Zoho Desk

What your agents can doCopy Anchor Link

Agents search the indexed Zoho Desk REST API to find operations, then call them with your connection's credentials. The index covers 905 unique operations from Zoho's public specification, including tickets, threads, contacts, accounts, activities, knowledge articles, automation and settings. Access depends on your OAuth grant, profile permissions and plan. Five operations with broken specification references are listed under Limits.

AuthenticationCopy Anchor Link

Zoho Desk uses OAuth.

Data centre values are com (US), eu, in, com.au, jp, ca, sa, com.cn, uk, ae (UAE) and sg (Singapore). Canada uses accounts.zohocloud.ca and desk.zohocloud.ca; the other regions use accounts.zoho.<region> and desk.zoho.<region>.

Connect your appCopy Anchor Link

1. Create a Server app in the Zoho API console.
2. Register https://<your-helios-host>/integrations/zoho_desk/oauth_callback as the redirect URI.
3. In Helios, select Your Zoho OAuth app, choose the account's data centre, and enter the Organization ID and app credentials for that data centre.
4. Leave Admin access off for a Server app. Enable it only with an ORG client and an organization administrator's consent. This uses instance-level OAuth, a separate authorization flow.
5. Continue to Zoho and approve offline access. If Zoho redirects from a different data centre, select that data centre in Helios and reconnect.

For Existing OAuth tokens, generate access and refresh tokens with a Self Client or another OAuth app and enter both tokens and that app's credentials. Helios refreshes revoked or expired access tokens when the API requests reauthorization and schedules a weekly refresh while the refresh token remains usable. A revoked refresh token requires reconnection.

ScopesCopy Anchor Link

Normal OAuth requests the following published scope families. Every family below requests each of .ALL, .READ, .CREATE, .UPDATE and .DELETE.

• DRE.dreapi
• Desk.InstantMessages
• Desk.accounts
• Desk.activities
• Desk.activities.calls
• Desk.activities.events
• Desk.activities.tasks
• Desk.agents
• Desk.articles
• Desk.automations
• Desk.basic
• Desk.botchat
• Desk.buttons
• Desk.calls
• Desk.channels.email
• Desk.channels.helpcenter
• Desk.community
• Desk.contacts
• Desk.contracts
• Desk.custommodule
• Desk.departments
• Desk.events
• Desk.extensions
• Desk.extensions.data
• Desk.extensions.settings
• Desk.feeds
• Desk.fields
• Desk.forums
• Desk.integrations
• Desk.layouts
• Desk.modules
• Desk.phonebridge
• Desk.products
• Desk.settings
• Desk.settings.extension
• Desk.tasks
• Desk.templates
• Desk.tickets
• Desk.webhooks
• Desk.zia
• profile.userphoto

Additional exact scopes are Desk.featuresettings.READ, Desk.featuresettings.UPDATE, Desk.search.READ, Desk.deskOembed.READ, Desk.imports, Desk.exports, Desk.organization.READ, Desk.organization.UPDATE, Desk.privacysettings.READ; Desk.permissions and Desk.teams with each of .READ, .CREATE, .UPDATE, .DELETE; Desk.recyclebin.READ, Desk.recyclebin.UPDATE, Desk.recyclebin.DELETE; and Desk.contacts.WRITE, Desk.events.WRITE, Desk.tasks.WRITE, Desk.tickets.WRITE.

Admin access requests Desk.accessAll.ALL through the ORG flow. Ordinary scope grants do not override profile permissions. Helios does not request Desk.imports.CUSTOM, Desk.exports.CUSTOM, Desk.community.GET, Desk.community.PATCH, Desk.qaautomation.CREATE or bare settings.READ. Zoho may reject a broad consent request containing scopes unavailable to your app; reconnect with existing OAuth tokens carrying your approved scopes if needed.

TriggersCopy Anchor Link

On every setup, Helios creates or updates the first webhook at this connection's URL and requests all 56 catalog events without restrictions, including events from automation. It keeps accepted subscriptions if Zoho refuses another event and reports unavailable events with the vendor's reason. The account must have a plan that supports webhooks and the profile's Webhook permission.

All filters are optional glob patterns. ID filters are case-sensitive; text filters ignore case. A selected filter does not match when the delivery omits its field, so deletion events expose only the fields Zoho documents. Translation articleId reads payload.id, and section categoryId reads payload.rootCategoryId.

The vendor catalog documents most payloads. ticket_attachment.trashed, ticket_attachment.restored, ticket_comment_attachment.added and ticket_comment_attachment.deleted appear only in the pinned subscription schema and may be refused by Zoho.

Errors and limitsCopy Anchor Link

• Free and Standard plans have no active webhooks. Professional allows five, Enterprise ten and Ultimate twenty; an organization can configure at most twenty. A plan downgrade can disable webhooks. See Zoho's limits and permissions.
• OAUTH_ORG_MISMATCH means the Organization ID and token belong to different organizations. Reconnect with the matching ID and data centre. A 403 during setup can indicate missing Webhook permission, scopes or plan access. API rate limits and credits vary by plan.
• Webhooks use X-ZDesk-JWT and RS256. Helios verifies each token with the public keys of the connection's data centre, such as https://desk.zoho.eu/.well-known/jwks.json for eu. Helios checks the organization issuer, stored webhook audience, expiry and a five-minute token age.
• Zoho's JWT signs its claims, not the HTTP body.
• Zoho supplies no delivery ID, so Helios may treat identical events in different batches as one. Retry schedules, batch limits and daily delivery limits are not documented.

Limits on indexed operationsCopy Anchor Link

The pinned vendor files contain broken references. These five operations are excluded: