Loading…
MCP server providing 130 recruiting and talent management tools for AI-powered hiring workflows.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 1 month ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The 100hires-mcp-server MCP server exposes 133 tools, focused primarily on communication, filesystem, and web capabilities. Its published description reads: "MCP server providing 130 recruiting and talent management tools for AI-powered hiring workflows". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates 100hires-mcp-server F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Data-exfiltration parameters" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check 100hires-mcp-server's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add 100hires-mcp-server to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://mcp.100hires.com/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
List candidates with optional filters. Supports filtering by job, stage, email, name, LinkedIn, and date ranges. Returns paginated results. Recommended size <= 10: candidate payloads include the full
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: hires_list_candidates
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
d only when the API key has access to multiple companies."},"job_id":{"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: hires_list_candidates
A tool description tries to alter the model’s use of another tool.
ngle record via hires_get_candidate.RecommendationDescriptions must describe only their own tool.
tool: hires_create_candidate
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
tc.), parse the file content yourself from the chat context — LLMs nativelyRecommendationRemove side-channel parameters; constrain tool inputs.
tool: hires_create_candidate
One tool reads private data, ingests untrusted content, AND can send data outbound — the three preconditions for autonomous data theft in a single call. A prompt injection reaching this tool can exfiltrate secrets with no further step.
PDF/DOCX/etc.), parse the file content yourself from the chat context — LLMs nativelyRecommendationSplit the capabilities across separate least-privilege tools so no single tool can read secrets, read untrusted input, and reach the network at once.
tool: hires_upload_candidate_file
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
"Base64-encoded file content."},"file_name":{"type":"string","description":"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: hires_upload_candidate_file
A tool description tries to alter the model’s use of another tool.
fically, prefer hires_create_candidate / hires_update_candidate with resume_text — theRecommendationDescriptions must describe only their own tool.
tool: hires_list_candidate_messages
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
l and messaging history for a candidate. Use is_scheduled=1 to filter oRecommendationRemove side-channel parameters; constrain tool inputs.
tool: hires_send_candidate_message
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
itted, uses the API key owner's default mail account."},"cc":{"type":"aRecommendationRemove side-channel parameters; constrain tool inputs.
tool: hires_send_candidate_message
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: hires_list_applications
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: hires_create_application
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
"Base64-encoded file content."},"file_name":{"type":"string","description":"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: hires_update_application
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
"Base64-encoded file content."},"file_name":{"type":"string","description":"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: hires_update_application
A tool description tries to alter the model’s use of another tool.
nsitions prefer hires_move_application or hires_advance_application.RecommendationDescriptions must describe only their own tool.
tool: hires_list_application_stage_history
A tool description tries to alter the model’s use of another tool.
through /candidates/{id}/activities when only stage data is needed.RecommendationDescriptions must describe only their own tool.
tool: hires_upload_application_attachment
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
"Base64-encoded file content."},"file_name":{"type":"string","description":"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: hires_list_jobs
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
r multi-company API keys)"},"status":{"type":"string","description":"FilRecommendationRemove side-channel parameters; constrain tool inputs.
tool: hires_list_jobs
A tool description tries to alter the model’s use of another tool.
ngle record via hires_get_job.RecommendationDescriptions must describe only their own tool.
tool: hires_create_job
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
d only when the API key has access to multiple companies."},"form_id":{RecommendationRemove side-channel parameters; constrain tool inputs.
tool: hires_create_job_webhook
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: hires_delete_job_webhook
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "webhook_id"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: hires_rotate_job_webhook_secret
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "webhook_id"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: hires_list_messages
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
queue, delivery history, and plan next sends. Recommended size <= 10: mRecommendationRemove side-channel parameters; constrain tool inputs.
tool: hires_update_message
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
If omitted, the API key owner's default mail account is used."},"cc":{"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: hires_patch_message
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
If omitted, the API key owner's default mail account is used."},"cc":{"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: hires_batch_create_messages
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
If omitted, the API key owner's default mail account is used."},"cc":{"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: hires_batch_create_messages
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: hires_list_email_templates
A tool description tries to alter the model’s use of another tool.
le template via hires_get_email_template.RecommendationDescriptions must describe only their own tool.
tool: hires_create_nurture_campaign
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ID (optional if API key is scoped to one company)"},"title":{"type":"stRecommendationRemove side-channel parameters; constrain tool inputs.
tool: hires_create_company
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: hires_update_company
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: hires_create_webhook
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: hires_delete_webhook
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "webhook_id"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: hires_rotate_webhook_secret
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "webhook_id"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: hires_get_workflow_stages
A tool description tries to alter the model’s use of another tool.
