# Data Compliance API - Deauthorization Endpoint URL

**URL:** <https://devforum.zoom.us/t/data-compliance-api-deauthorization-endpoint-url/3870>\
**Category:** API and Webhooks\
**Created:** [April 5, 2019, 5:17pm UTC](https://devforum.zoom.us/t/data-compliance-api-deauthorization-endpoint-url/3870 "2019-04-05T17:17:11Z")\
**Posts on this page:** 1\
**Showing post:** 15

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [September 16, 2019, 8:50pm UTC](https://devforum.zoom.us/t/data-compliance-api-deauthorization-endpoint-url/3870/15 "2019-09-16T20:50:12Z")

</div>

Hey @john!

You are correct, you will only receive the Deauthorization Event Notification Webhook with the Production version of your app. You can test this by installing the production version of your app via your apps publishable URL,

![54%20PM](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/2X/e/e8fb332fb667a2fa25aea412ebcb6e0a16a87b00.png)

And then [uninstalling your app on your “Installed Apps” page.](https://marketplace.zoom.us/user/installed)

 ![21%20PM](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/2X/f/f35619fd8c7545393bd20b61fd974db29f919867.png)

* * *

I made a simple PHP web server and was able to see the `Verification Token` in the request headers (when testing a Zoom event/webhook sent to my server). Here is my code:

Example 1.

```php
<?php

error_log(print_r($_SERVER, true))

?>

```

![41%20PM](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/2X/b/beaf910c28cb7695f4006ff0b30c8c728be03531.png)

Example 2.

```php
<?php

error_log(print_r(getallheaders(), true))

?>

```

 ![48%20PM](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/2X/1/1bf0a70290f9c39752b886851443e91644f876b2.png)

> [@john](#):
>
> Nevertheless, I figure requiring a match on the client\_id HTTP header (which is present as expected), plus all the other values that have to line up, enables my code to be pretty darn sure that the request originated from Zoom!

[Just FYI your client\_id is publicly available via the install url.](https://marketplace.zoom.us/docs/guides/authorization/oauth/oauth-with-zoom#authorization-code) So I would use the Verification Token to verify the requests are coming from Zoom as the Verification Token is not publicly available.

Example:  
`https://zoom.us/oauth/authorize?response_type=code&client_id={YOUR_CLIENT_ID}&redirect_uri={https://YOUR_REDIRECT_URI}`

> [@john](#):
>
> To the other issue, that Node.js example you gave me was super helpful: I see now that sending the `'Content-Type: application/json'` header and sending the payload as JSON encoded is the key. (I had been doing form-based postings of the payload, which was wrong and presumably the cause of the “Internal Error” message.)

Happy to hear you figured it out 🙂

Let me know if you have any other questions!

Thanks,  
Tommy

---

_[View the full topic](https://devforum.zoom.us/t/data-compliance-api-deauthorization-endpoint-url/3870)._