# Able to vary the scope

**URL:** <https://devforum.zoom.us/t/able-to-vary-the-scope/41334>\
**Category:** API and Webhooks\
**Created:** [January 23, 2021, 6:01am UTC](https://devforum.zoom.us/t/able-to-vary-the-scope/41334 "2021-01-23T06:01:19Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![chrismurrph](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/chrismurrph/32/21804_2.png) [@chrismurrph](https://devforum.zoom.us/u/chrismurrph)\
**Post date:** [January 23, 2021, 6:01am UTC](https://devforum.zoom.us/t/able-to-vary-the-scope/41334/1 "2021-01-23T06:01:19Z")

</div>

**Description**  
I have a development installed application and want to publish it without any API scopes, because what I really want is to have event subscriptions for participant/host joining/leaving the event. Can I publish it that way, then later on add in the scopes? Just want to do some basic testing before we write a formal specification. Obviously this means the review process will have to happen twice. Would this be acceptable?

**Which App Type (OAuth / Chatbot / JWT / Webhook)?**  
OAuth, Webhook

---

<div class="post-metadata">

**Author:** ![chrismurrph](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/chrismurrph/32/21804_2.png) [@chrismurrph](https://devforum.zoom.us/u/chrismurrph)\
**Post date:** [January 25, 2021, 4:06pm UTC](https://devforum.zoom.us/t/able-to-vary-the-scope/41334/2 "2021-01-25T16:06:49Z")

</div>

I’ve been reading this forum and it does seem that making changes to the installed application then requesting a review and getting the installed application re-published is fine.

But now to my implicit question. Is it fine to have an published OAuth installed application that has no scopes, is just there for the Webhooks? We will be using the Zoom API at a later stage of development so will be requesting another review. But at the first stage of development our code at the redirect\_url will not need to do anything.

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [January 26, 2021, 5:23pm UTC](https://devforum.zoom.us/t/able-to-vary-the-scope/41334/3 "2021-01-26T17:23:58Z")

</div>

Hey @chrismurrph ,

> [@chrismurrph](#):
>
> But now to my implicit question. Is it fine to have an published OAuth installed application that has no scopes, is just there for the Webhooks?

Even if you just have webhooks enabled on your app, they still require a scope. For example, the Participant Joined Meeting webhook requires the scope `meeting:read` scope. It will be automatically added upon selection of the event subscription.

 ![Screen Shot 2021-01-26 at 10.22.38 AM](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/b/6/b6a532ea76ffd6333ddbeb627a7eddb3e7f786d1.jpeg) ![Screen Shot 2021-01-26 at 10.22.42 AM](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/1/2/12afcc74b908843c97c924cd5cd4a47f460cd512.jpeg)

For beta testing your app outside of your Zoom account, [please read this](https://marketplace.zoom.us/docs/guides/publishing/sharing-private-apps).

Thanks,  
Tommy

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\
**Post date:** [February 26, 2021, 3:24am UTC](https://devforum.zoom.us/t/able-to-vary-the-scope/41334/4 "2021-02-26T03:24:56Z")

</div>

Closed on February 26, 2021, 3:24am UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.