To check who created it:

I guess you can run an API call ( /api/v2/tickets/22074?include=requester ), which will return the requester_id and requested_for_id , which can be compared to see who actually raised it.

To prevent future occurrence: You can create a workflow where, action node ( ticket is raised ), then an expression node ( equals('{{ticket.requester.id}}','{{ticket.actual_requester.id}}') ), accompanied by a condition node where ( Result: True ), for the action node ( delete the ticket ). By implementing this, the system will automatically delete the ticket when the “requester” and “requested for” fields match, if it doesn't match, the ticket will be created normally. Hope this helps!

Thank you for the prompt response but that API call returned the same for requester_id and requested_for_id. We confirmed with the user that their supervisor submitted the incident on their behalf. Any other ideas?

Well, at instances like these, we might require FS support team to check logs from the backend. Cause, even if we check the audit logs from user side, we will get the same result as that received from an API call. However, a suggestion might be to use analytics and filter out ticket based on created date and created by, but even then, I’m not exactly sure if that user’s supervisor name/ID will pop up in the report. I’ll check a few things from my side and let you know if any workaround exists.