Does a Draft (Development) user-managed app receive webhook events at all?

API and Webhooks Zoom Events
,
1

We have a user-managed OAuth app in Draft status (Activation state --, Zoom product: Phone). It does not receive any webhook events at all, and we would like to know whether that is expected for an app that has not been activated.

Setup:

  • Event Subscription configured in the Development environment, using the Development Client ID, so the OAuth authorization and the subscription are in the same environment.
  • Endpoint is public HTTPS with a valid CA certificate, TLS 1.2+, accepts POST with JSON, and responds well within 3 seconds.
  • There is no Validate button for this endpoint, which we understand is expected for a development endpoint.

We progressively widened the subscription to rule out event-specific causes. All of these saved successfully, and none were ever delivered:

  • phone.recording_completed_for_access_member and phone.recording_transcript_completed — outbound calls with recordings.

  • phone.caller_ringing, phone.caller_connected, phone.caller_ended, phone.caller_call_log_completed — several outbound calls.

  • phone.recording_started, phone.recording_stopped, phone.recording_completed, phone.recording_failed — same calls. The recordings were created and are visible in the portal.

  • user.updated and user.settings_updated — changed the profile at zoom.us/profile.

The last one matters most: user.updated only needs user:read:user, which is granted, and it has nothing to do with Phone. It was not delivered either.

The decisive observation is that our app’s webhook logs in the Marketplace are completely empty, with zero entries for all dates. The legacy webhook logs are empty too. The API call logs do contain entries, so the logging surface itself works. From Zoom’s side, no delivery has ever been attempted for this app.

What we have ruled out:

  • The endpoint is reachable. Unsigned POST requests from the public internet return our own 401 and appear in our application logs. We ran such a probe immediately before and after every test window, so each negative result is backed by a demonstrated ability to detect an arrival.

  • Nothing arrives at all, accepted or rejected, across all instances in centralized logging.

  • Re-authorizing did not help. The original authorization predated the subscription by a month, so we re-authorized today and tested again.

  • The authorizing user is in the same account as the app, is a licensed Zoom Phone user, and can see the recordings.

Questions:

  1. Does an app in Draft Development status with Activation state -- receive webhook events at all? We could not find documentation stating either way.

  2. If it does, what makes an app eligible for delivery? Is there an install, activation, or local-test registration step beyond configuring the Event Subscription that we have missed?

  3. Is there any way to see from Zoom’s side why no event is generated or routed to this app? Empty webhook logs give us nothing to work with.

Happy to share the account number, client ID, call IDs and endpoint FQDN privately if that helps.