Automating ProjectSend with Zapier and n8n

ProjectSend's REST API works with Zapier, Make, n8n and anything else that can make HTTP requests — no official integration needed. You create a token in Settings → API tokens, and the tool signs in as you. ProjectSend does not push events yet, so automation tools poll the activity feed on a schedule instead. As of ProjectSend 2.8.0, this is all on v1 of the API.

This note is based on ProjectSend 2.8.0 (October 2026).

What you can build

Some things people use this for, taken from the Zapier guide in the docs:

• Post a message in Slack when a client downloads a file.
• Create a client account when someone fills in a form.
• Upload a file to ProjectSend when it lands in a Dropbox folder, then share it with a client.
• Add a row to a spreadsheet each time a file is shared.
• Send a reminder when a comment is waiting for approval.

Setting up a token

Zapier and other tools sign in as you using a token instead of a password. The token is scoped to exactly the abilities the integration needs, so a Zap that reads activity cannot create clients unless you say so.

1. Sign in and go to Settings → API tokens.
2. Click Create token and give it a name you will recognise later, like Zapier.
3. Tick only the abilities the integration needs. A Zap that reads activity and posts to Slack only needs view activity log. Setting a file's expiry date, download limit or public flag now requires those abilities ticked explicitly — they are their own permissions in 2.8.0. For full details, see the API guide.
4. Set an expiry. Tokens default to 90 days (maximum 365). Never expires exists for integrations that must run unattended — pick it deliberately, and scope the token tightly.
5. Copy the token immediately. It is shown once and never again.

If you upgraded from 2.7.x or earlier: tokens created before 2.8.0 do not have the new file-detail abilities. Re-create any token whose Zap sets file expiry, download limits, categories or the public flag. See the 2.8.0 changelog for the full list of affected abilities.

To confirm the token is working, make a test request to /api/v1/me. It returns the account the token belongs to and the abilities it has in effect:

curl -H "Authorization: Bearer YOUR_TOKEN" \
     -H "Accept: application/json" \
     https://your-install.example.com/api/v1/me

A 401 means the token is wrong or expired. A 403 means the token is valid but you did not tick that permission. Also see Hardening a ProjectSend Instance for guidance on keeping tokens scoped tightly.

Watching for things that happen

ProjectSend does not push events out yet, so Zapier has to ask. Use Webhooks by Zapier → Retrieve Poll (available on paid Zapier plans, as of October 2026). Zapier calls the URL every few minutes, runs the Zap for anything it has not seen before, and tracks items by their id. In the Zapier step, set Key to data — that is where the list of items lives in the response.

The most useful endpoints to watch:

• A file was shared with a client — /api/v1/activity?action[]=file.assigned
• A client downloaded a file — /api/v1/activity?action[]=file.downloaded
• A comment was posted — /api/v1/activity?action[]=comment.posted
• A file was added — /api/v1/files
• A client account was created — /api/v1/clients

Downloads and file shares do not leave a mark on the file itself — they are only visible through the activity feed. A share writes an assignment; a download is recorded as an event. Polling /api/v1/files will never show them, no matter how often you ask.

To watch for more than one kind of event, repeat the action[] parameter. To watch for changes since your last poll rather than the newest items each time, pass updated_since with the last timestamp you saw — the walk is then ordered oldest-first, so nothing is skipped. n8n's HTTP Request node follows links.next automatically.

Telling ProjectSend to do something

Use Webhooks by Zapier → Custom Request for actions. Every action needs the Authorization header with your token, and Content-Type: application/json for anything with a JSON body.

Create a client account

POST /api/v1/clients

{
  "name": "Acme Ltd",
  "email": "billing@acme.example",
  "password": "a-long-random-password"
}

The password must satisfy whatever rules the installation sets under Settings → Security — generate a long random one. The client can change it later.

Share a file with a client

POST /api/v1/files/{file-id}/assignments

{ "type": "client", "id": 42 }

Use "type": "group" to share with a whole group instead. This is idempotent — sharing the same file with the same person twice does nothing — so retrying a request is safe.

