Alert Slack before Zendesk SLA breaches using Claude Cowork

Prerequisites

Overview

Claude Cowork lets you define a recurring task in plain English and have Claude execute it on a schedule — no script or skill file required. You describe the API calls, the logic for detecting approaching breaches, and the Slack alert format. Claude handles the rest. This is the fastest way to get SLA monitoring running with zero code.

Step 1: Get your Zendesk API credentials

In Zendesk, go to Admin Center → Apps and integrations → APIs → Zendesk API. Enable Token Access if it isn't already, then click Add API token.

You'll need three values:

• Subdomain: the acme part of acme.zendesk.com
• Email: your Zendesk agent email
• API token: copy from the API token page (shown once on creation)

Step 2: Get your Slack bot token and channel ID

1. Go to api.slack.com/apps and create or select your app
2. Under OAuth & Permissions, add the chat:write scope and install to your workspace
3. Copy the Bot User OAuth Token (starts with xoxb-)
4. In Slack, right-click your SLA alerts channel → View channel details → copy the Channel ID from the bottom of the panel

Step 3: Create the Cowork task

Open Claude Desktop and go to the Cowork tab. Click + New task.

Title: Check for approaching Zendesk SLA breaches

Description:

You are a support ops assistant. Your job is to check open Zendesk tickets for approaching SLA breaches and alert the team in Slack.
 
Steps:
1. Search for open, pending, and new tickets:
   GET https://{SUBDOMAIN}.zendesk.com/api/v2/search.json?query=type:ticket status:open status:pending status:new&per_page=100
   Auth: Basic — username: {EMAIL}/token:{API_TOKEN}
 
2. For each ticket, get its SLA metrics:
   GET https://{SUBDOMAIN}.zendesk.com/api/v2/tickets/{ticket_id}/metrics.json
 
3. Check the reply_time_in_minutes.business and full_resolution_time_in_minutes.business fields.
   For each, calculate: remaining = target - elapsed
   If remaining is between 1 and 60 minutes, this ticket is approaching breach.
 
4. For each ticket approaching breach, post a warning to Slack:
   POST https://slack.com/api/chat.postMessage
   Authorization: Bearer {SLACK_BOT_TOKEN}
   Body: {"channel": "{CHANNEL_ID}", "text": "SLA Warning: Ticket #{ticket_id} ({subject}) — {metric_name} breach in {remaining} minutes\nPriority: {priority}\nLink: https://{SUBDOMAIN}.zendesk.com/agent/tickets/{ticket_id}"}
 
5. Print a summary: how many tickets checked, how many approaching breach, alerts sent.
 
Important:
- Only alert on tickets where remaining time is between 1 and 60 minutes.
- Check both first reply time and resolution time metrics.
- Use business hours metrics (.business), not calendar metrics.
- Skip tickets where the SLA metric is already completed (is_completed = true).

Replace {'{'}SUBDOMAIN{'}'}, {'{'}EMAIL{'}'}, {'{'}API_TOKEN{'}'}, {'{'}SLACK_BOT_TOKEN{'}'}, and {'{'}CHANNEL_ID{'}'} with your real values.

Step 4: Set the schedule

Frequency: Every 30 minutes

Cowork will execute the task on this cadence and show you the output each time.

Step 5: Run manually first

Before trusting the schedule, click Run now in Cowork to test it. Claude will:

1. Call the Zendesk search API for open tickets
2. Fetch SLA metrics for each ticket
3. Calculate remaining time on first reply and resolution SLAs
4. Post Slack alerts for any ticket within 60 minutes of breach
5. Print a run summary

A successful run looks like:

Checked 38 open tickets for SLA status.
 
SLA warnings found:
 
  #29101 "Billing issue — double charged last month" — First Reply Time: 34 min remaining
    → Slack alert sent
  #29118 "Cannot access reporting dashboard" — Resolution Time: 52 min remaining
    → Slack alert sent
  #29125 "Urgent: integration sync failing" — First Reply Time: 12 min remaining
    → Slack alert sent
 
Done. Checked 38 tickets, sent 3 SLA warning(s) to Slack.

Step 6: Refine the task description

After the first few runs, review the alerts in Slack. If the threshold feels wrong, update the task description:

• Lower the threshold to 30 minutes if agents complain about premature alerts
• Raise it to 90 or 120 minutes for high-priority tickets with tight SLAs
• Add exceptions: "Skip tickets tagged 'sla-exempt' or 'on-hold'"

Cowork's task description is your prompt — the more specific you are, the better Claude performs.

When to use this approach

• You want SLA monitoring working today without writing or deploying any code
• Your ticket volume is under 200 open tickets and 30-minute batching is acceptable
• You're evaluating SLA thresholds before committing to a cron script or n8n workflow
• You want quick iteration — changing the warning logic is just editing the task description

When to switch approaches

• You need monitoring to run 24/7 reliably → use the Agent Skill with cron or GitHub Actions
• You need 15-minute precision → use the n8n approach with a Schedule Trigger
• Your ticket volume is high and Cowork runs take too long → use n8n for parallel processing

Cost

• Cowork uses your Claude Desktop subscription — no additional API costs
• Each run processes up to 100 tickets and takes 1-3 minutes depending on volume
• Zendesk and Slack API calls are included in their respective plans