# How do we restrict API Scope access to our developers **URL:** \ **Category:** API and Webhooks\ **Created:** [March 26, 2025, 6:25pm UTC](https://devforum.zoom.us/t/how-do-we-restrict-api-scope-access-to-our-developers/130568 "2025-03-26T18:25:24Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Erics1](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/erics1/32/68193_2.png) [@Erics1](https://devforum.zoom.us/u/Erics1)\ **Post date:** [March 26, 2025, 6:25pm UTC](https://devforum.zoom.us/t/how-do-we-restrict-api-scope-access-to-our-developers/130568/1 "2025-03-26T18:25:24Z")
How do we restrict API scope access to our developers. In Zoom role access, we created a Developer role, but we want to restrict the API scope that they have access to by selecting only the scopes they need for the custom app they are developing. ---
**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\ **Post date:** [April 4, 2025, 2:14pm UTC](https://devforum.zoom.us/t/how-do-we-restrict-api-scope-access-to-our-developers/130568/2 "2025-04-04T14:14:02Z")
Hi @Erics1 Thanks for reaching out to us and welcome to our Developer Forum ! Were you able to figure out this issue? Basically you would give you developers just the permissions that they need, by going into the Roles settings and just enabling settings that they would need for developing integrations. ---
**Author:** ![Erics1](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/erics1/32/68193_2.png) [@Erics1](https://devforum.zoom.us/u/Erics1)\ **Post date:** [April 24, 2025, 2:46pm UTC](https://devforum.zoom.us/t/how-do-we-restrict-api-scope-access-to-our-developers/130568/3 "2025-04-24T14:46:31Z")
Hi Elisa, So as an example, a developer can create a server-to-server app, and they can add all the admin scopes they want, but they won’t be able to use them unless they are also assigned those permissions settings through the Role settings? ---
**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\ **Post date:** [April 24, 2025, 2:54pm UTC](https://devforum.zoom.us/t/how-do-we-restrict-api-scope-access-to-our-developers/130568/4 "2025-04-24T14:54:16Z")
Thats correct @Erics1 ---
**Author:** ![Erics1](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/erics1/32/68193_2.png) [@Erics1](https://devforum.zoom.us/u/Erics1)\ **Post date:** [April 24, 2025, 10:29pm UTC](https://devforum.zoom.us/t/how-do-we-restrict-api-scope-access-to-our-developers/130568/5 "2025-04-24T22:29:27Z")
Thanks. Is there any future enhancements where this can be further restricted by only certain scopes permission is provided. Also if it’s an admin scope, to restrict being able to access to only these users or group of users? (example, create meetings on behalf of this person or group of users?) ---
**Author:** ![elisa.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/elisa.zoom/32/47836_2.png) [@elisa.zoom](https://devforum.zoom.us/u/elisa.zoom)\ **Post date:** [April 28, 2025, 2:22pm UTC](https://devforum.zoom.us/t/how-do-we-restrict-api-scope-access-to-our-developers/130568/6 "2025-04-28T14:22:31Z")
Hey Eric, You can actually restrict a lot of persmissions in the Webportal, you can make it very granular . With admin scopes you can restrict access to groups and probably individuals too but you would have to manage the individual as a group. ---
**Author:** ![MultiplayerSession](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/multiplayersession/32/66446_2.png) [@MultiplayerSession](https://devforum.zoom.us/u/MultiplayerSession)\ **Post date:** [April 28, 2025, 3:46pm UTC](https://devforum.zoom.us/t/how-do-we-restrict-api-scope-access-to-our-developers/130568/7 "2025-04-28T15:46:18Z")
If you’re trying to limit which users can be affected, that’s also controlled by who authorized and installed the application. [User OAuth applications get consent from the authorizing user](https://developers.zoom.us/docs/integrations/end-user-auth/), so the application can manipulate that user’s data. OAuth admin scopes can be limited to a custom audience by [setting their role’s scope](https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0064983#h_bbc87f8b-3ec1-417b-933f-612b63cbfc47). The application is essentially impersonating the user that authorized the application, and inherits a subset of their privileges based on declared OAuth scopes. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\ **Post date:** [May 2, 2026, 7:23am UTC](https://devforum.zoom.us/t/how-do-we-restrict-api-scope-access-to-our-developers/130568/8 "2026-05-02T07:23:15Z")
Closed on May 2, 2026, 7:23am UTC This topic was automatically closed 368 days after the last reply. New replies are no longer allowed.