Announcing more granular OAuth client scopes

<figure class="wysiwyg-table" style="height: 44px; width: 100%;"><table class="wysiwyg-table-resized" style="border-collapse: collapse; margin-left: 0px; margin-right: auto;">
<colgroup>
<col style="width: 33%;">
<col style="width: 29%;">
<col style="width: 38%;">
</colgroup>
<tbody>
<tr style="height: 22px;">
<td style="height: 22px; width: 33.3333%;"><strong>Announced on</strong></td>
<td><strong>Rollout starts</strong></td>
<td style="height: 22px; width: 33.3333%;"><strong>Rollout ends</strong></td>
</tr>
<tr style="height: 22px;">
<td style="height: 22px; width: 33.3333%;">August 6, 2026</td>
<td>August 10, 2026</td>
<td style="height: 22px; width: 33.3333%;">August 11, 2026</td>
</tr>
</tbody>
</table></figure><p>We're introducing more granular OAuth scopes and the ability to configure allowed scopes for OAuth clients in Admin Center. Together, these enhancements give you more control over the access applications can request and help you apply the principle of least privilege.</p><p>This article includes the following sections:</p><ul>
<li data-list-item-id="e020a6b98c04c39132ba577f4dfa0f08d"><a href="#h_01K39FKN2ZKQS92V5424YQV505">What's changing?</a></li>
<li data-list-item-id="e3dd6e358869d5d12f95cd7ecff95a279"><a href="#h_01K3A7DY1MGYWC5Z9FE5WEZMD9">Why is Zendesk making this change?</a></li>
<li data-list-item-id="e3e42f1bdb94f846b08123531e33b4044"><a href="#h_01K3A7FEPQBH8P3JPGKNBZRT8C">What do I need to do?</a></li>
</ul><h2 id="h_01K39FKN2ZKQS92V5424YQV505">What's changing?</h2><p>Starting August 10, 2026, admins can configure allowed scopes when creating or editing an OAuth client in <strong>Admin Center</strong> &gt; <strong>Apps and integrations</strong> &gt; <strong>APIs</strong> &gt; <strong>OAuth clients</strong>. Allowed scopes define which scopes an OAuth client is permitted to request during the OAuth flow, giving you more control over the permissions granted to applications that integrate with your account.</p><p>To configure allowed scopes, create a new OAuth client or edit an existing one in <strong>Admin Center</strong> &gt; <strong>Apps and integrations</strong> &gt; <strong>APIs</strong> &gt; <strong>OAuth clients</strong>. Select the scopes the client is allowed to request. Learn about <a href="https://support.zendesk.com/hc/en-us/articles/4408845965210-Using-OAuth-authentication-with-your-application" target="_blank" rel="noopener noreferrer">using OAuth with your application</a> and <a href="https://developer.zendesk.com/api-reference/ticketing/oauth/grant_type_tokens/#scope" target="_blank" rel="noopener noreferrer">OAuth scopes</a>. </p><p><img class="wysiwyg-image img-screenshot" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/scopes_announcement.png" width="850"></p><p>When allowed scopes are configured, an OAuth client can request only those scopes during the OAuth flow. If a client requests a scope that isn't included in its configured allowed scopes, the request fails with a <code>400 Bad Request</code> response and an <code>invalid_scope</code> error.</p><h3 id="h_01KZ9G7FPVZRT399HASZVRKP6Y">Available OAuth scopes</h3><p>We've expanded the available OAuth scopes to provide more granular control over access. The following scopes are now available:</p><div><figure class="wysiwyg-table" style="width: 100%;"><table class="wysiwyg-table-resized">
<colgroup>
<col style="width: 30%;">
<col style="width: 70%;">
</colgroup>
<thead><tr>
<th>Scope</th>
<th>Description</th>
</tr></thead>
<tbody>
<tr>
<td><span style="color: #188038;">read</span></td>
<td>Read all data</td>
</tr>
<tr>
<td><span style="color: #188038;">write</span></td>
<td>Write all data</td>
</tr>
<tr>
<td><span style="color: #188038;">tickets:read</span></td>
<td>
<p><strong>View tickets</strong></p>
<p>Includes ticket contents, comments and conversation history, tags, forms and fields, audits, events, and metrics.</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">tickets:write</span></td>
<td>
<p><strong>Create, edit, and delete tickets </strong></p>
<p>Includes adding comments, adding and removing tags, merging tickets, marking tickets as spam, attaching uploaded files, managing ticket forms and custom statuses, and permanently deleting tickets.</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">users:read</span></td>
<td>
<p><strong>View users</strong></p>
<p>Includes their identities, active sessions, group, organization, and brand memberships, roles, and settings. </p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">users:write</span></td>
<td>
<p><strong>Create, edit, and delete users and manage their access</strong></p>
<p>Includes resetting passwords, ending active sessions, adding and verifying identities, changing group, organization, and brand memberships, and managing custom roles.</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">organizations:read</span></td>
<td>
<p><strong>View organizations and their details</strong></p>
<p>Includes organization memberships, subscriptions, and merge history.</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">organizations:write</span></td>
<td>
<p><strong>Create, edit, and delete organizations and manage their memberships</strong></p>
<p>includes adding and removing users from organizations, managing subscriptions, and merging organizations.</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">auditlogs:read</span></td>
<td>
<p><strong>View audit logs</strong></p>