. Equivalent to hires_list_workflow_stages with workflow_id filter.RecommendationDescriptions must describe only their own tool.
tool: hires_list_template_placeholders
A tool description tries to alter the model’s use of another tool.
here, then use hires_prepare_template_placeholders to get an HTML tag for insertion.RecommendationDescriptions must describe only their own tool.
tool: hires_submit_feedback
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "endpoint"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: hires_download_attachment
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: hires_upload_attachment
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
e authenticated API key's company. Returns `{uuid, url, file, relative_RecommendationRemove side-channel parameters; constrain tool inputs.
tool: hires_submit_career_application
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
"Base64-encoded file content"},"file_name":{"type":"string","description":"RRecommendationRemove side-channel parameters; constrain tool inputs.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: hires_update_candidate
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_delete_candidate
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_remove_candidate_tag
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_batch_remove_tags
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_list_candidate_files
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
candidate_files List all files attached to a candidate (resumes and other docuRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: hires_disqualify_candidate
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_send_candidate_message
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: hires_create_application
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: hires_update_application
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_delete_application
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_move_application
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_advance_application
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_hire_application
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_reject_application
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_unreject_application
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_transfer_application
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: hires_list_application_attachments
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
ion_attachments List all file attachments linked to an application (resumes,RecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: hires_batch_move_applications
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_batch_reject_applications
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_create_job
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: hires_update_job
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_delete_job
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_set_job_status
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_publish_to_job_board
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: hires_remove_from_job_board
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_batch_publish_to_boards
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: hires_batch_remove_from_boards
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_create_job_webhook
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: hires_delete_job_webhook
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_rotate_job_webhook_secret
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_update_message
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_patch_message
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_delete_message
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_batch_create_messages
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: hires_update_notification_message
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_delete_notification_message
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_cancel_all_notification_messages
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_update_note
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_delete_note
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_create_form
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: hires_update_form
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_delete_form
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_update_form_question
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_update_email_template
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_delete_email_template
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_create_nurture_campaign
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: hires_update_nurture_campaign
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_delete_nurture_campaign
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_create_company
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: hires_update_company
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_delete_company
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_restore_company
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_create_webhook
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: hires_delete_webhook
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_rotate_webhook_secret
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_update_question
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_delete_question
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: hires_upload_attachment
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: hires_submit_career_application
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
The server exposes one or more ui:// (MCP Apps) resources whose HTML/JS renders inside the host client — a client-side injection / data-exposure surface most scanners ignore. Flagged for review, not damning on its own.
8 ui:// resource(s); e.g. ui://widget/candidate-list.htmlRecommendationReview each ui:// resource’s markup and scripts; treat host-rendered UI as untrusted, sandbox it, and never expose secrets or conversation context to it.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Create a new candidate profile. Optionally link to a job/stage and attach the candidate's resume as extracted text. Used for imports, inbound forms, and enrichment workflows. When the user provides an
Get full candidate data including application summaries by candidate ID or alias.
Update candidate fields, profile answers, and optional resume text. Used for bi-directional sync from ATS, CRM, sourcing, or enrichment tools. When the user provides an attached resume, parse it yours
Permanently delete a candidate by ID or alias.
List all tags assigned to a candidate. Useful for segmentation and audience-based automations.
Add one or more tags to a candidate. Used for campaign tagging, qualification labels, and source attribution.
Remove a specific tag from a candidate.
Add tags to multiple candidates in one request (max 100). Returns per-item results with partial success support.
Remove tags from multiple candidates in one request (max 100). Returns per-item results with partial success support.
