Bug Description

The webhook handler (createWebhookHandler) hangs when receiving valid JSON that doesn't match the expected Zoom webhook payload schema. Instead of returning a 400 Bad Request error for malformed payloads, a 200 OK status is returned. Subsequent RTMS requests work as expected.

Language/Runtime

Node.js
Python

SDK Version

1.0.2

Environment Details

• OS and Version: macOS (darwin-arm64) / Linux (linux-x64)
• Node.js version: 24.x
• RTMS SDK version: 1.0.2

Steps To Reproduce

1. Start a webhook server using onWebhookEvent with a raw callback:

import rtms from '@zoom/rtms';

rtms.onWebhookEvent((payload, req, res) => {

});

2. Send a POST request with valid JSON but invalid webhook schema:

curl http://localhost:8080/ -X POST -H "Content-Type: application/json" -d '{"a":"b"}'

Expected Behavior

The server should return a 400 Bad Request error when the JSON payload is missing required Zoom webhook fields (like event). The webhook handler should validate the payload schema before passing it to the callback.

Suggested behavior:

• If JSON parsing fails -> 400 "Invalid JSON received" (already implemented)
• If JSON is valid but missing event field -> 400 "Invalid webhook payload: missing 'event' field"
• If JSON is valid with event field -> pass to callback

Actual Behavior

1. Valid JSON without required fields is passed directly to the callback
2. For raw callbacks, if the callback doesn't explicitly send a response for invalid payloads, the connection hangs
3. No schema validation occurs at the handler level

Code Example

Minimal reproduction:

import rtms from '@zoom/rtms';

// Using raw callback (3 args)
rtms.onWebhookEvent((payload, req, res) => {

});

Relevant Log Output

request returns {status: ok} 200 OK

Additional Context

The bug is in createWebhookHandler in index.ts:445-507.

Two potential fixes:

1. Schema validation: Add validation for required webhook fields before passing to callback
2. Timeout/default response: For raw callbacks, add a timeout or ensure a response is always sent

Related code location: index.ts:471-485 where raw callbacks are handled without ensuring a response is sent.

Verification

• I've searched existing issues to ensure this bug hasn't already been reported
• I've verified this bug still exists in the latest version of the SDK
• I've included all necessary information to reproduce this issue