Setting Up Zoom Archiving

Zoom covers the surfaces compliance teams care about: Team Chat (channels, DMs, edits, deletes, files), Zoom Phone (call recordings, voicemail with transcript, SMS/MMS), and meetings (cloud recordings and transcripts). Comma captures all of them from a single Zoom connection.

Today Comma connects using a Server-to-Server (S2S) OAuth app that your Zoom admin creates in the Zoom Marketplace. This is a self-service setup you can complete yourself: you create a small credentials-only app in Zoom, paste four values into Comma, and register a webhook URL that Comma generates for you. A one-click marketplace install is coming soon.

This guide walks through both sides in order - the Zoom console first, then Comma.

How Zoom capture works

• Team Chat - channels, group chats, DMs, edits, deletes, and file shares
• Zoom Phone - call recordings, voicemail with transcript, and SMS/MMS
• Meetings - cloud recordings and transcripts
• Capture is webhook-primary (Zoom pushes events to Comma in near-real time) with polling reconciliation as a safety net, so nothing is lost if a webhook is ever dropped
• Each surface is enabled independently - turn on only the ones you need to archive

Prerequisites

• Zoom account admin or owner - required to create a Server-to-Server OAuth app in the Zoom Marketplace and to grant admin-level scopes
• Comma team admin access
• The Zoom authorizing role must hold the “Edit” permission for Chat Messages - admin chat reads depend on it
• Per-surface licensing on your Zoom account:
  • Cloud recording enabled for meetings and for Zoom Phone
  • A Zoom Phone seat with an SMS-capable number for phone and SMS/MMS capture
  • Call-recording transcription enabled in Zoom Phone settings if you want call-transcript archiving - this is admin-disabled by default, so an admin must turn it on
• About 15 minutes

For the exact account-level toggles behind these licensing requirements, see Required Zoom Admin Settings - enable those first, then come back here to connect.

Step 1 - Create the Server-to-Server OAuth app in Zoom

In the Zoom Marketplace, go to Develop > Build App and choose “Server-to-Server OAuth”.

1. Create the app and give it a name (for example, “Comma Archiving”).

2. On the app’s App Credentials tab, copy the three values Comma needs:

   • Account ID
   • Client ID
   • Client Secret

   Keep these somewhere safe for Step 2 - you’ll paste them into Comma.

Add the admin scopes

On the app’s Scopes section, add the granular admin scopes for the surfaces you want to capture. There are 24 scopes total. Add every scope for each surface you plan to archive - a missing scope means that surface will report as unavailable rather than silently dropping data.

Surface	Scopes
Team Chat	team_chat:read:list_user_messages:admin, team_chat:read:list_user_sessions:admin, team_chat:read:list_user_channels:admin, team_chat:read:list_channels:admin, team_chat:read:channel:admin, team_chat:read:list_members:admin, team_chat:read:thread_message:admin, team_chat:read:file:admin, report:read:list_chat_sessions:admin, report:read:chat_session:admin
Zoom Phone (calls, recordings, voicemail)	phone:read:list_call_logs:admin, phone:read:call_log:admin, phone:read:list_call_recordings:admin, phone:read:call_recording:admin, phone:read:recording_transcript:admin, phone:read:list_voicemails:admin, phone:read:voicemail:admin
SMS / MMS	phone:read:list_sms_sessions:admin, phone:read:sms_session:admin, phone:read:sms_message:admin
Meetings	cloud_recording:read:list_user_recordings:admin, cloud_recording:read:list_recording_files:admin
Shared / directory (always add these)	user:read:list_users:admin, user:read:user:admin

The shared directory scopes let Comma map messages and calls back to the right people, so add them regardless of which surfaces you enable.

Set up the Event Subscription

In the app’s Feature / Event Subscription section, add an event subscription so Zoom can push activity to Comma in real time.

1. Endpoint URL - paste the webhook endpoint URL that Comma generates for you. You get this from the Comma connect form after you save the installation in Step 2 (it appears on the connection page with a copy button). If you’re doing this in one sitting, complete Step 2 first, copy the URL, then come back here.
2. Subscribe to the events Comma handles. Add:
   • Team Chat - chat_message.sent, chat_message.updated, chat_message.deleted
   • Zoom Phone - the call-log completed events, phone.recording_completed, phone.recording_transcript_completed, phone.voicemail_received, phone.recording_deleted
   • SMS - phone.sms_received, phone.sms_sent
   • Meetings - recording.completed, recording.transcript_completed, recording.trashed, recording.deleted, recording.recovered
   • Always add - endpoint.url_validation and app_deauthorized
3. Copy the Secret Token shown for the event subscription - you’ll paste it into Comma as the Webhook Secret Token in Step 2.
4. Enable the Team Chat webhook toggle explicitly. Team Chat events do not fire by default - if you skip this toggle, chat is captured only by polling reconciliation instead of in real time.
5. Confirm your SMS number is provisioned. SMS/MMS capture needs an SMS-capable number on the account.
6. Once Comma’s endpoint URL is in place, click Validate on the event subscription and confirm it succeeds against the Comma endpoint.

Step 2 - Enter your credentials in Comma

1. Sign in to the Comma Compliance dashboard and open the Configuration Center.

2. Open the Zoom section and choose Set up Zoom.

3. Leave the credential mode on “Connect via your Zoom Server-to-Server app.”

4. Enter the four values from Zoom:

   • Account ID, Client ID, and Client Secret from the app’s App Credentials tab (Step 1)
   • Webhook Secret Token from the event subscription (Step 1)

   These are stored encrypted and are never shown again after you save.

5. Tick the capture surfaces you want to enable - Team Chat, Zoom Phone, SMS / MMS, Meetings - matching the scopes you added in Zoom.

6. Save. The connection page then displays the generated webhook endpoint URL with a copy button.

Now finish the loop:

1. Copy that webhook endpoint URL.
2. Paste it into your Zoom app’s Event Subscription (Step 1, Event Subscription).
3. Click Validate in Zoom and confirm it succeeds.

The order matters: save in Comma to get the URL, then register the URL in Zoom, then Validate.

Verifying capture

Each enabled surface shows an honesty badge on the connection page so you can see exactly where it stands:

• Connected - authenticated and capturing
• Connected - not yet archiving - connected, no activity captured yet
• Missing scope - a required scope wasn’t granted in the Zoom app
• No Zoom license - the account lacks the license for that surface (for example, no Zoom Phone seat)
• Authentication failed - the credentials didn’t authenticate
• Not yet checked - the surface hasn’t been probed yet

A surface that’s missing a scope or a license says so honestly rather than appearing connected while silently capturing nothing. If a badge flags a missing scope, add it to your Zoom app (Step 1); if it flags a missing license, enable that surface on your Zoom account.

Chat history backfill: when you enable Team Chat, Comma backfills roughly the last 6 months of chat history - that’s Zoom’s API ceiling. Anything older than that window is recorded as a coverage gap so you have a clear, honest record of what predates the connection rather than a false impression of complete history.

What’s next

• One-click marketplace install (coming soon) - a one-click Zoom Marketplace OAuth install is pending Zoom’s security review. When it ships, it will remove the need to self-create the Server-to-Server app - you’ll approve scopes in a single flow instead. Until then, the S2S setup above is the supported path, and the marketplace option can be made available on request.
• Required Zoom Admin Settings - Zoom account-level settings to enable before connecting (recording, chat, phone, transcript)
• Inbound Webhooks - Push other voice and meeting data into Comma
• Available on Request integrations - Webex Meetings, Twilio Voice, and other call platforms