Zoom Integration

Connect your Zoom account so AI agents can look up meetings, recordings, transcripts, and registrants under scopes you choose.

Overview

The Zoom integration authorizes agent access to your organization's Zoom account through OAuth 2.0. Instead of granting every scope at once, you choose which capability packs to enable during setup - Core Read, Meeting Content, and Meeting Write - and only the scopes those packs need are requested from Zoom.

info

The Zoom integration is rolled out gradually. Until it is fully enabled for your environment, the connection page shows a Coming Soon state instead of a Connect button.

Use Cases

• Meeting Recaps - Agent reads past meeting metadata, transcripts, and recording summaries to draft a recap for attendees who missed a call
• Attendance and Engagement Review - Agent reads a past meeting's participant list, poll results, and Q&A to confirm attendance and follow up with the right people
• Registrant Management - Agent adds, approves, or removes meeting registrants on request, keeping attendee lists current without manual admin work

Capability Packs

Capabilities build on each other - enabling one automatically enables the packs it depends on, and turning one off turns off anything that depends on it.

Pack	Access	Depends On	Data Included
Core Read	Always on	-	Directory profiles, meeting metadata, registrant details
Meeting Content	Optional	Core Read	Cloud recording metadata, transcripts, summaries, participants, polls, Q&A
Meeting Write	Optional	Core Read	Create, update, cancel meetings; manage registrants

Core Read is required and cannot be turned off - every other pack builds on it.

Getting Started

Prerequisites

Before connecting Zoom:

1. Zoom Account Administrator - You must be able to authorize the OAuth app on your organization's Zoom account
2. Control Bridge Admin Access - You must hold the zoom:connections:write permission to run setup, or zoom:connections:read to view an existing connection
3. Applicable Zoom Licenses - The Meeting Content pack requires Cloud Recording and related Zoom features to be enabled on your account

Step 1: Navigate to Zoom Setup

1. Go to Capabilities > Connections > Zoom
2. If the integration is available in your environment, click Connect Zoom to start setup

Step 2: Walk Through the Setup Wizard

The setup wizard has five steps:

1. Overview - Introduces the integration and what it enables
2. Capabilities - Choose which capability packs to request. Cards show the exact scopes, license prerequisites, data categories, and read/write risk for each pack. An unavailable optional pack (for example, Meeting Content on an account without Cloud Recording enabled) does not block the rest of the connection
3. Permissions - Review a summary of every scope your selection will request before continuing to Zoom
4. Connect - You are redirected to Zoom to sign in and approve the request. The flow returns to the same browser tab or window it started in and restores your wizard progress, including after a popup is blocked and the browser falls back to a full-page redirect
5. Verify - Confirms which packs Zoom actually granted. A pack can show as granted even if a dependent pack was denied; the connection page reflects the real granted set, not just what was requested

Step 3: Assign Tools to Agents

1. Go to Workforce > Agents > Agents & SMEs
2. Edit the agent that should use Zoom
3. In the Tools section, enable the Zoom tools that match the capability packs you granted
4. Save the agent

Available Tools

Connecting Zoom and enabling capability packs makes up to 7 agent tools available for assignment. A tool is assignable only when every capability pack its actions need is enabled and every scope those actions require was actually granted by Zoom - enabling a pack in Control Bridge does not retroactively grant an already-connected tenant a scope it never authorized; reauthorize to pick up newly required scopes.

Tool (tool_id)	Capability Pack	Access	Data Sensitivity
zoom_users	Core Read	Read	Internal
zoom_meetings	Core Read	Read	Internal
zoom_meeting_registrants	Core Read	Read	Confidential PII
zoom_manage_meetings	Meeting Write	Write	Internal
zoom_meeting_content	Meeting Content	Read	Highly Confidential Communications
zoom_meeting_attendance	Meeting Content	Read	Confidential PII
zoom_manage_meeting_registrants	Meeting Write	Write	Confidential PII

Core Read tools

• zoom_users - Lists account users, or gets one user by ID, email, or "me". Returns profile metadata only, never a personal meeting ID or personal meeting URL. Zoom's presence-status lookup is not offered: it needs a scope Outermind does not request, so presence is not available through any Zoom tool today.
• zoom_meetings - Lists a host's meetings, gets one meeting by numeric ID, lists a recurring series' past occurrences, or gets one past occurrence by UUID. Never returns a start URL, passcode, or join link.
• zoom_meeting_registrants - Lists a meeting's registrants, or gets one registrant by ID. Registrant records are confidential PII: contact address, phone, employer and custom-question answers, and the token-bearing join link are withheld from every response and reported as withheldFieldGroups.

