Endpoint.url_validation webhook spontaneously failing with no changes

endpoint.url_validation is a webhook event type sent to production Zoom apps to validate that the URL is owned by the person maintaining the app.

Description
I got an email today that said that we’ve been failing the url_validation for the past few days. We have not made any changes on our end, so this is quite confusing.

Here’s the code that is constructing the response:

          const { plainToken } = parsedEvent.payload
          const encryptedToken = hashZoomString(
            plainToken,
            ZOOM_ADMIN_EVENT_SECRET_TOKEN,
          )
          ctx.body = { plainToken, encryptedToken }
          ctx.status = 200
export function hashZoomString(text: string, secretToken: string): string {
  return crypto.createHmac("sha256", secretToken).update(text).digest("hex")
}

Here’s what I’ve tried:

  • confirmed that token is correct
  • reconstructed a request and sent it to the production server. I got back the expected response.
  • created a new zoom app, pointed it to my local dev environment (using the new app’s secret token), and did the URL validation. The code is exactly the same as what is running in production. The validation succeeded with no issues.

Something odd that I noticed:

  • we have logs of when we receive the endpoint.url_validation messages. According to the documentation, Zoom revalidates every 72 hours. However, in checking the logs, I only see validation requests today and 3 days ago. There are no validation requests prior to that. The production app has been approved for several months, so this is somewhat confusing. It seems like Zoom wasn’t sending these validation requests for some time, and then spontaneously started and they’re failing.

Is there any way to get some more information on what is being received by Zoom so we can troubleshoot this?

Hi @kyle3
thanks for reaching out to us and welcome to the Zoom Developer Community!
When you get these emails, do you stop receiving events or are you just getting these notifications but your app keeps getting all the events?

We have an endpoint that you could use to check webhook logs from your app from the past 7 days

I am also happy to look closer into this issue

Hi @Elisa! Appreciate your response!

We’re getting the notification emails but our app is still getting all the events. I can see that we’re getting them from our logs.

I’ve added additional logging to log out the response we’re sending, but I haven’t received another event since then (I think they come every 3 days).

Thank you for that link, I was not aware of this endpoint. I will dig into those and see if they provide any insight.

Thanks @kyle3
Please let me know if you find anything that you’d like me to look into