Zapier

Keel’s Zapier integration lets a Zap react to what happens in your compliance program, and write back into it, without writing code. It is a wrapper over the same REST API the MCP server uses, so it grants no more access than the API key you connect it with.

Private beta

The Keel app is in private beta and is not listed in Zapier’s public app directory. Access is by invite, which Keel emails to you. This page describes version 1.1.0 of the app. If a step below does not appear in your Zap editor, what the editor offers is the authority, and every step is also available without Zapier.

Get access

Request the invite from inside the app, at Integrations → Zapier setup. Keel emails the invite link to the address on your account.

Zapier connects through Keel’s API, which is available on the Pro plan and above. On a plan without API access the request button is replaced by a link to your plan options.

Connect your workspace

1. Accept the invite. This adds Keel to the app list in your Zapier account.
2. Create an API key in the app under Integrations. The key is shown once, so copy it before you leave the page.
3. Add Keel to a Zap. When Zapier asks you to connect an account, paste the key. Leave Keel app URL at its default, https://app.keelgrc.com, unless your workspace runs at a different address. The app sends your key only to an https:// address.

A key acts with the role of the person who created it. Create it as a workspace owner or admin, and make sure that person keeps the role: only owners and admins can remove a trigger subscription, so with any other role, turning a Zap off fails.

Turning a Zap on subscribes it to the relevant Keel event. You can see every active subscription under Active webhook subscriptions on the Integrations page, and Zapier removes the subscription when you turn the Zap off. Repeated testing can leave extras behind, and it is safe to remove any you do not recognise.

Triggers

A trigger starts a Zap when something happens in Keel. Keel delivers each one as a signed webhook to the URL Zapier subscribes, using the event named in the table. Every trigger also returns at, the time Keel emitted the event.

Trigger	Fires when	Event	Returns
Control Status Changed	a control’s implementation status changes	control.status_changed	control ID, new status
Task Created	a task is created, in the app or through the API	task.created	task ID, title
Task Status Changed	a task moves to a new status	task.status_changed	task ID, new status
New Risk	a risk is added to the risk register	risk.created	risk ID, title
New Vendor	a vendor is added	vendor.created	vendor ID, name, criticality tier
New Evidence	evidence is added, as an uploaded file or a link sent through the API	evidence.created	evidence ID, and the link or the file name and size
Policy Approved	a policy moves into approved	policy.approved	policy ID, title
Readiness Updated	a framework’s readiness percentage differs from the last one Keel recorded	readiness.updated	framework key and readiness figures

Details that affect how you build the Zap:

• Control Status Changed. When a bulk action in the app moves several controls at once, the trigger fires once for the whole change. It then has no single control ID. Instead it returns the new status, the number of controls changed, and a list of their IDs.
• Task Status Changed carries no title. Use the task ID in a later step if you need more.
• New Risk fires for a risk created through the API, in the risk register, by a risk CSV import, or from a vendor risk draft.
• New Vendor returns the criticality tier the vendor was created with.
• New Evidence returns the link for link evidence, and the file name and size in bytes for a file. It does not return the evidence title, because the event does not carry one.
• Policy Approved fires only on the move into approved. Saving a policy that is already approved does not fire it again.
• Readiness Updated runs on a schedule, not the moment something changes. Keel records the readiness of each framework your workspace has applied, and fires once for each framework whose percentage has changed since the previous record. It returns the framework key, the readiness percentage, the requirements covered, the requirements in scope, and the requirements with a gap or not yet addressed.

When you test a trigger in the Zap editor, Keel returns existing records shaped like a live delivery, so a field you map from the test is a field a real delivery carries. For New Risk the test records are a sample of the register, not necessarily the newest risks.

How the app checks a delivery

The Keel app verifies each delivery before a Zap runs on it. It checks the x-keel-signature header against the signing secret Keel returned when the Zap subscribed, checks that the delivery was addressed to that Zap’s subscription, and refuses a delivery whose at is more than five minutes old. A delivery that fails any check produces no trigger run and no error in your Zap history. A Zap subscribed before Keel signed deliveries has no secret, and Keel sends it nothing; turn the Zap off and on again to subscribe it with one.

Actions

An action writes into Keel from a Zap. An optional field you leave blank is left out of the request, so Keel applies its own default.

