Resolve webhook user IDs with an API credential, not the webhook secret

A webhook secret token only verifies incoming signed events (Zoom's signature and timestamp headers). It cannot call the platform API. Turning an answer event's user ID into an email needs a Server-to-Server OAuth app (account ID, client ID and secret exchanged for a short-lived bearer token) with a phone read scope, and reading webhook delivery logs needs yet another scope. Without the scope the API returns 401. After lookup worked, alerts still failed closed with no visible error because the resolver also required the answerer to belong to an app-level team. Gate on what proves identity: a signed event, an account and queue allowlist, exact call correlation, and an email that matches exactly one connected user in the same organization. Make each channel independently optional so a missing chat link never blocks email.

Applies when: sending notifications to the person a phone-platform webhook names. Keywords: Zoom webhook secret token Server-to-Server OAuth scopes phone read user lookup notification gating Microsoft Teams email answerer identity