Calum Ochkas

Thanks Bryan. If you'd like to see the Auth fail without basic auth I'm happy to show you via a private ticket. Let me know, else I'm happy with the workaround for now.

The way you mention is how I've done it when able to encrypt the token somewhere. However, I'm building scripts into the Google Apps Script API. Ideally I don't want to be publishing any API Token plain text on the Apps Script console, hence I'm initiating the OAuth Token request and retrieving the token in a variable - saving any token being published on the script itself

Found the issue. For others: creating ticket requests as the end user you must pass basic auth and the emailaddress\token.

Eg.
---
'method': 'post',
'payload' : JSON.stringify(formData),
'contentType' : 'application/json',
'headers' : {"Authorization" : "Basic " oauthemail + "/" + token}
---

I'm attempting to create ZenDesk tickets using an OAuth Token from the Google Scripts API.

When creating the ZenDesk ticket using an token provided for an Agent, it works fine. However, when running it as an end user, it obtains a token fine, then fails to create the request throwing the error:
---
{"error":"RecordInvalid","description":"Record validation errors","details":{"base":[{"description":"Subject: cannot be blank","error":"BlankValue","field_key":"subject"},{"description":"Type: cannot...)
---

The token is correct as the same token works when listing requests using the GET method.

The JSON payload and options must be correct as the same code works correctly when initiating the request from an Agent, it's only when initiating it from an end user that it fails.

Payload:
---
"request" : {
"subject": "Test Ticket Subject",
"comment": { "body": "Test Ticket Body" }
}
---

Body:
---
'method': 'post',
'payload' : JSON.stringify(formData),
'contentType' : 'application/json',
'headers' : {"Authorization" : "Bearer " + token}
---

Doing a GET on the requests.json works correctly and enumerates the requests as expected. It's only POST that's failing

Are there specific permissions that are required for an end-user to post a request with their own token?