Setting the file. One moment.
Subchapter 127.5
concepts/scopes-architecture.mdMarkdown7 KBView on GitHub
Zoom OAuth uses scopes to limit API access. Understanding Classic vs Granular scopes is critical.
| Type | Format | Example |
|---|
| Status |
|---|
| Classic | resource:level | meeting:write:admin | Active |
| Granular | service:action:data_claim:access | meeting:write:meeting:admin | Active (newer) |
{resource}:{action}:{level}Examples:
meeting:read - Read user’s own meetingsmeeting:write:admin - Create/update meetings for all account usersrecording:read:master - Read recordings across all sub-accounts| Level | Access | Who Can Authorize | Example |
|---|---|---|---|
| (none) | Own data only | Any user | meeting:read |
:admin | Account-wide | Admin role required | meeting:write:admin |
:master | Multi-account | Account owner only | user:master |
meeting:read # View own meetings
meeting:write # Create/edit own meetings
meeting:write:admin # Manage all account meetings
user:read # View own profile
user:write:admin # Manage account users
recording:read # View own recordings
recording:write:admin # Manage account recordings
webinar:read # View own webinars
webinar:write:admin # Manage account webinars
imchat:bot # Team Chat bot access{service}:{action}:{data_claim}:{access_level}Examples:
meeting:read:meeting:user - Read user’s own meetingsmeeting:write:invite_links:admin - Create invite links for accountrecording:delete:recording_file:admin - Delete recording files account-wide| Level | Access | Example |
|---|---|---|
user | Own data | meeting:read:meeting:user |
admin | Account-wide | meeting:write:meeting:admin |
account | Account settings | account:read:settings:account |
| Classic | Granular Equivalent |
|---|---|
meeting:read | meeting:read:meeting:user + meeting:read:list_meetings:user |
meeting:write:admin | meeting:write:meeting:admin + meeting:write:settings:admin + more |
Classic scopes are broad:
meeting:write:admin grants ALL meeting write permissions account-wideGranular scopes are specific:
meeting:write:meeting:admin - Only create/update meetingsmeeting:delete:meeting:admin - Only delete meetingsmeeting:write:settings:admin - Only update settingsPrinciple of Least Privilege: Request only the granular scopes you need.
✅ Yes, you can request both Classic and Granular scopes in the same app.
scope=meeting:read user:write:admin meeting:write:invite_links:adminScopes are configured in Zoom Marketplace:
Token will include all configured scopes.
Scopes are requested in authorization URL:
const authURL = new URL('https://zoom.us/oauth/authorize');
authURL.searchParams.set('response_type', 'code');
authURL.searchParams.set('client_id', CLIENT_ID);
authURL.searchParams.set('redirect_uri', REDIRECT_URI);
// Request specific scopes (space-separated)
authURL.searchParams.set('scope', 'meeting:read user:read recording:read');
// User sees consent screen listing these scopesWhen user authorizes your app, they see:
[Your App Name] wants to:
✓ View your meetings (meeting:read)
✓ View your profile (user:read)
✓ View your recordings (recording:read)
[Deny] [Authorize]Cause: Token’s scopes don’t include required scope for API endpoint.
Example:
// Token has: meeting:read
// API requires: meeting:write
await axios.post('https://api.zoom.us/v2/users/me/meetings', {...}, {
headers: { Authorization: `Bearer ${token}` }
});
// Error 4711: Insufficient scopeSolution:
// S2S OAuth: scopes returned in token response
const { access_token, scope } = tokenResponse.data;
console.log('Scopes:', scope); // "meeting:read user:read recording:write"
// User OAuth: scopes returned during token exchange
const { access_token, scope } = tokenResponse.data;
console.log('Granted scopes:', scope.split(' ')); // ['meeting:read', 'user:read', ...]curl -H "Authorization: Bearer {access_token}" \
https://zoom.us/oauth/token// ❌ AVOID: Requesting broad admin access when not needed
scope: "meeting:write:admin user:write:admin recording:write:admin"
// ✅ PREFER: Request only what you need
scope: "meeting:read user:read"// ❌ Classic (broad)
scope: "meeting:write:admin" // Includes create, update, delete, settings, etc.
// ✅ Granular (specific)
scope: "meeting:write:meeting:admin" // Only create/update meetings/**
* Create a meeting for a user
* Required scope: meeting:write:admin (Classic) or meeting:write:meeting:admin (Granular)
*/
async function createMeeting(userId, meetingData) {
// ...
}