> ## Documentation Index
> Fetch the complete documentation index at: https://docs.opal.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Zendesk

> Learn how to connect Opal to Zendesk to manage access to Zendesk groups, organizations, and custom roles.

With the Zendesk integration, you can manage support platform access through Opal:

* Allow users to request just-in-time access to Zendesk groups, organizations, and custom roles from the web and Slack
* Set the right resource owners to delegate approvals to those with the most context
* Configure day-one access to Zendesk resources with groups from your identity provider

## Supported resources

| Resource | Read | Grant and revoke access | Notes |
| - | - | - | - |
| Zendesk Groups | ✔️ | ✔️ | |
| Zendesk Organizations | ✔️ | ✔️ | |
| Zendesk Custom Roles | ✔️ | ✔️ | Enterprise only |

## Requirements

* You must be an Opal admin.
* You must have admin access to your Zendesk account to generate an API token.
* Be on version 1.1168.0 or greater, if you self-host Opal.

## 1. Create a Zendesk API token

In Zendesk, generate an API token by navigating to **Admin Center** > **Apps and integrations** > **APIs** > **Zendesk API** and enabling token access if not already on. Click **Add API token**, give it a description (e.g., `Opal`), and copy the token — it is only shown once.

## 2. Create a Zendesk app in Opal

In Opal, go to **Inventory > +App** and select **Zendesk**. Fill in the following fields and hit create.

| Field | Value |
| - | - |
| App admin | The team or user that should manage the Zendesk app in Opal. |
| Description | Let your end users know what they're requesting access to. |
| Subdomain | The subdomain of your Zendesk instance (e.g., `mycompany` from `mycompany.zendesk.com`). |
| Admin email | The email address of the Zendesk admin/agent who generated the API token. |
| API token | The API token you generated in [Step 1](#1-create-a-zendesk-api-token). |

## 3. Import Zendesk resources

After creating the app, you can import resources from **... > Import items**. Users will now be able to request access to Zendesk groups, organizations, and custom roles through Opal.

## User provisioning

Opal can automatically provision and deprovision users in Zendesk.

When provisioning is enabled, users who don't already have a Zendesk account are automatically created as agents when they are granted access to a Zendesk resource. If a Zendesk user with the same email already exists, Opal uses that user. Deprovisioning permanently deletes users from Zendesk when you deprovision them manually, revoke their account in an access review, or when they're deprovisioned in your IdP or HRIS.

This is configurable in **Setup > Edit > Provision Zendesk users** and **Deprovision Zendesk users**. For more details, see [User provisioning](https://docs.opal.dev/docs/user-provisioning.md).

## Organizations: multiple organization support

> [!NOTE]
>
> By default, Zendesk only allows a user to belong to one organization at a
> time. If you plan to manage organization membership through Opal, enable
> **Multiple organizations** in your Zendesk account settings under **Admin
> Center** > **People** > **Configuration** > **End users**. Without this
> setting, granting a user access to a second organization will remove them from
> their current one.

## Custom roles

Custom roles are only available on Zendesk **Enterprise** plans. On other plans, the custom roles resource type will not appear when importing items.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.