Zendesk API to get User Roles and Access

Hi Rikita! Depending on what you're looking for, you may find it in the Users API or if you're on an Enterprise plan and have custom roles, the Custom Agent Roles API.

Hi,

I think the question is not around setting a Support role, but adjusting Access to to the various products. Changing access in the UI has the browser hitting this endpoint:

https://{subdomain}/api/admin/private/staff/{userID}/entitlements

This API isn't published in the API docs. Is there any roadmap for supporting this?

It would be nice if this API endpoint https://{subdomain}/api/admin/private/staff/{userID}/entitlements could be officially supported by Zendesk and a published API Doc.

As of now, I am able to activate only TALK via API via PUT Method. For chat, we need POST method but it says "You may have mistyped the address or the page may have moved." for the same endpoint which works fine for PUT methods. 

If Zendesk could add these lines below as default to a user's entitlement here https://{subdomain}/api/admin/private/staff/{userID}/entitlements it would fix it and we could use the PUT methods.

 "entitlements": {
    "chat": {
      "user_id": {userID},
      "name": "agent",
      "is_active": false
    }

FWIW I was able to activate Chat via PUT with the following JSON (we're using a custom role for Support). It works even if the Chat object does not exist on the user and you don't need to supply the user_id parameter since it's in the URL.

{
  "entitlements": {
    "chat": {
      "name": "agent",
      "is_active": true
    },
    "explore": {
      "name": "admin",
      "is_active": true
    },
    "guide": {
      "name": "admin",
      "is_active": true
    },
    "support": {
      "name": "custom_16653721760667",
      "is_active": true
    },
    "talk": {
      "name": "agent",
      "is_active": false
    }
  }
}

@greg29

Is there an update to this? Being able to update many users roles and access in one go via the API will be a really good addition.

Are there any updates on this API? As mentioned earlier, this would be a great feature to have.

Hi all,

No additional updates since the last time I responded with the closest options. I would recommend sharing your thoughts in our product feedback forum to get some traction around this idea.

Adding my voice to this feature request.

Our team relies heavily on Zendesk Chat, but the inability to manage an agent's Chat access via the API creates a significant operational bottleneck.

When an agent leaves, our automated offboarding process is halted. I am forced to manually go into the admin panel, access the user's profile, and individually disable their access to the Chat product. This should be a simple API call.

While we can fully automate role changes for the Support product, this manual step for Chat prevents us from efficiently freeing up paid licenses (seats) and requires daily, time-consuming intervention. An API endpoint for this is essential for proper user and license lifecycle management.

FYI; I just used this to bulk shut off access to Guide for 300+ users. I fed a text file of user IDs through a for loop that ran this. No doubt this could be adapted for the other products.

Replace (zd-domain) and (user-id) appropriately, and make sure you include an authorization header/login.

curl -H "Content-Type: application/json" \
  -X PUT https://(zd-domain)/api/admin/private/staff/(user-id)/entitlements \
  -d "{\"entitlements\": {\"guide\": {\"name\": \"viewer\", \"is_active\": false}}}"

+1 on this request, my team would find this very useful for automating the onboarding process for new agents. As it stands, we can create a user automatically though the api with nearly all the correct permissions, but then we have to manually go in and grant them acccess to Talk.

I asked for an update on this back in January 2024 but haven't had one. I'm revisiting this as I want to list all agents and the prodcuts they have access to for accurate licence reporting and logging.

Using ‘https://(zd-domain)/api/admin/private/staff/(user-id)/entitlements’ still works for showing one agent but I want all. I tried with ‘https://(zd-domain)/api/admin/private/staff.json' and this semi works. By that I mean it shows the first page as it is on the Team Members page in Admin Center. I then tried ‘https://(zd-domain)/api/admin/private/staff.json?&page=2’ but the same users were shown (just those on the first page of the Team Members page.

Is there any update to this being added into the main api requests? Does anyone have a work around to show more than the first page?

Hey,

Based on 2 Kind users here we are able to achieve adding the “Chat" option via API:

PUT
URL: [subdomain].zendesk/api/admin/private/staff/{user_id}/entitlements.json

JSON Body:

{
 "entitlements": {
   "chat": {
     "name": "agent",
     "is_active": true
   },
   "support": {
     "name": "[Custom Role ID]", 
     "is_active": true
   },
   "explore": {
     "name": "agent",
     "is_active": true
   },
   "guide": {
     "name": "agent",
     "is_active": true
   },
   "talk": {
     "name": "agent",
     "is_active": false
   }
 }
}

Zendesk Team:

We request that Zendesk officially expose this functionality in the standard User Update endpoint.

We should be able to fully provision an agent—including their Product Access (Support, Chat, Talk)—in a single API call without relying on undocumented private endpoints or legacy Zopim calls.

Desired Capability: Support a parameter like "chat_access": true (or an entitlements object) directly inside the PUT /api/v2/users/{id}.json body:

This would significantly streamline onboarding automation for Enterprise customers.

Thanks!