Apps API

• message

  object — Message object, including text field

  • text

    string — App notification content.

• notification_id

  string — App-generated identifier.

• user_id

  string — The user's unique identifier.

Content-Type: application/json

Example:

[
  {
    "field_id": "city_name",
    "type": "plain_text_input",
    "value": "San Jose"
  }
]

Content-Type: application/json

Example:

{
  "next_page_token": "eer587w4eiyfsudgf",
  "page_size": 30,
  "event_subscriptions": [
    {
      "event_subscription_id": "sFrBezKES3-UdcfMPXFA0A",
      "events": [
        "meeting.deleted"
      ],
      "event_subscription_name": "Example Event Subscription",
      "event_webhook_url": "https://www.example.com",
      "subscription_scope": "user",
      "created_source": "default",
      "subscriber_id": "5AATFjiUS0yEnELIMzQO4g",
      "custom_header": {
        "custom_header_type": 2,
        "username": "my_username",
        "password": "my_password",
        "client_id": "your_client_id",
        "client_secret": "your_client_secret",
        "token_url": "https://auth.example.com/oauth/token",
        "scope": "read:org write:user",
        "state": "request-123",
        "client_authentication": "body",
        "custom_header_key": "x-api-key",
        "custom_header_value": "your_api_key_value"
      }
    }
  ]
}

• event_webhook_url (required)

  string — The event notification endpoint URL.

• events (required)

  array

  Items:

  string — The event's name.

• subscription_scope (required)

  string, possible values: "user", "account", "master_account", "team", "group" — The app event subscription's scope * `user` — The app event subscription is for specific users. * `account` — The app event subscription is for all users in the account. * `master_account` — The app event subscription is for all users in the master account. * `team` — The app event subscription is for team in the account, and only events from the contact center are supported. * `group` — The app event subscription is for specific user groups in the account.

• account_id

  string — The account's ID.

• custom_header

  object — Custom header configuration for event subscription webhook. This allows you to configure authentication headers that will be sent with webhook requests.

  • custom_header_type (required)

    integer, format: int8, possible values: 0, 1, 2, 3, default: 0 — The type of custom header to use for authentication. * `0` - Default (no custom header) * `1` - Basic Authentication (requires username and password) * `2` - OAuth2 Token Authentication (requires client_id, client_secret, and token_url) * `3` - Custom Key-Value Header (requires custom_header_key and custom_header_value)

  • client_authentication

    string, possible values: "header", "body", default: "header" — The client authentication method for OAuth2 token requests. Only valid when `custom_header_type` is `2` (OAuth). * `header` - Send client credentials as Basic Auth header (default) * `body` - Send client credentials in request body

  • client_id

    string — The OAuth2 client ID. Required when `custom_header_type` is `2` (OAuth).

  • client_secret

    string — The OAuth2 client secret. Required when `custom_header_type` is `2` (OAuth).

  • custom_header_key

    string — The custom header key name. Required when `custom_header_type` is `3` (Custom Key-Value). Can only contain letters, numbers, and hyphens. Cannot contain spaces or line feeds.

  • custom_header_value

    string — The custom header value. Required when `custom_header_type` is `3` (Custom Key-Value). Cannot contain line feeds.

  • password

    string — The password for Basic Authentication. Required when `custom_header_type` is `1` (Basic Auth).

  • scope

    string — The OAuth2 scope parameter for limiting access token permissions. Optional, only valid when `custom_header_type` is `2` (OAuth).

  • state

    string — The OAuth2 state parameter for CSRF protection and request tracking. Optional, only valid when `custom_header_type` is `2` (OAuth).

  • token_url

    string, format: uri — The OAuth2 token endpoint URL. Required when `custom_header_type` is `2` (OAuth). Must be a valid HTTPS URL.

  • username

    string — The username for Basic Authentication. Required when `custom_header_type` is `1` (Basic Auth).

• event_subscription_name

  string — The app event subscription's name.

• team_ids

  array — The team ID list.

  Items:

  string — The team's ID.

• user_group_ids

  array — The user group ID list.

  Items:

  string — The user group's ID.

• user_ids

  array

  Items:

  string — The user's user ID list.

