Zoom

What your agents can doCopy Anchor Link

Helios provides API access for these Zoom products: Accounts, AI Companion, AI Services, Auto Dialer, Calendar, Canvas, Chatbot, Clips, Cobrowse SDK, Commerce, Conference Room Connector, Contact Center, Healthcare, Hub, Mail, Marketplace, Meetings (with webinars and cloud recordings), My Notes, Number Management, Phone, Quality Management, Quality of Service Subscription, Revenue Accelerator, Rooms, Scheduler, SCIM 2, Tasks, Team Chat, Users, Video Management, Video SDK, Virtual Agent, Whiteboard, Workforce Management, and Zoom Events. It also supports the Master Account APIs, which a master account uses to act on its sub accounts, including the Billing API for sub account plans and invoices. Agents call endpoints with your Zoom token attached by Helios. Access depends on your app's scopes, account permissions, and product licenses.

• Schedule, reschedule, and cancel meetings and webinars, and share their join links
• Read AI Companion meeting summaries and who attended a past meeting, and download cloud recordings and transcripts
• Send Team Chat messages and files, and create and manage channels
• Read Zoom Phone call history and voicemail details, and Contact Center engagements and queues
• Manage Zoom Rooms, workspaces, and reservations, and upload room backgrounds
• Create and update users and groups through SCIM 2

Many endpoints need a paid plan or a license:

• Cloud recordings, transcripts, meeting summaries, and the list of who attended a past meeting need a Pro plan or higher. Transcripts also need audio transcription turned on.
• Webinars need a Webinar license.
• Phone, Contact Center, Rooms, Zoom Events, and some other products need their own Zoom license.
• The Calendar API works only for users who have Zoom Calendar, Zoom's own calendar service. A Google or Microsoft calendar connected to Zoom doesn't count.

The agent's API tool sends your Zoom token to https://api.zoom.us/v2 and to the other hosts Zoom uses for its API and its files:

• https://fileapi.zoom.us/v2 and https://file.zoom.us for file uploads and downloads
• https://api.zoom.us/scim2 for SCIM 2
• The download links under https://zoom.us/rec/, https://zoom.us/file/, https://zoom.us/v2/phone/recording/download/, and https://zoom.us/v2/phone/recording_transcript/download/, for recordings and Team Chat files
• Any single-label zoom.us subdomain, such as the regional recording host us06web.zoom.us

When a download link redirects to a host outside this list, Helios follows it without your token. The tool can't reach other hosts, so agents can't use the customer managed key API, which runs on your own key connector.

Helios removes the host's ZAK token from start links (start_url), the ZAK token that GET /users/{userId}/token returns, and recording download tokens before an agent sees a response or an event. A ZAK token lets anyone start the meeting as the host. Agents call Zoom with the connection's own token, so they don't need these values. Registrant join links keep their tk value, so an agent can send each registrant their link.

AuthenticationCopy Anchor Link

See Integration authentication for how credentials are stored and injected.

Zoom Server-to-Server OAuth AppCopy Anchor Link

You need to be the account owner or an admin, or have a role that can view and edit Server-to-Server OAuth apps. An admin grants it under User Management → Roles → Role Settings → Advanced features. Your role also needs admin-level permissions to add the admin scopes.

1. Sign in to the Zoom App Marketplace. Select Developers in the lower left corner to open Created Apps.
2. Select the plus sign next to Developer, then Build an app. Choose Server-to-Server OAuth app and click Create.
3. On the Information page, fill in the app's description and the developer's name and email.
4. On the Scopes page, click Add Scopes. Select each product your agents should use, check its admin scopes, the ones ending in :admin, and click Done. Add the admin scopes for the APIs and events you need from Scopes. On a master account, also add the master scopes. The picker lists only the scopes your account's plan and products allow, so skip the ones it doesn't show.
5. On the Activation page, activate the app.
6. In Helios, choose Zoom Server-to-Server OAuth App. Enter the Account ID, Client ID, and Client Secret from the app's App Credentials page, and the Secret Token from the app's Feature page.
7. Save.

Access tokens for this app last one hour and come with no refresh token. Helios asks Zoom for a new one shortly before the current one expires. If you regenerate the client secret or the secret token in Zoom, enter the new value in Helios through Manage. After you add scopes to the app, save the connection again, so Helios subscribes to the events they allow.

Your own Zoom OAuth appCopy Anchor Link

You need to be the account owner or an admin, or have the Zoom for developers role.

1. Sign in to the Zoom App Marketplace. Select Developers in the lower left corner, then the plus sign next to Developer, then Build an app. Choose General app and click Create.

2. On the Basic Info page, under Select how the app is managed, choose User-managed.

3. Under OAuth Information, set OAuth Redirect URL to this URL, and add the same URL to OAuth Allow Lists:

   Copy Text

   https://api.heliosapp.com/integrations/zoom/oauth_callback

4. On the Scopes page, click Add Scopes. Select each product your agents should use, check its scopes without a suffix, such as meeting:read:meeting, and click Done. Add the scopes without a suffix for the APIs and events you need from Scopes. The picker lists only the scopes your account's plan and products allow, so skip the ones it doesn't show.

