Zapier & Make

The Zapier and Make apps are thin consumers of the public developer platform:

Triggers are outbound webhooks created through /v1/public-api/webhook-subscriptions.
Actions call /v1/public-api/candidates, /v1/public-api/jobs, and /v1/public-api/applications/:id.
Authentication is a per-organization API key.

They are not Nango connectors. Nango is the unified connection vault for third-party systems Vitae connects to on behalf of recruiters, such as HR/payroll and job boards. Zapier and Make are downstream automation consumers of Vitae’s public API and webhook surface.

Required scopes

Use the minimum scopes needed by each automation. The full private app bundle uses:


candidates_read
candidates_write
jobs_read
jobs_write
applications_read
applications_write
placements_read
webhooks_read
webhooks_write

Zapier app

The Zapier app definition lives in integrations/zapier.

Triggers:

Trigger	Event type
New Candidate	`candidate_created`
New Job	`job_created`
Updated Application	`application_updated`
New Placement	`placement_created`

Actions:

Action	Public API call
Create Candidate	`POST /v1/public-api/candidates`
Create Job	`POST /v1/public-api/jobs`
Update Application	`PATCH /v1/public-api/applications/:id`

Auth, missing-scope, and rate-limit failures are surfaced as Zapier errors: 401 invalid/revoked key, 403 missing scope, and 429 rate limited with the Retry-After hint.

Make app

The Make custom app manifest lives in integrations/make/vitae.make.json and mirrors the Zapier module set. It uses the same API key header and the same subscribe/unsubscribe endpoints for instant webhook modules.

Listing path

Publish the Zapier app privately and import the Make manifest as a private custom app.
Connect both with a scoped production API key from a real organization.
Smoke test every trigger and action against live Vitae data.
Submit the Zapier app through Zapier Platform review and the Make app through Make’s custom/partner app review path.

Directory approval is an external review step. The repo contains the private app definitions and the public API/webhook contracts they depend on.