Automate workflows with PDQ's Zapier Integration

Licensing Model: Free for PDQ Customers on the premium plan

Connect PDQ to 7,000+ apps through Zapier. Automate device onboarding workflows, sync inventory data to your existing tools, and trigger software deployments from external events — no scripting required. Deployments happen when the workflow says they should, not when someone remembers to click Deploy.

What is Zapier? Zapier connects PDQ to other apps through automated workflows called Zaps. A Zap starts with a trigger (something happens in PDQ) and then performs one or more actions (something happens in another app, or vice versa). Zaps run in the background on Zapier's infrastructure, so they work even when you're not logged in.

What you'll need

Before setting up your first Zap, make sure you have the following:

• A PDQ account on the Premium plan (API access is required) - sign up here if you don't have one
• A Zapier account — sign up here if you don't have one (the free tier works for basic Zaps)
• A PDQ API key — generate one at Settings > API Keys
• Admin role in PDQ (or a custom role with API key permissions)

For more details on API key management, see PDQ API.

Connect PDQ to Zapier

1. Log in to Zapier and click Create a Zap (or + Create in the top nav).
2. In the trigger step, search for PDQ.
3. Select a trigger event (for example, New Device) and click Continue.
   
4. Click Sign in to PDQ. A dialog will appear with two fields:
   
   • Connection Name — A friendly label to identify this connection (e.g., "Production" or "Acme Corp"). This is only used within Zapier to help you tell connections apart.
   • API Key — Paste the API key you generated from Settings > API Keys.
5. Click Yes, Continue to PDQ.
6. Zapier will test the connection by pulling a sample device from your account. If the test succeeds, you're connected.
7. Configure any optional filters (like OS or device name), then click Test Trigger to pull in sample data.
   
8. Add an action step by searching for the app you want to connect (e.g., Slack, Jira, Google Sheets) and map the PDQ data fields into the action.
9. Test the Zap, then click Publish to turn it on.

Tip: If you manage multiple PDQ organizations, you can add multiple connections in Zapier — each with its own API key and connection name. Zapier will prompt you to choose which connection to use when building a Zap.

What you can automate

The PDQ Zapier integration provides triggers (events that start a Zap), searches (look up a specific record mid-workflow), and an action (do something in PDQ).

Triggers

Triggers are events in PDQ that kick off a Zap.

New Device and New Package are best for event-driven workflows — reacting to something that just happened. Matching Device, Matching Package, and Matching Group are polling triggers that return all matching records on each run, making them ideal for scheduled syncs and bulk operations.

Polling frequency: How often Zapier checks for new data depends on your Zapier plan. Free plans poll every 15 minutes; paid plans can poll as frequently as every 1–2 minutes.

Searches

Searches look up a single record in PDQ. Use them as a mid-Zap step when you need to enrich data or look up details before taking action.

Searches vs. triggers: Searches return a single result (the first match) and are used in the middle of a Zap to look up data. If you need all matching records, use the Matching Device, Matching Package, or Matching Group trigger instead.

Actions

Actions let other apps do something in PDQ.

The Deploy Package action accepts device IDs (dvc_...) and group IDs (grp_...). You can pass multiple targets separated by commas, spaces, semicolons, or newlines.

Device filters (Matching Device)

The Matching Device trigger supports extensive filtering so you can target exactly the devices you need. All filters are optional — leave them blank to return all devices.

Text filters (partial match — matches if the device value contains your input): Name, hostname, OS version, last user, current user, manufacturer, model, serial number, public IP address, MAC address, service pack, timezone.

Dropdown filters (exact match): OS (Windows / Mac), architecture (64-bit / 32-bit), requires reboot (Yes / No), SMBv1 enabled (Yes / No).

Date range filters (ISO 8601 format, e.g., 2025-01-01T00:00:00Z): Last seen after/before, enrolled after/before. You can set one or both bounds.

Numeric range filters: Memory in MB (at least / at most), free disk space percentage (at least / at most). For example, to find devices with less than 10% free disk space, set "Free Disk Space (%) At Most" to 10.

Group filter: Enter a group ID (grp_...) to return only devices belonging to that group.

Including additional data

By default, device records include core fields like name, OS, hostname, and serial number. Use the Include Additional Data multi-select to attach extended information to each device record. This is available on Matching Device, Find Device by ID, and Find Device.

Performance tip: Only include the data you actually need. Each include adds to the response size and processing time, especially when working with large device inventories.

Popular workflows for IT teams

Here are some of the most common ways IT teams use PDQ + Zapier together. Each workflow can be set up in a few minutes.

1. Get Slack or Teams alerts when new devices enroll

Trigger: New Device → Action: Send Channel Message (Slack or Microsoft Teams)

When a new device enrolls in PDQ, automatically post a notification to your IT team's channel with the device name, OS, and the user who enrolled it. This gives your team instant visibility into fleet changes without checking PDQ manually.

