Zendesk API Guide: OAuth, Rate Limits, Webhooks and MCP

The Zendesk API is a family of REST APIs (Ticketing, Help Center, Voice and others) that read and write the same data your agents see. Every current plan includes it, with a ceiling of 200 requests a minute on Support Team and Suite Team, 400 on Suite Professional and 700 on Suite Enterprise. The urgent part is authentication. All Support API tokens stop working permanently on April 30, 2027, with no opt-out or extension.^[1] Our verdict: build on OAuth now, page with cursors, expect duplicate webhooks, and check plan gates before you design around ZIS or MCP.

Step 1: Swap API tokens for OAuth before April 30, 2027

Zendesk is retiring tokens in stages. Accounts created on or after July 28, 2026 cannot create or use them, and since that date a token unused for 30 days deactivates, then is deleted after 60. Since October 27, 2026 no account can create a new token, though active ones work until the deadline. Only Support API tokens for Ticketing, Help Center and Voice are affected. Messaging and Chat credentials are exempt.

Migration is short on paper. Create an OAuth client in Admin Center, then request access tokens with the client_credentials grant for server jobs, or authorization_code when a person signs in. First, open the token usage report on the API tokens page: it shows the previous seven days of requests, which is how you find the forgotten script on someone's laptop. Browser code must move anyway, since client-side CORS requests work only with OAuth access tokens.

Vendors face stricter rules. An app distributed to several Zendesk customers must use global OAuth tokens, and developer policies forbid any third-party app from authenticating with a customer's API token or the customer's own OAuth client. Webhooks that call back into your own Zendesk with an API token will also break; Zendesk has promised native OAuth for webhooks, with no date yet. On Suite Enterprise, a Manage APIs permission lets admins delegate OAuth client management.

Step 2: Size the job against your plan's rate limit

Your plan sets the speed. The general limit for the Support and Help Center APIs is counted per minute, and the whole account is capped at 100,000 requests a minute across all sources. By our arithmetic, 200 requests a minute is 12,000 an hour, enough for most nightly syncs but tight for a historical backfill. Ticket updates agents make in the interface do not count toward the general limit, so a busy support floor will not starve your script.

The High Volume API add-on replaces the plan limit with 2,500 requests a minute rather than adding to it.^[2] It needs at least 10 agent seats, and among plans on today's pricing page only Suite Professional and Suite Enterprise qualify. Zendesk does not publish its price. Seats are billed per agent per month, so that 10-seat floor matters for small teams; our Zendesk pricing guide covers the seat rules.

Endpoint limits hit first. One user can update the same ticket 30 times in 10 minutes. Executing a view is capped at 5 requests a minute per view per agent, and Update User or Update Organization at 5 a minute per record. Incremental Exports allow 10 requests a minute, or 30 with High Volume. The Chat API allows 200 a minute per endpoint. A dashboard that polls one view for every agent is the classic way to hit these caps.

Step 3: Handle 429s and paginate with cursors

Cross a limit and Zendesk answers with HTTP 429 and a Retry-After header. Honor it. Wait the stated seconds, then retry the same request. Every response also carries X-Rate-Limit headers with your limit and remaining requests, so a well-behaved client slows down before it reaches zero. The Customer Agreement forbids bypassing rate limiting mechanisms, which rules out rotating credentials or splitting one job across accounts to dodge the cap.

Pagination has a hard trap. Offset pagination stops at the first 100 pages and 10,000 records; past that the API returns a 400 error. Cursor pagination has no depth limit and is switched on with the page[size] parameter, which most endpoints cap at 100. By our arithmetic, a 50,000-ticket backfill at 100 records a page needs 500 requests, about two and a half minutes of a 200-a-minute quota. Write cursor code from day one.

Incremental Exports were the usual shortcut for syncing changes. For third-party apps and integrations, Zendesk is ending them: the rollout starts December 2, 2026 and targets completion on January 19, 2027. Customers keep them for internal integrations, and an admin can request a 60-day extension for a partner. The voice stats incremental calls and legs endpoints have no alternative, so a vendor reporting on call data needs a new design.

