Zendesk

The Zendesk Source works by polling your event/alert logs every 60 seconds. It supports two authentication methods: OAuth client credentials, which is recommended, and the legacy API token method.

Setup with OAuth

In Zendesk Admin Center, go to Apps and integrations > APIs > OAuth clients and click Add OAuth client.

• Set Client kind to Confidential. Zendesk only allows the client credentials grant for confidential clients, so a public client will not work.
• Redirect URLs are not used by this integration. If the form requires a value, any HTTPS URL such as https://runreveal.com is fine.
• RunReveal only requires the auditlogs:read to ingest logs.

Save the client, then copy the Secret. Zendesk shows it in full only once.

Provide the client Identifier as the Client ID, the Secret as the Client Secret, and your Zendesk subdomain to RunReveal while creating the source.

Migrating from API token authentication

Zendesk is retiring API tokens in phases:

Sources still using an API token show a deprecation notice with an Upgrade to OAuth button. Create a confidential OAuth client as described above, then enter its Identifier and Secret and save. RunReveal deletes the stored API token and email address once the OAuth client is in place, so keep the token active in Zendesk until you have confirmed the source is still ingesting.

Setup with an API token

To connect your source with an API token, generate one from your Zendesk settings tab. Make sure Token Access is enabled and create a new token.

Provide the token, as well as the email address of your Zendesk Support administrator to RunReveal while creating the source.

Verify the configuration

Click verify source prior to connecting your source in RunReveal, which may take a moment, but if successful will ensure that the source is correctly configured.

Verify It's Working

Once added the source logs should begin flowing within a minute.

You can validate we are receiving your logs by running the following SQL query.

SELECT * FROM runreveal.logs WHERE sourceType = 'zendesk' LIMIT 1

Schema

The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.