Pro tip: Use the OS filter on the trigger to create separate Zaps for Windows and Mac enrollments, routing them to different channels or with different instructions.

2. Create a helpdesk ticket for new device onboarding

Trigger: New Device → Action: Create Issue/Ticket (Jira, Freshdesk, ServiceNow, Zendesk, etc.)

Automatically create an onboarding task whenever a new device enrolls. The ticket can include the device name, serial number, and OS so your team knows exactly what needs to be configured. Pair this with the Freshdesk or JIRA integration sidebar for even richer context — see Integrate PDQ with Freshdesk or Integrate PDQ with JIRA.

3. Keep an asset inventory spreadsheet in sync

Trigger: Matching Device → Action: Create or Update Spreadsheet Row (Google Sheets, Excel, Airtable)

On a recurring schedule, pull all devices (or a filtered subset) from PDQ and sync them into a spreadsheet. Use the includes option to attach software, disk, or networking data for a complete asset register. This is especially useful for compliance reporting or sharing device data with teams that don't have PDQ access.

4. Trigger a deployment from an external event

Trigger: New Form Response (Google Forms, Typeform, Microsoft Forms) → Search: Search Package → Action: Deploy Package

Let end users request software through a form. When a submission comes in, use a search step to find the matching package in PDQ, then deploy it to the requester's device. This creates a lightweight self-service portal without building a custom app.

5. Alert on low disk space or devices needing a reboot

Trigger: Matching Device (with filters) → Action: Send notification (Slack, Email, PagerDuty, etc.)

Use the numeric range filters to find devices with less than 10% free disk space, or the "Requires Reboot" boolean filter to find devices pending a restart. Route the results to Slack, email, or your incident management tool so you can act before users start complaining.

Troubleshooting

"Authentication failed" or "Invalid API Key"

• Make sure you're using an API key from a Premium plan. API access is not available on non-Premium tiers.
• Check that the API key hasn't been revoked. You can verify and manage keys at Settings > API Keys.
• If you recently rotated your key, update the connection in Zapier: go to My Apps, find PDQ, and reconnect with the new key.

Zap isn't triggering

• For New Device / New Package triggers: These use polling, which means Zapier checks for new records on a schedule. On the free plan, this happens every 15 minutes. Newly enrolled devices may take up to one polling cycle to appear.
• For Matching Device / Matching Package / Matching Group triggers: These return all matching records each time they run. If your filters are too narrow, the trigger may return no results. Try broadening your filters or removing them temporarily to confirm data is flowing.
• Click Test Trigger in the Zap editor to manually pull data and verify your filters are working.

Deploy Package isn't working

• The Package field accepts a Package ID (pkg_...) or a Package Version ID (pkgver_...). Use the dropdown to browse available packages, or paste an ID directly.
• The Targets field requires at least one device ID (dvc_...) or group ID (grp_...). Make sure you're passing the full ID including the prefix.
• Verify that the target devices are online and have the PDQ agent installed.

Rate limits

The PDQ API allows 300 requests per 2-minute window per organization. Under normal Zapier usage you're unlikely to hit this limit. If you're running many Zaps simultaneously against the same organization, you may see intermittent errors — Zapier will automatically retry failed requests.

Data fields are missing or empty

If you expect to see software, disk, or networking data but the fields are empty, make sure you've selected the relevant options in the Include Additional Data multi-select on your trigger or search step. These fields are not included by default.

Privacy & security

The PDQ Zapier integration was built with the same security-first mindset as PDQ itself. This section explains how your data moves, what Zapier can and can't do, and how to keep things locked down.

Authentication

The integration uses API key authentication. When you connect PDQ to Zapier, you provide an API key from your PDQ settings. Zapier stores this key encrypted and sends it as a Bearer token on every request it makes to the PDQ API.

There is no shared login, no password handed to Zapier, and no OAuth delegation. Zapier acts as an authenticated client — like any other tool you'd grant API access to.

Your API key carries your access level. Zapier's access to PDQ is scoped to the permissions of the key you use. We recommend creating a dedicated API key for Zapier so you can track and revoke it independently without affecting other integrations.

What data Zapier can access

The integration is designed to read broadly and write narrowly. Most actions are read-only. The only action that writes anything to your environment is Deploy Package, which requires you to explicitly configure a package and target in your Zap.

Read access (triggers & searches)

• Devices — Name, hostname, OS, architecture, last user, insertion date. Optional extended data (opt-in per Zap) includes installed software, custom fields, disks, network adapters, processors, Windows Updates, drivers, Windows features, Active Directory info, and AD group memberships.
• Packages — Name, publisher, version, source, version history.
• Device groups — Name, type, source.

Extended device data is opt-in. If you don't select those Include Additional Data options when building your Zap, that data is never requested or transmitted.

