Zoom

Twin of the Zoom Workplace API v2.


Covers	`api.zoom.us`, `zoom.us`, `mcp.zoom.us`
Auth	OAuth access and refresh tokens
Webhooks	No
MCP tools	12
Operations	91

Coverage

Users and their settings, profile pictures, presence, assistants and schedulers, meetings with their registration and registrant questions, cloud recording including trash and recovery, meeting and webinar summaries, and core webinars, plus the OAuth authorize and token flow. Zoom splits its API, its OAuth issuer and its hosted MCP server across three hosts in production, and the twin serves all three path sets on the one base URL: REST under /v2, the OAuth flow under /oauth, and the hosted MCP server on /mcp.

Zoom’s own webhooks and event subscriptions sit outside this twin’s boundary, so nothing is delivered back to your app.

Credentials

Zoom wants a credential the world knows, in either auth.mode, so a token invented by your test setup is refused where other twins would wave a well-formed one through. Take an access token through the OAuth flow, or use one of the grants the world publishes. See Credentials.

The token endpoint takes a form-encoded body with the client authenticating over HTTP Basic, and accepts PKCE. An authorization code is spent once, and a refresh token rotates each time you use it, so hold on to the one the exchange hands back.

The hosted MCP server answers an uncredentialed call with a resource-metadata challenge naming its authorization server and the scopes it advertises, rather than a bare 401.

Vendor specific details

Validation failures come back as XML from this JSON API: application/xml carrying <result><code>300</code><message>Validation Failed.</message>…, with a <field> per offending input. A client that parses a 400 body as JSON throws on the parse rather than reporting Zoom’s reason.
A user-level token has to say me. Naming another user’s id from a token without an :admin or :master scope gets 404 User does not exist, not a 403, so a permissions bug reads as a missing record.
GET /v2/users page size is normalised, never refused. A non-positive value becomes 30, values up to 2000 are kept, anything larger is capped at 2000, and a non-integer succeeds and takes the default.
Meeting duration on a scheduled meeting defaults to 60 when omitted, comes back absent when you send explicit null, and is accepted at zero. A negative value is refused before the meeting is written.
An unknown timezone is accepted rather than refused, and stored as the host’s account timezone, so a typo silently reschedules the meeting.

Its own notes

Once a sandbox is running, this twin serves its own operating notes at {control_url}/veris/manual: the credentials it accepts, the API versions it serves, and the fault statuses you can arm against it. They are generated from the same source as its behaviour, so they cannot drift.