{ "data": { "similar": [ { "grade": "BB", "json": "https://www.anchorterminal.com/tools/intercom.json", "name": "Intercom API + MCP", "score": 71.5, "shared": [ "support.tickets", "support.conversations", "support.contacts", "support.notes", "support.webhooks" ], "slug": "intercom" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/zendesk.json", "name": "Zendesk Support API", "score": 68.7, "shared": [ "support.tickets", "support.conversations", "support.contacts", "support.notes", "support.webhooks" ], "slug": "zendesk" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/plain.json", "name": "Plain API + MCP", "score": 65.5, "shared": [ "support.tickets", "support.conversations", "support.contacts", "support.notes", "support.webhooks" ], "slug": "plain" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/front.json", "name": "Front API + MCP", "score": 63.6, "shared": [ "support.tickets", "support.conversations", "support.contacts", "support.notes", "support.webhooks" ], "slug": "front" }, { "grade": "C", "json": "https://www.anchorterminal.com/tools/kustomer.json", "name": "Kustomer", "score": 57.3, "shared": [ "support.tickets", "support.conversations", "support.contacts", "support.notes", "support.webhooks" ], "slug": "kustomer" }, { "grade": "C", "json": "https://www.anchorterminal.com/tools/help-scout.json", "name": "Help Scout API + MCP", "score": 56.1, "shared": [ "support.tickets", "support.conversations", "support.contacts", "support.notes", "support.webhooks" ], "slug": "help-scout" } ], "tool": { "slug": "zoho-desk", "name": "Zoho Desk", "vendor": "Zoho", "vendorUrl": "https://www.zoho.com/desk/", "kind": "http-api", "category": "support", "summary": "Zoho Desk is a hosted helpdesk from Zoho for tickets, contacts, knowledge base articles and support channels. Agents reach it through the REST API v1 behind OAuth 2.0, described in public OpenAPI 3.1 files.", "url": "https://www.anchorterminal.com/tools/zoho-desk", "markdownUrl": "https://www.anchorterminal.com/tools/zoho-desk.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/zoho-desk.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/zoho-desk.json", "repo": "https://github.com/zoho/zohodesk-oas", "license": "Proprietary service under Zoho's Terms of Service. The OpenAPI repository on GitHub has no licence file", "transports": [ "http" ], "packages": [], "auth": "oauth", "authNotes": "OAuth 2.0 only. A person registers a client in the Zoho API console (a web application, or a self client for one organisation) and approves scopes such as `Desk.tickets.READ`. The access token lasts one hour and goes in `Authorization: Zoho-oauthtoken \u003ctoken\u003e` or `Authorization: Bearer \u003ctoken\u003e`. Each token is bound to one Desk organisation, and each data centre has its own accounts host and API host. Registration is self-serve, with no app review or sales approval found for use inside one's own organisation.", "pricing": "freemium", "pricingNotes": "Free edition for three users with 5,000 API credits a day and no card. Paid editions cost $7 to $40 a user a month billed yearly ($9 to $50 monthly) and have a 15-day trial without a card. API calls draw on a daily credit allowance set by edition and user count. Extra credits start at $4.20 a month per 1,000 daily credits and are ordered by email (https://www.zoho.com/desk/pricing.html, checked 2026-10-08).", "priceSummary": "$7 / seat-mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API document, the OpenAPI files or the pricing page (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://desk.zoho.com/DeskAPIDocument", "openapi": "https://github.com/zoho/zohodesk-oas/tree/main/v1.0", "capabilities": [ "support.tickets", "support.conversations", "support.contacts", "support.notes", "support.webhooks" ], "tags": [ "hosted", "closed-source", "oauth", "openapi", "webhooks", "free-tier", "no-card", "java", "status-page", "bug-bounty", "soc2" ], "lastRelease": "2026-09-09", "graded": true, "anchor": { "graded": true, "score": 66.6, "grade": "B", "agentReady": false, "rank": 262, "ranked": true, "rankOf": 842, "categoryRank": 3, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 67, "maintenance": 63, "payments": 40, "reliability": 75, "schema": 72, "security": 66, "transparency": 79 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 75, "points": 15, "reason": "Graded on the REST API v1, read as a hosted service. status.zoho.com redirects to us.zohostatus.com, which has a Zoho Desk component (20). The incident history loads by script and we could not read it. The status feed shows the Desk component returning to Operational on 3 September 2026 at the same minute as Zoho CRM, Books, Flow, SalesIQ and Deluge, with no other Desk entry since July, so we read the record as minor incidents only without a duration (20 of 30). Daily credits and concurrency are published with numbers per edition (15). A 429 at the daily limit carries Retry-After, and every response reports credits used and remaining. Concurrency 429s carry no Retry-After, and no idempotency or retry guidance for writes was found (10 of 15). No SLA found, and the Terms of Service disclaim uninterrupted service (0). v1 is the current documented version (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 72, "points": 11.7, "reason": "zoho/zohodesk-oas on GitHub holds OpenAPI 3.1.0 files for 185 resources and 911 operations (25). No llms.txt at zoho.com or desk.zoho.com and no Markdown docs found (0). 910 of 911 operations carry a description that states the purpose, often with a note on limits, and little on when not to use one (14 of 20). Parameters carry enums, patterns and length limits, and replies use a discriminated schema per channel. Custom fields make record bodies open (12 of 15). The API document has a curl sample and response per endpoint and a list of error codes, and 658 operations declare an error response (14 of 15). The version is in the path and a compatibility statement promises forum notice of changes, with no dated changelog found (7 of 15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 67, "points": 10.89, "reason": "Graded on the REST API. Lists default to 10 records with at most 50, `include` adds related resources on request, and `fields` exists on some list calls only (18 of 25). `from` and `limit`, saved views, `sortBy` and module search with field filters. Deep offsets cost up to 100 credits a call and search stops at offset 4,999 (18 of 20). Errors carry `errorCode`, `message`, `errorType` and the field as a JSON Pointer (18 of 20). No idempotency key. Drafts can be saved before sending (6 of 20). One official SDK, for Java, and setup needs an hourly token refresh and the right regional host (7 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 66, "points": 11.55, "reason": "OAuth 2.0 with scopes per module and operation, one-hour access tokens and revocable refresh tokens (30). Less 10 because Zoho's OAuth guide documents the refresh call with the refresh token and client secret in the URL query string as one of three options (20 of 30). READ-only scopes, calls bound by the user's profile permissions, a draft and send-for-review path for replies, and a 60-day recycle bin for deleted tickets. Spam deletion is permanent and no approval step guards bulk updates (15 of 20). Tickets hold customer-written text and no prompt-injection guidance was found (3 of 15). A ticket history endpoint lists actions per ticket and a dashboard shows credit use. A portal-wide audit log for Desk was not established (8 of 15). security.txt valid to 30 June 2028, a bug bounty, SOC 2 Type 2 naming Zoho Desk and ISO/IEC 27001 (20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 40, "points": 5, "reason": "No x402, MPP or L402 (0). Edition prices are public, $7 to $40 a user a month billed yearly, and extra API credits have a published rate from $4.20 a month per 1,000 daily credits (20). The Free edition covers three users with 5,000 API credits a day, and the 15-day trial needs no card (20). A person signs up in a browser, registers an OAuth client in the API console and approves scopes (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 