Everything an AI agent can do with the Vimeo API.

A reference guide for building AI agents: every method, how to authenticate, and the permissions each one needs.

Endpoints29
API version3.4
Last updated23 June 2026
Orientation

How the Vimeo API works.

The Vimeo API is how an app or AI agent works with a Vimeo account: uploading a video, editing its title and privacy, organizing videos into showcases and folders, or posting a comment on someone's behalf. Access is granted through an OAuth access token, and the token carries scopes like private, edit, upload, and delete that set which actions a call is allowed to take. Each request names the API version it wants, so a representation never changes underneath an integration without an explicit move.

29Endpoints
8Capability groups
12Read
17Write
6Permissions
Authentication
Vimeo authenticates with OAuth 2.0. Server-to-server apps use the client credentials grant for an unauthenticated app token that reaches only public data, while acting on a member's account uses the authorization code grant to obtain a user access token. The token is sent as a Bearer token, and the default scope when none is requested is 'public private'.
Permissions
An access token carries one or more scopes, each a domain of access. The short scope names are public, private, create, edit, delete, upload, interact, video_files, stats, and promo_codes. Reading nonpublic data needs the private scope; uploading needs upload; editing metadata needs edit; deleting needs delete; liking, commenting, and following need interact. A call missing the required scope is refused.
Versioning
Vimeo versions through the Accept header, like application/vnd.vimeo.*+json;version=3.4, and 3.4 is the current public default. A request can even pin different versions per resource type in one header, so a representation is stable until an integration deliberately targets a newer one.
Data model
Vimeo is resource-oriented REST returning JSON, with /me as a shorthand for the signed-in user in place of /users/{user_id}. A video upload uses the open tus resumable protocol, which lets a large or interrupted upload resume rather than restart. Showcases are also called albums in the API, and folders are called projects.
Connect & authenticate

Connection & authentication methods.

How an app or AI agent connects to Vimeo determines what it can reach. There is a route for making calls, authenticated with an OAuth access token, and a route for receiving events through app webhooks, and each is governed by the token behind it and the scopes that token carries.

Ways to connect

REST API

The REST API returns JSON and pages through lists with page and per_page, at https://api.vimeo.com. A call authenticates with an OAuth 2.0 access token sent as a Bearer token, and each request pins the API version in the Accept header (application/vnd.vimeo.*+json;version=3.4). The /me path is shorthand for the signed-in user.

Best forConnecting an app or AI agent to Vimeo.
Governed byThe access token and the scopes it carries.
Docs ↗

tus resumable upload

Video bytes are not posted to the REST API directly. A POST to /me/videos returns a tus upload link, and the file is transferred to that link using the open tus protocol, which sends the file in resumable chunks so an interrupted upload continues instead of restarting. This is the upload method since API version 3.4.

Best forUploading large or unreliable video files.
Governed byThe upload scope on the token that began the upload.
Docs ↗

App webhooks

An API app can register a webhook URL for a limited set of events, like video.upload.complete and video.play. Vimeo POSTs to the URL when an event fires, and the receiver verifies the vimeo-signature header against the app's secret to confirm the request came from Vimeo. There is no event for transcode completion, so transcode status is polled.

Best forReceiving a limited set of Vimeo events at an app.
Governed byThe app the webhook is registered against and its signing secret.
Docs ↗
Authentication

OAuth authorization code

The authorization code grant sends a member to Vimeo to approve the requested scopes, then exchanges the returned code for a user access token that acts on that member's account. The token is sent as a Bearer token and reaches only what its scopes allow. This is the flow for acting on behalf of a person.

TokenOAuth user access token (Bearer)
Best forActing on a member's account with their consent.
Docs ↗

OAuth client credentials

The client credentials grant exchanges an app's client id and secret for an unauthenticated app access token tied to no user. It can read public data and is used for server-to-server tasks that do not act on a member. It cannot reach nonpublic videos or take actions that need a user's consent.

TokenOAuth app access token (Bearer)
Best forServer-side access to public data with no user context.
Docs ↗

Personal access token

An app owner can generate a personal access token in the developer dashboard, scoped to the chosen permissions, to call the API as their own account without running the full OAuth redirect flow. It is sent as a Bearer token like any other access token and is suited to scripts and a single owner's automation.

TokenOAuth access token (Bearer)
Best forScripts and an owner's own automation.
Docs ↗
Capability map

What an AI agent can do in Vimeo.

The Vimeo API is split into areas an agent can act on, like videos, the signed-in user's account, showcases, folders, channels, groups, comments, likes, and captions. Each area has its own methods, and a write needs the matching scope, so reading a video and deleting one are governed separately.

Endpoint reference

Every Vimeo API method.

Filter by method, access, or permission, or search any path. Select a row for version detail, rate limits, the related webhook event, and the source.

MethodEndpointWhat it doesAccessPermissionVersion

Videos

Methods for uploading, reading, editing, and deleting videos, plus their captions.7

No scope for public videos; the private scope is needed to include nonpublic videos.