Content-Type: application/json

Example:

{
  "event_subscription_id": "0ZAaJY4dQ52BbwI9PArBLQ"
}

• event_subscription_id (required)

  string — The app event subscription's ID.

• custom_header

  object — Custom header configuration for event subscription webhook. This allows you to configure authentication headers that will be sent with webhook requests.

  • custom_header_type (required)

    integer, format: int8, possible values: 0, 1, 2, 3, default: 0 — The type of custom header to use for authentication. * `0` - Default (no custom header) * `1` - Basic Authentication (requires username and password) * `2` - OAuth2 Token Authentication (requires client_id, client_secret, and token_url) * `3` - Custom Key-Value Header (requires custom_header_key and custom_header_value)

  • client_authentication

    string, possible values: "header", "body", default: "header" — The client authentication method for OAuth2 token requests. Only valid when `custom_header_type` is `2` (OAuth). * `header` - Send client credentials as Basic Auth header (default) * `body` - Send client credentials in request body

  • client_id

    string — The OAuth2 client ID. Required when `custom_header_type` is `2` (OAuth).

  • client_secret

    string — The OAuth2 client secret. Required when `custom_header_type` is `2` (OAuth).

  • custom_header_key

    string — The custom header key name. Required when `custom_header_type` is `3` (Custom Key-Value). Can only contain letters, numbers, and hyphens. Cannot contain spaces or line feeds.

  • custom_header_value

    string — The custom header value. Required when `custom_header_type` is `3` (Custom Key-Value). Cannot contain line feeds.

  • password

    string — The password for Basic Authentication. Required when `custom_header_type` is `1` (Basic Auth).

  • scope

    string — The OAuth2 scope parameter for limiting access token permissions. Optional, only valid when `custom_header_type` is `2` (OAuth).

  • state

    string — The OAuth2 state parameter for CSRF protection and request tracking. Optional, only valid when `custom_header_type` is `2` (OAuth).

  • token_url

    string, format: uri — The OAuth2 token endpoint URL. Required when `custom_header_type` is `2` (OAuth). Must be a valid HTTPS URL.

  • username

    string — The username for Basic Authentication. Required when `custom_header_type` is `1` (Basic Auth).

• event_subscription_name

  string — The app event subscription's name.

• event_webhook_url

  string — The event notification endpoint URL.

• events

  array — The webhook events.

  Items:

  string — The event's name.

• account_id (required)

  string — The account's ID.

• team_ids

  array — The team ID list.

  Items:

  string — The team's ID.

• user_group_ids

  array — The user group ID list.

  Items:

  string — The user group's ID.

• user_ids

  array

  Items:

  string — The user ID list for the user.

Content-Type: application/json

Example:

{
  "next_page_token": "w7587w4eiyfsudgf",
  "page_size": 30,
  "apps": [
    {
      "app_id": "nqSreNVsQ2eGzUMGnA8AHA",
      "app_name": "Example App",
      "app_type": "ZoomApp",
      "app_usage": 1,
      "app_status": "PUBLISHED",
      "request_id": "zZLSQoL6S0OB6asaZ3zAOQ",
      "request_total_number": 8,
      "request_pending_number": 3,
      "request_approved_number": 2,
      "request_declined_number": 2,
      "latest_request_date_time": "2021-07-21T17:32:28Z",
      "reviewer_name": "Jill Chill",
      "review_date_time": "2021-07-21T17:32:28Z",
      "app_developer_type": "THIRD_PARTY",
      "app_description": "information about the app.",
      "app_icon": "https://marketplacecontent.zoom.us//oE98TDy1QymZ3nZs_uILrw/RxGA0jOvQU6aKxttLwQ2-A/app/B67xzmliS9-noBDwsGun1Q/KRUURXa-T6iQz7-S9bEO6A.png",
      "scopes": [
        {
          "scope_name": "View all users' team chat messages",
          "scope_description": "This app will gain access to the team chat channels. Please review its privacy policy first."
        }
      ],
      "app_privacy_policy_url": "https://www.example.com/privacy/policy",
      "app_directory_url": "https://marketplace.zoom.us/apps/{appId}",
      "app_help_url": "https://www.example.com/support",
      "restricted_time": "2024-03-21T17:32:28Z",
      "approval_info": {
        "approved_type": "forSpecificUser",
        "approver_id": "1gAKvx8fSUeTg-mHgmYTRA",
        "approved_time": "2024-03-21T14:32:28Z",
        "app_approval_closed": true
      }
    }
  ]
}

• app_name (required)

  string — The app's name.

