# Import from n8n, Zapier or Make (Preview)

Move a workflow you already have.

URL: https://docs.qaldy.com/connectors/import/

![Import a workflow: the export on the left, and on the right a report that says step by step what maps, what needs a connection and what cannot be imported.](https://docs.qaldy.com/screens/import.webp "Import a workflow, with a sample n8n export read. Sample data.")

Move a workflow you already have. Paste its export at **/import**, or give it to your coding agent
(MCP tool `import_workflow`). Qaldy reads it, tells you step by step what maps and what does not,
and leaves the result **switched off** until its owner has reviewed it.

This is a Preview: it maps the common steps and says so for the rest. It never fakes a translation.

## What happens

1. **Read.** `POST /v1/workspaces/:ws/imports/analyze` reads the text and returns a report. Nothing
   is stored. A pasted file is treated as hostile data: only own properties are read, size and depth
   are bounded, and nothing in it is ever evaluated.
2. **Create, switched off.** `POST /v1/workspaces/:ws/imports` keeps the **plan** (the steps as
   data) and the report, never the file (only its SHA-256, so the same file twice is the same
   import). It makes a draft app and, when a gate for it exists, a paused road. The same file from
   the same person is one import.
3. **Review and enable.** The owner reads the permission sentences, chooses the HTTP API connection
   for each host, skips the steps that could not be translated, and enables it
   (`POST /v1/imports/:id/enable`). An admin enables anything that spends a connector's sealed key
   (the same rule as a build). A token can analyze and create; it can never enable or discard.

## What the report says

Every step of the file, in running order, with one verdict:

| Verdict | Meaning |
|---|---|
| Maps 1:1 | Does the same here. |
| Maps with differences | Maps; the note says what differs (a Slack webhook posts to one channel, a sheet row is added by column position). |
| Needs a connection | Maps, but needs an HTTP API connection or a connector first. |
| Can't import | Not translated. The plan keeps a marker that **stops the run** until the owner skips it. |
| Left out | A note, or a step that was turned off. |

It also lists the connections to add (host, methods, key style, matching presets and connections the
workspace already has), the connectors to connect, the permission sentences of the result, and
warnings.

## What maps today

| | n8n | Zapier | Make |
|---|---|---|---|
| Starts | Schedule (all intervals and cron), Cron, Webhook, Manual | Schedule, Webhooks (catch hook) | Scenario schedule, Custom webhook |
| Steps | HTTP Request, Edit Fields (Set), If, Filter, Telegram (send), Slack (post), Send Email, Gmail (send), Google Sheets (append), Stop and Error | Webhooks (GET/POST/PUT/custom), Slack, Telegram, Gmail, Google Sheets (row), Email | HTTP request, Set variables, Telegram, Slack, Gmail, Google Sheets (row), filters between modules |
| Not imported | Code, loops, merges, switches, parallel paths, waits, AI nodes, service nodes without a step (the report says to rebuild them as HTTP requests) | Formatter, Code, Paths, Delay, Loops, Storage, AI | Routers, iterators, aggregators, tools, data stores, AI |

Starting from a Telegram message or a hosted form is **Planned**: such an import starts by hand
(Run now) until those triggers ship. Gmail and Google Sheets steps map. Google Sheets connects
through a service account (Preview); Gmail waits for the platform's Google sign-in app, so an import
with a Gmail step stays blocked until Gmail can be connected.

Zapier does not document its export. The reader follows the JSON it is known to produce (a `zaps`
list whose `nodes` carry `selected_api`, `action`, `params`) and a plain `steps` list; a file that
is neither says what it could not read.

Expressions translate only in their plain forms (a field, a field of a field, a list index). A
calculation, a function or a variable of the other tool does not: that step is reported as not
translated rather than guessed.

## What it will not carry over

- **Keys.** A key pasted into a header, a URL, a field or code is located (the step and the field)
  and never copied into the plan, the report, a log line or an audit row. A key in the URL's query
  makes that step "not imported": Qaldy no longer sends keys there. A key written into a step's own
  text (a message, a Set field, a condition) makes that step "not imported" too, and key-shaped
  text in a workflow or step name is masked. Rotate any key that was in a file you shared.
- **Hosts an expression picks, plain `http`, IP addresses, odd ports.** The gate connects to named
  HTTPS hosts an admin connected.
- **n8n's per-item behaviour.** n8n and Make run later steps once per item in a reply; Qaldy runs
  once per run. A list in a reply stays one value.
- **Webhook headers and query.** Only the request body reaches the steps.

## How it runs

An enabled import is a normal app whose code is **one fixed, reviewed runner**
(`packages/templates/runner`). The plan is data the runner reads, so a pasted file can never become
code. The manifest is exactly what the running steps use: the typed connectors, the chosen HTTP API
connections, no tables, no extra domains, no AI. The version's Trust Score is scored by
`import-runner.v0` (85 when every check that can run passes; the builder's static checks and smoke
tests did not run, and the report says so).