Making API requests on behalf of end users (Zendesk Support)

Have more questions? Submit a request

8 Comments

  • indra Widjaja
    Comment actions Permalink

    not working


    API Request


    curl https://{SUBDOMAIN}.zendesk.com/api/v2/tickets/XXXX/satisfaction_rating \
    -H "Authorization: Bearer {FULL_TOKEN} \
    -H "X-On-Behalf-Of: {EMAIL_ADDRESS}
    -X POST \
    -d '{"satisfaction_rating": {"score": "good", "comment": "Awesome support."}}'


    error response:


    {


      "error": {


        "title": "Forbidden",


        "message": "You do not have access to this page. Please contact the account owner of this help desk for further help."


      }


    }

    0
  • Charles Nadeau
    Comment actions Permalink

    Hi indra,


    The CSAT endpoint only works on tickets with a status of Solved (or reopened after being Solved). Make sure the status of the ticket is not Closed or Archived. Some info on the different statuses:



    • Tickets in solved status, that are not closed by a trigger or automation, are automatically closed after 28 days, regardless of whether there have been updates to the ticket in that timeframe.


    • Closed tickets are locked. They cannot be reopened or updated in any way.


    https://support.zendesk.com/hc/en-us/articles/203660386-What-is-the-difference-between-a-Solved-ticket-and-a-Closed-ticket-

    0
  • Vojtech Soban
    Comment actions Permalink

    Hi,

    I want to add comments on behalf of end users, according to docs I should just set up author_id

    curl 'https://d3v-bb.zendesk.com/api/v2/requests/109.json' -X PUT -H 'Authorization: Bearer b86c8*********410' -H 'Content-Type: application/json' -d '{"request":{"comment":{"author_id":363284300813,"body":"My comment","uploads":[]}}}'

    but when I refresh the comments I see my (I am admin) user id as author_id. I've tried this article and I am able to add a coment with different author using the X-On-Behalf-Of header but there are two still two issues:

    • it works only for end users with verified email address otherwise I got HTTP 403
    • it works only on server side, in the browser (our application is not server side), CORS complains that X-On-Behalf-Of header is not allowed, and that's true, see Access-Control-Allow-Headers: Authorization,X-Requested-With,X-Prototype-Version,X-Zendesk-API,Content-Type,X-CSRF-Token

    Please how to add comments on behalf of end users?

     

    Thanks

    Regards,

    Vojtech

    0
  • Bryan - Community Manager
    Comment actions Permalink

    Hello Vojtech -- the behavior you're experiencing is correct.

    Regarding impersonation...

    When using the X-On-Behalf-Of header, you can only impersonate end users. More details are here:

    Making API requests on behalf of end users

    "impersonate" is one of the available scopes that a token may have but it only allows admins to impersonate end users:

    "...allows Zendesk Support admins to make requests on behalf of end users"

    Regarding troubleshooting CORS...

    If you're using the Zendesk Apps framework, make the request using the framework's client.request method with cors:true setting. That keeps your request coming from the same domain and avoids CORS issues (assuming you're not crossing over to another Zendesk instance).

    The reason the request works server-side and not client-side is because CORS is only a browser based convention. Server-side apps don't have a CORS-like concept, so don't have such constraints. The same would be true if you're making the call using cURL (not a browser, so no CORS constraints).

     

    Post back for more detail or if you run into issues.

    0
  • Sam
    Comment actions Permalink

    I am attempting to update a ticket via the Support Tickets API endpoint using a token, impersonating an end-user. The request works, but any placeholders I add do not work. For instance, the following JSON request body:

    {
    "ticket": {
    "comment": {
    "author_id": NNNNNNNNN,
    "html_body": "<p>{{current_user.notes}}</p><p>{{comment.author.notes}}</p>{{comment.author.email}}<p></p><p>{{current_user.email}}</p>",
    "public": false
    }
    }
    }

    Does not fill the placeholders. It just adds the placeholder as plain-text, like so:

    {{current_user.notes}}

    {{comment.author.notes}}

    {{comment.author.email}}

    {{current_user.email}}

    If I replace the author ID with the ID of a user with role Agent or above, placeholders work fine.

    It seems that end-users don't have permission to use placeholders. Is there any way for me to allow end-users to use placeholders?

    For use-case, I have a Python-based local app that performs many automations for our Zendesk Support instance and places comments in tickets for any automatic actions taken. I want to use a "bot" end-user as the commenter for all of these comments for many important reasons (mostly metrics).

    EDIT: Interestingly, the following placeholder does work

    {{ "now" }}
    0
  • Bryan - Community Manager
    Comment actions Permalink

    Hi Sam. As you discovered, there are limitations on what end users can pull. Usually these can be inferred by looking at the related API -- in the below case, user information. The documentation, for example, for GET /api/v2/users/{id}.json is limited to agents.

    Since you're using a custom app, you could perhaps retrieve and cache that information through an agent authenticated call, then inline it into the subsequent call (versus using place holders). This doesn't avoid using an agent license as you mentioned, however.

    1
  • Sam
    Comment actions Permalink

    Bryan - Community Manager Thanks for the quick reply!

    I suspected this was the case. Do you know of any doc set I can view that will allow me to infer what placeholders a user might have access to? Possibly the Requests API?

    I may just make a quick test that puts all available placeholders from the reference material in one comment, just to see what populates.

    0
  • Bryan - Community Manager
    Comment actions Permalink

    The closest I can offer is to find the corresponding API (such as the one in my previous comment) and see what restrictions it may have. In this API's case, it is restricted to agents. And in truth, end-user allowed API calls are very limited. You can search on "Allowed For" and "End Users" in the API documentation. For example, see this link: https://developer.zendesk.com/rest_api/docs/support/requests#list-requests

    0

Please sign in to leave a comment.

Powered by Zendesk