• app_type (required)

  string, possible values: "s2s_oauth", "meeting_sdk", "general" — The app's type: * `s2s_oauth` — Server to Server OAuth app. * `meeting_sdk` — Meeting SDK app. * `general`— UBF General app.

• company_name (required)

  string — The company's name.

• contact_email (required)

  string, format: email — The developer's email.

• contact_name (required)

  string — The developer's name.

• active

  boolean, default: false — Only valid for s2s_oauth app, whether to activate automatically: * `true` — Automatically activate the app after creation. It is required that at least one scope should be included in the input parameter. * `false` — Do not activate the app after creation.

• manifest

  object — An app manifest object. It should meet the valid manifest schema. If the app_type equals general, you need to pass this param. Manifest resources: https://developers.zoom.us/docs/build-flow/manifests/
• publish

  boolean, default: false — Only valid for meeting_sdk app, whether to publish the app to the Marketplace: * `true` — The app contains development credentials and production credentials. * `false` — The app contains only development credentials.

• scopes

  array — The scopes of the created app: * `s2s_oauth` — If `active` field is true, there must be at least one scope. * `meeting_sdk` — Will automatically include `user_zak:read` scope.

  Items:

  string

Content-Type: application/json

Example:

{
  "created_at": "2023-02-16T17:32:28Z",
  "app_id": "Bwpq5zXvQr-4PKhtYOD23g",
  "app_name": "My App",
  "app_type": "s2s_oauth",
  "scopes": [
    "meeting:read"
  ],
  "production_credentials": {
    "client_id": "2J5nVOGXQXCvXoRWyGQDow",
    "client_secret": "BzFOrwgq1Gw6KCsyeYnmETU5e4zakGwQ"
  },
  "development_credentials": {
    "client_id": "2J5nVOGXQXCvXoRWyGQDow",
    "client_secret": "BzFOrwgq1Gw6KCsyeYnmETU5e4zakGwQ"
  }
}

Content-Type: application/json

Example:

{
  "app_id": "nqSreNVsQ2eGzUMGnA8AHA",
  "app_name": "Example App",
  "app_description": "Example App description",
  "app_type": "ZoomApp",
  "app_usage": 1,
  "app_status": "PUBLISHED",
  "app_links": {
    "documentation_url": "https://xxxx",
    "privacy_policy_url": "https://xxxx",
    "support_url": "https://xxxx",
    "terms_of_use_url": "https://xxxx"
  },
  "app_permissions": [
    {
      "group": "View",
      "group_message": "App can view information",
      "title": "Associated with you",
      "permissions": [
        {
          "name": "Devices"
        }
      ]
    }
  ],
  "app_requirements": {
    "user_role": "admin",
    "min_client_version": "5.7.3",
    "account_eligibility": {
      "account_types": [
        "Free"
      ],
      "premium_events": [
        {
          "event_name": "Meeting participant data",
          "event": "meeting.participant_qos_summary"
        }
      ]
    }
  },
  "app_scopes": [
    "meeting:read"
  ]
}

Content-Type: application/json

Example:

{
  "next_page_token": "b43YBRLJFg3V4vsSpxvGdKIGtNbxn9h9If2",
  "page_size": 30,
  "call_logs": [
    {
      "url_pattern": "https://zoom.us/v2/users/_DkLL5iMRW-p_6yhPocD4Q/assistants",
      "time": "1737704112808",
      "http_status": 200,
      "method": "GET",
      "trace_id": "v=2.0;clid=aw1;rid=ZTP_10094594754_scenario_10000000934_aw1_20250124T073509485Z"
    }
  ]
}

• action (required)

  string — The action of the deeplink, it's a user-defined string. Default length 2000, max length 9000.

• target (required)

  string, possible values: "meeting", "panel", "modal" — The target of the deeplink.

