# Zendesk > Zendesk: what the collector reads, how to connect it, its permissions, its certification by Atlantic Agentic Labs and its security posture. Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment. Reads tickets (with their comments and internal notes) and Help Centre articles from one Zendesk account, so service agents can answer from past tickets and the help centre. It reads in place, in your deployment; only ids, hashes and counts reach LightHouse. ## At a glance | Collector | Zendesk, version `1.0.0` | | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------ | | Reads | Zendesk: Zendesk Support and Help Center (API v2) ([the vendor's documentation](https://developer.zendesk.com/api-reference/)) | | Family | ITSM | | Kind | Tickets | | Ways to connect | Access token | | Scopes | - Read: | | Read only | Yes | | Vendor's API can move money | No | | Personal data | Contact, Content | | Hosts it may contact | `{subdomain}.zendesk.com`, `{host}` | | Vendor API versions | Support API v2, Help Center API v2 | | Lowest engine version | `0.46.0` | ## What it reads - **Tickets:** number and subject, status, priority, type, tags, description, and (unless you turn `comments` off) every comment, each marked as a public comment or an internal note. - **Articles:** published Help Centre articles: title, body as text, link, section and locale. Drafts are skipped. - Only the objects you name in `objects` (`tickets`, `articles`). - Changes only. Tickets come from the search export, which an agent may use and which pages by cursor without the plain search’s 1,000-result limit. Search is indexed a little after a change, so the query starts five minutes before the cursor and anything not newer than it is dropped. Articles come from the Help Centre’s listing, newest first, stopping at the first one not newer than the cursor. It does not read attachments, users, organisations or satisfaction ratings. ## How to connect 1. In Zendesk, make an API token on an agent’s account. Use a light agent, or an agent with only the groups the source should read. 2. In LightHouse, open **Setup and admin, Connectors**, choose **Zendesk**, and fill in `objects`. 3. Give the subdomain (`.zendesk.com`), the agent’s email address and the token. Your browser seals it to your deployment; LightHouse never sees it. The credential is JSON in the variable the source names (`ZENDESK_CREDENTIAL` by default) with `subdomain`, `email` and `token`. They are sent as HTTP Basic authentication with the user name `/token`. ## Permissions - Zendesk states no scope for an API token: it is **the agent’s own access**, so read-only is the agent’s role and groups. A light agent that can read tickets is enough. The collector does not use the administrators-only incremental export, so it never needs an administrator’s token. - **What the collector does:** `GET` requests only, to the Support API and the Help Center API. Its read-only test proves that on every change. - **One host:** `https://.zendesk.com`, from the sealed credential and checked to be a plain Zendesk name. A next-page link to any other host is refused before the credential could be sent to it. ## Limits - Support API v2 and Help Center API v2. - The subdomain must be lower-case letters, digits and hyphens. - Pages of 10 to 1,000 (`page_size`, default 100). - Deletions are found by listing ids every six hours; a deleted ticket or an archived article is removed from the corpus then, not at once. - A token that cannot list tickets or articles (403 or 404) skips the deletion check for that object rather than failing the read. ## Data handling - Tickets hold personal data: requesters’ and agents’ names and whatever they wrote. Internal notes are marked as such in the document. Documents carry the `label` you give the source. - Content is read in place, in your deployment. LightHouse receives ids, hashes and counts, never the records, and never opens the credential. - The raw bytes of each response are cached in your deployment, named by their SHA-256, so any passage can be traced to what was served. ## Troubleshooting | What you see | What it means | What to do | | ------------------------------------------------------ | -------------------------------------------------- | ----------------------------------------------------------- | | `credential variable 'ZENDESK_CREDENTIAL' is not set` | The deployment holds no credential for this source | Connect Zendesk again in LightHouse | | `the zendesk credential has no token` | A field (named in the message) is missing | Re-enter subdomain, email and token | | `subdomain is your Zendesk's name, .zendesk.com` | The subdomain is not a plain name | Give the name only, not a URL | | `HostNotAllowed` (`... is not an allowed host`) | A next-page link named another host | Report it; nothing was sent there | | `HTTP 401` | The email or token is wrong, or API access is off | Check the token and that token access is enabled | | `HTTP 429` | Zendesk’s rate limit | Nothing; the collector backs off and the next run continues | ## Certification Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See [How collectors are certified](/collectors/certification/). | Date | Collector | Engine | Vendor API | Method | Expires | | ---------------- | --------- | -------- | ---------------------------------- | ----------------------------------- | -------------- | | 10 November 2026 | `1.0.0` | `0.46.0` | Support API v2; Help Center API v2 | Fixtures only: built, not certified | Not applicable | ## Security posture From the collector’s last scan on the default branch. What each line means, and what blocks a release: [Security posture](/collectors/security/). | Last scanned | 10 November 2026 | | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Critical findings | 0 | | High findings | 0 | | Medium findings | 0 | | Low findings | 0 | | Info findings | 0 | | Release blocked | No | | Network allow-list check | Pass | | Read-only behavioural test | Pass | | SBOM (CycloneDX) | Produced | | Dependency licences | Pass | | Scanners | bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only | Source: https://docs.atlanticagenticlabs.com/collectors/catalogue/zendesk/