---
title: "Zendesk"
description: "Connect Zendesk, obtain the required access and configure permitted actions."
url: "https://documentation.verbatik.com/integrations/zendesk/"
---

# Zendesk

Connect Zendesk, obtain the required access and configure permitted actions.

The API adapter is implemented. Validate your own account and authorized actions before routing production calls.

## Before you start

Connect the account belonging to this business and workspace. Vendor subscriptions, API limits and role permissions still apply.

**API:** Zendesk Support Ticketing API v2 and OAuth Grant Types API

**Authentication:** OAuth (default), OAuth client credentials for a confidential service client, or existing legacy API tokens until retirement

## Get access and connect

1. Open the customer's Zendesk Admin Center → Apps and integrations → APIs → OAuth clients. Create a dedicated OAuth client; use a dedicated service account if audit attribution and ticket authorship should not be attributed to a general administrator.
2. For a background integration choose a confidential OAuth client. In Verbatik set the Zendesk origin and authMode client-credentials, then enter clientId and clientSecret. Verbatik exchanges them at that exact Zendesk origin's /oauth/tokens endpoint and renews access automatically.
3. For delegated user authorization choose authMode oauth, complete Zendesk's one-time authorization flow, and enter the resulting access token and refresh token plus client ID and, for confidential clients, client secret. Verbatik persists rotated refresh tokens after renewal.
4. Grant only users:read, users:write, tickets:read and tickets:write as needed. Verify the OAuth client's allowed scopes include the requested scopes.
5. Run Test connection (the current user). Create a requester before opening a ticket, or use an existing requester ID. Ticket comments default to private; make public delivery an explicit choice.
6. Legacy authMode api-token accepts an existing token plus its agent email. Do not plan a new integration around API-token creation: it was disabled on October 27, 2026 and all remaining API tokens retire April 30, 2027.

## Account requirements

- The authenticated Zendesk user must have permission to read/create users and to work on the target tickets. OAuth scopes do not override agent roles, ticket access or required ticket forms/custom fields.
- A confidential client may use client credentials. Public clients use authorization code plus PKCE and cannot protect a client secret in the browser.
- Existing legacy API tokens are automatically deactivated after inactivity and are being retired. OAuth is required for newly created customer integrations.
- Customer-visible public comments can trigger Zendesk notification rules. Internal notes use public:false and cannot be made public through the private-note action.

## Permissions

- `users:read`
- `users:write`
- `tickets:read`
- `tickets:write`

Grant the subset needed for the actions you enable. API scopes do not override the connected user’s record permissions or vendor validation rules.

## Connection fields

- `accessToken` — Zendesk OAuth access token (or existing legacy API token) (optional). Secret fields are saved as workspace credentials.
- `clientId` — OAuth client ID (automatic renewal) (optional). Secret fields are saved as workspace credentials.
- `clientSecret` — OAuth client secret (automatic renewal) (optional). Secret fields are saved as workspace credentials.
- `refreshToken` — OAuth refresh token (automatic renewal) (optional). Secret fields are saved as workspace credentials.
- `email` — Agent email (legacy API-token mode only) (optional). Secret fields are saved as workspace credentials.
- `instanceUrl` — Zendesk origin (required).
- `authMode` — Authentication mode: oauth, client-credentials, or api-token (legacy) (optional).

## Available actions

- `test_connection` — **Read** · available for after-call automation. Read account or schema metadata to verify credentials without creating records.
- `find_user` — **Read** · available for after-call automation. Search Zendesk users by email or name.
- `create_user` — **Write** · available for after-call automation. Create an end user for a ticket requester.
- `get_ticket` — **Read** · available for after-call automation. Read a known Zendesk ticket.
- `create_ticket` — **Write** · available for after-call automation. Create a support ticket for a known requester. Its initial comment defaults to a private agent note.
- `update_ticket` — **Write** · available for after-call automation. Update a ticket's subject, status, priority, tags or assignee.
- `list_comments` — **Read** · available for after-call automation. Read public comments and internal notes when the connected agent has permission.
- `add_comment` — **Write** · available for after-call automation. Add a ticket comment using the ticket update endpoint. Public delivery must be explicitly selected.
- `add_private_note` — **Write** · available for after-call automation. Add an internal agent note that is never public.


## Verify before going live

Run Test connection and one read action against a known permitted record. Then test each intended write in an authorized sandbox. Check the provider’s own record and the Verbatik receipt. Publish the agent after assigning its tools. If a write has an unknown outcome, reconcile it with the vendor before trying again.

## Vendor documentation

- [Setup and API documentation](https://developer.zendesk.com/documentation/authentication/oauth-migration/)
- [Additional provider reference](https://developer.zendesk.com/api-reference/ticketing/oauth/grant_type_tokens/)
- [Additional provider reference](https://support.zendesk.com/hc/en-us/articles/4408889192858-Managing-API-token-access-to-the-Zendesk-API)
- [Additional provider reference](https://developer.zendesk.com/api-reference/ticketing/tickets/tickets/)
- [Additional provider reference](https://developer.zendesk.com/api-reference/ticketing/tickets/ticket_comments/)