Zoom Schema
graph LR
ZoomAccount -- HAS_SETTINGS --> ZoomSecuritySettings
ZoomAccount -- RESOURCE --> ZoomApp
ZoomAccount -- RESOURCE --> ZoomClientVersion
ZoomAccount -- RESOURCE --> ZoomGroup
ZoomAccount -- RESOURCE --> ZoomMeeting
ZoomAccount -- RESOURCE --> ZoomRecording
ZoomAccount -- RESOURCE --> ZoomRole
ZoomAccount -- RESOURCE --> ZoomRolePrivilege
ZoomAccount -- RESOURCE --> ZoomSecuritySettings
ZoomAccount -- RESOURCE --> ZoomUser
ZoomGroup -- HAS_SETTINGS --> ZoomSecuritySettings
ZoomMeeting -- HOSTED_BY --> ZoomUser
ZoomRecording -- HOSTED_BY --> ZoomUser
ZoomRecording -- RECORDED_FROM --> ZoomMeeting
ZoomRole -- GRANTS --> ZoomRolePrivilege
ZoomRolePrivilege -- SCOPED_TO --> ZoomGroup
ZoomUser -- HAS_ROLE --> ZoomRole
ZoomUser -- HAS_SETTINGS --> ZoomSecuritySettings
ZoomUser -- MEMBER_OF --> ZoomGroupZoomAccount
A Zoom account containing users and pending invitations.
Ontology Mapping: The Tenant label enables cross-provider tenant queries.
Ontology Mapping: This node uses the ontology label
Tenant.
Properties
Ontology-generated fields are shown in italics.
| Field | Index | Description |
|---|---|---|
| id | Yes | Zoom account ID used for server-to-server OAuth. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| _ont_name | Yes | Normalized field sourced from id. |
| _ont_source | Module that populated this node's ontology fields. |
Relationships
(:ZoomAccount)-[:HAS_SETTINGS]->(:ZoomSecuritySettings)(:ZoomAccount)-[:RESOURCE]->(:ZoomApp): The owning Zoom account contains this resource.(:ZoomAccount)-[:RESOURCE]->(:ZoomClientVersion): The owning Zoom account contains this resource.(:ZoomAccount)-[:RESOURCE]->(:ZoomGroup): The owning Zoom account contains this resource.(:ZoomAccount)-[:RESOURCE]->(:ZoomMeeting): The owning Zoom account contains this resource.(:ZoomAccount)-[:RESOURCE]->(:ZoomRecording): The owning Zoom account contains this resource.(:ZoomAccount)-[:RESOURCE]->(:ZoomRole): The owning Zoom account contains this resource.(:ZoomAccount)-[:RESOURCE]->(:ZoomRolePrivilege): The owning Zoom account contains this resource.(:ZoomAccount)-[:RESOURCE]->(:ZoomSecuritySettings): The owning Zoom account contains this resource.(:ZoomAccount)-[:RESOURCE]->(:ZoomUser): Contains a user or pending invitation in its Zoom account.
ZoomApp
An account-added or approved Marketplace app. Approval and installation are independent states.
Ontology Mapping: This node has the extra label
ThirdPartyAppto enable cross-platform queries for third-party applications.
_ont_client_id uses the Marketplace app ID as a surrogate identifier, not
an OAuth client ID. Publication status does not imply enabled state or protocol.
Ontology Mapping: This node uses the ontology label
ThirdPartyApp.
Properties
Ontology-generated fields are shown in italics.
| Field | Index | Description |
|---|---|---|
| id | Yes | Account-scoped Marketplace app ID. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| account_id | Yes | Owning Zoom account ID. |
| app_id | Marketplace app_id. | |
| app_scopes | Exact OAuth scope identifiers from app_scopes; unknown if omitted, empty if explicitly returned empty. | |
| app_status | Detail app_status is publication status, not installation state. | |
| app_type | Detail app_type. | |
| approval_required | Inverse of approval_info.app_approval_closed, when provided. | |
| approval_type | approval_info.approved_type, such as forAllUser or forSpecificUser. | |
| approved | Yes | Present in the approved_apps list. |
| developer_type | List app_developer_type: THIRD_PARTY, ZOOM or INTERNAL; unknown if omitted. | |
| installed | Yes | Present in the account_added list; does not enumerate individual user installations. |
| name | Yes | Marketplace app_name. |
| _ont_client_id | Yes | Normalized field sourced from app_id. |
| _ont_name | Yes | Normalized field sourced from name. |
| _ont_source | Module that populated this node's ontology fields. |
Relationships
(:User)-[:AUTHORIZED]->(:ZoomApp): generated by analysis jobOntology - User AUTHORIZED ThirdPartyApp linking.Properties:
Field Description scopes Property generated by analysis job: Ontology - User AUTHORIZED ThirdPartyApp linking.
