> ## Documentation Index
> Fetch the complete documentation index at: https://docs.anyshift.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Zabbix Integration

> Let Annie read your Zabbix problems, triggers, hosts and metrics during investigations.

# Zabbix Integration

BetaOn-demand

Connect your Zabbix servers so Annie can investigate problems, triggers, hosts and metrics, and correlate them with your infrastructure graph.

> [!NOTE]
>
> **Available on request** — [contact us](mailto:contact@anyshift.io) to enable it for your workspace.

## What Annie can do

* **Triage open problems**: list current problems by severity, then find the trigger, host and host groups behind each one
* **Read the values**: fetch the item behind a trigger, its latest raw values (`history`) and hourly min/avg/max (`trend`)
* **Look back in time**: list the problem events of a time window, and when they recovered
* **Explain missing or silent alerts**: check maintenance windows, disabled hosts and agent availability
* **Cover several servers**: each Zabbix connection is a separate server for Annie, and Annie reports which one it queried

Annie reaches Zabbix through its JSON-RPC API (`<your Zabbix URL>/api_jsonrpc.php`) with an API token.

## Requirements

* **Zabbix 6.0 or later.** Tested on 6.0, 7.0, 7.4 and 8.0.
* An **API token** (Zabbix 5.4+). Username and password login is not supported.
* The Zabbix frontend must be reachable from the internet (see [Network access](#network-access)).

## Quickstart

1. [Contact us](mailto:contact@anyshift.io) so Anyshift enables the integration for your workspace.
2. [Create a read-only Zabbix user and API token](#create-a-read-only-user-and-api-token).
3. [Allow Anyshift's outbound IPs](#network-access) to reach your Zabbix frontend.
4. Go to the [Anyshift integrations page](https://app.anyshift.io/integrations).
5. In the **Monitoring** section, open **Zabbix** and click **Add Zabbix server**.
6. Fill in the form:
   * **Name**: a label for this server, for example `Production Zabbix`
   * **Zabbix URL**: the base URL of the Zabbix web frontend, for example `https://zabbix.example.com` or `https://example.com/zabbix`. Don't add `/api_jsonrpc.php`; Anyshift adds it.
   * **API token**: the token you created
   * **Verify SSL certificate**: keep it on. Turn it off only for a server with a self-signed certificate.
7. Click **Save Zabbix server**.

On save, Anyshift reads the Zabbix version and makes one authenticated read call with the token. The server shows **Active** when it succeeds and **Error** when it fails. Only active servers are available to Annie.

### Multiple servers

Add one connection per Zabbix server (for example production and edge). The servers can run different Zabbix versions.

## Create a read-only user and API token

Annie only needs to read. Give it a dedicated user that can read the host groups you want investigated and nothing more.

1. In Zabbix, go to **Users → User groups** and create a group (for example `anyshift-readonly`) with **Read** permission on the host groups Annie should see.
2. Go to **Users → Users** and create a user (for example `anyshift`) in that group, with the **User role**.
3. **On Zabbix 8.0 and later, enable API access for that role.** Go to **Users → User roles**, open the role and turn on **Access to API**. New Zabbix 8.0 installations turn it off for every role except Super admin. Without it, a valid token is refused with `No permissions to call "host.get"`.
4. Go to **Users → API tokens**, click **Create API token**, pick the user, optionally set an expiry date, and copy the token. Zabbix shows it only once.

> [!WARNING]
>
> Do not use a token that belongs to a Super admin. Annie only sees what the token's user can read, so a read-only user on the right host groups is the safest setup.

## Security model

* **Read-only.** Only read methods (`*.get`, version and check calls) are allowed. Create, update, delete and acknowledge calls are refused before they reach Zabbix.
* **No access to users, tokens, settings or audit data.** Methods on users, user groups, API tokens, authentication, settings, audit log, connectors, media types, user directories and MFA are blocked, whatever the token's permissions.
* **Credentials in responses are redacted.** Zabbix returns some stored credentials to any user who can read the object, for example the password of an HTTP agent or SSH item. Anyshift removes these fields (passwords, SNMPv3 passphrases, TLS PSK, …) from every response before Annie sees it.
* **Your API token** is encrypted at rest with AWS KMS and is never shown to the AI agent.
* **Network safety.** Anyshift only connects to public addresses and does not follow redirects, so enter the final URL of your frontend.

### Network access

Your Zabbix frontend must be reachable from the internet over HTTP(S). If it sits behind a firewall or an IP allowlist, allow inbound traffic from Anyshift's outbound IP addresses:

| IP Address |
| - |
| 52.73.42.120 |
| 18.211.221.82 |
| 18.209.252.79 |

See [Network Requirements](https://docs.anyshift.io/pages/privacy_security/network.md) for the downloadable list.

## Example questions

* "What Zabbix problems are open right now, and which is the most severe?"
* "Which hosts are behind the High problems on our production Zabbix, and in which host groups?"
* "Show me the last values and the hourly trend of the metric behind the disk space alert on db-01."
* "Was web-01 in maintenance when the alert fired yesterday at 14:00 UTC?"

## Troubleshooting

### Status Error with "No permissions to call"

The token is valid but its user role cannot use the API. On Zabbix 8.0 and later, open **Users → User roles**, edit the user's role and turn on **Access to API**, then update the connection in Anyshift so it is re-tested.

### Status Error with "the Zabbix API token was rejected"

The token is wrong, expired or disabled. Create a new token under **Users → API tokens** and update the connection.

### Status Error with "unsupported Zabbix version"

The server runs Zabbix 5.x or older. Annie requires Zabbix 6.0 or later.

### Status Error with a redirect or connection error

Check that the URL is the final address of the frontend (for example `https://` rather than an `http://` address that redirects), that it is reachable from the internet, and that [Anyshift's IPs](#network-access) are allowed. For a self-signed certificate, turn off **Verify SSL certificate**.

### Annie says a host or problem is missing

Annie sees only the host groups the token's user can read. Give the user's group **Read** permission on the missing host groups.

### Annie doesn't use Zabbix

* Verify the server shows **Active** on the integrations page
* Make sure Annie's access to this server is not disabled in your integration settings
* After fixing a server in **Error**, update it so Anyshift re-tests it


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.