External API of the Web-to-Object service

Looking at creating leads via the Web-to-Object service but sourced not from a web landing page but an API service.  The documentation seems to imply I can do this as this is an external system.

I was trying to post JSON data to this Web-to-Object service from Zapier with their generic POST action.  The process runs successfully, but a "Not allowed request URL" message is returned from my bpm’online instance or landing page record.  I know from a previous forum post here the Website Domains property needs to be set properly.  I have tried their domain, subdomains, and others per their support (e.g.  hooks.zapier.com).

Is the Website Domains “whitelisting” feature only apply to actual web page sources or does this restriction work with external services like Zapier (or Mulesoft, custom)?  Any help to POST to these bmp'online service via Zapier or other external process would be welcome.

Service Output

{
    "SaveWebFormObjectDataResult": "{resultMessage:\"Not allowed request URL.\",resultCode:-1}"
}