Acts onvideo
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

No scope for a public video; the private scope is needed for a nonpublic one.

Acts onvideo
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs the upload scope; the file itself is sent via the tus resumable protocol, not this endpoint.

Acts onvideo
Permission (capability)upload
VersionAvailable since the API’s base version
Webhook eventvideo.upload.complete
Rate limitStandard limits apply

Needs the edit scope.

Acts onvideo
Permission (capability)edit
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs the delete scope; the video is permanently removed.

Acts onvideo
Permission (capability)delete
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

No scope for a public video's tracks.

Acts ontext_track
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs the upload scope; the caption file is then uploaded to the returned link.

Acts ontext_track
Permission (capability)upload
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Me & Users

Methods for reading a user account, where /me stands in for the signed-in user.2

No scope is required for public fields; the private scope is needed to read nonpublic account data.

Acts onuser
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

No scope is required for public profile fields.

Acts onuser
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Showcases (Albums)

Methods for creating, editing, and deleting showcases and adding videos to them.5

No scope for public showcases; the private scope includes nonpublic ones.

Acts onalbum
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs the create scope.

Acts onalbum
Permission (capability)create
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs the edit scope.

Acts onalbum
Permission (capability)edit
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs the delete scope; removes the showcase but not its videos.

Acts onalbum
Permission (capability)delete
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs the edit scope.

Acts onalbum
Permission (capability)edit
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Folders (Projects)

Methods for organizing a user's own videos into folders, called projects in the API.4

Needs the private scope, since folders organize a user's own videos.

Acts onproject
Permission (capability)private
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs the create scope.

Acts onproject
Permission (capability)create
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs the interact scope.

Acts onproject
Permission (capability)interact
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs the delete scope.

Acts onproject
Permission (capability)delete
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Channels

Methods for creating channels and adding videos to them, plus following channels.4

No scope required.

Acts onchannel
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs the create scope.

Acts onchannel
Permission (capability)create
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs the edit scope.

Acts onchannel
Permission (capability)edit
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs the interact scope.

Acts onchannel
Permission (capability)interact
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Groups

Methods for reading groups, their members and videos, and joining or contributing to them.3

No scope required.

Acts ongroup
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

No scope required.

Acts ongroup
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs the interact scope.

Acts ongroup
Permission (capability)interact
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Comments

Methods for reading and posting comments on a video.2

No scope for a public video's comments.

Acts oncomment
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs the interact scope; the comment is visible to others.

Acts oncomment
Permission (capability)interact
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Likes

Methods for liking and unliking videos on a member's behalf.2

Needs the interact scope.

Acts onlike
Permission (capability)interact
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

No scope for public likes; the private scope includes nonpublic ones.

Acts onlike
Permission (capability)None required
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply
No endpoints match those filters.
Webhooks

Webhook events.

Vimeo can notify an app when something happens to a video, like an upload finishing or a play being recorded. Webhooks are registered against an API app, not against an arbitrary token, and a receiver verifies the vimeo-signature header to confirm the request came from Vimeo.

EventWhat it signalsTriggered by
video.upload.completeA video upload finished and the source file was received. This signals that the video exists, though transcoding may still be in progress, which is checked by polling the video's status./me/videos
video.playA play of a video was recorded. An app subscribes to this through an app webhook to learn about viewing activity without polling.In-app only
No events match that search.
Rate limits & pagination

Rate limits, pagination & request size.

Vimeo limits how fast an app can call, counted per app across all of its users over a rolling window, with the remaining allowance returned on every response.

Request rate

Vimeo meters requests per app across all of its users, not per individual end user, over a rolling window. Every response returns the current allowance in the X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset headers, so an integration watches the remaining count and slows down before it runs out. Going over returns HTTP 429 with error code 9000, and the app stops being served for that user for the rest of the period. The newer AI endpoints are limited separately, to roughly 10 requests per minute per endpoint.

Pagination

List endpoints are page-based: the page parameter selects the page and per_page sets its size, up to a maximum of 100 items. A paging object in the response carries next, previous, first, and last links so an integration can walk the full set without constructing URLs by hand. A total field gives the count of matching items.

Request size

A list page returns at most 100 items (the maximum value of per_page). Uploads have no fixed per-request size because tus transfers a file in resumable chunks, and the account's storage plan, not the API, sets the overall ceiling on how much video can be stored.

Errors

Status codes & error handling.

The status codes an agent should handle, and what to do about each.

