Zoom Connector

The Zoom connector indexes Team Chat channels and direct messages, along with cloud recording transcripts and AI-generated meeting summaries.

Setup requires two Zoom apps, created in the Zoom Marketplace. You must be a Zoom Admin or Owner to create and configure them. No single Zoom app type can cover both roles:

• A Server-to-Server (S2S) OAuth app provides the org-wide read access used to backfill users, channels, messages, recordings, and summaries.
• A General app provides real-time streaming, so new messages and channel changes are indexed as they happen rather than waiting for the next backfill.

The streaming app is optional. If you configure only the S2S app, the connector runs in backfill-only mode.

Create the Backfill App (Server-to-Server OAuth)

1. Go to the Zoom Marketplace and select Develop > Build App.
2. Choose Server-to-Server OAuth.
3. Give the app a name, for example Atolio Backfill.
4. From App Credentials, record the Account ID, Client ID, and Client Secret.
5. Open Scopes, select Add Scopes, and add the following:

6. Select Activate to enable the app, and confirm it shows the green Active status.

Note: One additional scope, meeting:read:list_past_participants:admin, is required only if you enable share-recordings-with-participants. See Recording Visibility.

Create the Streaming App (General App)

Skip this section if you only need backfill.

1. Go to the Zoom Marketplace and select Develop > Build App.
2. Choose General App.
3. Give the app a name, for example Atolio Streaming.
4. Select admin-managed as the app type, then select Save.
5. From App Credentials, record the Client ID and Client Secret.
6. Open Scopes, select Add Scopes, and add the following:

Zoom grants the app’s marketplace and websocket scopes automatically. You do not need to add them by hand.

7. Install the app on your account from the app page by selecting Install or Authorize.

Configure the WebSocket Subscription

Zoom’s API cannot create websocket subscriptions, so this step must be done in the Marketplace UI.

1. On the General app, go to Features > Access > Event Subscription and enable it with the slider.

2. Select Add New Event Subscription and give it a name, for example Atolio WS.

3. Choose WebSocket as the delivery method.

4. Select Add Events and add all 11 events:

   User (5): user created, profile updated, deleted, activated, and deactivated.

   Team Chat (6): channel message posted, updated, and deleted; DM message posted, updated, and deleted.

5. Save the subscription.

The connector detects this subscription automatically. If you have more than one and need to pin a specific subscription, record its ID and set websocket-subscription-id.

Configure the Webhook Subscription

Channel and member events are delivered by webhook only — they are not available over websocket. Configuring webhooks is what keeps channel and membership changes current between backfills.

By default the connector creates and maintains this webhook subscription for you, with the correct events. To use it, copy the Secret Token from the Event Subscription page and provide it as the webhook secret listed in Required Configuration Values.

Auto-provisioning requires that your deployment’s public URL is configured, which your Deployment Engineer sets with the platform’s --http-base-url flag. Atolio derives the webhook callback URL from it. If that URL is not set, the connector logs a warning and continues with backfill for channels and members.

Zoom validates the endpoint before delivering events; the connector answers that challenge automatically.

Note: To manage the subscription yourself instead, set auto-provision-subscription to false and create a Webhook subscription in the Marketplace UI containing the 3 chat channel events (created, updated, deleted) and the 4 chat channel member events (invited, joined, removed, left).

Required Configuration Values

Enter these values in the Atolio Admin console (v4.24 and later), or send them to Atolio Support (your Deployment Engineer).

Without the webhook secret, the connector cannot verify webhook signatures and does not start the webhook receiver.

Keep secrets secure: Share values marked “Yes” in the Secret column only through a password-manager share (e.g. 1Password) or another secure channel agreed with Atolio Support. Never send them in plain email, chat, or support tickets.

Configuration Example

Add this block to connector-values.yaml. Replace each <PLACEHOLDER> with the matching value from the table above, and remove any line marked “Only if” that doesn’t apply.

connectors:
  zoom:
    default:
      zoom:
        connector: zoom
        instance: default
        source: zoom
        common:
          enabled: true
          identity-provider: false
        secrets:
          account_id:
            value: "<ACCOUNT_ID>"
          client_id:
            value: "<BACKFILL_CLIENT_ID>"
          client_secret:
            value: "<BACKFILL_CLIENT_SECRET>"
          general_admin_client_id:  # Only if using streaming
            value: "<STREAMING_CLIENT_ID>"
          general_admin_client_secret:  # Only if using streaming
            value: "<STREAMING_CLIENT_SECRET>"
          webhook_secret:  # Only if using channel and member streaming
            value: "<WEBHOOK_SECRET_TOKEN>"
        configuration:
          websocket-subscription-id: "<WEBSOCKET_SUBSCRIPTION_ID>"  # Only if you have more than one WebSocket subscription

The account ID and client IDs go under secrets: because the connector reads them from there, even though they are not secret.

Content Filtering

The Zoom connector supports filtering on the user and conversation resources.

Users are matched by email address, and conversations are matched by channel ID — not by channel name:

resources:
  user:
    excluded:
      - contractor@example.com
  conversation:
    excluded:
      - a1b2c3d4e5f6g7h8

Channel IDs are assigned by Zoom rather than chosen, so a channel’s display name will not match. If you are unsure of a channel’s ID, ask your Deployment Engineer to retrieve it.

Excluding a user also excludes that user’s direct messages and recordings. In the absence of both included and excluded, everything the app’s scopes grant access to is indexed.

Recording Visibility

By default, a recording’s transcript and summary are only visible in Atolio to the meeting host.

To widen this to everyone who attended the meeting, set share-recordings-with-participants to true. This also requires adding the meeting:read:list_past_participants:admin scope to the backfill app — the connector fails with an explicit error if the scope is missing.

Only meetings with a cloud recording are indexed.

Optional Settings

These settings are optional and have working defaults. Provide them to your Deployment Engineer only if you need to change the connector’s behavior.