> ## Documentation Index
> Fetch the complete documentation index at: https://docs.opal.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Zendesk

> Learn how to connect Opal to Zendesk to manage access to Zendesk groups, organizations, and custom roles.

With the Zendesk integration, you can manage support platform access through Opal:

* Allow users to request just-in-time access to Zendesk groups, organizations, and custom roles from the web and Slack
* Set the right resource owners to delegate approvals to those with the most context
* Configure day-one access to Zendesk resources with groups from your identity provider

## Supported resources

| Resource              | Read | Grant and revoke access | Notes           |
| --------------------- | ---- | ----------------------- | --------------- |
| Zendesk Groups        | ✔️   | ✔️                      |                 |
| Zendesk Organizations | ✔️   | ✔️                      |                 |
| Zendesk Custom Roles  | ✔️   | ✔️                      | Enterprise only |

## Requirements

* You must be an Opal admin.
* You must have admin access to your Zendesk account to generate an API token.
* Be on version 1.1168.0 or greater, if you self-host Opal.

## 1. Create a Zendesk API token

In Zendesk, generate an API token by navigating to **Admin Center** > **Apps and integrations** > **APIs** > **Zendesk API** and enabling token access if not already on. Click **Add API token**, give it a description (e.g., `Opal`), and copy the token — it is only shown once.

## 2. Create a Zendesk app in Opal

In Opal, go to **Inventory > +App** and select **Zendesk**. Fill in the following fields and hit create.

| Field       | Value                                                                                    |
| ----------- | ---------------------------------------------------------------------------------------- |
| App admin   | The team or user that should manage the Zendesk app in Opal.                             |
| Description | Let your end users know what they're requesting access to.                               |
| Subdomain   | The subdomain of your Zendesk instance (e.g., `mycompany` from `mycompany.zendesk.com`). |
| Admin email | The email address of the Zendesk admin/agent who generated the API token.                |
| API token   | The API token you generated in [Step 1](#1-create-a-zendesk-api-token).                  |

## 3. Import Zendesk resources

After creating the app, you can import resources from **... > Import items**. Users will now be able to request access to Zendesk groups, organizations, and custom roles through Opal.

## User provisioning

Opal can automatically provision and deprovision users in Zendesk.

When provisioning is enabled, users who don't already have a Zendesk account are automatically created as agents when they are granted access to a Zendesk resource. Deprovisioning permanently deletes users from Zendesk when their access is revoked.

## Organizations: multiple organization support

<Note>
  By default, Zendesk only allows a user to belong to one organization at a
  time. If you plan to manage organization membership through Opal, enable
  **Multiple organizations** in your Zendesk account settings under **Admin
  Center** > **People** > **Configuration** > **End users**. Without this
  setting, granting a user access to a second organization will remove them from
  their current one.
</Note>

## Custom roles

Custom roles are only available on Zendesk **Enterprise** plans. On other plans, the custom roles resource type will not appear when importing items.