Zapier/Make.com Connector

Paid pluginsize Mplanned, not built

Indicative price, not an offer: €24/mo; credential: we publish official Zapier/Make app, webhook support

Generated from docs/plan/paid/zapier-make-com-connector/PLAN.md in the AstroBaaS repository. Nothing described below is implemented — it is the written plan for it.

Merchants automate business logic by connecting AstroBaaS to Zapier or Make.com workflows. New orders, refunds, and inventory changes trigger Zapier/Make actions (Slack notifications, spreadsheet updates, email campaigns). The paid pack publishes and maintains the Zapier/Make apps; core owns the webhook interface.

The problem

Merchants want to automate workflows (Zapier, Make) but AstroBaaS is not available as an app. Webhooks require custom code; non-technical merchants cannot use them.

What it does

• Official Zapier app: new order, refund, payment declined triggers available as Zapier Zaps
• Official Make.com app: same triggers available in Make scenarios
• Rich event data: order detail, customer info, items, total, payment status included in trigger payload
• Searchable fields: orders can be found by ID, customer email, date range (for Make/Zapier lookups)
• Webhook validation: signed webhooks prevent spoofing
• Test mode: send test events to Zapier/Make workflow
• Rate limiting: 1000 events per hour per app (documented in app description)

What it deliberately does NOT do

Each boundary carries its reason. A boundary without a reason gets crossed by the next person who reads this.

• Custom app per merchant: Zapier/Make apps are shared by all AstroBaaS merchants; merchant-specific customizations are not supported.
• Real-time sync: Zapier/Make workflows have latency (up to 5 minutes); if real-time is required, use webhooks directly.
• Bidirectional sync: AstroBaaS app sends events only; Zapier/Make cannot update AstroBaaS data (requires separate admin API endpoint, which is out of scope here).
• Advanced filtering: Zapier/Make filter logic is handled by Zapier/Make, not AstroBaaS (reduce scope to simple triggers).

Data model

No new schema; uses existing webhook infrastructure. Zapier/Make integrations publish to webhook endpoints maintained by Zapier/Make APIs.

API

• POST /api/zapier/trigger/order-created { event payload } (internal; triggered by order subsystem)
• POST /api/zapier/trigger/refund-requested { event payload }
• POST /api/zapier/trigger/inventory-low { product, quantity }
• GET /api/zapier/auth (Zapier app validates OAuth token)
• GET /api/zapier/test (admin only, sends test event)

Every route added here must also appear in src/pages/openapi.json.ts — a test fails the build if it does not.

Admin

Admin sees: Zapier/Make connection status (connected/disconnected), list of triggers available, test button, event delivery stats (last 24 hours), webhook rate limit status.

The seam — why this is paid

Core owns the webhook interface. Paid pack owns: Zapier app publishing (in Zapier app directory), Make.com app publishing (in Make app marketplace), app maintenance and vendor relationship.

Support commitment: Zapier/Make app maintenance, webhook SLA, action verification

Dependencies

• webhook-management (existing; delivers events to Zapier/Make)
• event subsystem (existing; publishes order, refund, inventory events)

Acceptance checks

Each of these must be able to fail. Before claiming this is done, break the code deliberately and watch each one go red.

• Merchant creates Zapier Zap: ‘When order created, send Slack message’; new order triggers notification
• Make.com scenario: ‘When order > 100 EUR, add to Google Sheet’; orders above threshold are logged
• Event payload includes order ID, customer email, items, total, payment status, order date
• Webhook is signed with HMAC-SHA256; Zapier/Make validates signature
• Admin clicks ‘Send test event’; test order appears in Zapier flow for configuration
• Rate limit of 1000 events/hour is enforced; 1001st event receives 429 Too Many Requests
• Zapier app appears in Zapier app directory and can be found by searching ‘AstroBaaS’
• Event delivery log shows trigger count, successful deliveries, failed deliveries (by type)

Risks

If webhook signature is not validated, merchants can forge orders in Zapier workflows. If event payload is missing fields, Zapier/Make workflows fail (e.g., customer email missing). If rate limit is not enforced, a misbehaving workflow consumes quota and blocks legitimate workflows. If Zapier/Make API changes, app breaks (maintenance burden). If webhook retries create duplicates, Zapier workflows receive order twice.

Commercial context

The anchor is what the nearest equivalent charges on Shopify or Magento today. It is context for a pricing decision, not the decision.

---

Generated from the commerce plan. See docs/COMMERCE-PLAN.md for the full catalogue and ../../AI-GUIDE.md for how to work on this repository.