​
Overview

The Freshservice integration syncs your ITSM data into LowerPlane: tickets, changes, assets, and agents. LowerPlane uses your Freshservice API Key to collect compliance evidence automatically and run continuous checks against your incident and change management processes.

​
Prerequisites

  • You need your Freshservice domain and an agent account whose role grants Full Access: Read.
  • The API key inherits the permissions of the agent it belongs to. A key from a restricted agent collects only what that agent can see — and Freshservice returns an empty list rather than an error for data the agent cannot reach.
An Account Admin role alone is not enough. Per Freshservice’s agent roles documentation, Account Admins and Admins have “complete access to everything, including billing and account management, excluding access to tickets.”So a key belonging to an Account Admin reads Agents fine but returns zero tickets, changes, problems and releases — and every ITSM check reports not applicable. Give the agent a ticket-capable role as well (Supervisor, or Agent plus Change/Problem/Release Manager), or use a custom role with Full Access: Read.

​
Required scopes

ScopeNeeded for
Tickets (Global scope)Incident closure, assignee and SLA checks
ChangesChange approval and risk-assessment checks
AgentsAccess review and the user checks
RolesResolving role names so admins are flagged in access review
LowerPlane reads only these endpoints. It does not collect assets, problems, releases, contracts or software licences — none of them evidences a control, so they are not worth the access.
One supplementary item is collected: recent ticket activity, as a logging artefact. Freshservice v2 exposes no audit-log API, so this is a recent-activity proxy rather than a complete audit trail, and the evidence says so. It backs no check and never fails a sync — if the ticket scope is missing it is skipped silently.
A missing optional scope surfaces as a 403 that LowerPlane logs and skips; the sync continues. A missing ticket scope does not — it looks like an empty instance, which is why the agent role matters.

​
How to Get Your API Key

1

Sign in to Freshservice

Log in to your Freshservice account.
2

Open Profile Settings

Click your profile picture in the upper right corner, then select Profile Settings.
3

Copy the API Key

Your API key is shown in the right sidebar. Click to reveal it and copy the value.

​
Connecting in LowerPlane

1

Navigate to Integrations

Go to Integrations from the main navigation and search for Freshservice.
2

Enter API Key

Paste the API Key you copied from Freshservice.
3

Enter Domain

Enter your Freshservice domain — either acme or acme.freshservice.com. Both are accepted.
4

Connect

Click Submit. LowerPlane verifies the credentials against the Freshservice API before saving, so an invalid key or domain is rejected immediately.
To revoke LowerPlane’s access, regenerate the API key in Freshservice under Profile Settings. The old key stops working immediately.

​
Access Review

Freshservice agents are synced as people and appear in Access Reviews, with their resolved role, admin flag, last login, and whether they match an existing employee record. LowerPlane resolves role IDs to names via the Roles API so an Account Admin is visibly distinct from a regular agent — the signal a reviewer most needs.
Freshservice’s agent API exposes no MFA status, so the MFA check does not apply to Freshservice. Enforce and evidence MFA through your identity provider instead.

​
What LowerPlane Monitors

Incidents & Tickets

Ticket status, priority, assignee, and SLA breach flags.

Change Management

Change approval status, risk rating, change type, and planned windows.

Asset Inventory

Assets from the CMDB with assignment, department, and location coverage.

Agents

Agent directory with roles, groups, and last-login activity.

​
Automated Checks

Connecting Freshservice seeds eight continuous checks across incidents, changes and access. Incident management
CheckWhat it verifiesControls
Incident should be closedTickets progress to a resolved or closed stateSOC 2 CC7.3, ISO 27001 A.5.24
Ticket should have an assigneeEvery ticket has someone accountable for itSOC 2 CC7.3, ISO 27001 A.16.1.5
Incidents should be resolved within SLAIncidents close inside their agreed service levelSOC 2 CC7.4, ISO 27001 A.5.26
Change management
CheckWhat it verifiesControls
Change should be approved before releaseEvery change request carries an approved statusSOC 2 CC8.1, ISO 27001 A.8.32
Change should have a risk assessmentEvery change request has a risk level recordedSOC 2 CC3.2, CC8.1, ISO 27001 A.8.32
Access review
CheckWhat it verifiesControls
User should be identifiedEach agent maps to a known personaccess governance
Offboarded users should not retain accessNo terminated employee still holds an active agent seataccess governance
Critical system access should be validAgent access correlates to a current HR recordaccess governance
Failing incidents carry a ticket URL, so opening the record from a failing check is one click. Incidents also record overdue and due_by for triage.

​
Data Handling

LowerPlane collects metadata for compliance evidence, not ticket contents. Ticket subjects, change subjects, and asset hostnames are masked before storage, and agent email addresses are masked in evidence records.
Freshservice’s v2 API does not expose an audit-log endpoint. The “Recent Ticket Activity” evidence item is a recent-activity snapshot built from the most recently updated tickets — it is not a complete audit trail, and is labelled as such in the evidence record.

​
Troubleshooting

LowerPlane returns this when Freshservice rejects the key with a 401. Regenerate the key from Profile Settings and reconnect.
A 404 means the domain could not be resolved. Enter only your Freshservice subdomain (acme) or the full host (acme.freshservice.com) — do not include https:// or a trailing path.
The API key’s agent may lack read access to that module. Confirm the agent can view Tickets and Changes in Freshservice, then trigger a manual sync.