Step 4: Receive events with webhooks, and expect duplicates

Webhooks push data out instead of making you poll. Each one connects either to Zendesk events (users, organizations, help center and community activity) or to a trigger or automation for ticket activity. Not both. The choice cannot be changed later, so pick the trigger path when you need conditions, such as only urgent tickets. Authentication options are API key, basic and bearer token over HTTPS, and a signing secret lets your endpoint verify the payload.

Delivery is best effort. Zendesk says it cannot guarantee single delivery, so duplicates are possible.^[3] Requests time out after 12 seconds and are retried up to five times; a 409 response is retried up to three times. Make your receiver idempotent: store the event or ticket ID, return a success code fast, and do the heavy work from a queue. Trial accounts are capped at 10 webhooks and 60 invocations a minute.

A failing endpoint trips the circuit breaker at more than 1,000 errors in five minutes, or 70 percent errors, once the webhook has sent at least 100 requests in that window. After a five-second pause it fires again, repeating the pause until a request succeeds. The activity log keeps each invocation's status for seven days, so check it during rollout rather than after a quiet week of silently dropped events.

Step 5: Choose Action Builder, ZIS or MCP for orchestration

Not every integration needs your own server. Action Builder, included from Suite Team, runs no-code action flows, and its built-in Zendesk actions on tickets, users and organizations need no API token or OAuth and do not count toward API rate limits. Custom actions do count. Choosing the Zendesk API authentication option on one creates an OAuth connection automatically, scoped to minimum permissions, so credential handling disappears for many internal jobs.

ZIS (Zendesk Integration Services) handles heavier plumbing: workflows triggered by activity in Zendesk or another system, on OAuth 2.0, with 2,000 requests a minute on Inbound Webhooks. Zendesk lists it for Suite Growth and above or Support Professional and above. Neither plan is on today's pricing page, so a new buyer gets ZIS on Suite Professional or Suite Enterprise. Our Zendesk for developers guide covers apps and SDKs.

MCP runs in two directions, and only one is Zendesk's. The built-in MCP client, generally available since August 10, 2026, connects Zendesk to public or private MCP servers such as Asana, Stripe or GitHub and exposes their tools in action flows and to AI agents. The announcement lists Support Team and above plus Suite Growth and above, so Suite Team is not on it. Connections are managed on the Connections page in Admin Center.

To let Claude, ChatGPT or another assistant reach into your Zendesk, the Marketplace lists Swifteq's MCP Server app, a third-party product.^[4] It is free for 500 MCP calls a month per account; its Team plan is 49 EUR a month including the first user, plus 9 EUR per extra user. It has no delete, merge or spam tools, and public replies stay off until an account owner enables them. Review it like any vendor with ticket access.

Step 6: Test in a sandbox or developer account first

Never build against production. Zendesk offers a free 14-day trial developer account, and developer partners get a sponsored instance for up to 5 agents that does not expire; Marketplace partners get Suite Enterprise by default. It is strictly a workbench. Zendesk suspends any sponsored Support account used to provide actual support, so keep real customer traffic on a paid account and your experiments on the free one.

In-house teams use sandboxes instead. Suite Enterprise includes two, and Suite Professional can buy them as an add-on with no published price. A sandbox matches production only when created; a later sync updates products, add-ons and seat counts but no other data. The High Volume API add-on is not copied to sandboxes, so load tests there run at the plan limit. Testing AI agents in a sandbox consumes no automated resolutions.

The bottom line

The Zendesk API is broad and well documented, but 2026 changed its ground rules. Treat April 30, 2027 as a hard deadline: move every script, webhook callback and vendor integration to OAuth, switch list calls to cursor pagination, honor Retry-After, and make webhook receivers idempotent. Support Team and Suite Team cover REST and webhooks at 200 requests a minute, while ZIS, sandboxes and the High Volume add-on start at Suite Professional among current plans. For off-the-shelf apps, see our Zendesk integrations guide.