Meeting Write tools

• zoom_manage_meetings - Creates, updates, or cancels a meeting. Create always sends explicit values for every security-relevant setting rather than inheriting Zoom account defaults. Update uses patch semantics and reports exactly which fields changed. Cancel needs a confirmation token bound to the meeting's current state; see Write Confirmation below. Never returns a start URL, passcode, or join link.
• zoom_manage_meeting_registrants - Adds one registrant, adds a batch of up to 30, or approves, denies, cancels, or removes one existing registrant. Registering someone for a meeting is never a marketing opt-in and never implies consent to contact them elsewhere. cancel here cancels a registration, not the meeting itself, which is a distinct action from zoom_manage_meetings's own cancel.

Meeting content tools

• zoom_meeting_content - Lists a host's cloud recordings in a date window, gets one occurrence's recording file metadata, reads its transcript in time-coded chunks (up to 25,000 characters per call, with continuation), or reads its AI Companion summary (up to 20,000 characters per call, with truncation metadata). Three additional actions (stage_recording, stage_transcript, stage_summary) copy one explicitly named artifact into Outermind's own regional storage and return an opaque artifact ID that expires in 24 hours; staging never happens automatically as a side effect of a read. Never returns recording media bytes, a download URL, or a recording download token.
• zoom_meeting_attendance - Lists the participants of a past meeting, poll results, or Q&A. Attendee IP address, geographic location, network and device telemetry, and screen-sharing activity are withheld.

Write Confirmation and Safety Controls

Two of the 7 tools write to Zoom, and each layers its own confirmation control on top of the tool-assignment and authorization checks every tool call already passes through. Neither routes through the outbound Safety Gateway - both change Zoom account state rather than sending a message - so confirmation here is a state-fingerprint check, not a message review:

• zoom_manage_meetings - Only cancel requires confirmation. Previewing a cancellation mints a short-lived confirmation token, valid for 10 minutes, bound to the meeting's exact state at that moment. Confirming re-reads the meeting; if the topic, start time, host, or status changed since the token was issued, the token is refused as stale and no Zoom call is made. Create and update do not require this token, but every write still requires a written reason and an idempotency key.
• zoom_manage_meeting_registrants - Every write requires confirm: true, a written reason, and an idempotency key. Approve, deny, cancel, and remove additionally require the registrant's expected current status and email, checked against a fresh read immediately before the change; a mismatch refuses the write with no Zoom call made. remove is not verifiable after the fact: an absent registrant reads the same whether the removal landed or never ran, so an ambiguous failure surfaces as an unknown outcome rather than being silently retried.

Access Model: Four Layers of Control

Four separate controls decide whether an agent can actually call Zoom on your behalf, and they are independent of each other. Turning one off never turns off another.

Layer	Where it is controlled	What it governs
1. Zoom consent	Zoom's own OAuth consent screen, approved by a Zoom account administrator	Which granular Zoom scopes Outermind is permitted to request at all
2. Zoom license	Your organization's Zoom account entitlements	Whether Cloud Recording and related features needed by the Meeting Content pack are available on your Zoom account in the first place
3. Outermind capability enablement	Capabilities > Connections > Zoom, the capability pack toggles	Which capability packs are turned on for this tenant, and therefore which Zoom tools can be provisioned
4. Outermind authorization	The zoom:connections:read/zoom:connections:write permissions, and per-agent tool assignment under Workforce > Agents	Who can manage the connection, and which agents can actually call which tools

A few consequences worth being explicit about:

• Turning off a capability pack in Control Bridge removes the matching tools from every agent immediately, but it does not revoke the Zoom OAuth grant. The connection stays active at a narrower scope.
• Holding a Zoom Cloud Recording license does not, by itself, give any agent access. The pack must also be enabled in Control Bridge, the scope must be granted through Zoom consent, and a tool built on that pack must be assigned to the agent.
• Revoking the Zoom OAuth grant, by disconnecting or by an admin revoking the app on Zoom's side, is the only action that removes what Outermind is permitted to request. Disabling a capability pack or unassigning a tool from an agent narrows what is used, not what is authorized to be requested.
• Holding zoom:connections:write lets someone manage the connection and its capability packs; it does not by itself assign any tool to any agent. Tool assignment is a separate step under each agent's Tools section.

