Making API requests on behalf of end users (Zendesk Support)

Have more questions? Submit a request


  • indra Widjaja
    Comment actions Permalink

    not working

    API Request

    curl https://{SUBDOMAIN} \
    -H "Authorization: Bearer {FULL_TOKEN} \
    -H "X-On-Behalf-Of: {EMAIL_ADDRESS}
    -X POST \
    -d '{"satisfaction_rating": {"score": "good", "comment": "Awesome support."}}'

    error response:


      "error": {

        "title": "Forbidden",

        "message": "You do not have access to this page. Please contact the account owner of this help desk for further help."



  • Charles Nadeau
    Comment actions Permalink

    Hi indra,

    The CSAT endpoint only works on tickets with a status of Solved (or reopened after being Solved). Make sure the status of the ticket is not Closed or Archived. Some info on the different statuses:

    • Tickets in solved status, that are not closed by a trigger or automation, are automatically closed after 28 days, regardless of whether there have been updates to the ticket in that timeframe.

    • Closed tickets are locked. They cannot be reopened or updated in any way.

  • Vojtech Soban
    Comment actions Permalink


    I want to add comments on behalf of end users, according to docs I should just set up author_id

    curl '' -X PUT -H 'Authorization: Bearer b86c8*********410' -H 'Content-Type: application/json' -d '{"request":{"comment":{"author_id":363284300813,"body":"My comment","uploads":[]}}}'

    but when I refresh the comments I see my (I am admin) user id as author_id. I've tried this article and I am able to add a coment with different author using the X-On-Behalf-Of header but there are two still two issues:

    • it works only for end users with verified email address otherwise I got HTTP 403
    • it works only on server side, in the browser (our application is not server side), CORS complains that X-On-Behalf-Of header is not allowed, and that's true, see Access-Control-Allow-Headers: Authorization,X-Requested-With,X-Prototype-Version,X-Zendesk-API,Content-Type,X-CSRF-Token

    Please how to add comments on behalf of end users?





  • Bryan Flynn
    Comment actions Permalink

    Hello Vojtech -- the behavior you're experiencing is correct.

    Regarding impersonation...

    When using the X-On-Behalf-Of header, you can only impersonate end users. More details are here:

    Making API requests on behalf of end users

    "impersonate" is one of the available scopes that a token may have but it only allows admins to impersonate end users:

    "...allows Zendesk Support admins to make requests on behalf of end users"

    Regarding troubleshooting CORS...

    If you're using the Zendesk Apps framework, make the request using the framework's client.request method with cors:true setting. That keeps your request coming from the same domain and avoids CORS issues (assuming you're not crossing over to another Zendesk instance).

    The reason the request works server-side and not client-side is because CORS is only a browser based convention. Server-side apps don't have a CORS-like concept, so don't have such constraints. The same would be true if you're making the call using cURL (not a browser, so no CORS constraints).


    Post back for more detail or if you run into issues.


Please sign in to leave a comment.

Powered by Zendesk