# Support ticket API exercise
All accounts and tickets are synthetic. Authentication is an implementation task, not provided here.

## Ticket
- id: server-generated integer
- owner_id: derived from authenticated identity, never trusted from request body
- subject: trimmed string, 5–120 characters
- status: open, in_progress, closed
- created_at: UTC timestamp

## GET /tickets?page=1
200: {"items": [], "page": 1, "page_size": 20}
Students receive only owned tickets; agents may see all. Sort by created_at descending, then id descending.

## POST /tickets
Input: {"subject":"Cannot access course"}
201: created ticket; default status open.
400: invalid JSON; 422: invalid subject; 401: missing identity.

## GET /tickets/{id}
200: authorized ticket; 404: unknown or inaccessible ticket.

## Required evidence
Show sample requests, authorization tests and setup instructions. Document retry behavior and any mock authentication.