We have an existing scheduled process (.net) that uploads user profile pictures using the POST /users/{userId}/picture API. Recently, the process began failing with a 403 (Forbidden) response.
The production process is a JWT app and recently deprecated. I requested the one-time extension of 1 month. Upon doing so, the other API calls started working again. Upon reviewing logs, I’ve noticed that this 403 error has been occurring, in production, for many months for the upload picture process.
I have created OAuth server-to-server apps in the marketplace to upgrade our existing processes. However, when running the upgraded process (from code), which is using OAuth server-to-server, I am getting the same response from Zoom, which is 403 (Forbidden) for the upload picture API call only.
The OAuth server-to-server account being used for this application does have the “user:write:admin” scope assigned. The documentation mentions that “user:write” is needed too, but that option isn’t made available as a scope. But, again, this is failing the same way with the JWT app.
The other API calls are working, both in the (extended) JWT and rewritten OAuth server-to-server versions.
Also, I’ve noticed that both the old (extended JWT) and new (OAuth server-to-server) apps are NOT logging these 403s in the Call Logs in the App Marketplace.
Both the old and new processes are using the following URL to upload pictures:
“https://api.zoom.us/v2/users/{user id}/picture”