Upload a file

Use POST /api/v1/files with the file as form data, not JSON. The file field holds the file from an earlier Zap step, and name is what it will be called. The response includes the new file's id, which you pass to the share action in the next step.

Manage folders (since ProjectSend 2.7.0)

Create a folder with POST /api/v1/folders. If a folder with that name already exists in the same place, you get it back rather than an error, so a sync job can create a folder without checking first.

POST /api/v1/folders

{ "name": "Acme Ltd", "parent_id": 12 }

Three examples

1. Tell the team in Slack when a client downloads a file

• Trigger: Webhooks by Zapier → Retrieve Poll → GET /api/v1/activity?action[]=file.downloaded
• Action: Slack → Send Channel Message, using actor.name and subject.name from the trigger output.

This is the one people ask for most, and it is only possible through the activity feed — a download leaves no trace on the file itself.

2. Create a client account from a form

• Trigger: your form app (Typeform, Google Forms, or similar).
• Action 1: Zapier → Formatter → Utilities → Random Value, to generate a password.
• Action 2: Webhooks by Zapier → Custom Request → POST /api/v1/clients. Map the form's name and email fields into the body, and use the generated password.

3. Put a Dropbox file into ProjectSend and share it

• Trigger: Dropbox → New File in Folder.
• Action 1: Webhooks by Zapier → Custom Request → POST /api/v1/files with the Dropbox file in the file field (form data, not JSON).
• Action 2: Webhooks by Zapier → Custom Request → POST /api/v1/files/{{id}}/assignments, using the id that came back from action 1.

Things to know before you rely on it

Token expiry

Tokens expire by default — 90 days to start, up to a year. When one expires, the Zap stops, but nobody gets an automatic alert. Zapier shows errors; the usual first sign is noticing weeks later that something stopped happening. If you set an expiry, put a calendar reminder for a week before. To replace a token, create a new one and paste it into the Zap — you do not need to rebuild anything.

Rate limits

Each token can make 60 requests per minute on a self-hosted installation (120 on ProjectSend Cloud). Uploads have a lower limit: 20 per minute (30 on Cloud). Zapier's polling is well within that. If you do hit the limit, the API now responds with a 429 and a Retry-After header telling Zapier how long to wait — fixed in 2.8.0, which previously returned a 500 instead. See the 2.8.0 release notes.

Large files

The single-request upload works up to this installation's configured maximum. For very large files there is a resumable upload that sends the file in parts — it takes four steps and is not covered here. The API reference inside ProjectSend describes it.

Only staff accounts

A token belongs to a staff account, not a client account. Clients cannot create tokens in v1. Everything a Zap does appears under the staff member who made the token in the activity log — worth knowing when you are troubleshooting.

No outgoing events yet

ProjectSend does not push events out yet — there are no outgoing webhooks in v1. Automation tools ask on a schedule instead. The one case where this makes a difference is deletions: a deleted file stops appearing in list results, but the activity feed records the moment it was deleted, so /api/v1/activity?action[]=file.deleted catches it. Note that a deletion entry has no subject — the name is in context.name instead, because the file is already gone when the entry is written.

Make, n8n, and other tools

Everything above works with any tool that can make HTTP requests — nothing here is Zapier-specific. A few notes from the Zapier guide on the most common ones:

• Make — use the HTTP module and its Iterator to walk the data array.
• n8n HTTP Request node — has built-in pagination that understands the links.next URL in list responses, so it walks all the pages on its own.
• Power Automate — use the HTTP action with the same Authorization header.
• Custom scripts — import /api/v1/openapi.json into Postman, Insomnia or a code generator. The API guide covers every endpoint.

Questions

If something here does not match what you are seeing, or a workflow is not behaving the way the docs describe, ask in our Discord or open an issue on GitHub. The Zapier guide in the docs has the full reference for every trigger endpoint and action, and improvements to it are welcome as pull requests to the app repository.

Also see more notes on client portals in the blog.