Zapier, Make.com & Power Automate

Zapier, Make.com, and Power Automate all consume plain HTTP webhooks, so point them at Event Bridge's API endpoint type — no OAuth2 or request signing required. The same approach works for any other platform that accepts an incoming webhook (n8n, a custom script), just substitute its "catch webhook" URL for the ones below.

Each section below mentions the x-pbo-* metadata headers (table name, event type, and so on) that come along with every event — see Testing & Troubleshooting → Headers & properties for the full list.

Zapier

1. In Zapier, create a Zap and choose Webhooks by Zapier → Catch Hook as the trigger. Copy the generated URL (https://hooks.zapier.com/hooks/catch/.../...).
2. In Business Central, open Event Bridge Setup:
   • Endpoint Type = API endpoint
   • API Endpoint = the URL from step 1
   • Authorization = No Auth
3. Back in Zapier, click Test trigger. Use Setup's Send Test Payload action (or trigger a real insert/modify on a table you've registered) so Zapier has a sample payload to map fields from.
4. Continue building the Zap's action steps using the payload fields and the x-pbo-* headers (e.g. x-pbo-table-name, x-pbo-event-type) if you want to branch on event type or source table — the API endpoint sends those as headers only, not as keys inside the JSON body.

Optional hardening: since the catch-hook URL itself is the only secret, add a Filter by Zapier step right after the trigger that checks a custom header — set Authorization = API Key in Business Central with a header name of your choosing, then filter on that header in Zapier. See Authentication.

Make.com

1. In Make, add a Webhooks → Custom webhook module as your scenario's trigger, click Add, and copy the generated URL.
2. In Business Central, open Event Bridge Setup:
   • Endpoint Type = API endpoint
   • API Endpoint = the webhook URL from step 1
   • Authorization = No Auth
3. Click Run once in Make, then send a test event from Business Central (Send Test Payload, or a real record change) so Make can auto-detect the JSON payload structure.
4. Add a Router or Filter downstream to branch on the x-pbo-table-name / x-pbo-event-type headers — the API endpoint doesn't add table_name or event_type keys to the JSON body itself, only to the request headers.

Optional hardening: same pattern as Zapier — set Authorization = API Key in Business Central and add a Filter on the router's first route checking that header value. See Authentication.

Power Automate

Power Automate's Request trigger is the same "give me a URL" webhook pattern as Zapier/Make, so this also uses the API endpoint type in Event Bridge Setup.

1. Create a flow (Instant or Automated) and add When a HTTP request is received as the trigger.
2. Optionally paste a sample JSON payload into Use sample payload to generate schema so Power Automate can offer payload fields as dynamic content in later steps. You can get a sample by running Setup's Send Test Payload action once and copying the body it would send.
3. Save the flow — Power Automate only generates the HTTP POST URL after the first save. Copy it.
4. In Business Central, open Event Bridge Setup:
   • Endpoint Type = API endpoint
   • API Endpoint = the URL from step 3
   • Authorization = No Auth
5. Trigger a real event (or use Send Test Payload) and check the flow's Run history to confirm the payload arrived, then refine the schema/actions from that run's trigger output.

The x-pbo-* headers (x-pbo-table-name, x-pbo-event-type, etc.) aren't surfaced as dynamic content automatically — reference them with an expression like triggerOutputs()?['headers']['x-pbo-event-type'] in a Condition or Switch step if you want to branch on them.

Optional hardening: Power Automate's generated URL already includes a signed sig= query parameter, so it's less guessable than Zapier/Make's plain path-based URLs out of the box. For stricter control, two options:

• Simple: set Authorization = API Key in Business Central and add a Condition step right after the trigger checking that header, same pattern as Zapier/Make above. See Authentication.
• Stronger (Premium plans): secure the trigger with Entra ID authentication so only callers with a valid token can invoke it, then set Authorization = OAuth 2.0 in Business Central pointing at your tenant's token endpoint with the flow's exposed API as the scope. See Authentication.