63, "points": 5.51, "reason": "The OpenAPI files were last changed on 9 September 2026, 29 days before this check (30). The repository has dated commits on 2, 8 and 9 September 2026, three in the last 90 days, all within one week (20). The developer forum named as the place for API notices loads by script, so replies and dates were unread, and no dated changelog was found (6 of 15). The only official SDK is for Java, version 1.3.0 for Java 7 and above, with no release date found (5 of 15). No public repository or CI for the SDK (2 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 79, "points": 6.91, "note": "editorial 62, provenance 95", "reason": "Closed service under the Zoho Terms of Service, last updated 2 March 2022. The OpenAPI repository has no licence file (15 of 30). The privacy policy of 22 December 2025 says data is deleted from the active database within six months of account termination and from backups three months later. The DPA is sent on request by email (24 of 30). The API document promises forum notice and a transition period for deprecations without stating a length, and marks deprecated fields without dates (8 of 20). A sub-processor page exists, but its directory loads by script and we could not read the list. The data centre page names regions and cities (15 of 20)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Graded on the REST API. Lists default to 10 records with at most 50, `include` adds related resources on request, and `fields` exists on some list calls only (18 of 25). `from` and `limit`, saved views, `sortBy` and module search with field filters. Deep offsets cost up to 100 credits a call and search stops at offset 4,999 (18 of 20). Errors carry `errorCode`, `message`, `errorType` and the field as a JSON Pointer (18 of 20). No idempotency key. Drafts can be saved before sending (6 of 20). One official SDK, for Java, and setup needs an hourly token refresh and the right regional host (7 of 15).", "maintenance": "The OpenAPI files were last changed on 9 September 2026, 29 days before this check (30). The repository has dated commits on 2, 8 and 9 September 2026, three in the last 90 days, all within one week (20). The developer forum named as the place for API notices loads by script, so replies and dates were unread, and no dated changelog was found (6 of 15). The only official SDK is for Java, version 1.3.0 for Java 7 and above, with no release date found (5 of 15). No public repository or CI for the SDK (2 of 10).", "payments": "No x402, MPP or L402 (0). Edition prices are public, $7 to $40 a user a month billed yearly, and extra API credits have a published rate from $4.20 a month per 1,000 daily credits (20). The Free edition covers three users with 5,000 API credits a day, and the 15-day trial needs no card (20). A person signs up in a browser, registers an OAuth client in the API console and approves scopes (0).", "reliability": "Graded on the REST API v1, read as a hosted service. status.zoho.com redirects to us.zohostatus.com, which has a Zoho Desk component (20). The incident history loads by script and we could not read it. The status feed shows the Desk component returning to Operational on 3 September 2026 at the same minute as Zoho CRM, Books, Flow, SalesIQ and Deluge, with no other Desk entry since July, so we read the record as minor incidents only without a duration (20 of 30). Daily credits and concurrency are published with numbers per edition (15). A 429 at the daily limit carries Retry-After, and every response reports credits used and remaining. Concurrency 429s carry no Retry-After, and no idempotency or retry guidance for writes was found (10 of 15). No SLA found, and the Terms of Service disclaim uninterrupted service (0). v1 is the current documented version (10).", "schema": "zoho/zohodesk-oas on GitHub holds OpenAPI 3.1.0 files for 185 resources and 911 operations (25). No llms.txt at zoho.com or desk.zoho.com and no Markdown docs found (0). 910 of 911 operations carry a description that states the purpose, often with a note on limits, and little on when not to use one (14 of 20). Parameters carry enums, patterns and length limits, and replies use a discriminated schema per channel. Custom fields make record bodies open (12 of 15). The API document has a curl sample and response per endpoint and a list of error codes, and 658 operations declare an error response (14 of 15). The version is in the path and a compatibility statement promises forum notice of changes, with no dated changelog found (7 of 15).", "security": "OAuth 2.0 with scopes per module and operation, one-hour access tokens and revocable refresh tokens (30). Less 10 because Zoho's OAuth guide documents the refresh call with the refresh token and client secret in the URL query string as one of three options (20 of 30). READ-only scopes, calls bound by the user's profile permissions, a draft and send-for-review path for replies, and a 60-day recycle bin for deleted tickets. Spam deletion is permanent and no approval step guards bulk updates (15 of 20). Tickets hold customer-written text and no prompt-injection guidance was found (3 of 15). A ticket history endpoint lists actions per ticket and a dashboard shows credit use. A portal-wide audit log for Desk was not established (8 of 15). security.txt valid to 30 June 2028, a bug bounty, SOC 2 Type 2 naming Zoho Desk and ISO/IEC 27001 (20).", "transparency": "Closed service under the Zoho Terms of Service, last updated 2 March 2022. The OpenAPI repository has no licence file (15 of 30). The privacy policy of 22 December 2025 says data is deleted from the active database within six months of account termination and from backups three months later. The DPA is sent on request by email (24 of 30). The API document promises forum notice and a transition period for deprecations without stating a length, and marks deprecated fields without dates (8 of 20). A sub-processor page exists, but its directory loads by script and we could not read the list. The data centre page names regions and cities (15 of 20)." }, "sources": [ { "what": "API document", "url": "https://desk.zoho.com/DeskAPIDocument", "seen": "2026-10-08" }, { "what": "OpenAPI repository (clone)", "url": "https://github.com/zoho/zohodesk-oas", "seen": "2026-10-08" }, { "what": "webhook document", "url": "https://desk.zoho.com/support/WebhookDocument.do", "seen": "2026-10-08" }, { "what": "Java SDK", "url": "https://www.zoho.com/desk/developers/javasdk", "seen": "2026-10-08" }, { "what": "pricing", "url": "https://www.zoho.com/desk/pricing.html", "seen": "2026-10-08" }, { "what": "price values read by the pricing page", "url": "https://www.zohowebstatic.com/sites/zweb/json/pricing/desk-pricing-val.json", "seen": "2026-10-08" }, { "what": "OAuth refresh", "url": "https://www.zoho.com/accounts/protocol/oauth/web-apps/access-token-expiry.html", "seen": "2026-10-08" }, { "what": "OAuth token limits", "url": "https://www.zoho.com/accounts/protocol/oauth/token-limits.html", "seen": "2026-10-08" }, { "what": "status page", "url": "https://us.zohostatus.com/", "seen": "2026-10-08" }, { "what": "status RSS", "url": "https://us.zohostatus.com/rss", "seen": "2026-10-08" }, { "what": "status incident history (script-drawn, unread)", "url": "https://us.zohostatus.com/incident_history", "seen": "2026-10-08" }, { "what": "terms of service", "url": "https://www.zoho.com/terms.html", "seen": "2026-10-08" }, { "what": "privacy policy", "url": "https://www.zoho.com/privacy.html", "seen": "2026-10-08" }, { "what": "GDPR and DPA", "url": "https://www.zoho.com/gdpr.html", "seen": "2026-10-08" }, { "what": "sub-processors", "url": "https://www.zoho.com/privacy/sub-processors.html", "seen": "2026-10-08" }, { "what": "data centres", "url": "https://www.zoho.com/know-your-datacenter.html", "seen": "2026-10-08" }, { "what": "compliance", "url": "https://www.zoho.com/compliance.html", "seen": "2026-10-08" }, { "what": "security.txt", "url": "https://www.zoho.com/.well-known/security.txt", "seen": "2026-10-08" }, { "what": "Zoho MCP", "url": "https://www.zoho.com/mcp/", "seen": "2026-10-08" }, { "what": "developer