POST

Ticket.UnlockEncrypted

Verify the organization encrypted-custom-field password (user_detail.enc_pwd_custom_field, base64-decoded) and unlock encrypted customer fields for later Ticket.EncryptedFields / Ticket.Get calls. Matches dashboard setting/check_enc_pwd_custom_field.

Permissions

User must be logged in with a valid bearer token.
The user must be from the same company domain as the request Host (call the API on that account subdomain or allowed custom domain). A token from another company returns success=0, error user_not_in_company.
Returned or changed records are limited by the user permissions, team access, folder access, and account settings.

Action

Runs the Ticket.UnlockEncrypted function and returns JSON.

Push Service

No push is sent because this function only reads data or returns helper information.

Automation

No automation is run for this function.

Special Instructions

On a company subdomain (e.g. https://{user_domain}.bull36.com) the user must match that Host — Login and protected APIs reject another company with success=0, error user_not_in_company. On a main brand host (bull36.com, biz1.co.il, mastrocrm.com, …) the company domain gate is skipped.
Password is compared to base64_decode(org.enc_pwd_custom_field), same as the dashboard modal.
Unlock is stored in Node memory keyed by bearer login_token (not PHP CI session). Default TTL 8 hours (APP_NODE_ENC_UNLOCK_TTL_MS).
After success, call Ticket.EncryptedFields or Ticket.Get to read plain values instead of ••••••••.
If enc password is not configured on the org, EncStatus already reports unlocked.

Required Parameters

Name	Type	Sample	Explanation
`password` post	string	`my-secret`	Plain-text password. Alias: enc_pwd.

Optional Parameters

No optional body parameters are defined for this function.

Authentication

Send the bearer token returned by Login in the request header. The user must be from the same company domain as this Host — a token from another company is rejected (user_not_in_company).

Authorization: Bearer YOUR TOKEN

Sample Request

{
    "url": "\/app\/Ticket.UnlockEncrypted",
    "method": "POST",
    "headers": {
        "Authorization": "Bearer YOUR TOKEN"
    },
    "body": {
        "password": "my-secret"
    },
    "url_user": "https:\/\/{user}.bull36.com\/app\/Ticket.UnlockEncrypted",
    "url_domain": "https:\/\/{domain}\/app\/Ticket.UnlockEncrypted"
}

Endpoint

POST /app/Ticket.UnlockEncrypted
POST https://{user}.bull36.com/app/Ticket.UnlockEncrypted
POST https://{domain}/app/Ticket.UnlockEncrypted

Sample Output

{
    "success": 1,
    "message": "Success",
    "unlocked": 1,
    "expires_at": "2026-09-08T18:45:00.000Z"
}

JavaScript Example

const token = 'YOUR TOKEN';
const body = new URLSearchParams({ password: 'my-secret' });
const res = await fetch('/app/Ticket.UnlockEncrypted', { method: 'POST', headers: { Authorization: 'Bearer ' + token }, body });
console.log(await res.json());

Error Example

{
    "success": 0,
    "message": "Please check your password"
}