(:ZoomAccount)-[:RESOURCE]->(:ZoomApp): The owning Zoom account contains this resource.
ZoomClientVersion
An account-wide Dashboard count of one Zoom client version.
This is an aggregate from the client versions report, not a device or user inventory, and it cannot be attributed to individual users.
Properties
| Field | Index | Description |
|---|---|---|
| id | Yes | Account-scoped Dashboard client version string. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| account_id | Yes | Owning Zoom account ID. |
| client_version | Yes | Dashboard client_version, such as a platform-prefixed build string. |
| total_count | Dashboard total_count reported for this client version. |
Relationships
(:ZoomAccount)-[:RESOURCE]->(:ZoomClientVersion): The owning Zoom account contains this resource.
ZoomGroup
A Zoom account group with members correlated from the complete Users API snapshot.
Ontology Mapping: This node has the extra label
UserGroupto enable cross-platform queries for user groups.
Ontology Mapping: This node uses the ontology label
UserGroup.
Properties
Ontology-generated fields are shown in italics.
| Field | Index | Description |
|---|---|---|
| id | Yes | Account-scoped Zoom group ID. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| account_id | Yes | Owning Zoom account ID. |
| name | Yes | Group name. |
| total_members | Provider total_members. | |
| zoom_id | Group id. | |
| _ont_name | Yes | Normalized field sourced from name. |
| _ont_source | Module that populated this node's ontology fields. |
Relationships
(:ZoomGroup)-[:HAS_SETTINGS]->(:ZoomSecuritySettings)(:ZoomUser)-[:MEMBER_OF]->(:ZoomGroup): MEMBER_OF relationship to ZoomUser.(:ZoomAccount)-[:RESOURCE]->(:ZoomGroup): The owning Zoom account contains this resource.(:ZoomRolePrivilege)-[:SCOPED_TO]->(:ZoomGroup): SCOPED_TO relationship to ZoomGroup.
ZoomMeeting
An unexpired scheduled meeting, including a recurring meeting series.
Protection settings describe provider configuration, not verified public access. Meeting passcodes, join/start URLs, agendas and invitees are never ingested. Cleanup only runs after every eligible host was read, so a denied read keeps the prior meetings, and a transfer keeps one HOSTED_BY.
Properties
| Field | Index | Description |
|---|---|---|
| id | Yes | Account-scoped Zoom meeting number. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| account_id | Yes | Owning Zoom account ID. |
| approval_type | Registration: 0 automatic approval, 1 manual approval, 2 not required. | |
| authentication_domains | Allowed domains from settings.authentication_domains, when returned. | |
| auto_recording | Configured automatic recording mode from settings.auto_recording. | |
| created_at | Provider created_at as a native datetime, when available. | |
| duration | Scheduled duration in minutes. | |
| encryption_type | Configured encryption mode from settings.encryption_type. | |
| host_id | Yes | Provider user ID of the meeting host. |
| join_before_host | Whether settings.join_before_host allows participants to join before the host. | |
| meeting_authentication | Whether settings.meeting_authentication requires authenticated participants. | |
| meeting_id | Provider meeting ID (meeting number), stored as a string. | |
| password_protected | Whether the response supplies a nonempty passcode; unknown if omitted. Passcodes are never stored. | |
| start_time | Scheduled start_time as a native datetime, when available. | |
| status | Meeting status from the meeting details response. | |
| topic | Meeting topic from the meeting details response. | |
| type | Provider meeting type code for instant, scheduled, or recurring meetings. | |
| waiting_room | Whether settings.waiting_room enables the waiting room. |
Relationships
(:ZoomMeeting)-[:HOSTED_BY]->(:ZoomUser)(:ZoomRecording)-[:RECORDED_FROM]->(:ZoomMeeting)(:ZoomAccount)-[:RESOURCE]->(:ZoomMeeting): The owning Zoom account contains this resource.
