Zapier and Make (webhook-based)

Set up

1. Status, plainly: webhook-based, no marketplace listing. There is no CapchaCloud app in the Zapier or Make directories; you use Zapier's Webhooks and Make's HTTP modules.
2. Inbound to your zap/scenario: register a Catch Hook / custom webhook URL as your tenant webhook (POST /api/v1/tenant/webhook). Each capture then posts a JSON event containing certificate_id, verify_json_url, verify_html_url and the lead fields.
3. Verify the signature in a Code step before trusting an event (snippet below): HMAC-SHA256 over timestamp + dot + raw body, in the X-CapchaCloud-Signature header as v1=hex.
4. Outbound from your zap/scenario: call the API with an HTTP module and your API key (verify-lead, suppression check, certificate export).

Snippets

Verify a CapchaCloud webhook signature (Node, for a Code step)server

const crypto = require("crypto");

// rawBody: the exact request body string. headers: the request headers (lower-cased keys).
function verifyCapchaWebhook(rawBody, headers, secret, toleranceSeconds = 300) {
  const sig = String(headers["x-capchacloud-signature"] || "");
  const ts = String(headers["x-capchacloud-timestamp"] || "");
  if (!sig.startsWith("v1=") || !/^\d{10}$/.test(ts)) return false;
  if (Math.abs(Date.now() / 1000 - Number(ts)) > toleranceSeconds) return false;
  const expected = crypto.createHmac("sha256", secret).update(ts + "." + rawBody).digest("hex");
  const got = sig.slice(3);
  return got.length === expected.length && crypto.timingSafeEqual(Buffer.from(got), Buffer.from(expected));
}

HTTP module: check a lead (Zapier Webhooks 'Custom Request' or Make 'Make a request')server

POST https://capchacloud.com/api/v1/verify-lead
Authorization: Bearer YOUR_API_KEY
Content-Type: application/json

{"email": "lead@example.com", "phone": "+15551234567"}

HTTP module: check the suppression (DNC) list before you dial or sendserver

POST https://capchacloud.com/api/v1/suppression/check
Authorization: Bearer YOUR_API_KEY
Content-Type: application/json

{"phone": "+15551234567"}

HTTP module: pull a flat certificate record for a pipeline (LeadConduit-style field names)server

GET https://capchacloud.com/api/v1/leadconduit/cert?certificate_id=CERTIFICATE_ID
Authorization: Bearer YOUR_API_KEY

HTTP module (buyer side): validate a certificate before you buy the leadserver

POST https://capchacloud.com/api/v1/buyer/certificate/validate
Authorization: Bearer YOUR_BUYER_API_KEY
Content-Type: application/json

{"certificate_id": "CERTIFICATE_ID", "max_age_seconds": 86400}