Server-to-Server app receiving 403 "You do not have permission" on outbound_caller_id/customized_numbers endpoints since mid-August — same operation works in web portal

API and Webhooks
1

API Endpoint(s)

GET/POST/DELETE /v2/phone/users/{userId}/outbound_caller_id/customized_numbers (also the site-level variant)

Description

These endpoints worked for months, then started returning 403 for our account around Aug 15 with no changes on our side. All verbs, all users, all sites.

  • App holds the granular scopes (phone:read/write/delete:user_customized_number:admin)
  • A brand-new S2S app with all grantable Phone scopes fails identically on its first request
  • The same operation works in the web admin portal, and select_outbound_caller_id is enabled
  • All other Phone endpoints return 200 with the same token

Error?

403 {"code":403,"message":"You do not have permission."}

Note: it’s a bare 403 — not the usual “does not contain scopes:[…]” error, so it isn’t a missing declared scope.

Tracking IDs (Aug 17 ~01:56 UTC): GET WEB_d465aa84789b10f25b29a7334008092c, POST WEB_c0a18ca403b9cf514c0c7a3db55a2f35

How To Reproduce

  1. GET https://api.zoom.us/v2/phone/users/{userId}/outbound_caller_id/customized_numbers with Authorization: Bearer {token}
  2. Server-to-Server OAuth (account_credentials), scopes as above
  3. 403 on every call since ~Aug 15; 200 up to Aug 14

What changed in authorization for these endpoints, and how do we restore access? Account details available via DM.