forum (script-drawn, unread)", "url": "https://help.zoho.com/portal/community/zoho-desk/zoho-desk-developer-apis", "seen": "2026-10-08" }, { "what": "RDAP for zoho.com", "url": "https://rdap.verisign.com/com/v1/domain/zoho.com", "seen": "2026-10-08" } ], "openQuestions": [ "unchecked: the incident history at us.zohostatus.com/incident_history, which loads by script. The duration and cause of the 3 September 2026 event were not read", "unchecked: status pages for data centres other than the US", "unchecked: the Zoho Desk Developer APIs forum, which loads by script, so no dated API notice or staff reply was read", "unchecked: the sub-processor directory at zoho.com/privacy/sub-processors.html, which loads by script", "unchecked: a portal-wide audit log for Zoho Desk. The help centre pages we tried returned articles for other Zoho products", "unchecked: Maven coordinates, release date and download counts for the Java SDK, and GitHub stars for the OpenAPI repository", "unchecked: Zoho Desk release notes at zoho.com/desk/whats-new.html, which load by script", "unchecked: the Zoho contracting entities page, not re-read today", "The pricing page showed prices in rupees to our reader. US dollar prices come from the price file the page loads", "The webhook document lists an Ultimate edition that the pricing page does not sell. Which editions map to it is not established", "Zoho MCP lists Zoho Desk among its apps. Its Desk tools, limits and prices were not found, so the grade covers the REST API only", "Whether failed calls and 429 responses use credits is not stated in the reviewed pages", "The Terms of Service bar use of the services for competitive or benchmarking purposes, which matters before our probes run", "The lead was right on the vendor, URL, docs link and interface" ] }, "negative": 0, "verdict": "Public OpenAPI 3.1 files cover 911 operations, OAuth scopes separate read, create, update and delete per module, and replies can be saved as drafts or sent for review before a customer sees them. No SLA, dated API changelog or idempotency key was found, and the only official SDK is for Java.", "bestFor": "Teams already on Zoho who want an agent to read tickets, draft replies for review, add private comments and change status with narrow scopes, and small teams that want a free edition with API access.", "strengths": [ "OpenAPI 3.1 files for 185 resources and 911 operations are public on GitHub, last changed on 9 September 2026", "OAuth scopes split tickets, contacts, tasks, articles and events into READ, CREATE, UPDATE and DELETE", "`draftReply`, `sendDraft` and `sendForReview` let an agent stage a reply for a person before it is sent", "A 429 at the daily credit limit carries Retry-After, and every response reports credits used and remaining", "Free edition for three users with 5,000 API credits a day, and a 15-day trial of paid editions without a card" ], "weaknesses": [ "No SLA found, and the Terms of Service disclaim uninterrupted service", "No dated API changelog. Changes are announced in a community forum that loads by script", "No idempotency key on writes, and Retry-After is absent on concurrency 429s", "The only official SDK is for Java, version 1.3.0, with no release date or source repository found", "Webhooks need Professional or higher. Free and Standard have none", "Zoho's OAuth guide documents a refresh call with the client secret in the URL query string" ], "agentNotes": [ "Use the `api_domain` returned with the token. Each data centre has its own host, such as desk.zoho.com, desk.zoho.eu and desk.zoho.in", "Send `Authorization: Zoho-oauthtoken \u003ctoken\u003e` and refresh hourly. Put refresh parameters in the POST body, not the URL", "Create replies with `POST /api/v1/tickets/{id}/draftReply`, then `sendDraft` or `sendForReview`. `sendReply` emails the customer", "Add internal notes with `POST /api/v1/tickets/{id}/comments` and `isPublic` false", "Page with `from` and `limit` (50 at most). Deep offsets cost more credits, from 3 a call under 2,000 records to 100 above 100,000" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 66.6 } ], "editorialScores": { "ergonomics": 67, "maintenance": 63, "payments": 40, "reliability": 75, "schema": 72, "security": 66, "transparency": 62 }, "provenanceScore": 95 }, "connect": { "http": "curl -X GET \"https://desk.zoho.com/api/v1/tickets?limit=5\" \\\n -H \"orgId: $ZOHO_DESK_ORG_ID\" \\\n -H \"Authorization: Zoho-oauthtoken $ZOHO_ACCESS_TOKEN\"" }, "letme": { "capability": "https://letme.dev/support.tickets", "tool": "https://letme.dev/zoho-desk" }, "sameCompany": [ "zoho-books", "zoho-zeptomail", "zoho-crm", "zoho-recruit", "zoho-people", "zoho-mail" ], "notable": [ "API use is counted in credits per calendar day in the data centre's time zone. Free and trial 5,000, Express 25,000 plus 100 a user, Standard 50,000 plus 250, Professional 75,000 plus 500, Enterprise 100,000 plus 1,000 (https://desk.zoho.com/DeskAPIDocument)", "There is no per-minute limit. Concurrent calls per portal are capped at 5 on Free, 10 on Express and Standard, 15 on Professional and 25 on Enterprise (https://desk.zoho.com/DeskAPIDocument)", "zoho/zohodesk-oas holds OpenAPI 3.1.0 files for 185 resources and 911 operations, with six commits between 16 March and 9 September 2026 and no licence file (https://github.com/zoho/zohodesk-oas)", "Extra API credits are bought by email to support or through an account manager, at $4.20 a month per 1,000 daily credits for the first 25,000, falling to $0.75 above 250,000 (https://desk.zoho.com/DeskAPIDocument)", "Webhooks cover tickets, contacts, accounts, agents, tasks, articles and messaging events, signed with a JWT in the `X-ZDesk-JWT` header. Professional enables 5, Enterprise 10 and Ultimate 20 (https://desk.zoho.com/support/WebhookDocument.do)", "The Terms of Service say the customer agrees not to use the services for any form of competitive or benchmarking purposes (https://www.zoho.com/terms.html)", "Zoho MCP, a separate Zoho product, lists Zoho Desk among the apps it connects by OAuth. Its tools, limits and prices were not found on the public page (https://www.zoho.com/mcp/)", "The US status feed shows the Zoho Desk component returning to Operational on 3 September 2026 together with Zoho CRM, Books, Flow, SalesIQ and Deluge (https://us.zohostatus.com/rss)" ], "area": "business", "details": [ { "label": "API", "value": "REST API v1 at https://desk.zoho.com/api/v1 (US). Tickets, threads, comments, contacts, accounts, agents, departments, tasks, articles, community, search, views, webhooks, automation and messaging endpoints. 911 operations in the OpenAPI files" }, { "label": "Credentials", "value": "OAuth 2.0 through Zoho Accounts, with server, client, mobile, device and self client flows. Access tokens last one hour. A refresh token is optional and lasts until revoked. Tokens are bound to one Desk organisation" }, { "label": "Auth scopes", "value": "`Desk.\u003cmodule\u003e.