403 error when creating request via API | The place for Zendesk users to come together and share
Skip to main content
January 27, 2021
Question

403 error when creating request via API

  • January 27, 2021
  • 23 replies
  • 148 views

Hi,

I'm creating a custom form for our end-users within Zendesk itself. When I try to call the https://subdomain.zendesk.com/api/v2/requests API to create the request, it returns with a 403 error. I'm using an api token for auth. The API call works in postman and I was able to create a request but when I try to call it in my custom form in zendesk, it gives me a 403 error.


We are on Proffesional.

{
"error": {
"title": "Forbidden",
"message": "Invalid authenticity token"
}
}

 

Not sure what I'm doing wrong since the call works on postman.

var myHeaders = new Headers();
myHeaders.append("Authorization", "Basic btoa(email/token:API_TOKEN)");
myHeaders.append("Content-Type", "application/json");
myHeaders.append("Cookie", "__cfduid=d3d63f8118c012940ee1e08701ec6140d1610414533; _zendesk_session=BAh7CEkiD3Nlc3Npb25faWQGOgZFVEkiJTBiMGNlNTVlOGVhNjQ4NTcyMDkxNGJjMzZjOWQxNTdhBjsAVEkiDGFjY291bnQGOwBGaQMvZ5JJIgpyb3V0ZQY7AEZpA7nELw%3D%3D--2608b56780c88cadb0776d6913aace910de8a12b; __cfruid=da3497d68006538ec0acea547c226758ea2a06fc-1611699971");

var raw = JSON.stringify({"request":{"subject":"TESTING API!","comment":{"body":"My printer is on fire!"}}});

var requestOptions = {
  method: 'POST',
  headers: myHeaders,
  body: raw,
  redirect: 'follow'

};

fetch("https://subdomain.zendesk.com/api/v2/requests", requestOptions)
  .then(response => response.text())
  .then(result => console.log(result))
  .catch(error => console.log('error', error));

23 replies

Greg K
Employee
October 3, 2022
So I just tested this myself and it turns out it has nothing to do with the authentication method that you're using, rather it has to do with multibrand. When you make a request using a CSRF token from a secondary brand, it will always return a 403. Previously we have investigated this internally with respect to host-mapped instances, but I can confirm that host-mapping has nothing to do with it here.
 
I'm going to raise this with our secdev team, although I do want to note that this will likely not be a quick solution. Using a CSRF token like this is not an officially supported method for auth, so they may not prioritize this as a result. I'll update you when I hear back on this, just wanted to let you know that for the time being, we're going to say that receiving a 403 when using a CSRF token in a secondary brand is "expected." 
Manuel34
October 4, 2022

@ahmed11

I had this same issue and I had a very lenghty discussion regarding this with the Support team. I solved this issue by making all API requests to the main brand instead of the sub-brand (in my opinion API documentation says otherwise so this behavior is not as expected). Then it will work as it should. I have set up a trigger that fires on ticket creation to set the respective brand for the ticket so that it will be visible for the end user inside of Guide. You can use e.g. the title of the ticket to filter for the right brand if you are setting it programmatically.

Manuel34
October 7, 2022

@ahmed11

Yes, we are also unsure on how to do the authentication across brands right. We got it working for now on our end, but the comments are still being shown as "User was not logged in when the comment was submitted". Even though we use authentication.

To get it working, we did the following way (which at least works for now). Maybe you have another breakthrough:

  1. Visitor is on Help Center of Brand B
  2. If the visitor goes to the the custom contact forms a check is performed if the user is logged in (via the window object HelpCenter.user; If the user is not logged in, his role will be anonymous)
  3. If the visitor is logged in, display the custom contact forms, which the visitor can select and fill in
  4. On submit, the following http requests happen:
  5. GET Brand A.zendesk.com/api/v2/users/me (using the visitors email address from HelpCenter.user.email and API token)
  6. POST Brand A.zendesk.com/api/v2/requests (using the auhtenticity_token)

When we tried the subdomain Brand B on step 5, we got a 403 error.

In addition, we got the 403 when we did step 5 and 6 with the Brand B subdomain as well (we thought this was the way you're supposed to do it).