• type (required)

  integer, possible values: 1, 2, default: 1 — The type of deeplink. This value defaults to `1`. `1` - Generate a deeplink that opens Zoom App in-meeting if the meeting is in progress, if not opens Zoom App in Apps Tab. `2` - Generate a deeplink that refreshes Chat App Webview.

Content-Type: application/json

Example:

{
  "deeplink": "https://zoom.us/launch/chatapp/Zx_cSBEZUWRUMIf454A3sRpEzRp8kVmFINKvSBMok37i5bNRqtLbUxy681Qh_wVhFyW2AhyyF2LbtqSz9pFckUUupHg.wEt88YlHQpzp635x"
}

• action

  string, possible values: "approve_all", "approve_user", "disapprove_user", "approve_group", "disapprove_group", "disapprove_all", default: "null" — The action with which to take with the app: * approve_all — Turn on app pre-approval and set it as the account. * approve_user — Add users to approved list and set it as the specific user/group. * disapprove_user — Remove users from approved list and set it as the specific user/group. * approve_group — Add groups to approved list and set it as the specific user/group. * disapprove_group — Remove groups from approved list and set it as the specific user/group. * disapprove_all — Turn off app pre-approval.

• group_ids

  array — If the action value is approve_group or disapprove_group, the group IDs to add or remove.Maximum limit of 20.

  Items:

  string — Zoom user group id

• user_ids

  array — If the action value is approve_user or disapprove_user, the user IDs to add or remove.Maximum limit of 20.

  Items:

  string — Zoom user Id

Content-Type: application/json

Example:

{
  "executed_at": "2021-07-21T17:32:28Z",
  "user_ids": [
    "xurCXOI_Ty2RRNMv648OPw"
  ],
  "group_ids": [
    "JJcuSipRRS2JqYmk8mfBbA"
  ]
}

Content-Type: application/json

Example:

{
  "next_page_token": "w7587w4eiyfsudgf",
  "page_size": 30,
  "requests": [
    {
      "request_user_id": "f1sTWCMaTmOIZxLMlmHvEQ",
      "request_user_name": "Jill Chill",
      "request_user_email": "jchill@example.com",
      "request_user_department": "department",
      "request_date_time": "2021-07-21T17:32:28Z",
      "reason": "I want to use this app.",
      "status": "pending"
    }
  ]
}

• action (required)

  string, possible values: "add_all", "add_user", "add_group" — The action with which to take with the app: * `add_all` — Add all user for the app. * `add_user` — Add specified user for the app. * `add_group` — Add specified group of user for the app.

• group_ids

  array — If the `action` value is `add_group`, the group IDs to add

  Items:

  string

• user_ids

  array — If the `action` value is `add_user`, the user IDs to add

  Items:

  string

Content-Type: application/json

Example:

{
  "added_at": "2021-07-21T17:32:28Z",
  "user_ids": [
    "f1sTWCMaTmOIZxLMlmHvEQ"
  ],
  "group_ids": [
    "t-_-d56CSWG-7BF15LLrOw"
  ]
}

• action (required)

  string, possible values: "approve_all", "approve", "decline_all", "decline", "cancel" — The app's action: * `approve_all` — Approve all user requests for the app. * `approve` — Partially approve user requests the app. * `decline_all` — Reject all user requests for the app, users who have been approved will also be declined and the installed apps will be disabled. * `decline` — Partially reject user requests for app. * `cancel` — Cancel partially user requests for app.

• request_user_ids

  array — If the `action` value is `approve`, the user's request will be approved. If the `action` value is `decline`, the user's request will be rejected. If the `action` value is `cancel`, the user's request will be canceled.

  Items:

  string

• action (required)

  string, possible values: "new", "update" — `new` - Create a new client secret rotate schedule. `update` - Update `revoke_old_secret_time` of an existing client secret rotate schedule.

• revoke_old_secret_time (required)

  string, format: date-time — Old and new secret will both work until the old secret is revoked. To revoke the old secret immediately, set this value to `now`. To set a time to revoke the old secret, this value should be in UTC time format, `yyyy-MM-dd'T'HH:mm:ss'Z'`. When action = `new`, this time cannot exceed more than 30 days. When action = `update`, this time cannot exceed more than 30 days starting from the initial new request.

