Zapier

Keel’s Zapier integration lets a Zap react to what happens in your compliance program, and write back into it, without writing code. It is a wrapper over the same REST API the MCP server uses, so it grants no more access than the API key you connect it with.

Private beta — not everything below is live yet

The integration is not yet listed in the Zapier app directory. Access is by invite, which Keel emails to you.

Keel’s side of a capability and the Zapier app’s side of it ship separately, so the tables below mark each one Available or Planned:

• Available — the Zapier app exposes it today. You can pick it in the Zap editor.
• Planned — Keel’s side is built and you can use it over the API (the event fires, or the endpoint is live), but the Zapier app does not offer it yet, so it will not appear in the Zap editor. See Doing this without Zapier.

These marks are maintained by hand and can lag a Zapier release. What you can actually select in the Zap editor is the authority.

Get access

Request the invite from inside the app, at Integrations → Zapier setup. Keel emails the invite link to the address on your account.

Zapier connects through Keel’s API, which is available on the Pro plan and above. On a plan without API access the request button is replaced by a link to your plan options.

Connect your workspace

1. Accept the invite. This adds Keel to the app list in your Zapier account.
2. Create an API key in the app under Integrations. The key is shown once — copy it before you leave the page.
3. Add Keel to a Zap. When Zapier asks you to connect an account, paste the key.
4. Build the Zap using the capabilities marked Available below.

Turning a Zap on subscribes it to the relevant Keel event. You can see every active subscription under Active webhook subscriptions on the Integrations page, and Zapier removes the subscription when you turn the Zap off. Repeated testing can leave extras behind — it is safe to remove any you do not recognise.

Triggers

A trigger starts a Zap when something happens in Keel. Each one is delivered as a signed webhook to the URL Zapier subscribes, using the event named on the right.

Trigger	Fires when	Event	In Zapier
Task Created	a task is created	task.created	Available
Control Status Changed	a control’s status changes	control.status_changed	Available
New Risk	a risk is added to your register	risk.created	Planned
New Vendor	a vendor is created	vendor.created	Planned
New Evidence	evidence is recorded	evidence.created	Planned
Readiness Updated	a framework’s readiness score changes	readiness.updated	Planned
Policy Approved	a policy is approved	policy.approved	Planned

Actions

An action writes into Keel from a Zap.

Action	What it does	Endpoint	In Zapier
Create Task	opens a task in Keel	POST /api/v1/tasks	Available
Create Risk	adds an entry to the risk register	POST /api/v1/risks	Planned
Create Vendor	adds a vendor to your workspace	POST /api/v1/vendors	Planned
Report Evidence	attaches a link as evidence, optionally to a control	POST /api/v1/evidence	Planned

Searches

A search looks a record up part-way through a Zap, so a later step can use it.

Search	What it finds	Endpoint	In Zapier
Find Readiness	the current ISO 27001 readiness summary	GET /api/v1/readiness	Available
Find Control	a control by key or name	GET /api/v1/controls?query=	Planned
Find Vendor	a vendor by name	GET /api/v1/vendors?query=	Planned

Find Readiness takes no input — it reads the current summary rather than finding a record, and Zapier presents it as a search because that is the step type that returns data mid-Zap. It scores ISO 27001 only; it does not report readiness for any other framework you have enabled.

Doing this without Zapier

Every capability above is a plain API call, including the ones marked Planned — those are built on Keel’s side and waiting on the Zapier app, not on the API. If you would rather not add Zapier to the picture, or you need something the Zap editor does not offer yet, you can subscribe to the same events yourself with POST /api/v1/hooks and call the same endpoints directly — see the REST API reference. Keel signs every webhook, so your endpoint can verify it came from us.