Zendesk

Connect Zendesk to collect ticketing evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In Zendesk:

   1. Sign in to Zendesk as an administrator. In Admin Center, click Apps and integrations in the sidebar, then select APIs › API configuration.
   2. Select Allow API token access and click Save (API token access is off by default).
   3. Click Apps and integrations in the sidebar, then select APIs › API tokens.
   4. Click Add API token, optionally enter a Description, and click Save to generate the token.
   5. Copy the token right away; when you click Save to close the window, the full token is never displayed again. Click Save again to return to the list.
   6. Alternative (Access token): in Admin Center, click Apps and integrations, select APIs › OAuth clients and click Add OAuth client. Then use the OAuth client with the API to create an OAuth access token.

   Where to find the other values:

   • Subdomain: Your Zendesk address, https://<subdomain>.zendesk.com; enter the part before .zendesk.com.
   • Email: The email address of the administrator who generated the API token (Zendesk API token sign-in uses that email with /token appended).

   Zendesk shows the secret only once, so copy it before you leave the page.

   Requires the Team, Professional or Enterprise plan. API tokens are not scoped: they act with the rights of any user whose email is paired with them, so read-only cannot be enforced with an API token. Zendesk is removing API tokens: from July 28, 2026 tokens unused for 30 days are deleted automatically, and by April 30, 2027 all API tokens stop working; the OAuth access token alternative is the long-term path. OAuth access tokens created through the API expire (expires_in 300 to 172,800 seconds, default 30 minutes), so they need refreshing. The OAuth token scope, the permission needed to create tokens and whether the token is shown once were not on the fetched pages, so they are not given.

   Source: support.zendesk.com, support.zendesk.com, support.zendesk.com, developer.zendesk.com, checked 2026-10-07.

   The permissions Safeguard needs: users:read. Zendesk shows the full user list only to administrators, so this credential must belong to one. Safeguard only reads with it. Safeguard's compliance tests for Zendesk need the credential on the API token tab: an OAuth connection cannot read everything they check.

2. On Compliance › Connectors, open Zendesk, click Connect, choose API token and fill in:

   Field	What to enter
   Subdomain	Optional. The part before .zendesk.com in your address.
   Email	Optional.
   API token	Optional. Stored encrypted and never shown again.

   Or, instead: Access token (optional).

3. Click Connect with token.

Frameworks

Safeguard's automated tests read Zendesk and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Ticketing connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks