Flagright's Zendesk integration connects a customer's Zendesk instance to Flagright's case management platform, so that suspicious activity identified in support tickets can be investigated and escalated without an agent needing to switch systems. The integration supports two independent flows, which can be enabled together or separately depending on the customer's use case.

Flagright ingests tickets from the customer's Zendesk instance and links them to the matching user profile in Flagright, using a shared user ID field. When a ticket is flagged as suspicious, typically via a custom ticket field or tag, Flagright automatically creates an alert for review, removing the need for a support agent to file a separate report and for the compliance team to work out of a second tool.

In the reverse direction, Flagright can create a Zendesk ticket automatically when a rule based alert fires, for example a transaction exceeding a $10,000 threshold. This is commonly used to route Requests for Information (RFIs) to a team that works exclusively out of Zendesk, using configurable templates and placeholders.

Before Flagright can match Zendesk tickets to the correct user, the customer must expose a shared identifier, a User ID, on their Zendesk user profiles. This is a one time setup.

In Zendesk Admin Center, go to People → Configuration → User Fields, then click “Add Field.”

In the Flagright Console, during integration setup, provide the exact API field key configured in Step 1. This tells Flagright which field to extract from each Zendesk user object when mapping tickets to the corresponding user record in Flagright.

The customer must ensure the custom field is populated for all relevant Zendesk users and kept up to date as users onboard or their IDs change. This can be done manually or via the Zendesk Users API:

Once the UID field exists on the customer's side, the connection itself is configured from the Flagright Console.

Once connected, Flagright begins syncing tickets from Zendesk into user profiles. Ticket sync follows an all or nothing model by default; there is no option to filter which tickets are ingested by tag or type.

Connecting Zendesk to Flagright only enables ticket ingestion. It does not, by itself, decide which tickets should become cases. That decision is driven by a custom ticket field that support agents set to flag a ticket as suspicious, in the same way Section 02 used a custom user field for identity matching.

A support agent checks a “Suspicious Activity” field on a Zendesk ticket. The ticket, including that field's value, syncs into Flagright on the next poll. A Flagright rule evaluates the field and creates an alert for the linked user, surfaced as a case the compliance team investigates entirely within Flagright.

Tickets that did not have the field set when first created will still be picked up on a later sync if the field is set afterward. The field's current value is what matters at each sync, not the ticket's original state.

This is the step Flagright refers to as rule configuration. It is a rule inside the Flagright Console, not a webhook or trigger on the Zendesk side. Flagright does not accept inbound webhook calls from third party systems, including Zendesk; all Zendesk data reaches Flagright through the polling connection described in Section 03. The rule below is what turns a synced ticket into a case.

In the Flagright Console, go to Rules and click Create scenario to open the Scenario Builder. Set Rule Type to CRM ticket, a rule type that evaluates CRM ticket properties linked to a Flagright user and runs whenever a linked ticket is updated. Set Rule Nature (e.g. AML or Fraud, depending on how the customer classifies suspicious activity referrals), Rule Execution Mode (Real Time or Post Processing), and give the rule a clear name.

Rule type options in the Scenario Builder, including CRM ticket

Add an Entity variable referencing the custom ticket field created in Section 04, selecting CRM ticket as the variable type. Once at least one synced ticket carries that field, it becomes available to select in the variable picker. Build a simple condition, for example: IF [Suspicious Activity ticket field] equals true THEN create alert.

The Entity variable dialog; select CRM ticket instead of CRM user shown here

Alert Creation Details works the same as for any other rule type; configure severity, routing, and assignment as needed. Save the rule, then choose to deploy it as a Live rule (in sandbox, to test end to end, see Section 07) or a Shadow rule (in production, to observe on real tickets before it starts generating live cases, see Section 08).

Alert Creation Details screen in the Scenario Builder

When the rule from Section 05 fires, it creates an alert. Flagright then checks the ticket against the user matching logic from Section 02: if a match is found, the alert is attached to a case for that user; if not, see Unmatched Tickets below.

An alert is generated only once, when the condition is first met for that ticket; a later update to the same ticket does not create a duplicate alert. If a ticket does not carry the flagged field when it first syncs, no alert is created; if the field is added later, the next fetch reads the updated value and creates the alert at that point.

Flagright extracts requester_id from the ticket, queries /users/{requester_id} from Zendesk, extracts the UID from user_fields using the configured field key, and attaches the alert to a case linked to that Flagright user.

If no matching user is found, for example the ticket was submitted by someone who is not yet a known Flagright user, or the UID field was not populated, the ticket does not convert into a case automatically. Plan to monitor an unmatched queue manually for these cases.

Cases in Flagright must be linked to a known user; creating a case with an unknown subject (no linked user) is not supported.

Before enabling the integration in production, validate the full flow end to end in a sandbox environment.

Once sandbox testing passes, migrating to production involves steps on both the customer side and the Flagright side.