Zoom end-to-end test plan

Setup and reviewer credentials

• Use a current desktop browser and current Zoom desktop client.
• Sign in at app.superpractice.com/login with the credentials in the Marketplace Test account and credentials field.
• The supplied account is an owner-role user in the seeded Zoom Review Sandbox organization. It has no 2FA or paid Superpractice prerequisite.
• Open the restricted Zoom review console. It is available only to the supplied reviewer email.
• Use Zoom Account A to authorize Superpractice. Use a separate Zoom Account B to host the external meeting. Zoom-owned reviewer accounts may be used; no Zoom passwords are embedded here.

No calendar connection, event type, client record, or historical booking is needed. The console creates and cleans up its own clearly labeled meeting.

Required scopes and expected outcomes

1. Authorize Zoom Account A

1. If an old grant is present, disconnect it from Settings → Integrations so the final scope grant is tested.
2. On the review console, select Connect Zoom.
3. Sign in to Zoom as Account A, review the requested permissions, and select Allow.
4. Return to the review console after Zoom redirects to Superpractice.

Expected: the console shows Connected and Account A's Zoom email. The connection is specific to the signed-in Superpractice user.

2. Test the meeting lifecycle scopes

1. Select Create test meeting. In Account A's Zoom web portal, confirm the displayed meeting ID exists under Upcoming and has a 30-minute duration.
2. Select Reschedule + change duration. Refresh Zoom and confirm the same ID now matches the displayed date/time and has a 45-minute duration.
3. Select Delete test meeting. Refresh Zoom and confirm the labeled meeting is gone.

Expected: create, update, and delete each succeed independently, and the console reflects every new state.

3. Test the external-meeting OBF flow

1. From Zoom Account B, which must be under a different Zoom account, create and start a meeting.
2. Join that meeting as the authorized Zoom Account A and keep Account A present.
3. Paste Account B's attendee join URL into the review console and select Launch Meeting Agent.
4. Account B admits Superpractice Meeting Agent if the waiting room is enabled.
5. Open Zoom's Active Apps Notification for the Meeting Agent.

Expected: the Meeting Agent joins only after Account A is present and the notice shows Brought by [Account A participant name]. This validates the short-lived OBF token from user:read:token.

Have Account A leave to validate associated-user lifecycle behavior. If the agent remains briefly while Zoom propagates the departure, select Remove test agent. This isolated action creates no transcript or mixed-video file, and temporary vendor data is configured for one-hour retention.

4. Test both removal paths

In Superpractice

1. Open Settings → Integrations.
2. On the Zoom card, select the disconnect icon and confirm.
3. Refresh the review console.

Expected: the OAuth grant is revoked, the stored connection is deleted, and the console shows Disconnected.

In Zoom Marketplace

Reconnect first if the in-app removal test was completed.

1. As Account A, open Zoom Marketplace → Manage → Added Apps.
2. Find Superpractice, select Remove, and confirm.
3. Refresh the Superpractice review console.

Expected: Zoom sends a verified deauthorization webhook, Superpractice deletes Account A's OAuth connection, and the console shows Disconnected.

Plans, access controls, seed data, and support

• No paid Superpractice plan is required.
• The seeded reviewer has the owner role and no 2FA requirement.
• Zoom plan limits remain those of the reviewer's Zoom accounts; the test needs only basic meeting creation and an external meeting.
• The reviewer console returns 404 for all other Superpractice users.

For review assistance, email support@superpractice.com. See support hours and first-response target.