Webhook event notification validation - development

We have set up our webhooks as instructed, with both a development (ngrok) and a production Event notification endpoint URL.

We’ve successfully validated our production endpoint, and are ready to receive revalidation requests to the production endpoint every 72 hours.

Having to also validate the development endpoint was unexpected. It appears to be mandatory as I couldn’t save my settings if I removed the development endpoint url, and I can’t submit the app without this being validated.

Can you please confirm that:

  • validation for the development url is a 1 time operation, when I click the validate button i.e. it won’t be periodically revalidated. Our local servers will not be always online (unlike production). If periodic revalidation attempts are made, they will almost always fail.

  • If development endpoints are sent revalidation requests, what happens if they fail?
    We want to confirm that validation failures to the development endpoint will not affect webhook events that are sent to the production endpoint. Eg if my development endpoint gets turned off due to validation failure and no longer receives webhook events, the production endpoint will continue to receive webhook events.

Hi @partners
Thanks for reaching out to us and I am sorry I missed this post!
I am happy to hear that you were able to implement the Endpoint validation URL!
I do not think that if the development endpoint revalidation fails, your production endpoint will be affected, it should still receive the events because they work separately.

I understand that you can not have your local servers online all the time and they most likely will remain offline (unless you turn your servers on).

Let me reach out to internal stakeholders to confirm that the information I am giving you is accurate and will come back to you with an update soon.

Cheers,
Elisa

An additional data point:

We recently got the following email for each of our apps:

Hi (Name Redacted),

Some of your app events have issues, check information below for details.

(App Name Redacted)

Meeting changes and participant changes

Notification URL [Devleopement]

(Notification URL Redacted (also ngrok.io))

Fail to respond for revalidation - 2nd time

If your app events fail to respond for revalidation for 1 more time, we will temporarily disable the event subscription in your app until you fix the issue.

What to do next?

  • Review your app logs
  • Find the code or systems that cause the issues based on the documented webhook parameters
  • Revalidate endpoint URLs and submit your app for update request review

It’s possible this was sent in error, or it’s possible that the “we will temporarily disable the event subscription” language was only referring to the development endpoint, but the email didn’t inspire confidence, and I’m glad we’re not the only people wondering about this.

Thanks for looking into this @elisa.zoom!

Yours,
Dave

Hi @davidbalbert
I think this could be the case that the language is only for the development endpoint, especially if you are still getting your events on production.

I am investigating this further but I wanna say that if the revalidation of your development url fails, it should not have an impact on your production endpoint

Hope this helps,
Elisa

Thanks @elisa.zoom! Much appreciated. Looking forward to hearing what you find out.

Based on Zoom’s documentation, webhook validation for both the development and production endpoint URLs is a one-time operation. Once the endpoints are validated, they should continue to work as expected without periodic revalidation attempts.

However, it’s important to note that if a revalidation request is sent to an endpoint and it fails, Zoom will assume that the endpoint is no longer functional and stop sending webhook events to that endpoint. This means that if a revalidation request to the development endpoint fails, Zoom will stop sending webhook events to that endpoint, even if the production endpoint is still functional.

To avoid any interruption in webhook events being sent to your production endpoint, it’s important to ensure that your development endpoint is always functional and able to pass revalidation requests. If your local servers are not always online, you may need to consider setting up a cloud-based development endpoint that is always available to receive revalidation requests.

Hi @anawilliam850
If the validation fails for the development endpoint, this will not affect webhook events that are sent to the production endpoint.