Zendesk Response Integration via API

Purpose

This guide explains how to configure the Zendesk Response integration in Logsign USO, so that Incidents and Alarms can automatically, or an analyst can manually, create and update Zendesk tickets, and look up tickets/users/organizations, directly from a Logsign Incident. This lets Logsign use Zendesk itself as a ticketing target, separate from the "zendesk-support-docs" internal tooling used elsewhere in Logsign's own documentation workflow; this integration is a customer-facing Response integration for any organization that uses Zendesk as their support/ITSM platform.

Prerequisites

  • A Zendesk account with API access.
  • Either an API token (recommended) or a password-based agent account, plus the account's username/email and subdomain host.
  • Use least privilege. Create a dedicated Zendesk agent account for this integration, scoped to ticket management, rather than reusing an administrator's personal login.

Step 1: Obtain Zendesk API Credentials

  1. Log in to your Zendesk account as an administrator.
  2. Go to Admin Center > Apps and integrations > APIs > Zendesk API, and enable Token Access if not already enabled.
  3. Generate an API token and copy it immediately; treat it as a secret credential.
  4. Note your Zendesk subdomain host (the yourcompany.zendesk.com address) and the email of the agent account the token is associated with.

Step 2: Configure the Integration in Logsign USO

In Logsign USO, go to Settings > Integrations > Responses, search for Zendesk, click Configure then +Device, and fill in:

FieldRequiredDescription
Device NameYesFree-text label identifying this Zendesk device in Logsign.
HostYesYour Zendesk subdomain host.
UsernameYesThe agent account's email/username from Step 1.
PasswordYesThe agent account's password, if using password-based auth.
Api KeyYesThe API token from Step 1, if using token-based auth. Stored encrypted at rest.

Both Password and Api Key are present in the configuration form; use the API token (recommended, since it can be revoked independently of the agent's login password) rather than the agent's actual login password where possible. Click Create to save the device.

Available Methods

Tickets

  • create-ticket (Containment) — creates a ticket. Args required: comment, requester_id; optional: type, subject, priority, status, assignee_id, organization_id, group_id, tags, custom_fields, macro_ids, and others.
  • update-ticket — updates a ticket. Arg required: ticket_id; same optional field set as create-ticket.
  • show-ticket (Analysis) — fetches a single ticket by id (required).
  • list-tickets (Analysis) — lists tickets, with pagination/sort args.
  • list-tickets-by-organization — lists tickets scoped to an organization. Arg: organization_id (required).
  • list-tickets-by-user — lists tickets scoped to a user. Arg: user_id (required).

Users and organizations

  • list-users — lists users.
  • show-end-user — fetches end-user detail by id (required).
  • list-users-by-group / list-users-by-organization — lists users in a group or organization by id (required).
  • list-organizations-by-user — lists organizations for a user by id (required).

Fields and search

  • list-ticket-fields — lists ticket field definitions.
  • query — free-text/API search. Arg required: query; optional: sort_by, sort_order.

Troubleshooting

SymptomLikely causeWhat to check
401 UnauthorizedWrong Host, Username, Password, or Api Key.Re-enter all fields exactly as shown in Zendesk; confirm the API token has not been revoked in Admin Center > APIs.
403 Forbidden on create-ticket/update-ticketThe agent account's role does not permit the action, or a referenced group_id/organization_id is outside the agent's access.Confirm the agent account's role in Zendesk includes ticket management for the target group/organization.
429 Too Many RequestsZendesk enforces API rate limits based on your plan.Reduce the frequency of automated calls, especially in high-volume correlation rules.

Notes and Limits

  • Use list-ticket-fields, list-users, and query to confirm valid field/ID values before calling create-ticket or update-ticket with fields you are not certain about.
Was this article helpful?
0 out of 0 found this helpful

Articles in this section

See more
Become a Certified Logsign User/Administrator
Sign-up for Logsign Academy and take the courses to learn about Logsign USO Platform in detail. Enjoy the courses, and get your badges and certificates. In these courses, you'll learn how to use Logsign in your work and add value to your career.
Visit Our Blog
Our Logsign USO Platform illustrate our expertise. So do the blog. Through our blog posts, deepen your knowledge on various SecOps topics or get updated about important news & modern approaches for cybersecurity. Get into the habit of reading valuable information provided by Logsign. Be a step ahead.