Zapier

Overview#

The Zapier connector proxies Zapier webhook endpoints and REST API calls. Webhook URLs and API keys are sealed in QuantaVault. All payloads sent to Zapier are encrypted before transit.

Prerequisites#

• 1A Zapier account with Webhook access
• 2A Zapier webhook URL (from Webhooks by Zapier trigger) or a Zapier API key

Configuration#

Follow these steps to connect Zapier to QuantaSeal. You can configure integrations via the Admin Console or directly via the API.

1. 1

   In Zapier, create a Zap with 'Webhooks by Zapier' as the trigger. Copy the webhook URL.

2. 2

   Seal: POST /api/v2/vault/seal with credential_type: webhook_secret and values: {url: 'https://hooks.zapier.com/...', secret: 'optional-signing-secret'}.

3. 3

   Create integration with system_type: zapier.

Authentication Types#

For webhook triggers, seal the webhook URL as webhook_secret. For the Zapier REST API, seal the API key as api_key.

All credential types are sealed in QuantaVault with ML-KEM-768 + AES-256-GCM and wrapped by your tenant AWS KMS CMK before storage. See the Vault API reference for the full list of credential types and seal/unseal endpoints.

Available Operations#

QuantaSeal enforces a default-deny operation policy. Only operations listed in your integration's allowed_operations array will be permitted. Add operations when creating or updating the integration.

Code Example#

Every proxy call returns a HybridCryptoEnvelope - the response is ML-KEM-768 key-encapsulated, AES-256-GCM encrypted, and signed with ML-DSA-65 + HMAC-SHA-512. Verify both signatures before trusting the decrypted payload.

curl -X POST https://api.quantaseal.io/api/v2/proxy/outbound \
  -H "X-API-Key: qs_live_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"integration_id":"int_ZAP001","operation":"trigger_webhook","payload":{"event":"new_customer","email":"alice@acme.com","plan":"professional"}}'

Troubleshooting#