ZoomRecording
Cloud recording metadata for one meeting instance within the configured window.
Contains aggregate file metadata and sharing configuration, never recordings, transcripts, passcodes, or URLs. Links to a scheduled meeting when it is ingested. Cleanup runs after every eligible host and recording was read, and expires records outside the rolling lookback window. A denied or unread host skips cleanup, so the prior recordings are kept.
Properties
| Field | Index | Description |
|---|---|---|
| id | Yes | Account-scoped recorded meeting occurrence UUID. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| account_id | Yes | Owning Zoom account ID. |
| approval_type | Registration: 0 automatic approval, 1 manual approval, 2 not required. | |
| authentication_domains | Allowed viewer domains from settings.authentication_domains, when returned. | |
| auto_delete | Whether settings.auto_delete enables automatic deletion. | |
| auto_delete_date | Provider settings.auto_delete_date, when automatic deletion is configured. | |
| duration | Recorded meeting duration in minutes. | |
| file_types | Types of available recording files; file contents and access URLs are never fetched. | |
| host_id | Yes | Provider user ID of the recorded meeting host. |
| meeting_id | Provider meeting ID (meeting number), stored as a string. | |
| meeting_uuid | Identifies this recorded meeting instance, including recurring meetings. | |
| on_demand | Whether viewing requires registration. | |
| password_protected | Whether settings supplies a nonempty passcode; unknown if omitted. Passcodes are never stored. | |
| recording_authentication | Whether settings.recording_authentication restricts viewing to authenticated users. | |
| recording_count | Provider recording_count for this meeting instance. | |
| share_recording | Provider sharing mode: publicly, internally, or none. Public sharing can still require authentication or a passcode. | |
| start_time | Recorded meeting start_time as a native datetime, when available. | |
| topic | Topic of the recorded meeting. | |
| total_size | Aggregate recording size in bytes. | |
| viewer_download | Whether settings.viewer_download permits recording downloads. |
Relationships
(:ZoomRecording)-[:HOSTED_BY]->(:ZoomUser)(:ZoomRecording)-[:RECORDED_FROM]->(:ZoomMeeting)(:ZoomAccount)-[:RESOURCE]->(:ZoomRecording): The owning Zoom account contains this resource.
ZoomRole
A common account role and its assigned primary users; privileges are separate nodes.
Ontology Mapping: This node has the extra label
PermissionRoleto enable cross-platform queries for permission roles.
Ontology Mapping: This node uses the ontology label
PermissionRole.
Properties
Ontology-generated fields are shown in italics.
| Field | Index | Description |
|---|---|---|
| id | Yes | Account-scoped Zoom role ID. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| account_id | Yes | Owning Zoom account ID. |
| description | Role description. | |
| name | Yes | Role name. |
| total_members | Provider total_members; only primary membership is correlated from the user inventory. | |
| zoom_id | Role id from the Roles API. | |
| _ont_name | Yes | Normalized field sourced from name. |
| _ont_scope | Yes | Property generated by the ontology mapping. |
| _ont_source | Module that populated this node's ontology fields. |
Relationships
(:ZoomRole)-[:GRANTS]->(:ZoomRolePrivilege): GRANTS relationship to ZoomRole.(:ZoomUser)-[:HAS_ROLE]->(:ZoomRole): HAS_ROLE relationship to ZoomUser.(:ZoomAccount)-[:RESOURCE]->(:ZoomRole): The owning Zoom account contains this resource.
ZoomRolePrivilege
One privilege granted by a role, with explicit group restrictions when returned.
Properties
| Field | Index | Description |
|---|---|---|
| id | Yes | Account-scoped role ID and privilege identifier. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| account_id | Yes | Owning Zoom account ID. |
| group_ids | Provider group IDs from privilege_scopes; empty when no group restriction is returned. | |
| privilege | Yes | Role privileges entry. |
| restricted_to_groups | True when privilege_scopes restricts this privilege to group_ids; false indicates no group restriction returned. |
Relationships
(:ZoomRole)-[:GRANTS]->(:ZoomRolePrivilege): GRANTS relationship to ZoomRole.(:ZoomAccount)-[:RESOURCE]->(:ZoomRolePrivilege): The owning Zoom account contains this resource.(:ZoomRolePrivilege)-[:SCOPED_TO]->(:ZoomGroup): SCOPED_TO relationship to ZoomGroup.