Data Handling

Data categories

Data	Classification	Default behavior
User directory and meeting metadata	Internal	On-demand read, bounded cache
Registrants, participants, poll answers, Q&A	Confidential PII	On-demand, elevated authorization, no broad export
Transcripts, AI summaries	Highly Confidential Communications	Off by default (Meeting Content pack), on-demand, output bounded
Audio/video recordings	Restricted media	Metadata only by default; server-side staging only on explicit request
OAuth tokens, host start URLs, passcodes, recording download tokens	Secret	Never exposed in a tool response or written to a log

Server-side staging and retention

zoom_meeting_content's three stage_* actions are the only way recording, transcript, or summary content is copied out of Zoom into Outermind's own storage, and it happens only when explicitly requested; it is never a side effect of a metadata read. When staging runs, Outermind verifies tenant, capability, tool authorization, Zoom scope, and resource ownership; fetches the content through the regional API service; virus-scans it and validates its type and size; writes it to a tenant-prefixed container in your tenant's assigned Outermind region, encrypted at rest; and returns an opaque Outermind artifact ID, never the Zoom URL.

Staged content is ephemeral by default and expires after 24 hours. An hourly housekeeping sweep deletes both the database record and the underlying stored file together once an artifact expires, so nothing is left orphaned in normal operation. Promoting staged content into Grounded Knowledge or another durable destination is a separate, explicit action, and once promoted, the content follows that destination's own retention, deletion, legal-hold, and access policies rather than the 24-hour default.

Regional residency

Zoom data is processed and staged in your tenant's assigned Outermind region. Content is not copied to another region as part of normal tool operation.

Disconnect and deletion

Disconnecting Zoom deletes the stored connection and its staged content in your tenant's region. Deleting your Outermind tenant removes everything staged under your tenant's storage prefix as part of the standard tenant-deletion process. Neither disconnect nor tenant deletion can act on content you already promoted into Grounded Knowledge or another durable destination outside this connection; that content follows its own destination's deletion policy.

Managing Your Connection

Go to Capabilities > Connections > Zoom to manage an existing connection.

Connection Details

The connection page shows:

Field	Description
Health	Per-capability health, checked against Zoom
Last Refresh	When the connection state was last reconciled
Granted vs. Required Scopes	Which scopes are actually granted compared to what each selected pack needs
Provisioned Tools	Which agent tools are currently available from this connection
Preview	A sample of recent users and meetings, so you can confirm the connection is returning real data

Health checks and reconciliation run on a bounded polling interval and act as a fallback for state that a webhook has not yet updated. Turning off an Outermind capability or tool assignment never revokes the underlying Zoom grant - that only happens when you reauthorize with a narrower selection or disconnect.

Reauthorize

If a scope shows as missing, or you want to add or remove a capability pack, click Reauthorize. This runs the same Connect/Verify steps as initial setup with your updated selection.

Preview

The Preview section shows a short list of recent users and meetings pulled through the connection, so you can confirm data is flowing before assigning tools to agents.

Integration Logs

The connection page includes a log viewer showing recent tool executions and reconciliation activity for troubleshooting.

Disconnect

To disconnect Zoom:

1. Click Disconnect Zoom
2. Confirm by entering the requested account identifier in the dialog

warning

Disconnecting removes every Zoom tool from your agents and deletes the stored Zoom connection. Agents will no longer be able to access Zoom data. You can reconnect at any time.

