Zoom Marketplace Reviewer Test Plan

App boundaries

TimeSentry uses one user-managed Zoom OAuth connection to analyze historical scheduled Zoom Meetings, their full agendas, available Zoom My Notes, and the connected user’s Zoom Phone call history. It creates draft time entries that must be reviewed in TimeSentry before approval.

Out of scope by design

The app does not join meetings or use the Zoom Meeting SDK.
The app does not access recordings, meeting audio or video, phone audio, or transcripts.
The app never sends the optional include=transcript parameter when retrieving Zoom My Notes content.
The app does not promise coverage for instant meetings.
The app does not require or expect an AI Companion summary for every meeting.
The app does not create, edit, start, or delete Zoom meetings or calls.

Private reviewer access package

Use the TimeSentry credentials provided privately with the Zoom Marketplace submission. No username, password, recovery code, OAuth token, meeting identifier, agenda, Zoom My Notes content, participant information, phone number, or customer data is stored on this public page or in the TimeSentry source repository. Authorize the app with your own Zoom account on Zoom’s OAuth screen. TimeSentry does not supply or request Zoom credentials.

The private review package provides:

A TimeSentry reviewer account and sign-in instructions.
The TimeSentry company to select and the navigation path to Integrations and Capture Time with AI.
A direct support contact for authorization, navigation, or test-data questions.

Preconditions

Item	Required state
TimeSentry	Reviewer can sign in, select the supplied company, open Integrations, and use Capture Time with AI.
Zoom account	The reviewer uses their own Zoom account and enters Zoom credentials only on Zoom’s authorization screen.
Scheduled meeting	At least one completed scheduled meeting owned by the reviewer’s connected Zoom user and dated within the previous six months. Add a distinctive, non-sensitive test agenda before completing the meeting. If none exists, the reviewer can schedule and complete a short test meeting before capture.
Past participants	Optional. Verify when the reviewer’s eligible paid Zoom account exposes past-participant data; otherwise mark this capability-dependent check unavailable.
AI Companion	Optional. Verify when the reviewer’s account has a completed meeting with an existing AI Companion summary.
Zoom My Notes	Optional. Verify when the reviewer can link a manual or generated My Notes record containing distinctive, non-sensitive test text to the completed meeting.
Zoom Phone	Optional. Verify when the reviewer’s account has an active Zoom Phone license and a completed call visible in that user’s call history.

Install and authorization test

Sign in with the privately supplied TimeSentry reviewer account.

Expected: The reviewer reaches the supplied TimeSentry company without entering Zoom credentials in TimeSentry.
Open Integrations, find Zoom, and select Connect.

Expected: TimeSentry redirects the browser to Zoom’s OAuth authorization screen.
On Zoom’s site, sign in with the reviewer’s own Zoom account and inspect the consent screen.

Expected: Zoom receives the Zoom credentials directly. The consent screen identifies TimeSentry and requests only the nine read scopes documented below.
Select Allow.

Expected: Zoom redirects to TimeSentry and Zoom appears as one connected integration.
Refresh the Integrations page.

Expected: The connection remains present and no second Zoom Phone authorization is required.

Stop the test and report a scope discrepancy if Zoom requests permissions beyond the nine scopes listed in the next section.

Scope-by-scope verification

These tests exercise one connected account. Meeting details, agenda, summary, participants, and My Notes can contribute to the same draft, so a separate draft is not expected for every scope.

user:read:user

Read the authorized Zoom user and account identifiers once during connection so a later app-deauthorization event can be matched to the correct TimeSentry connection and its associated data. TimeSentry does not retain the user’s Zoom profile fields.

Reviewer action: Authorize TimeSentry with the reviewer’s own Zoom account, then remove the app from Zoom after completing the capture tests.
Expected result: TimeSentry stores only the Zoom user and account identifiers needed for connection ownership and deauthorization; removing the app deletes the matched connection and associated Zoom-derived data.

meeting:read:list_meetings

List the connected user’s historical scheduled meetings for the selected capture period, up to six months.

Reviewer action: Run a Zoom capture for a date range containing a scheduled meeting owned by the connected user.
Expected result: The scheduled meeting is available as source context for a draft time entry.

meeting:read:meeting

Read the full scheduled-meeting record, including its agenda, so the draft can reflect the work the meeting was intended to cover.

Reviewer action: Use a scheduled meeting owned by the connected user and add a distinctive, non-sensitive test agenda before the meeting occurs.
Expected result: The available agenda can enrich the proposed draft description. TimeSentry reads the meeting; it does not edit the meeting or its agenda.

meeting:read:past_meeting

Read completed-meeting details such as actual start, end, and duration.

Reviewer action: Use a completed scheduled meeting whose actual duration is visible in Zoom.
Expected result: The draft reflects the completed meeting’s available timing details rather than creating an approved entry automatically.

meeting:read:list_past_participants

Use eligible past-participant information to improve client and project context.