Action	What it does	Endpoint
Create Task	opens a remediation or work task	POST /api/v1/tasks
Update Task	changes a task’s status, its assignee, or both	PATCH /api/v1/tasks/[id]
Update Control Status	sets a control’s implementation status	PATCH /api/v1/controls/[id]
Create Risk	adds a risk to the risk register	POST /api/v1/risks
Create Vendor	adds a vendor	POST /api/v1/vendors
Report Evidence	records a link as evidence, optionally attached to a control	POST /api/v1/evidence
Create or Update Person	adds a person to the people directory, or replaces the profile of the person with that email	POST /api/v1/people

Create Task

Title is required. Description and Due date are optional. A new task fires the Task Created trigger.

Update Task

Task ID is required, for example from the Task Created trigger. Set Status (Open, In progress, Blocked, Done or Cancelled), Assignee email, or both. The assignee must be a member of the workspace. The step refuses to run with both left blank, and it cannot unassign a task. A status change fires the Task Status Changed trigger.

Update Control Status

Control ID and Status are required. Status is one of Not started, In progress, Implemented, Gap or Not applicable. Take the control ID from Find Control. The step changes the status only, so it works with any key whose role is not auditor. A change fires the Control Status Changed trigger.

Create Risk

Title and Treatment (Accept, Mitigate, Transfer or Avoid) are required. The optional fields are Description, Category, Likelihood and Impact (each 1 to 5), Status (Open, Treating, Accepted or Closed), Owner name, Owner email, and Residual likelihood and Residual impact (each 1 to 5).

Leave likelihood and impact blank to add the risk unscored. A blank status becomes Open. A new risk fires the New Risk trigger.

Create Vendor

Name is required. The optional fields are Website, Contact email, Criticality tier (Critical, High, Medium or Low), Status (Active, In review or Offboarded), Data the vendor can access, and Notes. A blank tier becomes Medium, and a blank status takes Keel’s default. A new vendor fires the New Vendor trigger.

Report Evidence

Link is required and must be an http or https address. Title is optional; leave it blank and Keel uses the address’s host name. Description is optional.

To attach the evidence to a control, give its Control key as shown in Keel, or its Control ID, for example from Find Control. The control must exist in your workspace. If it does not, Keel refuses the request and records nothing. This step records links only; it does not upload files. It fires the New Evidence trigger.

Create or Update Person

This step needs an API key created by a workspace owner or admin.

Email is required, and identifies the person. The optional fields are Full name, Job title, Department, Groups (a list), Manager email, and Status (Active, Suspended or Deprovisioned).

• No one has that email: Keel adds a new person. A blank status means Active.
• A person added by hand has that email: Keel replaces their whole profile with what the step sends. Any field you leave blank is cleared. Map every field you want to keep.
• A person synced from a directory connector has that email: their profile is kept, and only Status is applied.

A blank status on an existing person keeps their current status.

Searches

A search looks a record up part-way through a Zap, so a later step can use it. Each one uses the first match.

Search	What it finds	Endpoint
Find Control	a control by key or name	GET /api/v1/controls?query=
Find Vendor	a vendor by name	GET /api/v1/vendors?query=
Find Task	a task by title	GET /api/v1/tasks?query=
Find Readiness	the current readiness of one framework your workspace has applied	GET /api/v1/frameworks

• Find Control matches any part of the key or name, ignoring case. It returns the control’s ID, key, name, description, status, and owner name and email. Keel returns matches in key order.
• Find Vendor matches any part of the name, ignoring case. It returns the vendor’s ID, name, website, contact email, status, data access and notes, its tier, inherent tier and residual tier, and its review dates, with whether a review is due or overdue.
• Find Task looks up a task by title.
• Find Readiness takes a Framework key, for example iso-27001, soc-2 or hipaa, and defaults to iso-27001. The key is matched ignoring case and surrounding spaces. GET /api/v1/frameworks lists the keys your workspace has applied. A framework the workspace has not applied is not found.

Find Readiness reads the current figures rather than finding a record, and Zapier presents it as a search because that is the step type that returns data mid-Zap. It returns the framework’s key, name and version, whether it is the primary framework, the readiness percentage, and the counts behind it: total requirements, requirements in scope, covered, in progress, gap, not yet addressed, not applicable, and the framework’s clause count. If the framework is part of a bundle, it also returns the bundle’s key and name. A Zap built on the earlier version of this step, which covered ISO 27001 only, keeps working: the framework and figure fields have the same names.

Doing this without Zapier

Every step above is a plain API call. If you would rather not add Zapier to the picture, or you need something the Zap editor does not offer, you can subscribe to the same events yourself with POST /api/v1/hooks and call the same endpoints directly. See the REST API reference. Keel signs every webhook with a secret you receive once when you subscribe, so your endpoint can verify each delivery came from Keel. The reference shows how to verify a delivery.