting endpoints are available only to Plus and Pro plans.

Acts onreport
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Webhooks

List the registered webhooks and create a new one for chosen events.2

Help Scout has no per-endpoint scopes.

Acts onwebhook
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Takes a target URL, an events array, and a secret of up to 40 characters used to sign each delivery. A mailboxIds array can restrict it to chosen inboxes. Counts as 2 requests against the rate limit. Returns 201 with a Resource-Id header.

Acts onwebhook
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitCounts as 2 against the per-minute account limit
No endpoints match those filters.
Webhooks

Webhook events.

Help Scout can notify an app or AI agent when something happens in an account, instead of the app repeatedly asking. Help Scout posts the event payload to a webhook URL that has been registered for the chosen events, signed so the receiver can confirm it came from Help Scout.

EventWhat it signalsTriggered by
convo.createdFires when a conversation is created, by a customer or by a user./v2/conversations
convo.agent.reply.createdFires when a user adds a reply to a conversation./v2/conversations/{id}/reply
convo.customer.reply.createdFires when a customer adds a reply to a conversation.In-app only
convo.note.createdFires when an internal note is added to a conversation./v2/conversations/{id}/notes
convo.assignedFires when a conversation is assigned to a user.In-app only
convo.statusFires when a conversation's status changes, such as to active, pending, or closed.In-app only
convo.tagsFires when a conversation's tags change.In-app only
convo.deletedFires when a conversation is deleted./v2/conversations/{id}
customer.createdFires when a customer record is created./v2/customers
customer.updatedFires when a customer record is updated./v2/customers/{id}
satisfaction.ratingsFires when a customer leaves a satisfaction rating on a conversation.In-app only
No events match that search.
Rate limits & pagination

Rate limits, pagination & request size.

Help Scout limits how fast an app or AI agent can call, through a per-minute request quota shared across the whole account, where write requests count double.

Request rate

Help Scout sets one rate limit of 400 requests per minute, shared across the whole account, so every user and integration on the account draws from the same per-minute pool. Write requests, meaning POST, PUT, PATCH, and DELETE, count as 2 against the limit, so an account can make up to 400 reads or 200 writes a minute, or a mix. Each response reports the state in the X-RateLimit-Limit-Minute and X-RateLimit-Remaining-Minute headers, and going over returns 429 Too Many Requests with an X-RateLimit-Retry-After header giving the seconds to wait.

Pagination

List endpoints use page-based pagination through the page query parameter, returning 50 items per page by default, except List Conversations which returns 25. Each response carries a _page object with size, totalElements, totalPages, and number, and a _links object with self, next, previous, first, and last URLs where they apply, so the next link should be followed rather than the URL built by hand.

Request size

Requests and responses are JSON, in the HAL+JSON shape with embedded resources under _embedded and navigation under _links. A single attachment is capped at 10MB, and a conversation can hold at most 100 threads.

Errors

Status codes & error handling.

The status codes an agent should handle, and what to do about each.

StatusCodeMeaningWhat to do
400Bad RequestThe request does not meet all requirements, such as a malformed JSON Patch body or a field that fails validation. The body holds a logRef identifier and an _embedded.errors array naming the field at fault.Read the errors array, correct the named field, and resend.
401Not AuthorizedThe OAuth token is missing or not valid, often because it has expired. Access tokens expire after 2 days.Fetch a fresh token, with the refresh token on the authorization code flow or the app credentials on the client credentials flow, then retry.
403Access DeniedThe token is valid but the associated user is denied access to this resource.Confirm the user behind the token has access to the inbox or resource, then retry.
404Not FoundThe resource does not exist or was deleted. A conversation that has been merged into another also returns 404 on its thread endpoints.Confirm the ID is correct and the conversation has not been merged or deleted.
412Precondition FailedThe request was well formed and valid, but another condition was not met, such as a conversation already holding the maximum of 100 threads or being locked by company policy.Resolve the condition, for example by acting on a different conversation, then retry.
423LockedThe resource cannot be modified because a limit has been reached, such as updating a customer that has 5000 or more conversations.Avoid modifying the locked resource; the limit cannot be raised through the API.
429Too Many RequestsThe per-minute account rate limit was reached. A Retry-After value reports how many seconds to wait.Wait the number of seconds in the X-RateLimit-Retry-After header, then retry.
500Internal Server ErrorSomething went wrong on the Help Scout side.Retry after a short pause, and quote the logRef from the response if contacting support.
Versioning & freshness

Version history.

Help Scout runs a single, continuously updated version 2 of the Mailbox API, and ships dated changes through its changelog rather than minting new version numbers. New behavior arrives additively, and breaking changes are called out by date.

