The 403 SCOPE_MISMATCH for Ticket Search means the access token you sent does not include the Desk API scope required to call the Ticket Search endpoint; Zoho rejects the request for authorization reasons. This usually happens after a scope change, a token refresh that lost scopes, or when an app was never granted the Desk search/ticket scopes [3][4].
What it means
Zoho’s authorization layer checks the OAuth scopes attached to the bearer token against the API endpoint you call. The Ticket Search endpoint requires specific Desk search/ticket scopes; if the token lacks those scopes, the API returns 403 SCOPE_MISMATCH rather than a data or syntax error [3]. The error is an authorization failure tied to OAuth scope claims, not to COQL or query syntax.
Common causes
- Your OAuth client/token was created or refreshed without the Desk search/ticket scopes being requested or approved [3].
- The user or admin revoked the app’s permission or removed the required scopes after initial consent [3][4].
- You refreshed/obtained an access token using a different grant flow (or different client) that doesn’t request the same scopes [4].
- Using a long-lived cached token issued before you added the search/ticket scope to the client; the old token never had the new scope [3].
How to fix it
- Confirm required scopes: check which Desk scopes the Ticket Search endpoint requires in Zoho Desk API docs or your integration notes, then list the scopes your app must request.
- Update the OAuth request: add the required Desk search/ticket scopes to your authorization URL or scope parameter in the token request.
- Re-consent as a user/admin: open the authorization URL so the user (or org admin if admin consent is required) re-grants the updated scope set. For org-level access, sign in as an admin via Zoho Accounts > Authorized Applications.
- Generate a fresh access token: after consent, exchange the authorization code (or use the refresh flow that requests scopes) to get a new access token and verify its scopes. Do not reuse the old token.
- Test the call: retry the Ticket Search request with the new token and confirm the 403 goes away. Log the token’s scope claim for future debugging.
When to escalate
If re-requesting scopes and getting a new token does not resolve the 403, open a support ticket with Zoho Desk. Include your client ID, the exact scope list you requested, the time of the failing request, and the full API endpoint and headers (redact secrets); Zoho support can check org-level consent and scope mappings [3][4].