\u003coperation\u003e` with READ, CREATE, UPDATE, DELETE, WRITE and ALL. Modules include tickets, contacts, tasks, basic, search, events, articles, settings and custommodule" }, { "label": "Rate limits", "value": "Credits per day. Free and trial 5,000. Express 25,000 plus 100 a user. Standard 50,000 plus 250. Professional 75,000 plus 500. Enterprise 100,000 plus 1,000. At most 5,000,000 with add-ons. Concurrency 5, 10, 10, 15 and 25" }, { "label": "Credit costs", "value": "A record fetched by ID 1. List and search calls 3 to 100 by offset. Update many 1 per 2 records. Move to trash and restore 6 per record" }, { "label": "Rate limit headers", "value": "`X-Rate-Limit-Request-Weight-v3`, `X-Rate-Limit-Remaining-v3`, and `Retry-After` on a 429 at the daily limit" }, { "label": "Replies and notes", "value": "`sendReply`, `draftReply`, `sendDraft` and `sendForReview` on a ticket for email, Facebook and forum channels. Comments are public or private through `isPublic`" }, { "label": "Pagination", "value": "`from` and `limit`, default 10 and at most 50 a call. Search accepts `from` 0 to 4,999. `include` adds related resources" }, { "label": "Errors", "value": "HTTP status plus `errorCode`, `message` and, for invalid data, `errorType` and `fieldName` as a JSON Pointer" }, { "label": "Webhooks", "value": "Up to 20 configured a portal. Enabled 0 on Free and Standard, 5 on Professional, 10 on Enterprise, 20 on Ultimate. A callback must answer 200 within 5 seconds. JWT in `X-ZDesk-JWT`" }, { "label": "Data centres", "value": "US, EU, India, Australia, Canada, Japan, China, Saudi Arabia, Singapore and UAE, each with its own API host" }, { "label": "SDK", "value": "Java SDK 1.3.0 for Java 7 and above, a JAR download from zoho.com with a Maven guide" }, { "label": "Certifications", "value": "SOC 2 Type 2 naming Zoho Desk, ISO/IEC 27001, 27701, 27017 and 27018 valid to 21 August 2028 (https://www.zoho.com/compliance.html)" } ], "unitPrices": [ { "item": "Express", "unit": "seat-month", "usd": 7, "note": "billed yearly; $9 billed monthly" }, { "item": "Standard", "unit": "seat-month", "usd": 14, "note": "billed yearly; $20 billed monthly" }, { "item": "Professional", "unit": "seat-month", "usd": 23, "note": "billed yearly; $35 billed monthly" }, { "item": "Enterprise", "unit": "seat-month", "usd": 40, "note": "billed yearly; $50 billed monthly" }, { "item": "Add-on API credits, first 25,000 a day", "unit": "credit", "usd": 0.0042, "note": "$4.20 a month per 1,000 daily credits, falling to $0.75 above 250,000; ordered by email to support" } ], "provenance": { "legalEntity": "Zoho Corporation Private Limited", "domain": "zoho.com", "domainRegistered": "2004-01-16", "domainNote": "The US API answers at desk.zoho.com. Other data centres use Zoho domains such as desk.zoho.eu, desk.zoho.in and desk.zohocloud.ca.", "endpointOnVendorDomain": true, "terms": "https://www.zoho.com/terms.html", "privacy": "https://www.zoho.com/privacy.html", "statusPage": "https://status.zoho.com", "changelog": "https://help.zoho.com/portal/community/zoho-desk/zoho-desk-developer-apis", "securityTxt": "valid", "checked": "2026-10-08", "notes": [ "The Terms of Service (last updated 2 March 2022) are the service agreement for Zoho's online services. They name the applicable Zoho contracting entity by region (https://www.zoho.com/legal/zoho-contracting-entities.html), which we did not re-read today.", "The privacy policy was last updated on 22 December 2025. Its Part II covers service data held in Zoho products.", "security.txt at www.zoho.com gives a bug bounty contact, security@zohocorp.com, a policy link and an expiry of 30 June 2028.", "The API document says changes are announced in the Zoho Desk Developer APIs forum. The forum loads by script and no dated entry could be read. No other API changelog was found.", "status.zoho.com redirects to us.zohostatus.com, which lists a Zoho Desk component.", "RDAP for zoho.com gives a registration date of 2004-01-16." ], "score": 95, "checks": [ { "check": "Legal entity named", "value": "Zoho Corporation Private Limited", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "zoho.com, registered 2004-01-16 (22 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "zoho.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 6 of the 7 things a reader expects, and has 1 clause that costs points", "points": 7.1, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 8 of the 8 things a reader expects, and has 1 clause that costs points", "points": 8, "max": 10, "state": "part" }, { "check": "Status page", "value": "status.zoho.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "valid", "points": 10, "max": 10, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "https://www.zoho.com/terms.html", "state": "read", "readAt": "2026-10-08", "statedDate": "2022-03-02", "words": 4052, "points": 7.1, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last updated on: 2nd March 2022.", "says": "Last updated 2022-03-02" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "Accordingly, each party agrees to the governing law (without regard to choice or conflicts of law rules) and to the exclusive jurisdiction of the courts mentioned herein in case of any dispute or lawsuit arising out of or in connection with this Agreement ." }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "IN NO EVENT SHALL ZOHO’S ENTIRE LIABILITY TO YOU IN RESPECT OF ANY SERVICE, WHETHER DIRECT OR INDIRECT, EXCEED ONE THOUSAND DOLLARS ($1000) OR THE FEES PAID BY YOU DURING THE TWELVE (12) MONTHS PRIOR TO THE FIRST EVENT GIVING RISE TO SUCH LIABILITY, WHICHEVER IS HIGHER.", "says": "Capped at the fees paid in the 12 months before the claim or $1000" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "If you provide any information that is untrue, inaccurate, outdated, or incomplete, or if Zoho has reasonable grounds to suspect that such information is untrue, inaccurate, outdated, or incomplete, Zoho may terminate your user account and refuse current or future use of any or all of the Services." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "If we make significant changes to the Agreement that affect your rights, you will be provided with at least 30 days advance notice of the changes by email to your primary email address.", "says": "Gives 30 days of notice before a change" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "In addition to all other terms and conditions of this Agreement, you shall not: (i) transfer the Services or otherwise make it available to any third party;" }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": false } ], "toKnow": [ { "key": "terms.benchmark", "label": "Restricts benchmarking or competitive use", "found": true, "quote": "use the Services for any form of competitive or benchmarking purposes", "costsPoints": true }, { "key": "old", "label": "Has not been updated for three years or more", "found": true, "quote": "Last updated on: 2nd March 2022." } ], "notes": [ { "date": "2026-10-08", "text": "Subscriptions renew automatically and the customer must give at least seven days' notice before the renewal date to stop renewal.", "quote": "If you do not wish to renew the subscription, you must inform us at least seven days prior to the renewal date." }, { "date": "2026-10-08", "text": "Unpaid accounts inactive for 120 continuous days may be terminated and their data deleted, with prior notice, and activity in one service does not keep another active.", "quote": "We reserve the right to terminate unpaid user accounts that are inactive for a continuous period of 120 days." }, { "date": "2026-10-08", "text": "If the customer does not answer a forwarded complaint within 10 days, Zoho may give the customer's name and contact information to the complainant.", "quote": "If you do not respond to the complainant within 10 days from the date of our email to you, we may disclose your name and contact information to the complainant for enabling the complainant to take legal action against you." } ] }, { "kind": "privacy", "url": "https://www.zoho.com/privacy.html", "state": "read", "readAt": "2026-10-08", "statedDate": "2025-12-22", "words": 6377, "points": 8, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last updated on: 22nd Dec 2025.", "says": "Last updated 2025-12-22" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "This policy tells you what information we collect from you, what we do with it, who can access it, and what you can do about it." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "After you terminate your account, your data will be automatically deleted from our active database within 6 months and from our backups within 3 months after that.", "says": "Names a period of 6 months" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "If you ask about our products through one of our referral programs or reselling partners, or sign in to one of our products through an authentication service provider like LinkedIn or Google, they'll pass on your contact information to us." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "We share your information only in the ways that are described in this Privacy Policy, and only with parties who adopt appropriate confidentiality and security measures." }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "The European Economic Area (EEA) provides certain rights to data subjects (including access, rectification, erasure, restriction of processing, data portability, and the right to object and to complain)." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "If you wish to update or delete your testimonial, you can contact us at privacy@zohocorp.com", "says": "privacy@zohocorp.com" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "…or otherwise providing personal information or service data to us, you understand that the processing, transfer, and storage of your personal information or Service Data within the United States of America, the European Economic Area (EEA) and other countries where Zoho operates.", "says": "Data goes to the United States" } ], "toKnow": [ { "key": "training", "label": "Says it may use customer content to train or improve models, and no opt-out was found", "found": true, "quote": "In keeping with Zoho's promise not to exploit your data in a way that is not respectful of your privacy and confidentiality expectations, we make only the following limited use of service data for these technologies: (i) using anonymized crops of service data to improve accuracy of the algorithms;", "costsPoints": true } ], "notes": [ { "date": "2026-10-08", "text": "Zoho employees and contractors may open service data to resolve errors and to check by hand emails reported as spam and scanned images.", "quote": "so that they can (i) identify, analyze and resolve errors, (ii) manually verify emails reported as spam to improve spam detection, or (iii) manually verify scanned images that you submit to us to verify the accuracy of optical character recognition." }, { "date": "2026-10-08", "text": "Zoho says it uses an organisation's data to develop models specific to that organisation.", "quote": "(ii) using your organization's data for developing models specific for your organization." }, { "date": "2026-10-08", "text": "After an account is terminated, data leaves the active database at a clean-up run once every six months and leaves backups three months later.", "quote": "Once you terminate your Zoho user account, your data will eventually get deleted from active database during the next clean-up that occurs once in 6 months." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/zoho-desk.json", "live": { "slug": "zoho-desk", "vendorStatus": { "page": "https://status.zoho.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-09T07:58:42.65135167Z" }, "updatedAt": "2026-10-09T07:58:42.65135167Z" } }, "verify": { "accepts": "a page on zoho.com or one of its subdomains, or the README of github.com/zoho/zohodesk-oas", "badgeUrl": "https://www.anchorterminal.com/badges/zoho-desk.svg", "body": { "slug": "zoho-desk", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/zoho-desk", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/zoho-desk\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/zoho-desk.svg\" alt=\"Zoho Desk on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![Zoho Desk on Anchor Terminal](https://www.anchorterminal.com/badges/zoho-desk.svg)](https://www.anchorterminal.com/tools/zoho-desk)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/zoho-desk\"\u003eZoho Desk on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/zoho-desk", "json": "https://www.anchorterminal.com/tools/zoho-desk.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/zoho-desk.md", "slim": "https://www.anchorterminal.com/tools/zoho-desk.min.md" }, "markdown": "## Overview\n\n**Grade B · 66.6/100 · rank #262 of 842 · #3 in Customer support \u0026 helpdesk · not agent-ready · confidence medium**\n\n\nMore from Zoho, listed separately because each is its own product: [Zoho Books](https://www.anchorterminal.com/tools/zoho-books.md) (Accounting \u0026 invoicing), [Zoho CPaaS (formerly ZeptoMail)](https://www.anchorterminal.com/tools/zoho-zeptomail.md) (Email delivery APIs), [Zoho CRM](https://www.anchorterminal.com/tools/zoho-crm.md) (CRM \u0026 customer platforms), [Zoho Recruit](https://www.anchorterminal.com/tools/zoho-recruit.md) (Recruiting \u0026 applicant tracking), [Zoho People](https://www.anchorterminal.com/tools/zoho-people.md) (HR \u0026 employee operations), [Zoho Mail API](https://www.anchorterminal.com/tools/zoho-mail.md) (Mailbox access).\n\n## Assessment\n\nPublic OpenAPI 3.1 files cover 911 operations, OAuth scopes separate read, create, update and delete per module, and replies can be saved as drafts or sent for review before a customer sees them. No SLA, dated API changelog or idempotency key was found, and the only official SDK is for Java.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | Zoho (https://www.zoho.com/desk/) |\n| Kind | HTTP API |\n| Category | Customer support \u0026 helpdesk (https://www.anchorterminal.com/categories/support) |\n| Transport | HTTP |\n| Auth | OAuth · OAuth 2.0 only. A person registers a client in the Zoho API console (a web application, or a self client for one organisation) and approves scopes such as `Desk.tickets.READ`. The access token lasts one hour and goes in `Authorization: Zoho-oauthtoken \u003ctoken\u003e` or `Authorization: Bearer \u003ctoken\u003e`. Each token is bound to one Desk organisation, and each data centre has its own accounts host and API host. Registration is self-serve, with no app review or sales approval found for use inside one's own organisation. |\n| Pricing | Freemium ($7 / seat-mo) · Free edition for three users with 5,000 API credits a day and no card. Paid editions cost $7 to $40 a user a month billed yearly ($9 to $50 monthly) and have a 15-day trial without a card. API calls draw on a daily credit allowance set by edition and user count. Extra credits start at $4.20 a month per 1,000 daily credits and are ordered by email (https://www.zoho.com/desk/pricing.html, checked 2026-10-08). |\n| x402 | No · No x402, MPP or L402 in the API document, the OpenAPI files or the pricing page (checked 2026-10-08). |\n| Licence | Proprietary service under Zoho's Terms of Service. The OpenAPI repository on GitHub has no licence file |\n| Source | https://github.com/zoho/zohodesk-oas |\n| Docs | https://desk.zoho.com/DeskAPIDocument |\n| llms.txt | not found |\n| Last release | 2026-09-09 |\n| API | REST API v1 at https://desk.zoho.com/api/v1 (US). Tickets, threads, comments, contacts, accounts, agents, departments, tasks, articles, community, search, views, webhooks, automation and messaging endpoints. 911 operations in the OpenAPI files |\n| Credentials | OAuth 2.0 through Zoho Accounts, with server, client, mobile, device and self client flows. Access tokens last one hour. A refresh token is optional and lasts until revoked. Tokens are bound to one Desk organisation |\n| Auth scopes | `Desk.\u003cmodule\u003e.\u003coperation\u003e` with READ, CREATE, UPDATE, DELETE, WRITE and ALL. Modules include tickets, contacts, tasks, basic, search, events, articles, settings and custommodule |\n| Rate limits | Credits per day. Free and trial 5,000. Express 25,000 plus 100 a user. Standard 50,000 plus 250. Professional 75,000 plus 500. Enterprise 100,000 plus 1,000. At most 5,000,000 with add-ons. Concurrency 5, 10, 10, 15 and 25 |\n| Credit costs | A record fetched by ID 1. List and search calls 3 to 100 by offset. Update many 1 per 2 records. Move to trash and restore 6 per record |\n| Rate limit headers | `X-Rate-Limit-Request-Weight-v3`, `X-Rate-Limit-Remaining-v3`, and `Retry-After` on a 429 at the daily limit |\n| Replies and notes | `sendReply`, `draftReply`, `sendDraft` and `sendForReview` on a ticket for email, Facebook and forum channels. Comments are public or private through `isPublic` |\n| Pagination | `from` and `limit`, default 10 and at most 50 a call. Search accepts `from` 0 to 4,999. `include` adds related resources |\n| Errors | HTTP status plus `errorCode`, `message` and, for invalid data, `errorType` and `fieldName` as a JSON Pointer |\n| Webhooks | Up to 20 configured a portal. Enabled 0 on Free and Standard, 5 on Professional, 10 on Enterprise, 20 on Ultimate. A callback must answer 200 within 5 seconds. JWT in `X-ZDesk-JWT` |\n| Data centres | US, EU, India, Australia, Canada, Japan, China, Saudi Arabia, Singapore and UAE, each with its own API host |\n| SDK | Java SDK 1.3.0 for Java 7 and above, a JAR download from zoho.com with a Maven guide |\n| Certifications | SOC 2 Type 2 naming Zoho Desk, ISO/IEC 27001, 27701, 27017 and 27018 valid to 21 August 2028 (https://www.zoho.com/compliance.html) |\n| Capabilities | support.tickets, support.conversations, support.contacts, support.notes, support.webhooks |\n| Tags | hosted, closed-source, oauth, openapi, webhooks, free-tier, no-card, java, status-page, bug-bounty, soc2 |\n| JSON | https://www.anchorterminal.com/api/v1/tools/zoho-desk.json |\n\n## Score breakdown (methodology v0.4, October 2026 research run)\n\nAssessed 2026-10-08 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 75 | 15.0 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 72 | 11.7 |\n| Agent ergonomics | 13% | 16.2 | 67 | 10.9 |\n| Security \u0026 auth | 14% | 17.5 | 66 | 11.6 |\n| Payments \u0026 pricing | 10% | 12.5 | 40 | 5.0 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 63 | 5.5 |\n| Transparency \u0026 trust (editorial 62, provenance 95) | 7% | 8.8 | 79 | 6.9 |\n| Negative events | up to −15 | up to −15 | none recorded | 0 |\n| **Total** | | | | **66.6 → B** |\n\n### Why each score\n\n- Reliability 75: Graded on the REST API v1, read as a hosted service. status.zoho.com redirects to us.zohostatus.com, which has a Zoho Desk component (20). The incident history loads by script and we could not read it. The status feed shows the Desk component returning to Operational on 3 September 2026 at the same minute as Zoho CRM, Books, Flow, SalesIQ and Deluge, with no other Desk entry since July, so we read the record as minor incidents only without a duration (20 of 30). Daily credits and concurrency are published with numbers per edition (15). A 429 at the daily limit carries Retry-After, and every response reports credits used and remaining. Concurrency 429s carry no Retry-After, and no idempotency or retry guidance for writes was found (10 of 15). No SLA found, and the Terms of Service disclaim uninterrupted service (0). v1 is the current documented version (10).\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 72: zoho/zohodesk-oas on GitHub holds OpenAPI 3.1.0 files for 185 resources and 911 operations (25). No llms.txt at zoho.com or desk.zoho.com and no Markdown docs found (0). 910 of 911 operations carry a description that states the purpose, often with a note on limits, and little on when not to use one (14 of 20). Parameters carry enums, patterns and length limits, and replies use a discriminated schema per channel. Custom fields make record bodies open (12 of 15). The API document has a curl sample and response per endpoint and a list of error codes, and 658 operations declare an error response (14 of 15). The version is in the path and a compatibility statement promises forum notice of changes, with no dated changelog found (7 of 15).\n- Agent ergonomics 67: Graded on the REST API. Lists default to 10 records with at most 50, `include` adds related resources on request, and `fields` exists on some list calls only (18 of 25). `from` and `limit`, saved views, `sortBy` and module search with field filters. Deep offsets cost up to 100 credits a call and search stops at offset 4,999 (18 of 20). Errors carry `errorCode`, `message`, `errorType` and the field as a JSON Pointer (18 of 20). No idempotency key. Drafts can be saved before sending (6 of 20). One official SDK, for Java, and setup needs an hourly token refresh and the right regional host (7 of 15).\n- Security \u0026 auth 66: OAuth 2.0 with scopes per module and operation, one-hour access tokens and revocable refresh tokens (30). Less 10 because Zoho's OAuth guide documents the refresh call with the refresh token and client secret in the URL query string as one of three options (20 of 30). READ-only scopes, calls bound by the user's profile permissions, a draft and send-for-review path for replies, and a 60-day recycle bin for deleted tickets. Spam deletion is permanent and no approval step guards bulk updates (15 of 20). Tickets hold customer-written text and no prompt-injection guidance was found (3 of 15). A ticket history endpoint lists actions per ticket and a dashboard shows credit use. A portal-wide audit log for Desk was not established (8 of 15). security.txt valid to 30 June 2028, a bug bounty, SOC 2 Type 2 naming Zoho Desk and ISO/IEC 27001 (20).\n- Payments \u0026 pricing 40: No x402, MPP or L402 (0). Edition prices are public, $7 to $40 a user a month billed yearly, and extra API credits have a published rate from $4.20 a month per 1,000 daily credits (20). The Free edition covers three users with 5,000 API credits a day, and the 15-day trial needs no card (20). A person signs up in a browser, registers an OAuth client in the API console and approves scopes (0).\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 63: The OpenAPI files were last changed on 9 September 2026, 29 days before this check (30). The repository has dated commits on 2, 8 and 9 September 2026, three in the last 90 days, all within one week (20). The developer forum named as the place for API notices loads by script, so replies and dates were unread, and no dated changelog was found (6 of 15). The only official SDK is for Java, version 1.3.0 for Java 7 and above, with no release date found (5 of 15). No public repository or CI for the SDK (2 of 10).\n- Transparency \u0026 trust 79: Closed service under the Zoho Terms of Service, last updated 2 March 2022. The OpenAPI repository has no licence file (15 of 30). The privacy policy of 22 December 2025 says data is deleted from the active database within six months of account termination and from backups three months later. The DPA is sent on request by email (24 of 30). The API document promises forum notice and a transition period for deprecations without stating a length, and marks deprecated fields without dates (8 of 20). A sub-processor page exists, but its directory loads by script and we could not read the list. The data centre page names regions and cities (15 of 20).\n\nFix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (23 items): https://www.anchorterminal.com/fixes/zoho-desk.md (JSON https://www.anchorterminal.com/fixes/zoho-desk.json)\n\n### What we couldn't check\n\n- unchecked: the incident history at us.zohostatus.com/incident_history, which loads by script. The duration and cause of the 3 September 2026 event were not read\n- unchecked: status pages for data centres other than the US\n- unchecked: the Zoho Desk Developer APIs forum, which loads by script, so no dated API notice or staff reply was read\n- unchecked: the sub-processor directory at zoho.com/privacy/sub-processors.html, which loads by script\n- unchecked: a portal-wide audit log for Zoho Desk. The help centre pages we tried returned articles for other Zoho products\n- unchecked: Maven coordinates, release date and download counts for the Java SDK, and GitHub stars for the OpenAPI repository\n- unchecked: Zoho Desk release notes at zoho.com/desk/whats-new.html, which load by script\n- unchecked: the Zoho contracting entities page, not re-read today\n- The pricing page showed prices in rupees to our reader. US dollar prices come from the price file the page loads\n- The webhook document lists an Ultimate edition that the pricing page does not sell. Which editions map to it is not established\n- Zoho MCP lists Zoho Desk among its apps. Its Desk tools, limits and prices were not found, so the grade covers the REST API only\n- Whether failed calls and 429 responses use credits is not stated in the reviewed pages\n- The Terms of Service bar use of the services for competitive or benchmarking purposes, which matters before our probes run\n- The lead was right on the vendor, URL, docs link and interface\n\n### Sources\n\n- API document: \u003chttps://desk.zoho.com/DeskAPIDocument\u003e (seen 2026-10-08)\n- OpenAPI repository (clone): \u003chttps://github.com/zoho/zohodesk-oas\u003e (seen 2026-10-08)\n- webhook document: \u003chttps://desk.zoho.com/support/WebhookDocument.do\u003e (seen 2026-10-08)\n- Java SDK: \u003chttps://www.zoho.com/desk/developers/javasdk\u003e (seen 2026-10-08)\n- pricing: \u003chttps://www.zoho.com/desk/pricing.html\u003e (seen 2026-10-08)\n- price values read by the pricing page: \u003chttps://www.zohowebstatic.com/sites/zweb/json/pricing/desk-pricing-val.json\u003e (seen 2026-10-08)\n- OAuth refresh: \u003chttps://www.zoho.com/accounts/protocol/oauth/web-apps/access-token-expiry.html\u003e (seen 2026-10-08)\n- OAuth token limits: \u003chttps://www.zoho.com/accounts/protocol/oauth/token-limits.html\u003e (seen 2026-10-08)\n- status page: \u003chttps://us.zohostatus.com/\u003e (seen 2026-10-08)\n- status RSS: \u003chttps://us.zohostatus.com/rss\u003e (seen 2026-10-08)\n- status incident history (script-drawn, unread): \u003chttps://us.zohostatus.com/incident_history\u003e (seen 2026-10-08)\n- terms of service: \u003chttps://www.zoho.com/terms.html\u003e (seen 2026-10-08)\n- privacy policy: \u003chttps://www.zoho.com/privacy.html\u003e (seen 2026-10-08)\n- GDPR and DPA: \u003chttps://www.zoho.com/gdpr.html\u003e (seen 2026-10-08)\n- sub-processors: \u003chttps://www.zoho.com/privacy/sub-processors.html\u003e (seen 2026-10-08)\n- data centres: \u003chttps://www.zoho.com/know-your-datacenter.html\u003e (seen 2026-10-08)\n- compliance: \u003chttps://www.zoho.com/compliance.html\u003e (seen 2026-10-08)\n- security.txt: \u003chttps://www.zoho.com/.well-known/security.txt\u003e (seen 2026-10-08)\n- Zoho MCP: \u003chttps://www.zoho.com/mcp/\u003e (seen 2026-10-08)\n- developer forum (script-drawn, unread): \u003chttps://help.zoho.com/portal/community/zoho-desk/zoho-desk-developer-apis\u003e (seen 2026-10-08)\n- RDAP for zoho.com: \u003chttps://rdap.verisign.com/com/v1/domain/zoho.com\u003e (seen 2026-10-08)\n\n## Who's behind it (provenance 95/100, checked 2026-10-08)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | Zoho Corporation Private Limited | 20/20 |\n| Domain age | zoho.com, registered 2004-01-16 (22 years) | 15/15 |\n| Endpoint on the vendor's domain | zoho.com | 15/15 |\n| Terms of service | read, states 6 of the 7 things a reader expects, and has 1 clause that costs points | 7.1/10 |\n| Privacy policy | read, states 8 of the 8 things a reader expects, and has 1 clause that costs points | 8/10 |\n| Status page | status.zoho.com | 10/10 |\n| Changelog | published | 10/10 |\n| security.txt | valid | 10/10 |\n\nThe US API answers at desk.zoho.com. Other data centres use Zoho domains such as desk.zoho.eu, desk.zoho.in and desk.zohocloud.ca.\n\nThe Terms of Service (last updated 2 March 2022) are the service agreement for Zoho's online services. They name the applicable Zoho contracting entity by region (https://www.zoho.com/legal/zoho-contracting-entities.html), which we did not re-read today.\n\nThe privacy policy was last updated on 22 December 2025. Its Part II covers service data held in Zoho products.\n\nsecurity.txt at www.zoho.com gives a bug bounty contact, security@zohocorp.com, a policy link and an expiry of 30 June 2028.\n\nThe API document says changes are announced in the Zoho Desk Developer APIs forum. The forum loads by script and no dated entry could be read. No other API changelog was found.\n\nstatus.zoho.com redirects to us.zohostatus.com, which lists a Zoho Desk component.\n\nRDAP for zoho.com gives a registration date of 2004-01-16.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service** (https://www.zoho.com/terms.html), read 2026-10-08, dated 2022-03-02, states 6 of the 7 things a reader expects.\n\n- To know. Restricts benchmarking or competitive use (costs points). \"use the Services for any form of competitive or benchmarking purposes\"\n- To know. Has not been updated for three years or more. \"Last updated on: 2nd March 2022.\"\n- Gives the date it was last updated. Last updated 2022-03-02.\n- States a limit on its liability. Capped at the fees paid in the 12 months before the claim or $1000.\n- Says how changes to the terms are announced. Gives 30 days of notice before a change.\n- Not found in the text. Refers to a service level or uptime commitment.\n- Also in the text (2026-10-08). Subscriptions renew automatically and the customer must give at least seven days' notice before the renewal date to stop renewal. \"If you do not wish to renew the subscription, you must inform us at least seven days prior to the renewal date.\"\n- Also in the text (2026-10-08). Unpaid accounts inactive for 120 continuous days may be terminated and their data deleted, with prior notice, and activity in one service does not keep another active. \"We reserve the right to terminate unpaid user accounts that are inactive for a continuous period of 120 days.\"\n- Also in the text (2026-10-08). If the customer does not answer a forwarded complaint within 10 days, Zoho may give the customer's name and contact information to the complainant. \"If you do not respond to the complainant within 10 days from the date of our email to you, we may disclose your name and contact information to the complainant for enabling the complainant to take legal action against you.\"\n\n**Privacy policy** (https://www.zoho.com/privacy.html), read 2026-10-08, dated 2025-12-22, states 8 of the 8 things a reader expects.\n\n- To know. Says it may use customer content to train or improve models, and no opt-out was found (costs points). \"In keeping with Zoho's promise not to exploit your data in a way that is not respectful of your privacy and confidentiality expectations, we make only the following limited use of service data for these technologies: (i) using anonymized crops of service data to improve accuracy of the algorithms;\"\n- Gives the date it was last updated. Last updated 2025-12-22.\n- Says how long data is kept. Names a period of 6 months.\n- Gives a privacy contact. privacy@zohocorp.com.\n- Says where data is transferred or stored. Data goes to the United States.\n- Also in the text (2026-10-08). Zoho employees and contractors may open service data to resolve errors and to check by hand emails reported as spam and scanned images. \"so that they can (i) identify, analyze and resolve errors, (ii) manually verify emails reported as spam to improve spam detection, or (iii) manually verify scanned images that you submit to us to verify the accuracy of optical character recognition.\"\n- Also in the text (2026-10-08). Zoho says it uses an organisation's data to develop models specific to that organisation. \"(ii) using your organization's data for developing models specific for your organization.\"\n- Also in the text (2026-10-08). After an account is terminated, data leaves the active database at a clean-up run once every six months and leaves backups three months later. \"Once you terminate your Zoho user account, your data will eventually get deleted from active database during the next clean-up that occurs once in 6 months.\"\n\n## Live (updated 2026-10-09 07:58 UTC)\n\n- Vendor status page: unknown, no machine-readable status found\n- Always current: https://www.anchorterminal.com/api/v1/live/zoho-desk.json\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Prices\n\n| Item | Price | Unit | Note |\n| --- | --- | --- | --- |\n| Express | $7 | per seat per month | billed yearly; $9 billed monthly |\n| Standard | $14 | per seat per month | billed yearly; $20 billed monthly |\n| Professional | $23 | per seat per month | billed yearly; $35 billed monthly |\n| Enterprise | $40 | per seat per month | billed yearly; $50 billed monthly |\n| Add-on API credits, first 25,000 a day | $0.0042 | per credit | $4.20 a month per 1,000 daily credits, falling to $0.75 above 250,000; ordered by email to support |\n\nAcross all listings: https://www.anchorterminal.com/prices/index.md\n\n## Strengths\n\n- OpenAPI 3.1 files for 185 resources and 911 operations are public on GitHub, last changed on 9 September 2026\n- OAuth scopes split tickets, contacts, tasks, articles and events into READ, CREATE, UPDATE and DELETE\n- `draftReply`, `sendDraft` and `sendForReview` let an agent stage a reply for a person before it is sent\n- A 429 at the daily credit limit carries Retry-After, and