<p>Includes the account-wide record of changes: who changed what and when.</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">hc:read</span></td>
<td>
<p><strong>View help center content</strong></p>
<p>Includes articles, sections, categories, community posts and comments.</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">hc:write</span></td>
<td>
<p><strong>Create, edit, and delete help center content</strong></p>
<p>Includes articles, sections, categories, community posts and comments.</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">apps:read</span></td>
<td>
<p><strong>View installed apps and their settings</strong></p>
<p>Includes which apps are installed in the account and each app’s settings.</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">apps:write</span></td>
<td>
<p><strong>Install, configure, and remove apps</strong></p>
<p>Includes installing and uninstalling apps, changing app settings, and uploading custom app packages.</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">automations:read</span></td>
<td>
<p><strong>View automations</strong></p>
<p>Includes viewing automations and their details.</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">automations:write</span></td>
<td>
<p><strong>Create, edit, and delete automations</strong></p>
<p>Includes creating, updating, and deleting automations.</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">targets:read</span></td>
<td>
<p><strong>View targets and their delivery failures</strong></p>
<p>Includes viewing targets and any failures when notifications were sent.</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">targets:write</span></td>
<td>
<p><strong>Create, edit, and delete targets</strong></p>
<p>Includes creating, updating, and deleting targets.</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">triggers:read</span></td>
<td>
<p><strong>View triggers</strong></p>
<p>Includes viewing triggers, trigger categories, and their revision history.</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">triggers:write</span></td>
<td>
<p><strong>Create, edit, and delete triggers</strong></p>
<p>Includes creating, updating, reordering, and deleting triggers and trigger categories.</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">macros:read</span></td>
<td>
<p><strong>View macros</strong></p>
<p>Includes viewing macros, their categories, and their attachments.</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">macros:write</span></td>
<td>
<p><strong>Create, edit, and delete macros</strong></p>
<p>Includes creating, updating, and deleting macros and their attachments.</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">requests:read</span></td>
<td>
<p><strong>View support requests</strong></p>
<p>Includes submitted requests and their comments.</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">requests:write</span></td>
<td>
<p><strong>Submit and edit support requests</strong></p>
<p>Includes creating new requests and adding to existing ones.</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">satisfaction_ratings:read</span></td>
<td>
<p><strong>View satisfaction ratings</strong></p>
<p>Includes ratings, their scores and reasons.</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">satisfaction_ratings:write</span></td>
<td>
<p><strong>Submit satisfaction ratings</strong></p>
<p>Includes rating a ticket good or bad with an optional reason.</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">dynamic_content:read</span></td>
<td>
<p><strong>View dynamic content</strong></p>
<p>Includes content items and their language variants.</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">dynamic_content:write</span></td>
<td>
<p><strong>Create, edit, and delete dynamic content</strong></p>
<p>Includes content items and their language variants.</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">themes:read</span></td>
<td>
<p><strong>View Guide themes</strong></p>
<p>Includes the help center's themes and their files.</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">themes:write</span></td>
<td>
<p><strong>Create, edit, and delete Guide themes</strong></p>
<p>Includes importing, updating, publishing, exporting, and deleting help center themes.</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">zis:read</span></td>
<td>
<p><strong>View private integrations</strong></p>
<p>Includes integration configurations, connections, and inbound webhooks.</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">zis:write</span></td>
<td>
<p><strong>Create, edit, and delete private integrations</strong></p>
<p>Includes integration configurations, connections, and inbound webhooks.</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">webhooks:read</span></td>
<td>
<p><strong>View webhooks</strong></p>
<p>Includes webhook configurations and their activity history.</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">webhooks:write</span></td>
<td>
<p><strong>Create, edit, and delete webhooks</strong></p>
<p>Includes creating, updating, testing, and deleting webhooks.</p>
</td>
</tr>
<tr>
<td>
<span style="color: #188038;">security:read</span> (read only)</td>
<td>
<p><strong>View security and sign-in settings</strong></p>
<p>Includes password policy, session timeouts, IP restrictions, and single sign-on configuration.</p>
</td>
</tr>
<tr>
<td>
<span style="color: #188038;">any_channel:write</span> (write only)</td>
<td>
<p><strong>Push messages from an external channel into Zendesk</strong></p>
