What is an OAuth scope?
An OAuth scope defines the permissions granted to an access token.
In Zendesk, scopes determine:
Which resources Salto can access (tickets, users, triggers, etc.)
What actions Salto can perform (read, write)
The scope is provided as a single string, made up of space-separated parts.
Scope string format
Zendesk supports two scope formats, and they can be combined:
Simple permissions (global access)
Resource-specific permissions
1. Simple permissions (global access)
These grant access across all Zendesk resources.
Valid permissions
read– Read-only accesswrite– Write access
Examples
Scope | Meaning |
| Read-only access to all Zendesk data |
| Full read/write access (default behavior) |
| Full access, including impersonation |
2. Resource-specific permissions
You can limit access to specific Zendesk resources using the format:
resource:permission
Valid resources
ticketsusersauditlogsorganizationshc(Help Center)appstriggersautomationstargetswebhookszis(Zendesk Integration Services)
Valid permissions
readwrite
Examples
Scope | Meaning |
| Read-only access to tickets |
| Read tickets, write users |
| Read and write tickets |
3. Mixed scope format
You can combine global and resource-specific scopes.
Zendesk evaluates them together.
Examples
Scope | Meaning |
| Read everything, write only tickets |
| Read tickets & users, write everything else |
Default and fallback behavior
Case | Result |
Scope not provided | Defaults to |
Invalid scope provided | Falls back to |