Reviewer action: If the reviewer’s Zoom account is eligible, capture a completed meeting with participants.
Expected result: Available participant context can inform the draft. If Zoom does not make participant data available for that account or meeting, capture continues without it.

meeting:read:summary

Use an existing Zoom AI Companion meeting summary as optional context for a draft description.

Reviewer action: If the reviewer’s Zoom account has AI Companion data, capture a meeting for which a summary already exists.
Expected result: The available summary can enrich the draft. A missing summary is handled as an optional-data case and is not an error.

my_notes:read:note

List Zoom My Notes records linked to a meeting so TimeSentry can identify optional manual or generated notes associated with that source meeting.

Reviewer action: If My Notes is available to the reviewer, use a completed meeting with a manual or generated My Notes record linked to it.
Expected result: TimeSentry can identify the linked note. If no note is available, meeting capture continues without My Notes enrichment.

my_notes:read:content

Retrieve the content of a linked manual or generated My Notes record as optional context for the draft description. TimeSentry never sends the optional include=transcript parameter.

Reviewer action: Add distinctive, non-sensitive text to a linked My Notes record, then capture the associated meeting.
Expected result: Available note content can enrich the draft. TimeSentry does not request, receive, or use the optional transcript.

phone:read:list_call_logs

Read the connected user’s Zoom Phone call-log history, including available timing, direction, duration, and phone-number context.

Reviewer action: If the reviewer’s Zoom account has a Zoom Phone license, capture a date range containing a completed call visible to that user.
Expected result: The completed call is available as source context for a draft time entry. No call audio, recording, or transcript is requested.

End-to-end draft workflow

Open Time in TimeSentry and select Capture Time with AI.
Select Zoom and a date range containing the completed scheduled meeting with the test agenda. If My Notes is available, link a manual or generated note containing distinctive test text. If the account supports Zoom Phone, include a completed call as well.
Run capture. Confirm that TimeSentry reports completion without asking for a second Zoom authorization.
Open the resulting meeting draft. Verify that it is not approved, then inspect the proposed date, duration, client, project, and description. Confirm that the available agenda and My Notes text can enrich the description.
Confirm that the draft contains no meeting transcript and that capture did not require a recording. TimeSentry does not send include=transcript when retrieving My Notes content.
Edit one draft field and save it. Confirm that the draft remains reviewable.
Approve one draft. If multiple drafts are available, dismiss another. Confirm that only approved records enter the approved timesheet workflow.
Run the same date range again. Confirm that TimeSentry does not create a second draft for the same Zoom source item.

Removal and deauthorization tests

A. Remove from TimeSentry

Confirm that the connection has at least one Zoom-derived record from the workflow test. If multiple source items are available, leave one as a draft and approve another.
Open Integrations and select Remove connection for Zoom.
Refresh the page.
Open Capture Time with AI to verify Zoom is unavailable, then inspect the draft and approved time views for the Zoom-derived test records.

Expected: Zoom no longer appears as connected or available for capture. The integration connection, stored OAuth credentials, source metadata, and all Zoom-derived drafts and approved entries associated with that connection, including records enriched with an agenda or Zoom My Notes, are deleted.

B. Remove from Zoom App Marketplace

Reconnect Zoom in TimeSentry.
Run a short capture and retain at least one Zoom-derived test draft or approved entry.
In Zoom App Marketplace, open Manage, then Added Apps.
Open TimeSentry, select Remove, and confirm.
Return to TimeSentry, refresh Integrations, and inspect the draft and approved time views for the Zoom-derived test records.

Expected: Zoom’s deauthorization invalidates the TimeSentry connection. TimeSentry deletes the integration connection, stored OAuth credentials, source metadata, and all Zoom-derived drafts and approved entries associated with that connection, including records enriched with an agenda or Zoom My Notes. Future Zoom capture is unavailable until the reviewer completes OAuth again.

Cleanup and deletion

Verify the connection purge: after the removal test, confirm that no Zoom connection, OAuth credential, source metadata, draft, or approved entry associated with that connection remains.
Report incomplete deletion: if any Zoom-derived test record remains after deauthorization processing, stop and contact reviewer support with the approximate removal time. Do not include Zoom data in the message.
Full account deletion is separate: removing Zoom does not close the TimeSentry reviewer account or delete other-source data. Do not close the shared reviewer account unless coordinated with TimeSentry. A verified account-deletion request can be sent to privacy@timesentry.ai.
Credentials and source content: do not copy reviewer credentials, tokens, meeting agendas, summaries, Zoom My Notes content, participant data, or phone numbers into review notes or public issue trackers.

Complete data-handling and user-deletion instructions are available in the Zoom data guide and Privacy Policy.

Return to Zoom documentation Contact reviewer support

Zoom integration test plan