<p>Includes creating tickets, comments, and users from an integrated channel's conversations.</p>
</td>
</tr>
<tr>
<td>
<span style="color: #188038;">web_widget:write</span> (write only)</td>
<td>
<p><strong>Edit Web Widget settings</strong></p>
<p>Includes updating the configuration of the embedded Web Widget.</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">account_settings:read</span></td>
<td>
<p><strong>View account settings</strong></p>
<p>Includes account configuration, ticket and user fields, and workspaces</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">account_settings:write</span></td>
<td>
<p><strong>Create, edit, and delete account settings</strong></p>
<p>Includes creating, updating, and deleting account configuration, ticket and user fields, and workspaces</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">brands:read</span></td>
<td>
<p><strong>View brands</strong></p>
<p>Includes viewing brands and their agent assignments</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">brands:write</span></td>
<td>
<p><strong>Create, edit, and delete brands</strong></p>
<p>Includes creating, updating, and deleting brands and their agent assignments</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">custom_objects:read</span></td>
<td>
<p><strong>View custom objects</strong></p>
<p>Includes custom object definitions and record attachments</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">custom_objects:write</span></td>
<td>
<p><strong>Create, edit, and delete custom objects</strong></p>
<p>Includes custom object definitions and record attachments</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">deletion_schedules:read</span></td>
<td>
<p><strong>View deletion schedules</strong></p>
<p>Includes viewing data retention policies that automatically delete tickets, users, and other data</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">deletion_schedules:write</span></td>
<td>
<p><strong>Delete deletion schedules</strong></p>
<p>Includes deleting data retention policies, which stops the scheduled deletion of tickets, users, and other data</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">groups:read</span></td>
<td>
<p><strong>View groups</strong></p>
<p>Includes viewing groups and their memberships</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">groups:write</span></td>
<td>
<p><strong>Create, edit, and delete groups</strong></p>
<p>Includes creating, updating, and deleting groups and their memberships</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">sla_policies:read</span></td>
<td>
<p><strong>View SLA policies</strong></p>
<p>Includes viewing SLA and group SLA policies</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">sla_policies:write</span></td>
<td>
<p><strong>Create, edit, and delete SLA policies</strong></p>
<p>Includes creating, updating, reordering, and deleting SLA and group SLA policies</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">ticket_attachments:read</span></td>
<td>
<p><strong>View ticket attachments</strong></p>
<p>Includes viewing files attached to tickets</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">ticket_attachments:write</span></td>
<td>
<p><strong>Upload, edit, and delete ticket attachments</strong></p>
<p>Includes uploading files, updating and deleting attachments, and redacting them</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">ticket_views:read</span></td>
<td>
<p><strong>View ticket views</strong></p>
<p>Includes viewing views and the tickets they return</p>
</td>
</tr>
<tr>
<td><span style="color: #188038;">ticket_views:write</span></td>
<td>
<p><strong>Create, edit, and delete ticket views</strong></p>
<p>Includes creating, updating, and deleting views</p>
</td>
</tr>
</tbody>
</table></figure></div><h2 id="h_01K3A7DY1MGYWC5Z9FE5WEZMD9">Why is Zendesk making this change?</h2><p>OAuth scopes help define the level of access an application can request. Previously, the available scopes were broader, which could result in applications requesting more access than they required.</p><p>By introducing more granular OAuth scopes and allowing you to configure which scopes an OAuth client can request, you can better align application access with your organization's security requirements. These enhancements support the principle of least privilege by helping ensure applications request only the access they need, while giving administrators greater control over OAuth client access. </p><p>Together, these changes make it easier to manage OAuth clients, reduce unnecessary access, and strengthen the security of integrations with your Zendesk account.</p><h2 id="h_01K3A7FEPQBH8P3JPGKNBZRT8C">What do I need to do?</h2><p>Existing OAuth clients continue to work as they do today. Clients without configured allowed scopes continue requesting scopes during the OAuth authorization flow as before. You can configure allowed scopes for existing clients whenever you're ready to apply scope restrictions. </p><p>If you have feedback or questions related to this announcement, visit our <a href="https://community.zendesk.com/ideas" target="_blank" rel="noopener noreferrer"><span class="wysiwyg-underline">community forum</span></a> where we collect and manage customer product feedback. For general assistance with your Zendesk products, contact <a href="https://support.zendesk.com/hc/en-us/articles/4408843597850" target="_blank" rel="noopener noreferrer"><span class="wysiwyg-underline">Zendesk Customer Support</span></a>.<br><br> </p>