# Zapier: 2 point Door Gap
- Site: zapier.com
- Scanned: 2026-09-03
- Scan type: Basic scan
- Business type: b2b_saas
- Report: https://www.seconddoor.io/r/zapier-su9rjz
- Scanner version: 9
Zapier publishes prices and API documentation but blocks programmatic access to API keys, forcing agents into a manual signup flow.
## Scores
| Measure | Score |
| --- | --- |
| Humans | 73/100 |
| Agents | 71/100 |
| Composite | 72/100 |
| Door Gap | 2 points |
The human score is the mean of the four human dimensions, the agent score the mean of the six agent dimensions, and the Door Gap the difference between them.
## What the machine actually did
The agent got through 11 of 15 requests, but could not find a contact route for machines. It came up empty on 3 other checks too.
- ok      reach the site at all
- ok      find out whether machines are welcome
- ok      ask whether the door opens for requests carrying the AI crawlers' names
- ok      read the site's own guide for language models
- ok      find out what pages exist
- missing find a contact route for machines
- ok      find a published agent interface
- missing find an agent plugin manifest
- missing find out whether verified agents are recognised
- ok      read the homepage as data rather than as a page
- missing find a machine readable API spec
- ok      read the developer documentation
- ok      read the prices without running JavaScript
- ok      find a comparison page worth citing
- ok      walk the way a visitor would, to a signup form or a product
## Top issues
1. **No OpenAPI specification was found at the 5 standard paths checked, so a client must be written from prose instead of generated.** (programmatic_onboarding)
2. **No security.txt is published, leaving no machine readable security contact or vulnerability disclosure policy.** (machine_fetchable_trust)
The evidence and the recommended fix for each are on the report page: https://www.seconddoor.io/r/zapier-su9rjz
## Files generated from this scan
- **Machine interfaces: where you stand** at `notes`, 10 minutes, no developer needed. Verify: The next scan finds the interface you published answering at its well-known path, and that check passes.
- **security.txt** at `/.well-known/security.txt`, 10 minutes, no developer needed. Verify: The next scan fetches /.well-known/security.txt as text and the security.txt check passes.
Each file is written from what this scan found on the site. The content is in the JSON once the evidence is opened: https://www.seconddoor.io/api/reports/zapier-su9rjz
## The agent door
- **machine_discoverability** 100/100. Robots.txt names 8 AI crawlers and allows them all. A real browser is served the page normally. Key pages (home, pricing, docs) are readable without JavaScript. Sitemap lists 1228 URLs. 8 schema.org types on the homepage.
- **programmatic_onboarding** 25/100. Authentication is documented, endpoint examples are shown, code samples are provided.
- **pricing_legibility** 93/100. 3 prices are readable without JavaScript on the pricing page: Free, Professional at $19.99, and Team at $69. An enterprise tier routes to sales, which is standard practice. Prices are published as Offer structured data. Currency is USD.
- **agent_aware_instrumentation** 90/100. An MCP manifest is published at https://docs.zapier.com/.well-known/mcp.json. Robots.txt names 8 AI crawlers and allows them. Pricing.md publishes prices in machine readable form.
- **machine_fetchable_trust** 40/100. No security.txt is published at /.well-known/security.txt (404). The homepage answers automated requests normally. Structured data is present on the homepage. No Web Bot Auth signals are published.
- **commercial_rails** 80/100. Prices are published in raw HTML on the pricing page. A self serve signup form is reachable from the homepage in 2 steps. Pricing.md is machine readable. Plans are published as Offer structured data.
## The human door
- **steps_to_first_value** 80/100. The primary call to action is 'Start free' on the homepage. The signup form is 2 steps away. The form contains 4 fields with 0 required. A visitor can enter an email and password or sign in with Google without friction.
- **required_fields** 98/100. The signup form contains 4 fields with 0 required. One sign in option is offered: Google. Of 13 total inputs on the form, 0 carry validation rules such as minlength, pattern, or required attributes.
- **verification_walls** 80/100. No verification requirement appears on the signup page itself. Single sign on via Google avoids email verification entirely. The form does not ask for phone, credit card, or proof of identity.
- **error_recovery** 35/100. Of 13 inputs on the signup form, 0 carry validation rules. No inline error containers are present. 3 live regions are present on the page. A visitor who enters invalid data will not receive client side feedback before submission.
---
Scored by SecondDoor. Method: https://www.seconddoor.io/methodology
Scan another site: https://www.seconddoor.io
Rate an issue or this report: POST https://www.seconddoor.io/api/feedback, or the rate_fix tool on https://www.seconddoor.io/api/mcp