Zapier & API Keys

Zapier connects Ventorie to 6,000+ other apps without code. Ventorie provides: • Triggers (things that start a Zap): New Purchase Order, Purchase Order Status Changed (including automatic changes from shipment tracking and connector syncs), Low Stock Alert (fires once per day per product when replenishment planning flags it critical), and Vendor Reply Received (an email from one of your vendors landed in the AI Inbox). • Actions (things a Zap does in Ventorie): Create Purchase Order, Adjust Inventory, Create Case, Add Note to Case. • Searches: Find Vendor, Find Product, Find Purchase Order — for dropdowns and lookup steps.

1. Open Integrations in the sidebar and find the "Zapier & API keys" card. 2. Enter a name (e.g. "Zapier") and click Create key. 3. Copy the key immediately — it starts with vk_ and is shown only once. If you lose it, revoke it and create a new one. When Zapier asks for your Ventorie credentials, paste this key.

• When a PO is confirmed → post to a Slack channel or Microsoft Teams. • When a low-stock alert fires → add a row to a Google Sheet or create a Trello card. • When a vendor replies → notify the buyer who owns that vendor. • When a Typeform/Jotform order form is submitted → create a draft PO in Ventorie. • When a PO is received → trigger your accounting or BI workflow.

The same surface works for any tool that speaks REST, not just Zapier. Authenticate with Authorization: Bearer vk_… and use POST /api/v1/public/hooks {topic, target_url, secret?} to subscribe to purchase_order.created, purchase_order.status_changed, inventory.low_stock, or vendor.reply_received. Events are delivered as JSON POSTs with automatic retries (about 1 minute, 5 minutes, 30 minutes, 2 hours, 12 hours); respond 410 Gone to unsubscribe permanently. If you set a secret, each delivery carries an X-Ventorie-Signature: sha256=… HMAC of the body so you can verify authenticity.

API keys are hashed at rest — Ventorie cannot show a key again after creation. Each key is scoped to one business. Revoking a key immediately blocks its API access and deactivates every webhook subscription it created, so a Zap built on a revoked key stops receiving data instantly.