List all files attached to a candidate (resumes and other documents). Each entry has uuid, absolute download url (use Bearer auth), relative_time, file metadata (orig_file_name, file_ext, file_type/MI
Upload a file for a candidate using a base64 payload. Used for portfolio uploads and document attachment. WARNING: host function-call serializers (both OpenAI and Anthropic) truncate tool arguments ab
Get the primary resume for a candidate. Returns uuid, absolute download url (use Bearer auth), relative_time, file metadata, type. Use include='text_content' to also get the parsed plain-text content
List timeline activities for a candidate (comments, stage moves, AI responses, etc.). Supports filtering by event type. Recommended size <= 10: copilot responses and call transcriptions can be large p
Disqualify a candidate from all active applications. Optionally provide rejection reason IDs. Returns affected application IDs.
List all interviews for a candidate across all applications. Useful for timeline views and scheduling conflict detection.
List email and messaging history for a candidate. Use is_scheduled=1 to filter only pending scheduled messages. Recommended size <= 10: messages include full HTML body; if the response exceeds the bud
Schedule an email message to a candidate. If scheduled_at is omitted, the message is scheduled for 15 minutes after creation.
List applications across all accessible jobs. Supports filtering by candidate, job, stage, status, AI score range, and date ranges. Use for pipeline analytics, sync jobs, and ATS dashboards. Avoid inc
Create an application by linking an existing candidate to a job. Use for sourcing workflows and manual application ingestion. The candidate must already exist.
Get full application details including stage, status, and rejection context. Recommended before mutating stage transitions.
Update application fields such as stage, disqualification flag, and CV. For explicit stage transitions prefer hires_move_application or hires_advance_application.
Permanently delete an application. This removes it from all list and view queries.
Moves an application to a specific pipeline stage for explicit stage transitions in workflow orchestration. Requires the target stage_id (available via the job's pipeline_stages).
Advance an application to the next pipeline stage according to workflow order. No stage_id needed -- the system determines the next stage automatically. **Always pass `include=candidate,job`** when su
Mark an application as hired. This is the finalization step in a hiring workflow. The application status changes to 'hired' and hired_at is set.
Reject an application with an optional rejection reason. Use GET /taxonomy/rejection-reasons to list available reason IDs. Set suppress_notification to skip the rejection email.
Undo a rejection and reopen a previously rejected application. The status returns to active and rejected_at is cleared.
Transfer an application to another job. A new application is created on the target job. Optionally specify a stage on the target job's pipeline.
Get the structured AI score for an application, including per-criterion scores, justifications, and follow-up questions. Returns null score if the application has not been AI-scored.
Get the full chronological stage transition history for an application, including the initial assignment. Each entry has from_stage_id/name, to_stage_id/name, moved_at (Unix seconds), moved_by_type (s
List all file attachments linked to an application (resumes, cover letters, documents). Returns file metadata and download URLs.
Upload a file attachment to an application. Provide the file as base64-encoded data. Commonly used for signed documents and interviewer artifacts.
List all filled evaluation forms for an application. Each evaluation includes the evaluator, summary score (strong-yes to strong-no), and summary text.
Schedule a new interview for an application. Provide start/end times as Unix timestamps and a list of interviewer user IDs. Location is resolved to an existing record or created automatically.
Move multiple applications to a pipeline stage in one request. Returns per-item results with partial success support. Max 100 application IDs per request.
Reject multiple applications in one request with an optional rejection reason. Returns per-item results with partial success support. Max 100 application IDs per request.
List jobs with optional filters by status, date range, department, or search query. Returns paginated results. Use for career-site sync, reporting, and external system indexing. Recommended size <= 10
Create a job with taxonomy, location, salary, and workflow configuration. Primary endpoint for programmatic job publishing. Required fields: status, title, description, location_city, location_country
Get full details of a job by ID or alias. Use `include` to load related workflow, hiring team, or pipeline stages data.
Update mutable job attributes. Only send fields you want to change. Preserves domain-level validation rules.
Delete a job. Use to align archived/removed positions across integrated platforms.
Change job status via dedicated endpoint. Recommended for publish/unpublish/archive transitions and status automation workflows.
Get current board publication state for a specific job. Returns which job boards the job is published to. Useful for distribution dashboards and posting audits.
