No-code integrations
Wave 57 supplies source packages for n8n, Power Automate / Logic Apps, Zapier and Make. Local verification is recorded in the Wave 57 report. Marketplace publication, certification and account-hosted flow validation are separate pending steps; no connector has been published by this work.
Use a render-scoped key for document generation and form metadata. Add a separate editor-scoped catalogue key only for template lists and dropdowns. Routine rendering needs no admin key. Creating domain-event subscriptions is an admin operation; an operator can provision them separately. Zapier’s optional subscription-management credential is explicitly admin-scoped and is not used for renders.
n8n
Build and pack packages/n8n-nodes-pulp-engine, install the tarball as a community node in a self-hosted n8n, and restart n8n. After npm publication, install n8n-nodes-pulp-engine from Settings > Community nodes. Create Pulp Engine API credentials with your HTTP(S) API root and render key; the connection test checks capabilities. Optional catalogue key is used only by list operations.
In Pulp Engine > Document > Render, select Template > By Key with a render-only credential. Choose Map Fields to load the pinned form-metadata schema; top-level fields become controls and objects/arrays remain JSON. Choose a version OR a label, or leave both blank for server resolution. Mapped templates require Raw JSON because their schema describes transformed data. The result is binary property data, suitable for Write Binary File, email attachments or cloud upload nodes. The API filename is preserved.
Document also supports Dry Run and Submit Async Batch. Supply an array of {template,data} items, a public callback URL (defaults to {{$execution.resumeUrl}}) and a secret of at least 16 characters. A Wait resume URL can resume a flow, but does not verify this service’s HMAC itself; use Pulp Engine Trigger for signature verification before downstream work. Template supports List (editor catalogue key) and Get Input Schema (render key).
Pulp Engine Trigger receives batch, schedule and domain-event callbacks. Configure the same secret used by the sender. It validates original request bytes, sha256 HMAC and a five-minute timestamp tolerance before emitting workflow data. Optional event filter selects an exact type. For Source > Batch or Schedule Callback, register the public trigger URL with the submitting batch/schedule. Source > Domain Event Subscription creates an event subscription on activation and removes its own subscription on deactivation; use a separate admin credential only for this trigger. An operator can instead provision subscriptions manually. Deduplicate jobId/executionId/event id in your workflow; timestamp checks alone do not prevent short-window replays.
Power Automate and Logic Apps
integrations/power-automate contains Swagger 2, API properties, icon and import instructions. The generator reads the canonical OpenAPI and a fixed operation allowlist. Run node --import tsx scripts/build-power-automate-connector.ts; --check fails for any source-spec drift. The same check runs in CI.
The connection has an HTTPS base URL and render API key; the dynamic-host policy targets your own server. Add the optional editor catalogue key for dynamic template lists. A scoped policy applies that key only to listTemplates; rendering and getTemplateFormMetadata retain the render credential. The data field’s dynamic properties reference body/template, body/version and body/label. Nested refs, unions and complex arrays may require a raw JSON object in the designer. Use version OR label. Import and OneDrive flow verification need a Power Platform environment and remain pending.
Zapier
integrations/zapier is a Platform CLI app pinned to core 19.2.0. Install its dependencies, run its tests, then use Zapier’s validate/test/push flow in your own developer account. Render dynamically loads form metadata, accepts a raw JSON override, and stashes the binary output as a file URL. Find Template uses a known key and render scope. New or Updated Template polls the first 100 recent templates using the optional editor key. Larger/busy catalogues should use domain events to avoid missing revisions between polls.
The REST-hook event trigger can register and remove a subscription when the optional admin subscription credential is present. It verifies the raw request content and signed timestamp with the returned subscription secret. Host the API on a public HTTPS endpoint and confirm Zapier supplies rawRequest.content before enabling a live hook. Vendor validation and marketplace review are pending.
Make
integrations/make contains base/connection blocks, Render, Dry Run, Find Template Contract, List Templates and Watch Updated Templates modules. Paste each block into the matching custom app component in Make’s developer console; the README maps them. Render returns filename + binary data; its raw JSON input works for nested schemas. Use Find Template Contract to inspect the required data. The catalogue modules use the optional editor key; render-only workflows need no catalogue access.
For event callbacks, the optional integrations/webhook-relay.mjs verifies the exact received JSON bytes and five-minute HMAC before forwarding them to Make. Deploy it yourself behind public HTTPS, with PULP_WEBHOOK_SECRET, MAKE_WEBHOOK_URL and a separate 32-character PULP_RELAY_TOKEN. The Make event webhook checks the matching relay token. This avoids verifying a reserialized JSON body. Do not expose the Make webhook directly as a Pulp callback when raw bytes are unavailable. Register the public relay /callback URL with the service; subscription provisioning remains an operator task. No relay was deployed by this work. Account import and IML execution remain pending.
Shared limits
The API rejects callback targets resolving to private, loopback or link-local addresses. Local n8n/Make gateways therefore need a public HTTPS callback or a controlled relay; this change adds no private-network bypass. Respect the server’s format capabilities, render quotas and request-size limits. PDF rendering requires a configured renderer. Keep keys and signing secrets in connector credential stores, not workflow source control.