# Endpoint.url\_validation Event Not Triggered

**URL:** <https://devforum.zoom.us/t/endpoint-url-validation-event-not-triggered/144502>\
**Category:** API and Webhooks\
**Created:** [June 29, 2026, 10:05am UTC](https://devforum.zoom.us/t/endpoint-url-validation-event-not-triggered/144502 "2026-06-29T10:05:18Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![demo\_zoom\_demosandbo](https://avatars.discourse-cdn.com/v4/letter/d/e495f1/32.png) [@demo\_zoom\_demosandbo](https://devforum.zoom.us/u/demo_zoom_demosandbo)\
**Post date:** [June 29, 2026, 10:05am UTC](https://devforum.zoom.us/t/endpoint-url-validation-event-not-triggered/144502/1 "2026-06-29T10:05:18Z")

</div>

Hi team,

In this [thread](https://devforum.zoom.us/t/server-to-server-oauth-webhook-endpoint-url-validation-event-not-triggered/131634/3), Zoom staff said ngrok is on a trusted-domain allowlist, so the endpoint.url\_validation (CRC) event is skipped for it.

I’m seeing similar behavior with other domains: validation passes for [https://webhooks.preview.workato.com](https://webhooks.preview.workato.com) and even [https://workato.com](https://workato.com) without my endpoint handling any CRC challenge.

Questions:

1. How is the trusted-domain allowlist determined, and can other platform domains be added to it?
2. If a domain is not on the allowlist, is receiving the endpoint.url\_validation event a reliable signal of that?
3. Does this differ between Server-to-Server OAuth and Webhook-only apps?

Thanks!