ZoomSecuritySettings
Allowlisted security policy metadata from Zoom's settings endpoints.
Configured values and lock flags are separate nodes. A locked flag describes whether members may change a setting, not whether that setting is enabled. These are provider-reported settings, not a computed inheritance hierarchy. Missing values are unknown. Passcodes and raw settings payloads are excluded. Cleanup runs only when every owner was read, so denied owners keep their prior settings until a complete sync.
Properties
| Field | Index | Description |
|---|---|---|
| id | Yes | Account-scoped owner and settings-kind identity. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| account_id | Yes | Owning Zoom account ID. |
| allow_authentication_exception | option=meeting_authentication allow_authentication_exception. | |
| allow_participants_to_rename | in_meeting.allow_participants_to_rename; configured account snapshots only. | |
| auto_delete_cloud_recordings | recording.auto_delete_cmr; account and user values, account and group lock flags. | |
| auto_delete_cloud_recordings_days | recording.auto_delete_cmr_days, such as 30, 60, 90 or 120; configured account and user only. | |
| auto_security | meeting_security.auto_security; require at least one meeting security option. | |
| cloud_recording | recording.cloud_recording. | |
| cloud_recording_download | recording.cloud_recording_download. | |
| cloud_recording_download_host | recording.cloud_recording_download_host; restrict downloads to the host. | |
| embed_passcode_in_join_link | meeting_security.embed_password_in_join_link. | |
| encryption_type | meeting_security.encryption_type: enhanced_encryption or e2ee; configured only. | |
| end_to_end_encrypted_meetings | meeting_security.end_to_end_encrypted_meetings. | |
| file_transfer | in_meeting.file_transfer. | |
| join_before_host | schedule_meeting.join_before_host. | |
| kind | configured contains values; locked contains lock flags, not enabled values. | |
| local_recording | recording.local_recording. | |
| meeting_authentication | option=meeting_authentication meeting_authentication, or schedule_meeting.meeting_authentication for locks. | |
| meeting_passcode_required | meeting_security.meeting_password; stores the policy, never the passcode. | |
| only_authenticated_can_join_from_webclient | meeting_security.only_authenticated_can_join_from_webclient. | |
| phone_passcode_required | meeting_security.phone_password; stores the policy, never the passcode. | |
| pmi_passcode_required | meeting_security.pmi_password boolean policy; never schedule_meeting.pmi_password, which is a secret. | |
| private_chat | in_meeting.private_chat; allows participants to message each other privately. | |
| recording_account_members_only | recording.account_user_access_recording. | |
| recording_authentication | option=recording_authentication recording_authentication, or recording.recording_authentication for locks. | |
| recording_embed_passcode_in_link | recording.embed_passcode_in_shareable_link. | |
| recording_invitees_without_passcode | recording.allow_invitees_access_recordings_without_passcode. | |
| recording_passcode_required | recording.required_password_for_shared_cloud_recordings. | |
| recording_sharing | recording.allow_share. | |
| remote_control | in_meeting.remote_control. | |
| require_sso_for_domains | security.signin_with_sso.require_sso_for_domains; domains are not collected. | |
| scope_id | Provider ID of the owning account, group, or user. | |
| scope_type | Owner type: account, group, or user. | |
| screen_sharing | in_meeting.screen_sharing. | |
| sign_again_period_for_inactivity_on_client | security.sign_again_period_for_inactivity_on_client; minutes of client inactivity before sign-out, 0 when disabled. Configured account only. | |
| sign_again_period_for_inactivity_on_web | security.sign_again_period_for_inactivity_on_web; minutes of web inactivity before sign-out, 0 when disabled. Configured account only. | |
| sign_in_with_two_factor_auth | security.sign_in_with_two_factor_auth: all, group, role, or none; configured only. | |