5. In Helios, choose Your own Zoom OAuth app. Enter the Client ID and Client Secret from App Credentials on the Basic Info page, and the Secret Token from Features → Access.

6. Save, then approve access in Zoom.

Zoom takes the scopes from the app's settings, not from the sign-in request. Access tokens last one hour, and Helios renews them with the refresh token. A refresh token expires after 90 days, so Helios renews it every week. An app you haven't published can only be authorized by users on your own Zoom account.

After you add scopes to the app, click Re-connect on the connection and approve again, so the new token carries them. If you regenerate the client secret or the secret token, enter the new value through Manage first.

ScopesCopy Anchor Link

Every connection needs user:read:user, or user:read:user:admin for a Server-to-Server app, so Helios can test the connection and set up triggers.

Add scopes for the operations and events you want to use. These are common examples:

Check each endpoint or event in Zoom's granular scopes reference for its required scopes. An endpoint or event works with any one of the scopes Zoom lists for it.

The Master Account APIs require :master scopes and a master account that manages sub accounts.

Helios also accepts classic scopes, such as meeting:read:admin, on apps that use them.

TriggersCopy Anchor Link

Available events below can start a Workflow. When you save the connection, Helios requests subscriptions through Zoom's event subscription API using the app credentials and scopes you configured. Each subscription is named Helios. Zoom limits how many events one subscription can list, so a connection can have several. A Server-to-Server app receives events for every user in the account. An OAuth app receives events for the user who authorized it. Deleting the connection removes the subscription.

Helios requests events allowed by the app's scopes. In the trigger picker, the other events show as unavailable, with the scope they need. Helios sets up the subscriptions again later on its own for the events it couldn't confirm or check, and every week for an OAuth app when it renews the refresh token.

Zoom sends the Chatbot events, such as bot_notification, only to a Team Chat app's bot endpoint URL, and app_deauthorized only to an app's deauthorization URL. Helios doesn't receive them.

Zoom's specs list no scope for the Video SDK and Cobrowse SDK events, including the Video SDK's session.rtms_* events, team_chat.channel_invitation_removed, team_chat.channel_reaction_added, workspace.pre_check_in_questionnaire_response_created and workspace.reservation_update. Zoom refuses them for Server-to-Server and OAuth apps, so they always show as unavailable.

All filters are optional, and each one is a pattern. In a pattern, * doesn't match a /. To match a value that contains a /, start the pattern with **/, such as **/*renewal*.

• Topic matches the meeting or webinar topic. On recording.renamed it matches the recording's new title. Case matters.
• Host email, Participant email, Registrant email, Contact email, and Invitee email match the email address of that person and ignore case. User email matches the user's email on user events, and the Contact Center user's email on Contact Center events, such as an agent or, on supervisor events, the supervisor. It ignores case too. Participant email is the invitee's email on meeting.invitation_* events.
• Participant name matches the participant's display name. Case matters.
• Changed field matches the names of the top-level fields an update changed, such as start_time or topic. A change inside settings matches settings. Update events carry only the changed fields, so this is their only filter.
• Channel name matches the Team Chat channel's name. Queue name and Flow name match the Contact Center queue and flow. Session name matches the Video SDK session. Room name, Workspace name, and Whiteboard name match those names. Case matters for all of them.
• Caller number and Callee number match phone numbers in E.164 format, such as +14155550100. Use a pattern such as +1415*. Zoom converts a number to E.164 only when it can, so the value can also be an internal extension, such as 100, or Anonymous.

The Needs column, or a note above a table, shows the plan or license an event requires, where Zoom's docs name one. A filter only matches when the event carries the field. Zoom leaves some fields out. For example, a participant's email is only sent when they signed in to Zoom, and it's empty when they aren't on the host's account.

Deliveries are verified with the HMAC-SHA256 x-zm-signature header, made with the secret token. Zoom retries a failed delivery up to three times, the last one 85 minutes after the first attempt. Helios accepts deliveries signed up to 90 minutes ago, so the retries get through, and a repeated delivery starts no second run.

Helios also answers Zoom's URL validation, which Zoom repeats every 72 hours. If validation fails 6 times in a row, Zoom disables the subscription. Save the connection again to create a new one.

Check that it worksCopy Anchor Link

• The connection: after you save, the connection's status shows Connected. Error means Zoom refused the credentials. See Common errors.
• A trigger:
  1. Add meeting.created to a workflow with no filters.
  2. Schedule a test meeting in Zoom as a user the connection covers.
  3. Check that a run starts. Then open the connection in Helios and click Webhook events to see the event.

Common errorsCopy Anchor Link

LimitsCopy Anchor Link

Zoom limits API requests for each account, by plan and by each endpoint's rate limit label. For example, a Pro account gets 30 light, 20 medium, and 10 heavy requests a second, and a free account gets fewer, with daily caps. A user can create or update at most 100 meetings and webinars a day. Phone and Contact Center APIs have their own limits. See Zoom's rate limits.