Write access (actions)

• Deploy Package — Triggers a package deployment to one or more specified devices or groups. This is the only action that causes PDQ to do something in your environment.

How data flows through a Zap

• All traffic is encrypted. Every request between Zapier and the PDQ API travels over HTTPS/TLS.
• PDQ only receives data you send. Data flows from PDQ to Zapier during read steps, and from Zapier to PDQ only when you explicitly trigger a deployment.
• Zapier retains task history. Zapier logs Zap runs — including sample input and output data — in your account's task history. If a Zap reads sensitive device data (like AD group memberships or installed software), that data appears in run logs. Review Zapier's data retention policy to understand how long this is kept.
• Downstream apps receive what you pass them. If your Zap sends device data to Slack, a spreadsheet, or a ticketing system, that destination now has a copy of that data. Review the privacy practices of every app in your Zap.

Security best practices

Use a dedicated API key for Zapier. Don't reuse an existing key. Create one specifically for Zapier so you can revoke it independently if needed.

Label your connection clearly. Use a descriptive name like PDQ – Zapier Prod when setting up the connection. This makes it easy to identify and audit if you have multiple connections.

Only request the data your Zap actually needs. Extended device fields like installed software and AD group memberships are optional. If your Zap doesn't need them, don't include them.

Review Zap task history regularly. Zapier stores a record of recent runs under Zap History. If your Zaps handle sensitive device data, check what's being logged and adjust retention settings accordingly.

Audit active connections periodically. In Zapier, go to My Apps to review connected accounts and remove any that are no longer in use. In PDQ, review and delete unused API keys at Settings → API Keys.

Rotating or revoking access

To rotate your API key:

1. Go to Settings → API Keys in PDQ and create a new key.
2. In Zapier, go to My Apps, find your PDQ connection, and reconnect using the new key.
3. Verify your Zaps are working, then delete the old key from PDQ.

To fully revoke Zapier's access:

• In PDQ: Delete the key at Settings → API Keys. This immediately invalidates the credential — all Zaps using that connection will stop working.
• In Zapier: Go to My Apps, find the PDQ connection, and disconnect it. This removes the stored credential from Zapier's systems.

Deleting the key in PDQ is sufficient to immediately terminate access.

Security FAQs

Can Zapier read my PDQ account password or billing information? No. Zapier only receives the API key you explicitly provide. It has no access to your PDQ login, billing information, or account settings.

Can Zapier modify PDQ settings or create/delete devices? No. The only write capability is triggering a deployment of an existing package. There are no actions that modify settings, create devices, delete devices, or alter packages.

Does PDQ see what other apps are in my Zaps? No. PDQ only sees API requests that reach its servers — it has no visibility into how Zapier routes data or what other apps are connected.

What should I do if my API key is compromised? Delete it immediately from Settings → API Keys in PDQ. The key is invalidated the moment it's deleted. Then create a new key and reconnect your Zaps.

Is this integration covered by PDQ's security program? Yes. The PDQ API powering this integration is part of PDQ's standard security posture. See the PDQ Privacy Policy and PDQ Security for details.

Who do I contact for security concerns? For PDQ-related concerns, contact security@pdq.com. For concerns about Zapier's handling of data, contact Zapier Support.

Frequently asked questions

Can I deploy to a group of devices, or only individual devices? You can deploy to both. The Deploy Package action accepts device IDs (dvc_...) and group IDs (grp_...). Mix and match by separating them with commas.

What data does PDQ send to Zapier? Only the data you request. Triggers and searches return device, package, or group records from the PDQ API. No data is stored on Zapier's servers beyond what's needed to run your Zaps. See Zapier's security practices for details.

Does Zapier replace PDQ automations? No. PDQ's built-in automations are the best way to handle recurring deployment schedules within PDQ (e.g., "deploy the latest Chrome to all devices in this group when a new version is released"). Zapier is for cross-tool workflows — notifying Slack, creating tickets, syncing data to a spreadsheet, or triggering deployments from external events.

Can I use Zapier with multiple PDQ organizations? Yes. Add a separate connection in Zapier for each organization, each with its own API key and connection name. When building a Zap, you'll be prompted to choose which connection to use.

What Zapier plan do I need? The free Zapier plan supports single-step Zaps with 15-minute polling. For multi-step Zaps (e.g., trigger + search + action), faster polling, or higher task volumes, you'll need a paid Zapier plan. See Zapier pricing for details.

Learn more

• PDQ API documentation — Full API reference for advanced integrations
• PDQ API (Help Center) — API key setup and PowerShell examples
• PDQ on Zapier — Browse pre-built Zap templates and popular integrations
• Zapier Getting Started Guide — New to Zapier? Start here
• PDQ Community Discord — Share workflow ideas and get help from other PDQ admins