Security & Limitations

Security

• OAuth 2.0 authorization - No Zoom credentials stored in Outermind
• Encrypted token storage - Tokens encrypted at rest
• Capability-scoped consent - Only the scopes needed for the packs you choose are requested
• Tenant isolation - Each tenant's Zoom connection and tools are scoped to that tenant only
• Audit logging - Every tool execution is logged with the agent, parameters, and results

Limitations

• Single account - Only one Zoom account per Control Bridge tenant
• License-gated packs - The Meeting Content pack requires Cloud Recording and related Zoom features to be enabled; without it, that pack shows as unavailable rather than failing the whole connection
• Coming Soon in some environments - The connection page shows a Coming Soon state until the integration is fully enabled for your environment

Troubleshooting

OAuth Connection Fails

Problem: Authorization fails or the browser tab does not complete the callback

Solutions:

1. Ensure you are signed in to Zoom as an account administrator before clicking Connect
2. Verify your browser allows popups for the Control Bridge domain, or complete the full-page redirect if a popup was blocked
3. Try a different browser or incognito window if the issue persists

A Capability Pack Shows Unavailable

Problem: An optional pack (for example, Meeting Content) will not activate

Solutions:

1. Confirm the required Zoom license or feature (Cloud Recording) is enabled on your Zoom account
2. Reauthorize after enabling the license or feature on Zoom's side
3. Other selected packs remain connected even while one pack is unavailable

Agent Cannot Find Zoom Tools

Problem: Zoom tools do not appear when editing an agent

Solutions:

1. Verify the connection is active at Capabilities > Connections > Zoom
2. Confirm the granted scopes cover the capability pack the tool needs
3. Refresh the page

Granted Scopes Do Not Match What Was Requested

Problem: The Verify step or connection page shows fewer granted scopes than requested

Solutions:

1. Check the connection page's granted-versus-required comparison to see which packs are affected
2. Click Reauthorize to request the missing scopes again
3. Confirm the account used to authorize has admin rights for those scopes on Zoom's side

Webhook Events Are Not Arriving

Problem: Recent Zoom activity (a new recording, a meeting registration) does not show up promptly on the connection page or in agent tool results

Solutions:

1. This is usually not data loss. Zoom webhook delivery is best-effort, and an hourly reconciliation sweep independently re-checks every connection and repairs any event that was verified but never fully processed, so state converges even if a webhook was missed or delayed
2. Check Last Refresh on the connection page; if it is within the last hour, the reconciliation sweep is working as designed
3. If staleness persists well beyond an hour, click Reauthorize to confirm the connection is still valid, then contact support if the gap continues

Zoom API Rate Limit Reached

Problem: Tool calls fail or slow down with a rate-limit error during a burst of Zoom activity

Solutions:

1. Outermind automatically retries a rate-limited call using Zoom's own guidance on how long to wait; most bursts resolve without any action
2. If rate limiting is sustained rather than a brief spike, avoid running multiple agents against the same Zoom account at once, and space out bulk operations (for example, large registrant batches)
3. Rate limits are enforced by Zoom per account, not per Outermind tenant, so a busy Zoom account can be the underlying cause even when Outermind activity looks light

A Tool Is Assigned But Returns No Data

Problem: An agent has a Zoom tool assigned, but every call to it fails or returns an authorization error

Solutions:

1. Confirm the tool's capability pack is still enabled at Capabilities > Connections > Zoom; disabling a pack removes the tools built on it from every agent immediately, even if the tool assignment on the agent still shows as enabled
2. Confirm the pack's scopes are actually granted (the connection page's granted-versus-required comparison); a pack can show as enabled in Control Bridge while its scopes were never approved on Zoom's side, most often after a partial reauthorization
3. Confirm the agent's own authorization tier permits the tool; some Zoom tools (registrants, transcripts, meeting content, attendance, and every write) require a higher-trust agent than basic directory and meeting metadata reads

Reauthorizing After Adding a Zoom License

Problem: The Meeting Content pack was unavailable at initial setup because Cloud Recording was not yet active on the Zoom account, and it has since been enabled

Solutions:

1. Confirm Cloud Recording is now active on the Zoom account used to authorize the connection
2. Click Reauthorize and select the newly available capability pack; this requests the additional scopes without disturbing packs that are already connected
3. After the callback completes, confirm the pack shows as granted on the connection page, then assign the matching tools to the agents that need them

Related Topics

• Tools Overview - All available agent tools
• Agents - Configure agents to use tools
• Agent Executions - View tool execution logs
• Xero Accounting Integration - Similar OAuth-based integration with a permission-gated wizard