We’re using the API to create private requests for clients to initiate back-office processes that we don’t want them to see. The API creates the request and populates the customer ID and email address - this is needed for the support teams.
We’re using black box authentication on the portal - when a client logs in they’re seeing a complete list of requests, including the internal requests we’ve created. The ‘request history’ page is displaying these private requests and the full contents of the (private) note is displayed.
Any work-arounds?