Content-Type: application/json

Example:

{
  "secret_id": "0dSHIBbdSYWCzlE8d9DKFw",
  "new_secret": "hjdgsuiuyer3956294832hjfgsjxf",
  "revoke_old_secret_time": "2025-03-15T12:34:56Z"
}

Content-Type: application/json

Example:

{
  "next_page_token": "b43YBRLJFg3V4vsSpxvGdKIGtNbxn9h9If2",
  "page_size": 30,
  "webhook_logs": [
    {
      "event": "meeting.deleted",
      "status": 429,
      "failed_reason_type": 1,
      "user_id": "IYHrdpjrS3ubOf7rPkkg8w",
      "endpoint": "https://example.com",
      "subscription_id": "9qwt8mkBEW2O6fPuxBpXpA",
      "request_headers": "N/A",
      "request_body": "{\"event\":\"meeting.created\",\"payload\":{\"account_id\":\"oFPqQAp3Q0u3yLXXrWuQuy\",\"event_ts\":1663654515392}",
      "response_headers": "{\\\"Server\\\":\\\"nginx\\\",\\\"Content-Type\\\":\\\"text/html; charset=UTF-8\\\"}",
      "response_body": "Timeout connecting to server.",
      "date_time": "2022-09-09T08:11:387Z",
      "trace_id": "WEB_5f1752ba04e4ffeccde2f2a923c106f9",
      "request_id": "e8ca3e3c_0196_4dc8_9f9e_81217d9000e6",
      "retry_num": 0
    }
  ]
}

Content-Type: application/json

Example:

[
  {
    "id": "123e4567-e89b-12d3-a456-426655440000",
    "plan_name": "PRO",
    "plan_id": "f3318144-b66c-4c1e-a987-ebc224e2b706"
  }
]

Content-Type: application/json

Example:

{
  "next_page_token": "w7587w4eiyfsudgf",
  "page_size": 30,
  "apps": [
    {
      "app_id": "nqSreNVsQ2eGzUMGnA8AHA",
      "app_name": "Example App",
      "app_type": "ZoomApp",
      "app_usage": 1,
      "app_status": "PUBLISHED",
      "request_id": "zZLSQoL6S0OB6asaZ3zAOQ",
      "request_date_time": "2021-07-21T17:32:28Z",
      "request_status": "pending"
    }
  ]
}

• action (required)

  string, possible values: "enable", "disable" — Enable or disable a user's app subscription.

Content-Type: application/json

Example:

{
  "entitlements": [
    {
      "entitlement_id": 1
    }
  ]
}

• action

  string — The action of the deeplink, it's a user-defined string.

• type

  integer, possible values: 1, 2 — The type of deeplink. * `1` — Generate a deeplink that opens Zoom App in-meeting if the meeting is in progress, if not opens Zoom App in Apps Tab. \n* `2` — Generate a deeplink that refreshes Chat App Webview. This value defaults to `1`.

• user_id

  string — The 'userId' property of the app deeplink. This field only applies to account level OAuth token.

Content-Type: application/json

Example:

{
  "deeplink": "https://zoom.us/launch/chatapp/Zx_cSBEZUWRUMIf454A3sRpEzRp8kVmFINKvSBMok37i5bNRqtLbUxy681Qh_wVhFyW2AhyyF2LbtqSz9pFckUUupHg.wEt88YlHQpzp635x"
}

• manifest (required)

  object — The manifest to be validated. It's validated according to the manifest schema
• app_id

  string — The ID of the app whose configuration you want to validate.

Content-Type: application/json

Example:

{
  "ok": false,
  "error": "invalid_manifest",
  "errors": [
    {
      "message": "Event Subscription requires either Request URL or Socket Mode Enabled",
      "setting": "/settings/event_subscriptions"
    }
  ]
}

Content-Type: application/json

Example:

{
  "manifest": {}
}

• manifest (required)

  object — An app manifest object. It should meet valid manifest schema. This API replaces the entire previous configuration. As a result, the manifest needs to contain all modified and unmodified fields.