StatusCodeMeaningWhat to do
400invalid_requestThe request was malformed: a required parameter is missing or a value is invalid. The developer_message names the specific problem.Read error and developer_message, fix the parameters, and resend. The request is not retryable as-is.
4018003Authentication failed or no usable credentials were sent, for example a missing, expired, or malformed access token.Send a valid Bearer access token, and re-run the OAuth flow if the token has expired or been revoked.
4033500Access is forbidden. The token lacks the scope the action needs, or the client has been banned for abuse.Request a token carrying the required scope, like edit or delete, or contact Vimeo support if the client has been banned.
4045000The requested resource does not exist, or is not visible to this token, account, or privacy setting.Verify the id and confirm the token's scopes and the resource's privacy allow it to be seen.
4299000The app exceeded its rate limit for this end user. The app is not served for that user for the rest of the current period.Watch the X-RateLimit-Remaining header, stop calling when it nears zero, and resume after X-RateLimit-Reset.
500server_errorAn error on Vimeo's side, returned as 'Something strange occurred'. It is rare.Retry with backoff, and contact Vimeo support if it persists.
Versioning & freshness

Version history.

Vimeo pins the API version through the Accept header on each request, so a call can target an exact representation and a newer version never silently changes an existing one.

Version history

What changed, and when

Latest version3.4
3.4Current version
Current public default

Version 3.4 is the current public default of the Vimeo API, targeted through the Accept header like application/vnd.vimeo.*+json;version=3.4. It introduced the open tus resumable protocol as the upload method, replacing the older resumable PUT 'streaming' upload. A request can pin different versions per resource type in a single Accept header.

What changed
  • tus became the resumable upload protocol, replacing the streaming PUT upload.
  • Folders (called projects in the API) added for organizing a user's own videos.
  • Accept-header versioning supports pinning different versions per resource type.
Earlier
Earlier 3.x versions

Earlier 3.x versions of the API are still reachable by pinning them in the Accept header, so an integration can request, for example, an older user representation alongside a newer video representation. Vimeo keeps prior representations stable so a pinned integration is not broken by later changes.

What changed
  • Albums (showcases) and the core video, user, channel, and group resources established.
  • Older versions remain pinnable through the Accept header for stability.

Pin the version in the Accept header and move up deliberately.

Vimeo API changelog ↗
Questions

Vimeo API, answered.

Which OAuth scopes does an integration need?+
It depends on the action. Reading public data needs no special scope, but reading nonpublic videos or metadata needs the private scope. Uploading needs upload, editing metadata needs edit, and deleting needs delete. Liking, commenting, following, and adding videos to folders need interact, and downloading the original source files needs video_files together with the right account membership. A token is requested with a space-separated list of scopes, and the default when none is asked for is 'public private'.
How does an app upload a video?+
An upload starts with POST /me/videos, which needs the upload scope and returns a tus upload link. The file is then transferred to that link using the open tus resumable protocol, which sends the file in chunks so a paused or interrupted upload can resume instead of starting over. The older resumable PUT 'streaming' approach was replaced by tus in API version 3.4.
How does Vimeo handle API versioning?+
Every request can name the version it wants in the Accept header, like application/vnd.vimeo.*+json;version=3.4, and 3.4 is the current public default. The header can even pin different versions for different resource types in a single request. Pinning a version means a representation will not change underneath an integration until it deliberately targets a newer one.
Does Vimeo support webhooks?+
Webhook support is limited and scoped to an API app rather than to a token. An app can register a webhook URL for events such as video.upload.complete and video.play, and the receiver verifies the vimeo-signature header to confirm the request is genuine. There is no webhook for transcode completion, so checking whether a video has finished transcoding is done by polling the video's status rather than waiting for a push.
What does an API error response look like?+
An error returns an HTTP status code plus a JSON body with four fields: error, a message safe to show a person; developer_message, the technical detail; error_code, a numeric Vimeo code; and link, a documentation URL or null. For example, exceeding the rate limit returns HTTP 429 with error_code 9000, and a banned client returns HTTP 403 with error_code 3500.
What is the difference between a showcase, a folder, a channel, and a group?+
They organize videos in different ways. A showcase, called an album in the API, is a curated collection an owner presents, often embedded as a player. A folder, called a project in the API, organizes an owner's own videos privately for workflow. A channel is a public, themed feed others can follow, and a group is a community space members can join and contribute to.
Is there an official Vimeo MCP server?+
Vimeo's developer documentation describes a Model Context Protocol server for working with the Vimeo API from an AI client, covering listing videos, reading video details and statistics, updating videos, and managing transcripts. It authenticates with a Vimeo access token. Because its hosting and first-party status are not stated as a Vimeo-hosted endpoint, treat the REST API and OAuth as the governed path an agent connects through.
Related

More social API guides for agents

What is Bollard AI?

Control what every AI agent can do in Vimeo.

Bollard AI sits between a team's AI agents and Vimeo. Grant each agent exactly the access it needs, read or write, area by area, and every call is checked and logged.

  • Set read, write, or full access per agent, never a shared Vimeo token.
  • Denied by default, so an agent reaches only what has been explicitly allowed.
  • Every call recorded in plain English: who, what, where, and the decision.
Vimeo
Video Ops Agent
View videos ResourceOffReadFull use
Upload videos ActionOffReadFull use
Delete videos ActionOffReadFull use
Showcases ResourceOffReadFull use
Per-agent access, set in Bollard AI, not in Vimeo