Activate selected job boards for a job. Sets boards to activation queue state. Use for controlled multi-board publishing workflows.
Deactivate selected board publications for a job. Stops the job from being listed on specified boards.
Get board publication states for multiple jobs in one request. Optimized for batch monitoring and management UIs.
Activate board publication for multiple jobs in one request. Use for bulk job distribution workflows.
Deactivate board publication for multiple jobs in one request. Use for bulk depublishing workflows.
List users currently assigned to a job's hiring team. Useful for notification routing and collaboration tooling.
Add a company member to the job's hiring team. Use in workflow setup and ownership automation.
List webhooks configured for job-level events. Use to audit subscriptions and deployment state.
Register a webhook URL for job-related events. Core step for outbound integration setup. URL must be HTTPS. Returns a signing_secret once — store it to verify the x-hires-signature-v2 header on incomi
Delete a job webhook subscription by ID. Use for cleanup, rotation, and endpoint migration.
Rotate a job webhook's signing secret (zero-downtime). Returns the new signing_secret once; the previous secret stays valid for a grace window so deliveries are not dropped while you switch over.
List messages sent or scheduled from a specific mail account. Returns outbound messages only (sent and scheduled), not received. Useful for monitoring cold outreach campaigns — check pending queue, de
Get a scheduled message by ID. Returns scheduler-backed message details including sender account, schedule timestamps, and cancelability.
Fully update (replace) a scheduled message before send time. All required fields must be provided.
Partially update a scheduled message before send time. Only provided fields are changed.
Cancel a scheduled message before it is processed by the mailbox scheduler.
Create up to 100 scheduled messages in one request. Each item specifies its own candidate_id and message payload. Items are processed independently -- one failure does not stop others. Per-candidate R
Get a notification email message (e.g. rejection email) by ID. Returns subject, body, sender, recipient, and schedule metadata. Use candidate messages list to discover notification message IDs.
Update a scheduled notification email before it is sent. Change subject, body, and optionally reschedule the send time. Only scheduled (not yet sent) messages can be updated.
Cancel a scheduled notification email before it is sent. Already sent messages cannot be canceled.
Cancel all scheduled notification emails for a candidate. Already sent notifications are not affected. Returns success even if no scheduled notifications exist.
List interviews with optional filters by job, application, candidate, interviewer, date, or timestamps for incremental sync. Returns paginated results. **Always pass `include=candidate`** when surfaci
Get full details of a specific interview by ID. Use `include` to embed related candidate, application, or job data.
List notes by candidate. Returns paginated discussion notes for a candidate. Use for shared recruiter context and timeline synchronization. Notes can contain long free-form text; if the response excee
Create a discussion note for a candidate. Supports visibility control (all or private) and @mentions with email notifications. **Always pass `include=candidate`** when surfacing results in the widget
Get a single note with author and visibility metadata. Use include=user to load author details.
Update note body and/or visibility without creating a new timeline item. Use for corrections and moderation workflows.
Delete a note. Use for moderation policies and data cleanup operations.
Get a filled evaluation form with all answers. Returns evaluator info, summary score, summary text, and individual question answers. Use for detailed review of evaluator feedback on a candidate applic
List application forms (paginated). Returns forms with their questions for the target company. Recommended size <= 10: each form embeds its full question list; if the response exceeds the budget the t
Create a new application form, optionally attaching existing questions by ID.
Get form details including all questions with their statuses.
Update form name and question composition.
Delete an application form.
Update the status (required/optional/hidden) of a question inside a form.
List email templates for the target company. Returns paginated results with template name, subject, and body. Recommended size <= 10: templates include the full HTML body; if the response exceeds the
Create a new email template with name, subject, and body. Subject and body support placeholders like {{first_name}}, {{job_title}}. To embed placeholders: 1) GET /template-placeholders to list them, 2
Get full details of a specific email template by ID, including subject and body content.
Update an existing email template. Only provided fields are overwritten; omitted fields keep their current values. To add placeholders, use the same workflow as creation.
Soft-delete an email template. Templates already used in automations will stop being available for new actions.
List nurture campaigns with pagination. Returns campaign summaries including steps.
