Zendesk

Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment.

Reads tickets (with their comments and internal notes) and Help Centre articles from one Zendesk account, so service agents can answer from past tickets and the help centre. It reads in place, in your deployment; only ids, hashes and counts reach LightHouse.

At a glance

Collector	Zendesk, version 1.0.0
Reads	Zendesk: Zendesk Support and Help Center (API v2) (the vendor's documentation)
Family	ITSM
Kind	Tickets
Ways to connect	Access token
Scopes	Read:
Read only	Yes
Vendor's API can move money	No
Personal data	Contact, Content
Hosts it may contact	{subdomain}.zendesk.com, {host}
Vendor API versions	Support API v2, Help Center API v2
Lowest engine version	0.46.0

What it reads

• Tickets: number and subject, status, priority, type, tags, description, and (unless you turn comments off) every comment, each marked as a public comment or an internal note.
• Articles: published Help Centre articles: title, body as text, link, section and locale. Drafts are skipped.
• Only the objects you name in objects (tickets, articles).
• Changes only. Tickets come from the search export, which an agent may use and which pages by cursor without the plain search’s 1,000-result limit. Search is indexed a little after a change, so the query starts five minutes before the cursor and anything not newer than it is dropped. Articles come from the Help Centre’s listing, newest first, stopping at the first one not newer than the cursor.

It does not read attachments, users, organisations or satisfaction ratings.

How to connect

1. In Zendesk, make an API token on an agent’s account. Use a light agent, or an agent with only the groups the source should read.
2. In LightHouse, open Setup and admin, Connectors, choose Zendesk, and fill in objects.
3. Give the subdomain (<name>.zendesk.com), the agent’s email address and the token. Your browser seals it to your deployment; LightHouse never sees it.

The credential is JSON in the variable the source names (ZENDESK_CREDENTIAL by default) with subdomain, email and token. They are sent as HTTP Basic authentication with the user name <email>/token.

Permissions

• Zendesk states no scope for an API token: it is the agent’s own access, so read-only is the agent’s role and groups. A light agent that can read tickets is enough. The collector does not use the administrators-only incremental export, so it never needs an administrator’s token.
• What the collector does: GET requests only, to the Support API and the Help Center API. Its read-only test proves that on every change.
• One host: https://<subdomain>.zendesk.com, from the sealed credential and checked to be a plain Zendesk name. A next-page link to any other host is refused before the credential could be sent to it.

Limits

• Support API v2 and Help Center API v2.
• The subdomain must be lower-case letters, digits and hyphens.
• Pages of 10 to 1,000 (page_size, default 100).
• Deletions are found by listing ids every six hours; a deleted ticket or an archived article is removed from the corpus then, not at once.
• A token that cannot list tickets or articles (403 or 404) skips the deletion check for that object rather than failing the read.

Data handling

• Tickets hold personal data: requesters’ and agents’ names and whatever they wrote. Internal notes are marked as such in the document. Documents carry the label you give the source.
• Content is read in place, in your deployment. LightHouse receives ids, hashes and counts, never the records, and never opens the credential.
• The raw bytes of each response are cached in your deployment, named by their SHA-256, so any passage can be traced to what was served.

Troubleshooting

What you see	What it means	What to do
credential variable 'ZENDESK_CREDENTIAL' is not set	The deployment holds no credential for this source	Connect Zendesk again in LightHouse
the zendesk credential has no token	A field (named in the message) is missing	Re-enter subdomain, email and token
subdomain is your Zendesk's name, <name>.zendesk.com	The subdomain is not a plain name	Give the name only, not a URL
HostNotAllowed (... is not an allowed host)	A next-page link named another host	Report it; nothing was sent there
HTTP 401	The email or token is wrong, or API access is off	Check the token and that token access is enabled
HTTP 429	Zendesk’s rate limit	Nothing; the collector backs off and the next run continues

Certification

Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See How collectors are certified.

Date	Collector	Engine	Vendor API	Method	Expires
10 November 2026	1.0.0	0.46.0	Support API v2; Help Center API v2	Fixtures only: built, not certified	Not applicable

Security posture

From the collector’s last scan on the default branch. What each line means, and what blocks a release: Security posture.

Last scanned	10 November 2026
Critical findings	0
High findings	0
Medium findings	0
Low findings	0
Info findings	0
Release blocked	No
Network allow-list check	Pass
Read-only behavioural test	Pass
SBOM (CycloneDX)	Produced
Dependency licences	Pass
Scanners	bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only