| sign_in_with_work_email | security.sign_in_with_work_email. | |
| sso_enabled | security.signin_with_sso.enable. | |
| two_factor_auth_group_ids | security.sign_in_with_two_factor_auth_groups; provider group IDs requiring 2FA when sign_in_with_two_factor_auth is group. Configured account only. | |
| two_factor_auth_role_ids | security.sign_in_with_two_factor_auth_roles; provider role IDs requiring 2FA when sign_in_with_two_factor_auth is role. Configured account only. | |
| waiting_room | in_meeting.waiting_room for configured snapshots, or meeting_security.waiting_room for locks. | |
| waiting_room_scope | meeting_security.waiting_room_settings.participants_to_place_in_waiting_room: 0 all participants, 1 users outside the account, 2 users outside the account and allowed domains; configured only. | |
| who_can_share_screen | in_meeting.who_can_share_screen: host or all; configured only. |
Relationships
(:ZoomAccount)-[:HAS_SETTINGS]->(:ZoomSecuritySettings)(:ZoomGroup)-[:HAS_SETTINGS]->(:ZoomSecuritySettings)(:ZoomUser)-[:HAS_SETTINGS]->(:ZoomSecuritySettings)(:ZoomAccount)-[:RESOURCE]->(:ZoomSecuritySettings): The owning Zoom account contains this resource.
ZoomUser
A Zoom user account or an invitation awaiting activation.
Ontology Mapping: The UserAccount label enables cross-platform user queries. Pending invitations are inactive and are replaced by provider-ID nodes on activation.
Ontology Mapping: This node uses the ontology label
UserAccount.
Properties
Ontology-generated fields are shown in italics.
| Field | Index | Description |
|---|---|---|
| id | Yes | Account-scoped Zoom ID, or account-scoped normalized email for pending invitations. |
| firstseen | Timestamp when a sync job first created this node. | |
| lastupdated | Yes | Timestamp of the last sync that observed this node. |
| account_id | Zoom account containing this user or invitation. | |
| created_at | Provider user_created_at as a native datetime, when available. | |
| department | User's department. | |
| display_name | User's display name. | |
| Yes | Trimmed lowercase email used for identity correlation. | |
| first_name | User's first name. | |
| group_ids | IDs of groups where the user is a member. | |
| last_client_version | Yes | Users API last_client_version; last observed login client, not a complete device inventory. |
| last_login_time | Yes | Provider last_login_time as a native datetime with Zoom's three-day reporting buffer; not precise activity telemetry. |
| last_name | User's last name. | |
| login_types | Provider login method codes; 101 denotes SSO, 100 Zoom work email. | |
| plan_type | Readable assigned plan type; not purchased seats, billing, or complete product entitlements. | |
| role_id | Assigned primary account role ID; the optional roles surface links the user to its role and ingests role privileges. | |
| status | Account membership status: active, inactive, or pending. | |
| type | Assigned plan type: 1 Basic, 2 Licensed, 4 Unassigned without Meetings Basic, 99 legacy None. | |
| zoom_id | Provider user ID; absent for pending invitations. | |
| _ont_active | Yes | Normalized field sourced from status. |
| _ont_email | Yes | Normalized field sourced from email. |
| _ont_firstname | Yes | Normalized field sourced from first_name. |
| _ont_fullname | Yes | Normalized field sourced from display_name. |
| _ont_lastactivity | Yes | Normalized field sourced from last_login_time. |
| _ont_lastname | Yes | Normalized field sourced from last_name. |
| _ont_source | Module that populated this node's ontology fields. |
Relationships
(:User)-[:HAS_ACCOUNT]->(:ZoomUser)(:ZoomUser)-[:HAS_ROLE]->(:ZoomRole): HAS_ROLE relationship to ZoomUser.(:ZoomUser)-[:HAS_SETTINGS]->(:ZoomSecuritySettings)(:ZoomMeeting)-[:HOSTED_BY]->(:ZoomUser)(:ZoomRecording)-[:HOSTED_BY]->(:ZoomUser)(:ZoomUser)-[:MEMBER_OF]->(:ZoomGroup): MEMBER_OF relationship to ZoomUser.(:ZoomAccount)-[:RESOURCE]->(:ZoomUser): Contains a user or pending invitation in its Zoom account.