Mutator and Zapier

Make videos and pictures from a Zap, and hear about them when they are made.

Nothing here publishes anything. There is no action in this integration that reaches a social account, because there is no endpoint in Mutator's API that schedules a post. A post exists once a person has put a particular file in a particular account's schedule, in Mutator, with their name against the decision.

Where it stands

The Mutator app is written and is not in Zapier's directory yet. Everything below works today through Zapier's own Webhooks by Zapier, against the same API the app uses, and moves over unchanged when the app is listed.

Connecting

Settings → API keys → New key in Mutator. Keys come with any paid plan and the secret is shown once.

A read key is enough to watch for things and to read them. The three actions that make things need a write key.

What a key reaches depends on the plan: automations are a Growth feature, so on Pro there are none to list and none to start, and everything else works.

Triggers

	Fires when
New Video or Picture	Mutator finished one and it passed the content check
Automation Run Finished	A run ended, whichever way
Generation Finished	Something asked for with the Generate action is ready, or failed
Post Published	A post somebody scheduled actually went out

Each one fetches the thing itself when a delivery arrives, rather than reading the delivery's copy of it. A delivery can sit on a queue while a receiver is down, and a signed link that old is a broken Zap. It also means the fields your Zap sees are the fields the API gives, so the sample you build against and the real delivery cannot drift apart.

Doing it today, without the app

Add Webhooks by Zapier → Catch Hook as the trigger. Copy the URL it gives you, then subscribe it once:

curl -X POST https://mutator.app/api/v1/hooks \
  -H "Authorization: Bearer loop_sk_..." \
  -H "content-type: application/json" \
  -d '{"event": "media.created", "targetUrl": "YOUR_CATCH_HOOK_URL"}'

The events are media.created, run.finished, generation.finished and post.published. The reply carries a secret, and every delivery is signed with it; the API documentation has the check to run before trusting one. DELETE /api/v1/hooks/{id} stops it.

A delivery carries ids rather than links. Add a Webhooks by Zapier → GET step on https://mutator.app/api/v1/media/{{id}} to read the file, which is what the app's triggers do for you.

Actions

Generate a Video or Picture. A row, a form or a message becomes a prompt. It answers at once with an id, because a clip takes minutes and an action that waits is one that times out. Pair it with the Generation Finished trigger.

Start an Automation. Runs one you have already built and switched on.

Add a Picture from a URL. A new product photo becomes a reference the next generation can paint from. PNG, JPEG, WebP or GIF, up to 32 MB, fetched by Mutator from a public link. It answers status: checking, because everything arriving goes past the content check before anything may paint from it.

Doing it today, without the app

Webhooks by Zapier → Custom Request, POST, with your key in the Authorization header. Every endpoint and its fields are in the API documentation.

Retries, and why every action asks for a key

Every write in Mutator's API takes an idempotencyKey, because a request that timed out after the work started looks exactly like one that timed out before it, and the work is a video somebody paid for.

The app fills one in for you from the Zap, the input and the hour. Two runs an hour apart are two requests; two identical runs inside one hour are one. Where that is wrong, set the Idempotency key field to something unique from your trigger, a row id or a file id.

Doing it by hand, send one yourself and use something stable from the trigger.

When something is refused

Mutator answers a refusal with a sentence you can act on and a code saying what would change the answer. The app turns each into the right kind of Zapier failure: a rate limit waits and tries again, words the content check refused halt the task because trying again will be refused the same way, and credits or a plan fail loudly, because only you can fix that one.

Doing it by hand, read code in the body. The table is in the API documentation.

Limits

120 reads and 30 writes a minute, per key. Download links last six hours: fetch the bytes rather than storing the link.