Api user management


#1

My team have recently implemented your api to our LMS platform, using oauth as authorization process.

We are using limited amount of endpoints since our workflow is very basic: 
Create meeting/webinar, 
Fetch meetings/webinars. 
Assign registrants for meetings/webinars, 
Run reports for fetching attendees for meetings/webinars.

Because of the scopes need to run the reports we had to use account level marketplace app (this is important for the issue that i’m trying to explain)

Now when you try to integrate the zoom account over oauth we are redirect our users to your service where they’re of course required to login, after that every user (that has access to do so) in our app will be able to create meetings, fetch webinars, etc. 
But the issue there is that every action done, will be shown in zoom account of the person who connected zoom at the first place. 
For example if person X do the integration, and then person Y created a webinar from our app using API that webinar will be created for person X in the zoom and only person X will be able to start it.

I know that all i have to do is send user_id of the user Y in the api endpoint for creating webinar and that solves my problem, but running the reports for a specific webinar/meeting is the main functionality of this integration in my app, and your endpoint for running the report for single webinar (report/webinars/#{webinar_id}/participants) doesn’t have user_id which blocks whole logic on my side.

If i send the request on that endpoint and webinar_id is the id of the webinar who’s owner is not the user who integrated the zoom service at the first place, i’ll get not authorized error message.

To make sure i’m not trying to do something impossible, i went to my zoom account to make sure i can run the reports for webinars that belongs to other users in my account, and i could without any issues run every single report since i am and admin user.

My question is why i can’t do that over api? Am i doing something wrong or was that feature just never implemented? I mean, i’m using account level app, which has all the the admin scopes and it looks like it’s meant to be used just like i described above, to have option to do everything for your users just by passing their user_id in the url, which you can, but just not for the reports, which is nuts.

This issue is kinda blocking my feature development, since my clients will be forced to do Zoom integration for every single user, instead of having to do that once and then from my app just choose which user to use, after all that should be the hole point of account level app.

I hope that i’ve explained this clear enough, i’ve tried to be as much detailed as possible, but if you need some additional information that will help you solve this issue for me, i’ll be happy to provide it.


#2

Hi Vladimir, 

The way OAuth is designed is after creating an app and person X does the integration, when person Y gets access using OAuth and makes the API calls, they will only have access to the data. 

Thanks