Zoom Webhook v2 Migration Guide: What Enterprise Teams Need to Know

Zoom deprecated its original callback-based notification system and replaced it with Webhook v2 — a structured, validated event delivery system that is significantly more reliable and secure. For enterprise teams that built Zoom integrations on top of the old system, the migration is not optional: Zoom's legacy notification URLs stopped receiving events for many event types.

This guide covers what changed, what broke, and how to migrate.

What Changed in Zoom Webhook v2

1. Endpoint Validation v2 requires your webhook endpoint to respond to a validation challenge before Zoom will send events to it. When you register a webhook endpoint in the Zoom developer dashboard, Zoom sends a endpoint.url_validation event. Your server must return a proper HMAC-SHA256 response within 3 seconds or the webhook is rejected.

{
  "event": "endpoint.url_validation",
  "payload": {
    "plainToken": "vrIBSD74Y7qMJe7nBrBVmg"
  }
}

Your server responds:

{
  "plainToken": "vrIBSD74Y7qMJe7nBrBVmg",
  "encryptedToken": "<HMAC-SHA256(secret, plainToken)>"
}

2. HMAC Signature Verification Every v2 event is signed with your webhook secret token. You must verify the x-zm-signature header on every incoming request. Failing to verify = a security vulnerability.

x-zm-signature: v0=<HMAC-SHA256(secret, "v0:" + timestamp + ":" + body)>
x-zm-request-timestamp: 1698765432

3. Event Payload Structure Some event payloads changed shape. The most common breaking change is in recording.completed — the recording_files array structure has additional fields and the download token handling changed.

4. New Event Types v2 introduced new event types unavailable in v1:

• meeting.started (real-time, not just scheduled)
• recording.transcript_completed (AI Companion transcript ready)
• meeting.participant_joined / meeting.participant_left

What This Means for Teams + Zoom Integrations

Most Zapier-based Zoom integrations used Zapier's polling mechanism to check for new recordings — they were never true webhooks. These continue working (slowly) but cannot access v2-only events like recording.transcript_completed.

If you built a custom integration, you need to:

1. Register a new webhook endpoint that passes the validation challenge.
2. Implement HMAC signature verification on every request.
3. Update your event payload parsing for changed structures.
4. Subscribe to new event types if your workflow uses them.

How SyncRivo Handles Zoom Webhook v2 Natively

SyncRivo's Zoom connector was built against the v2 API from the ground up:

• Automatic endpoint validation: When you connect your Zoom account in SyncRivo, the validation handshake is handled automatically.
• HMAC verification on every event: Every inbound Zoom event is cryptographically verified before being processed.
• Real-time event processing: Events are processed as they arrive — no polling.
• Chat message events: SyncRivo processes Zoom Team Chat message, reply, edit, and delete events so bridged conversations stay in sync with Microsoft Teams. It bridges chat only; it does not route meeting or recording events.

This is why moving cross-platform chat from polling to webhooks matters: instead of waiting on 15-minute polling cycles, messages typically arrive within seconds.

Explore the full Microsoft Teams and Zoom integration to see how SyncRivo bridges Zoom Team Chat and Microsoft Teams.