Ticket-only fallback

Before using ticket-only fallback

Use this page when a fix task or report finding needs to move to a developer, agency or customer team without connected repository, CMS, GTM, CMP or platform access. Ticket-only fallback keeps remediation work inside a provider ticket or portable export while WebRiskOps keeps the original finding, evidence and handoff state. Use ticket-only fallback when connected access is missing, expired, too broad, unsupported or unnecessary. Do not request broader credentials just to avoid exporting a ticket.

Create a ticket-only handoff

Follow the path `Fix task → Ticket-only fallback → Ticket export preview → External tracker or portable export → Customer-applied evidence`.

1. Open /fix-tasks/{fixTask} or /reports/{report}/ticket-exports from a fix task that cannot use connected access. Result: source finding, evidence links, delivery mode and export controls are visible.
2. Confirm connected access is missing, expired, too broad, unsupported or not needed. Result: you choose a ticket-only handoff instead of asking for broader credentials.
3. Select the report issue or fix task source for export. Result: the preview is tied to one evidence-backed finding or task.
4. Choose provider-native export or portable fallback. Result: WebRiskOps shows the destination fields, required mapping and customer-safe payload before anything is sent.
5. Review title, summary, acceptance criteria, evidence links, remediation steps and redactions. Result: the external ticket gives a developer enough context without secrets or private data.
6. Create the ticket or download the portable export only after the preview is safe. Result: implementation continues outside connected access while WebRiskOps keeps source and handoff status.

Ticket-only ready states

Continue only when the handoff target is clear.

• Provider ready means the selected Jira, GitHub, GitLab, Bitbucket, Trello, Linear, Azure DevOps, YouTrack, Asana, ClickUp or webhook target can receive the ticket payload.
• Portable fallback ready means CSV, Markdown or JSON export is available because a provider target is not configured or is temporarily unavailable.
• Duplicate detected means an external ticket already exists; open the existing provider link instead of creating another ticket.
• Customer evidence pending means the external team must apply the change and return evidence before WebRiskOps can run a retest.

Blocked or unsafe states

Do not send the ticket until the unsafe state is resolved.

• Missing evidence means return to [Fix tasks](/docs/remediation/fix-tasks) or report evidence before exporting work.
• Secret in preview means use [Privacy redaction](/docs/projects/privacy-redaction) before creating or downloading the handoff.
• Provider unavailable means use [Portable export fallbacks](/docs/ticket-exports/portable-export-fallbacks) rather than asking for unrelated credentials.
• Duplicate provider ticket means use [Status sync and duplicate handling](/docs/ticket-exports/status-sync-and-duplicate-handling) before re-exporting.
• Connected access too broad means keep ticket-only fallback and avoid widening permissions for routine remediation.

Continue to applied evidence

After the external team applies the change, continue to [Customer-applied evidence](/docs/remediation/customer-applied-evidence) so WebRiskOps has a safe record of what changed before retesting. Use [Ticket export provider overview](/docs/ticket-exports/provider-overview) when the destination provider, mapping or portable export path is unclear.