ManageEngine ServiceDesk Plus

Works with: ServiceDesk Plus Cloud (Zoho OAuth) and On-premises (technician API key). What SafeHanded does in SDP: private notes on every step · a customer-visible note for link delivery · the chain-of-custody certificate uploaded on purge · close-to-purge · request from a ticket (deep link).

Before you start

A ServiceDesk Plus admin (an SDAdmin technician on Cloud, to create the Zoho Self Client), and a SafeHanded Owner/Admin on the Team plan or above.
About ten minutes.

In SafeHanded, go to Settings → Integrations → Connect → ManageEngine ServiceDesk Plus and choose your Edition first — the form then asks only for what that edition needs.

1. Connect — Cloud

Cloud uses Zoho OAuth via a one-time Self Client; SafeHanded turns the code into a lasting token, so there’s no curl and nothing to renew by hand.

Find your region from the address bar when signed in to SDP Cloud, and use that region’s Zoho API Console (e.g. US api-console.zoho.com, EU api-console.zoho.eu, UK api-console.zoho.uk, Canada api-console.zohocloud.ca). A Self Client made in the wrong region won’t work.
In the API Console: Add Client → Self Client → Create. Copy the Client ID and Client Secret.
On the Generate Code tab: Scope (exactly) SDPOnDemand.requests.ALL,SDPOnDemand.users.READ, Time Duration 10 minutes, then Create and Copy the code (it expires in minutes — do the next step now).
On the SafeHanded connect form (Edition = Cloud): paste your Account URL (the address from your address bar), choose your Data centre (your region), and paste the Zoho client id, Zoho client secret and Zoho authorization code, then click Connect and test. SafeHanded exchanges the code for a token and tests the connection.

1. Connect — On-premises

Admin → Technicians, edit a technician with login permission, find API key details and click Generate (an SDAdmin can choose Never Expires). Copy the key.
On the connect form (Edition = On-premises): enter your server’s address as the Account URL (e.g. https://sdp.acme.example) and paste the Technician API key, then click Connect and test.

Reference — Cloud API · On-premises API. (The editions differ in places — e.g. the note payload is request_note on Cloud but note on-premises.)

2. Close detection

Nothing to set up. SafeHanded polls ServiceDesk Plus for status changes, so resolving or closing a ticket purges its credential on the next poll. SafeHanded re-reads the ticket via the API before anything is purged — see how ticketing works.

3. Request from a ticket (deep link)

ServiceDesk Plus has a built-in Request Custom Menu, which adds a one-click action to every request.

In ServiceDesk Plus, go to Admin → Helpdesk Customizer → Request Custom Menu and click Add New Menu.
Name it Create SafeHanded request, choose the action type Open URL, and paste the link below as the URL. $WORKORDERID is ServiceDesk Plus’s placeholder for the request ID; on ServiceDesk Plus Cloud, use the request-ID variable the editor offers instead.
Save. The action appears in each request’s Actions menu and opens a new SafeHanded request linked to it.

https://safehanded.com/app/requests/new?ticket=$WORKORDERID

Settings → Integrations → your ServiceDesk Plus card → Activity shows this link ready to copy.

Choosing a preset (optional). A preset is a saved request — the reason, how long the credential is kept, who receives it and how the link is sent. To start from one, add &preset= and the preset’s slug to the end of the link, for example &preset=password-reset. Each preset’s slug is shown, with a copy button, under Settings → Request presets. With no preset in the link, SafeHanded uses the client’s default preset, then the organisation default (Settings → Policy → Default preset for new requests), and otherwise the policy defaults.

No click at all. Point a Custom Trigger’s webhook action at a generic webhook integration’s trigger URL (Settings → Integrations → Generic webhook) with the SafeHanded trigger body; SafeHanded then creates the request with no one present. This needs a second ticketing integration (the generic webhook), which the MSP plan allows; the Team plan includes one ticketing integration. A request created this way is linked through the generic webhook integration, so its close-to-purge follows that integration’s setup, not ServiceDesk Plus’s polling.

4. Status mapping

The default map covers the stock statuses — Open / In Progress → open, On Hold → pending, Resolved → resolved, Closed / Cancelled → closed. Custom statuses show as unknown (never purge) until mapped.

5. What technicians see

Private notes (show_to_requester: false): created · submitted · (optionally) revealed · destroyed · expired · revoked · rotation recommended.
Customer-visible note (if the preset delivers in-ticket): the secure link and a one-line explanation — never the challenge code.
The certificate PDF uploaded on destruction (if the Attach certificate policy is on).

Troubleshooting

Symptom	Cause / fix
Authorization code rejected (Cloud)	It expired (minutes) or was made in a different region’s API Console than your data centre. Generate a fresh code in your region’s console and connect straight away.
Test connection fails (Cloud)	Confirm the Self Client scopes and that the data centre matches your sign-in URL.
Test connection fails (on-prem)	Check the technician key is active and the Account URL includes `https://`.
“Unknown status” on the card	Map the status in the status-map editor.