Videos with embed privacy set to “Only on sites I choose," also known as domain-level privacy, will need to take additional steps to use oEmbed for embed code retrieval.
In short, oEmbed requests for domain-level private videos will need to specify the domain in the request header to get the full oEmbed response returned. Requests that lack the whitelisted domain in the request header will be returned a truncated oEmbed response that omits private metadata (such as the video’s name, description, video ownership details, etc.)
Videos that are embeddable (i.e. embed privacy set to “Anywhere” or “Only on sites I choose”) but have viewing privacy set to “password” will only receive a truncated oEmbed response that omits private metadata.
Embeddable videos with viewing privacy set to “Only people with the private link” (also known as “unlisted”) must make an oEmbed request with the full unlisted video link to receive the full oEmbed response. Requests that lack the unlisted “hash” value at the end of the private link will receive a truncated oEmbed response.