---
name: "Zoom"
description: Manage Zoom meetings, recordings, participants, and webinars through the Zoom API.
version: 1
situations: zoom, meetings, recordings, webinars, calls
requires-secrets: ZOOM_ACCOUNT_ID, ZOOM_CLIENT_ID, ZOOM_CLIENT_SECRET
requires-packages:
requires-connector: zoom
---

# Zoom

Zoom has no official CLI. This skill uses its REST API with `curl` from your **bash** tool, against a
Server-to-Server OAuth app the operator created. Three values reach your shell:
`$ZOOM_ACCOUNT_ID`, `$ZOOM_CLIENT_ID`, `$ZOOM_CLIENT_SECRET`. Never print any of them.

## Get a token first (it lasts one hour)

```
TOKEN=$(curl -s -X POST "https://zoom.us/oauth/token?grant_type=account_credentials&account_id=$ZOOM_ACCOUNT_ID" \
  -u "$ZOOM_CLIENT_ID:$ZOOM_CLIENT_SECRET" | python3 -c 'import sys,json;print(json.load(sys.stdin)["access_token"])')
```

Keep `$TOKEN` in the shell for the rest of the command chain; don't write it to a file. If this step
returns `invalid_client`, the credentials or the app's scopes are wrong — that's a fix in the Zoom
Marketplace, not something to retry.

## Read

```
curl -s -H "Authorization: Bearer $TOKEN" "https://api.zoom.us/v2/users/me/meetings?type=upcoming"
curl -s -H "Authorization: Bearer $TOKEN" "https://api.zoom.us/v2/meetings/MEETING_ID"
curl -s -H "Authorization: Bearer $TOKEN" "https://api.zoom.us/v2/past_meetings/MEETING_UUID/participants"
curl -s -H "Authorization: Bearer $TOKEN" "https://api.zoom.us/v2/users/me/recordings?from=2026-08-01&to=2026-08-14"
```

Meeting **id** (numeric) and meeting **UUID** are different keys for different endpoints; past-meeting
endpoints want the UUID, and a UUID containing `/` or `//` must be double-URL-encoded.

## Write

```
curl -s -X POST -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  https://api.zoom.us/v2/users/me/meetings \
  -d '{"topic":"…","type":2,"start_time":"2026-08-20T15:00:00Z","duration":30,"timezone":"UTC"}'
```

Scheduling a meeting creates something other people will be invited to. Show the topic, time, and
duration first.

## Recordings

Recording download URLs need the same bearer token. Recordings are often confidential — download only
what the operator asked for, into the workspace, and never re-share a link outside this conversation.

## Never without being asked in this turn

Deleting meetings or recordings, ending a live meeting, changing account or user settings, and
creating webinars.