Zapier & Make

The Zapier and Make apps are thin consumers of the Vitae API:

Triggers are outbound webhooks created through /v1/webhook-subscriptions.
Actions call /v1/candidates, /v1/jobs, and /v1/applications/:id.
Authentication is a personal API key (vit_...), the same key auth as every other API integration.

They are not managed integrations. A managed integration is a third-party system Vitae connects to on your behalf after you authorize it in settings, such as HR/payroll or a job board. Zapier and Make are downstream automation consumers of Vitae’s API and webhook surface.

Required scopes

Use the minimum scopes needed by each automation. The full private app bundle uses:

candidates_read
candidates_write
jobs_read
jobs_write
applications_read
applications_write
placements_read
webhooks_read
webhooks_write

Minimum does not mean write-only. A write scope covers POST, PATCH, and DELETE; it grants no read access at all. A key holding only candidates_write can upload a CV but is refused with 403 on GET /v1/candidates and GET /v1/candidates/:id.

This matters most in Make and Zapier, because a scenario almost always starts by searching for or fetching the record it is about to act on. A “Search Candidates” or “Get Candidate” module in front of your upload step will fail on that first module, which looks like the upload endpoint is broken when the key is simply under-scoped.

Grant the read scope alongside the write scope for every resource your scenario looks up, even when the automation’s purpose is only to write. Vitae warns you about this when you create the key, and a refusal names the exact scope that was missing.

Get this right at creation. Scopes cannot be edited afterwards, and rotating a key only replaces its secret, so fixing an under-scoped key means creating a new one with the full scope set, repointing the scenario at it, and revoking the old key.

Zapier app

The Zapier app definition lives in integrations/zapier.

Triggers:

Trigger	Event type
New Candidate	`candidate_created`
New Job	`job_created`
Updated Application	`application_updated`
Candidate Stage Changed	`application_stage_changed`
LinkedIn Connection Accepted	`linkedin_connection_accepted`
Message Received	`message_received`

Actions:

Action	API call
Create Candidate	`POST /v1/candidates`
Create Job	`POST /v1/jobs`
Update Application	`PATCH /v1/applications/:id`

Auth, missing-scope, and rate-limit failures are surfaced as Zapier errors: 401 invalid/revoked key, 403 missing scope, and 429 rate limited with the Retry-After hint.

Make app

The Make custom app manifest lives in integrations/make/vitae.make.json and mirrors the Zapier module set. It uses the same API key header and the same subscribe/unsubscribe endpoints for instant webhook modules.

Listing path

Publish the Zapier app privately and import the Make manifest as a private custom app.
Connect both with a scoped production API key from a real organization.
Smoke test every trigger and action against live Vitae data.
Submit the Zapier app through Zapier Platform review and the Make app through Make’s custom/partner app review path.

Directory approval is an external review step. The repo contains the private app definitions and the public API/webhook contracts they depend on.