How to get your profile permissions in Zoho Desk

Retrieving your profile permissions in Zoho Desk is straightforward using a single authenticated API call that returns the permission set tied to your current user profile.

Why this matters

Understanding your profile permissions determines which Zoho Desk resources you can read, write, or manage. This is especially useful when troubleshooting access issues, auditing agent roles, or building integrations that need to confirm what actions the authenticated user is allowed to perform before executing them.

Step-by-step

Step 1. Ensure your OAuth token includes the correct Zoho Desk scopes before making any API call. At minimum you will need Desk.basic.READ in your token's scope list, which covers organisational and agent-level data. A full integration typically also requests scopes such as Desk.tickets.READ, Desk.settings.READ, and Desk.search.READ depending on what your workflow requires. ^[3]

Step 2. Send an authenticated HTTP GET request to the following Zoho Desk API endpoint:

GET /api/v1/profiles/mine/permissions

This operation — internally identified as getmyprofile_permissions — returns the permission data associated with the profile of the currently authenticated user. ^[2]

Step 3. Optionally, pass a p parameter object with your request if you need to filter or paginate the response. The endpoint accepts p as a query-parameter dictionary, so you can append key-value pairs to the URL as standard query strings. ^[2]

Step 4. Parse the JSON response. The returned payload will describe the permissions your profile holds, which you can then use to gate further API calls in your integration — for example, confirming write or destructive permission levels before attempting ticket updates or deletions. ^[1]

A minimal Python example using the Zoho Desk client wrapper looks like this:

# Assuming `desk_client` is an authenticated ZohoDeskApi instance
permissions = desk_client.get_my_profile_permissions()
print(permissions)

^[2]

Common pitfalls

• Missing OAuth scopes. If your access token was generated without Desk.basic.READ (or the broader Desk.settings.READ), the API will return an authorisation error rather than your permissions. Always verify the scopes listed in your token match the required Zoho Desk scope list. ^[3]
• Wrong risk level blocking write/destructive checks. If you are building an automated tool that acts on the returned permissions, be aware that read access is always the baseline, write access requires a medium-or-lower risk classification, and destructive operations require explicit opt-in beyond that. Failing to account for this layering can cause your integration to attempt operations it is not permitted to perform. ^[1]
• Calling the endpoint without authentication. The /api/v1/profiles/mine/permissions path is user-context-specific — it resolves to *your* profile based on the bearer token supplied. Sending the request without a valid token, or with a token scoped to a different Zoho product (e.g. a CRM-only token), will result in an error. ^[2]

What to check

• Scopes are present in your token. Confirm that Desk.basic.READ (and any other required scopes) appear in the OAuth token you are using to call the endpoint. ^[3]
• The endpoint returns a 200 response. A successful call to GET /api/v1/profiles/mine/permissions should respond with HTTP 200 and a JSON body containing your profile's permission data — any other status code indicates an auth or configuration problem. ^[2]
• Permissions match your expected role. Cross-reference the returned permissions against the agent profile configured in your Zoho Desk admin panel to confirm the API response reflects the correct role assignment. ^[1]

---

*Beam Help provides independent expert support for Zoho products and is not official Zoho support. For platform-level account issues, contact Zoho directly.*