every response reports credits used and remaining\n- Free edition for three users with 5,000 API credits a day, and a 15-day trial of paid editions without a card\n\n## Weaknesses\n\n- No SLA found, and the Terms of Service disclaim uninterrupted service\n- No dated API changelog. Changes are announced in a community forum that loads by script\n- No idempotency key on writes, and Retry-After is absent on concurrency 429s\n- The only official SDK is for Java, version 1.3.0, with no release date or source repository found\n- Webhooks need Professional or higher. Free and Standard have none\n- Zoho's OAuth guide documents a refresh call with the client secret in the URL query string\n\n## Before you call it (notes for agents)\n\n1. Use the `api_domain` returned with the token. Each data centre has its own host, such as desk.zoho.com, desk.zoho.eu and desk.zoho.in\n2. Send `Authorization: Zoho-oauthtoken \u003ctoken\u003e` and refresh hourly. Put refresh parameters in the POST body, not the URL\n3. Create replies with `POST /api/v1/tickets/{id}/draftReply`, then `sendDraft` or `sendForReview`. `sendReply` emails the customer\n4. Add internal notes with `POST /api/v1/tickets/{id}/comments` and `isPublic` false\n5. Page with `from` and `limit` (50 at most). Deep offsets cost more credits, from 3 a call under 2,000 records to 100 above 100,000\n\n## Connect\n\nFirst request:\n\n```bash\ncurl -X GET \"https://desk.zoho.com/api/v1/tickets?limit=5\" \\\n -H \"orgId: $ZOHO_DESK_ORG_ID\" \\\n -H \"Authorization: Zoho-oauthtoken $ZOHO_ACCESS_TOKEN\"\n```\n\nThrough letme (picks today, calling later): https://letme.dev/zoho-desk. letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| Intercom API + MCP | BB | 71.5 | 118 | support.tickets, support.conversations, support.contacts, support.notes, support.webhooks | no | https://www.anchorterminal.com/tools/intercom.md |\n| Zendesk Support API | B | 68.7 | 196 | support.tickets, support.conversations, support.contacts, support.notes, support.webhooks | no | https://www.anchorterminal.com/tools/zendesk.md |\n| Plain API + MCP | B | 65.5 | 289 | support.tickets, support.conversations, support.contacts, support.notes, support.webhooks | no | https://www.anchorterminal.com/tools/plain.md |\n| Front API + MCP | B | 63.6 | 345 | support.tickets, support.conversations, support.contacts, support.notes, support.webhooks | no | https://www.anchorterminal.com/tools/front.md |\n| Kustomer | C | 57.3 | 553 | support.tickets, support.conversations, support.contacts, support.notes, support.webhooks | no | https://www.anchorterminal.com/tools/kustomer.md |\n| Help Scout API + MCP | C | 56.1 | 574 | support.tickets, support.conversations, support.contacts, support.notes, support.webhooks | no | https://www.anchorterminal.com/tools/help-scout.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- API use is counted in credits per calendar day in the data centre's time zone. Free and trial 5,000, Express 25,000 plus 100 a user, Standard 50,000 plus 250, Professional 75,000 plus 500, Enterprise 100,000 plus 1,000 (source: \u003chttps://desk.zoho.com/DeskAPIDocument\u003e)\n- There is no per-minute limit. Concurrent calls per portal are capped at 5 on Free, 10 on Express and Standard, 15 on Professional and 25 on Enterprise (source: \u003chttps://desk.zoho.com/DeskAPIDocument\u003e)\n- zoho/zohodesk-oas holds OpenAPI 3.1.0 files for 185 resources and 911 operations, with six commits between 16 March and 9 September 2026 and no licence file (source: \u003chttps://github.com/zoho/zohodesk-oas\u003e)\n- Extra API credits are bought by email to support or through an account manager, at $4.20 a month per 1,000 daily credits for the first 25,000, falling to $0.75 above 250,000 (source: \u003chttps://desk.zoho.com/DeskAPIDocument\u003e)\n- Webhooks cover tickets, contacts, accounts, agents, tasks, articles and messaging events, signed with a JWT in the `X-ZDesk-JWT` header. Professional enables 5, Enterprise 10 and Ultimate 20 (source: \u003chttps://desk.zoho.com/support/WebhookDocument.do\u003e)\n- The Terms of Service say the customer agrees not to use the services for any form of competitive or benchmarking purposes (source: \u003chttps://www.zoho.com/terms.html\u003e)\n- Zoho MCP, a separate Zoho product, lists Zoho Desk among the apps it connects by OAuth. Its tools, limits and prices were not found on the public page (source: \u003chttps://www.zoho.com/mcp/\u003e)\n- The US status feed shows the Zoho Desk component returning to Operational on 3 September 2026 together with Zoho CRM, Books, Flow, SalesIQ and Deluge (source: \u003chttps://us.zohostatus.com/rss\u003e)\n\n## Compare\n\n- [Chatwoot API vs Zoho Desk](https://www.anchorterminal.com/compare/chatwoot-vs-zoho-desk.md): C 55.8 vs B 66.6\n- [Crisp API + MCP vs Zoho Desk](https://www.anchorterminal.com/compare/crisp-vs-zoho-desk.md): D 47.6 vs B 66.6\n- [Dixa vs Zoho Desk](https://www.anchorterminal.com/compare/dixa-vs-zoho-desk.md): D 53.2 vs B 66.6\n- [Freshdesk API + MCP vs Zoho Desk](https://www.anchorterminal.com/compare/freshdesk-vs-zoho-desk.md): D 48.5 vs B 66.6\n- [Front API + MCP vs Zoho Desk](https://www.anchorterminal.com/compare/front-vs-zoho-desk.md): B 63.6 vs B 66.6\n- [Gorgias API + MCP vs Zoho Desk](https://www.anchorterminal.com/compare/gorgias-vs-zoho-desk.md): D 51 vs B 66.6\n- [Help Scout API + MCP vs Zoho Desk](https://www.anchorterminal.com/compare/help-scout-vs-zoho-desk.md): C 56.1 vs B 66.6\n- [Intercom API + MCP vs Zoho Desk](https://www.anchorterminal.com/compare/intercom-vs-zoho-desk.md): BB 71.5 vs B 66.6\n- [Kustomer vs Zoho Desk](https://www.anchorterminal.com/compare/kustomer-vs-zoho-desk.md): C 57.3 vs B 66.6\n- [Plain API + MCP vs Zoho Desk](https://www.anchorterminal.com/compare/plain-vs-zoho-desk.md): B 65.5 vs B 66.6\n- [Pylon API + MCP vs Zoho Desk](https://www.anchorterminal.com/compare/pylon-vs-zoho-desk.md): C 54.2 vs B 66.6\n- [Zammad vs Zoho Desk](https://www.anchorterminal.com/compare/zammad-vs-zoho-desk.md): D 46.3 vs B 66.6\n- [Zendesk Support API vs Zoho Desk](https://www.anchorterminal.com/compare/zendesk-vs-zoho-desk.md): B 68.7 vs B 66.6\n- [Gladly vs Zoho Desk](https://www.anchorterminal.com/compare/gladly-vs-zoho-desk.md): D 53.1 vs B 66.6\n- [Missive API + MCP vs Zoho Desk](https://www.anchorterminal.com/compare/missive-vs-zoho-desk.md): C 54.3 vs B 66.6\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on zoho.com or one of its subdomains, or the README of github.com/zoho/zohodesk-oas. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"zoho-desk\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/zoho-desk\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/zoho-desk.svg\" alt=\"Zoho Desk on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![Zoho Desk on Anchor Terminal](https://www.anchorterminal.com/badges/zoho-desk.svg)](https://www.anchorterminal.com/tools/zoho-desk)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/zoho-desk\"\u003eZoho Desk on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say Zoho Desk is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/zoho-desk-dark.png\n- Light: https://www.anchorterminal.com/assets/share/zoho-desk-light.png\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-09", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Customer support \u0026 helpdesk", "url": "https://www.anchorterminal.com/categories/support" }, { "name": "Zoho Desk", "url": "" } ], "description": "Zoho Desk is a hosted helpdesk from Zoho for tickets, contacts, knowledge base articles and support channels. Agents reach it through the REST API v1 behind OAuth 2.0, described in public OpenAPI 3.1 files.", "facts": [ "rank #262 of 842", "OAuth auth", "0 desk reviews" ], "h1": "Zoho Desk", "image": "https://www.anchorterminal.com/assets/og/tools-zoho-desk.png", "path": "/tools/zoho-desk", "published": "2026-10-01", "section": "tools", "title": "Zoho Desk review for AI agents, grade B (66.6/100) | Anchor Terminal", "toc": null, "updated": "2026-10-09", "url": "https://www.anchorterminal.com/tools/zoho-desk" }, "tokens": { "markdown": 7800, "slim": 1830 }, "version": 1 }