/rest-api

name: build-zoom-rest-api-app
description: "Reference skill for Zoom REST API. Use after choosing an API-based workflow when you need endpoint selection, resource-management patterns, OAuth requirements, rate-limit awareness, or API error debugging."
triggers:
  - "api call"
  - "rest api"
  - "api create meeting"
  - "api get meeting"
  - "api list meetings"
  - "api update meeting"
  - "api delete meeting"
  - "meeting endpoint"
  - "/v2/meetings"
  - "create user"
  - "zoom api"
  - "api endpoint"
  - "recordings api"
  - "users api"
  - "webinars api"
  - "server-to-server oauth"
  - "account_credentials"
  - "account id"
  - "invalid access token"
  - "does not contain scopes"
  - "access token is expired"
  - "webhook verification"
  - "crc"
  - "download_url"

/build-zoom-rest-api-app

Background reference for deterministic server-side Zoom automation and resource management. Prefer `plan-zoom-product`, `plan-zoom-integration`, or `debug-zoom` first, then route here for endpoint-level detail.

Zoom REST API

Expert guidance for building server-side integrations with the Zoom REST API. This API provides 600+ endpoints for managing meetings, users, webinars, recordings, reports, and all Zoom platform resources programmatically.

**Official Documentation**: https://developers.zoom.us/api-hub/ **API Hub Reference**: https://developers.zoom.us/api-hub/meetings/ **OpenAPI Inventories**: `https://developers.zoom.us/api-hub/<domain>/methods/endpoints.json`

Quick Links

**New to Zoom REST API? Follow this path:**

1. **[API Architecture](concepts/api-architecture.md)** - Base URLs, regional URLs, `me` keyword, ID vs UUID, time formats 2. **[Authentication Flows](concepts/authentication-flows.md)** - OAuth setup (S2S, User, PKCE, Device Code) 3. **[Meeting URLs vs Meeting SDK](concepts/meeting-urls-and-sdk-joining.md)** - Stop mixing `join_url` with Meeting SDK 3. **[Meeting Lifecycle](examples/meeting-lifecycle.md)** - Create → Update → Start → End → Delete with webhooks 4. **[Rate Limiting Strategy](concepts/rate-limiting-strategy.md)** - Plan tiers, per-user limits, retry patterns

**Reference:**

• **[Meetings](references/meetings.md)** - Meeting CRUD, types, settings
• **[Users](references/users.md)** - User provisioning and management
• **[Recordings](references/recordings.md)** - Cloud recording access and download
• **[AI Services](references/ai-services.md)** - Scribe endpoint inventory and current AI Services path surface
• **[GraphQL Queries](examples/graphql-queries.md)** - Alternative query API (beta)
• **Integrated Index** - see the section below in this file

Most domain files under `references/` are aligned to the official API Hub `endpoints.json` inventories. Treat those files as the local source of truth for method/path discovery.

**Having issues?**

• Start with preflight checks → [5-Minute Runbook](RUNBOOK.md)
• 401 Unauthorized → [Authentication Flows](concepts/authentication-flows.md) (check token expiry, scopes)
• 429 Too Many Requests → [Rate Limiting Strategy](concepts/rate-limiting-strategy.md)
• Error codes → [Common Errors](troubleshooting/common-errors.md)
• Pagination confusion → [Common Issues](troubleshooting/common-issues.md)
• Webhooks not arriving → [Webhook Server](examples/webhook-server.md)
• Forum-derived FAQs → [Forum Top Questions](troubleshooting/forum-top-questions.md)
• Token/scope failures → [Token + Scope Playbook](troubleshooting/token-scope-playbook.md)

**Building event-driven integrations?**

• [Webhook Server](examples/webhook-server.md) - Express.js server with CRC validation
• [Recording Pipeline](examples/recording-pipeline.md) - Auto-download via webhook events

Quick Start

Get an Access Token (Server-to-Server OAuth)

curl -X POST "https://zoom.us/oauth/token" \
  -H "Authorization: Basic $(echo -n 'CLIENT_ID:CLIENT_SECRET' | base64)" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=account_credentials&account_id=ACCOUNT_ID"

Response:

{
  "access_token": "eyJhbGciOiJIUzI1NiJ9...",
  "token_type": "bearer",
  "expires_in": 3600,
  "scope": "meeting:read meeting:write user:read"
}

Create a Meeting

curl -X POST "https://api.zoom.us/v2/users/HOST_USER_ID/meetings" \
  -H "Authorization: Bearer ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "topic": "Team Standup",
    "type": 2,
    "start_time": "2025-03-15T10:00:00Z",
    "duration": 30,
    "settings": {
      "join_before_host": false,
      "waiting_room": true
    }
  }'

For S2S OAuth, use an explicit host user ID or email in the path. Do not use `me`.

List Users with Pagination

curl "https://api.zoom.us/v2/users?page_size=300&status=active" \
  -H "Authorization: Bearer ACCESS_TOKEN"

Base URL

https://api.zoom.us/v2

Regional Base URLs

The `api_url` field in OAuth token responses indicates the user's region. Use regional URLs for data residency compliance:

| Region | URL | |--------|-----| | Global (default) | `https://api.zoom.us/v2` | | Australia | `https://api-au.zoom.us/v2` | | Canada | `https://api-ca.zoom.us/v2` | | European Union | `https://api-eu.zoom.us/v2` | | India | `https://api-in.zoom.us/v2` | | Saudi Arabia | `https://api-sa.zoom.us/v2` | | Singapore | `https://api-sg.zoom.us/v2` | | United Kingdom | `https://api-uk.zoom.us/v2` | | United States | `https://api-us.zoom.us/v2` |

**Note:** You can always use the global URL `https://api.zoom.us` regardless of the `api_url` value.

Key Features

| Feature | Description | |---------|-------------| | **Meeting Management** | Create, read, update, delete meetings with full scheduling control | | **User Provisioning** | Automated user lifecycle (create, update, deactivate, delete) | | **Webinar Operations** | Webinar CRUD, registrant management, panelist control | | **Cloud Recordings** | List, download, delete recordings with file-type filtering | | **Reports & Analytics** |