Version history

What changed, and when

Latest version2.0
2.0Current version
Mailbox API v2 (current, continuously updated)

Version 2 is the single live version of the Mailbox API, reached at https://api.helpscout.net/v2 with OAuth 2.0. It is updated continuously, with no dated version header to pin, and changes ship additively through the changelog. Recent additions include user status endpoints, an Organizations API, cursor-based List Customers v3, and routing configuration, while the occasional breaking change is announced by date.

What changed
  • 2026-06-10: removed the legacy web link from attachment _links in thread responses
  • 2026-05-20: added V3 webhook payload version preserving the system_user type
  • 2026-02-06: added the user.status.changed webhook event
  • 2026-01-08 onward: added Set, List, and single-user status endpoints
  • 2025-12-08: launched Organization Properties endpoints
  • 2025-11-10: added the List Organizations endpoint
  • 2025-10-27: released List Customers v3 with cursor-based pagination
  • 2025-09-09: launched the Organizations API with full CRUD
  • 2025-07-28: added the mailboxIds filter to all webhook endpoints
2025-03-24Requires migration
Conversation owner ID validation tightened

A dated breaking change required conversation owner IDs to be positive integers greater than 1, rejecting values that earlier versions had accepted. It was released on Monday 24 March 2025.

What changed
  • Conversation owner IDs must be a positive integer greater than 1
  • Requests with an invalid owner ID are now rejected rather than accepted
2024-05-31Feature update
Conversation snooze introduced

Snooze operations were added so a conversation can be deferred to a later time through the API, with the next snooze surfaced on the conversation's nextEvent property. It was released on Friday 31 May 2024.

What changed
  • Added snooze operations for deferring a conversation
  • Added the nextEvent conversation property for the upcoming snooze or scheduled thread

An integration tracks the single live version 2 and watches the changelog for the rare dated breaking change.

Help Scout Mailbox API changelog ↗
Questions

Help Scout API, answered.

Does Help Scout have per-endpoint scopes I can limit a token to?+
No. Help Scout grants access at the account level. An OAuth token is tied to an active, invited user and can reach whatever that user's role can reach, across conversations, customers, inboxes, users, and reports. There is no scope that limits a token to read-only, or to a single inbox, or to one resource type. Fine-grained control has to be enforced in front of the API, by whatever sits between the agent and Help Scout.
Authorization code or client credentials, which OAuth flow should I use?+
Use the client credentials flow for an internal integration on a single account: it exchanges an application ID and secret for a token with no user approval screen, acting as the user the app is tied to. Use the authorization code flow when other Help Scout accounts will install the integration: it sends each user through an approval screen and returns a refresh token so access can be renewed without re-approval. Both issue an access token that expires after 2 days.
What are the rate limits?+
There is one limit of 400 requests per minute, shared across the entire account, so every user and integration draws from the same pool. Write requests, the POST, PUT, PATCH, and DELETE calls, count as 2 each, so an account can make up to 400 reads or 200 writes a minute, or a mix. Going over returns 429 with an X-RateLimit-Retry-After header saying how many seconds to wait, and the X-RateLimit-Remaining-Minute header tracks what is left.
How do I send a reply versus an internal note?+
A reply and a note are both threads added to a conversation, but on different paths. A reply, posted to the reply endpoint, sends an email to the customer; setting draft to true holds it unpublished instead. A note, posted to the notes endpoint, is internal and is only ever seen by the team, never the customer. Both return 201 with a Resource-Id header, and a conversation can hold at most 100 threads.
How do I receive events instead of polling?+
Register a webhook with a receiver URL, a list of events such as convo.created, convo.agent.reply.created, convo.customer.reply.created, convo.assigned, convo.status, or customer.created, and a secret of up to 40 characters. Help Scout posts a JSON payload when each event fires, signed with an HMAC signature built from the secret so the receiver can confirm it came from Help Scout. A webhook can be restricted to specific inboxes with the mailboxIds field.
Why does a thread call return a 412 or a 404?+
A 412 Precondition Failed means a condition was not met: most often the conversation already holds the maximum of 100 threads, or company policy has locked an old conversation against updates. A 404 on a thread call usually means the conversation was merged into another one, since the original ID stops resolving after a merge. Confirm the conversation is open and unmerged, or act on the surviving conversation.
Related

More support API guides for agents

What is Bollard AI?

Control what every AI agent can do in Help Scout.

Bollard AI sits between a team's AI agents and Help Scout. Grant each agent exactly the access it needs, read or write, resource by resource, and every call is checked and logged.

  • Set read, write, or full access per agent, never a shared Help Scout token.
  • Denied by default, so an agent reaches only what has been explicitly allowed.
  • Every call recorded in plain English: who, what, where, and the decision.
Help Scout
Support Agent
Read conversations ResourceOffReadFull use
Send replies ActionOffReadFull use
Delete conversations ActionOffReadFull use
Per-agent access, set in Bollard AI, not in Help Scout