Create a nurture campaign with steps. Steps are executed sequentially; each step has a type (email, sms, voicemail, move_to_next_stage, assign_tag, assign_task) with type-specific fields. Optionally b
Get a single nurture campaign by ID with all steps and configuration details.
Update an existing nurture campaign. Pass all steps -- mark removed steps with is_deleted=true. Existing steps must include their id.
Delete (soft-delete) a nurture campaign. Active campaign executions will be stopped.
List users for the target company with role context. Returns paginated results useful for access reviews and hiring-team management.
Get a single user by ID within current tenant scope. Use for identity resolution in automation flows. The `default_mail_account_id` field can be used as `from_account_id` when sending emails.
List mail accounts connected to a user. Use to resolve `from_account_id` before creating scheduled emails via POST /candidates/{id}/messages.
List partner-accessible companies with pagination. Use for tenant discovery and management panels.
Create a client company (partner tenant) — provisions its public career-site URL (slug) and public branding (logo, name). Typical entrypoint for multi-tenant onboarding.
Get company profile and owner metadata. Use before updates or ownership-sensitive actions.
Update company profile, owner contact data, and optional logo — changes the tenant's public career-site URL (slug), name, and logo (public branding). Supports partner-operated account management.
Delete (soft-delete) a company — takes its public career site offline. Use for lifecycle control in partner tenancy management.
List all mail accounts for all users in the current company. Use to resolve `from_account_id` before creating scheduled emails.
List all mail accounts for all users in a specific company. The company must be accessible (own company or a client).
Restore a previously deleted company and re-enable it for active use — its public career site comes back online. Use for recovery and rollback scenarios.
List webhook subscriptions configured at company scope.
Create a company-scoped webhook subscription. Use for outbound company-level event integrations. Returns a signing_secret once — store it to verify the x-hires-signature-v2 header on incoming deliveri
Delete a company-scoped webhook subscription by ID. Use for endpoint retirement and security rotation.
Rotate a company webhook's signing secret (zero-downtime). Returns the new signing_secret once; the previous secret stays valid for a grace window so deliveries are not dropped while you switch over.
List candidate sources for the company. Use for attribution sync and reporting consistency.
List candidate origin taxonomy values. Use for attribution analytics and source normalization.
List configured rejection reasons for the company. Use to validate rejection actions and analytics.
List job status labels (draft, published, on_hold, closed, archived). Cache to validate job status updates.
List departments for the company. Use for job organization filters and reporting dimensions.
List global job categories. Use for job classification and consistent taxonomy mapping.
List education level taxonomy values. Useful for job requirements and structured matching.
List experience level taxonomy values for role seniority modeling.
List supported employment types (full-time, part-time, contract, etc.). Use for validation and normalization.
List available publishing boards with metadata. Use for distribution setup and board selection.
List all tags for the company. Returns paginated results. Recommended to cache for fast tagging UX.
List workflows with embedded stages for the company. Use to build stage-aware integrations and routing rules.
List pipeline stages filtered by workflow or job. Useful for transition UIs and workflow validation.
Get stages for a specific workflow by ID. Equivalent to hires_list_workflow_stages with workflow_id filter.
List paginated question catalog for the company.
Create a reusable question with optional answer options for dropdown types. Used by forms and questionnaires.
Get a question definition including type and options by ID.
Update text, type, or options of an existing question definition.
Delete a reusable question from the catalog. Use cautiously when deprecating question banks.
List available question types supported by the platform. Use to drive dynamic form builders.
List available placeholders for email templates with pagination. Use `type` to filter by category, `q` to search by label. Discover placeholders here, then use hires_prepare_template_placeholders to g
Convert a placeholder reference into an HTML tag for insertion into an email template body.
Get billing/pricing capability flags for the current company. Use before invoking paid-only API behaviors.
Submit structured API feedback about missing features, issues, or workflow improvements. Rate limited to 5 requests per hour.
Download an attachment (resume, candidate file, application file, mail attachment, call recording). Pass the absolute URL returned by another endpoint (e.g. `message.attachments[].url`, `cv.url`, `res
Upload a file and create an attachment. Supported categories: `voicemail` (wav/mp3, max 20 MB, no object_id — returned `uuid` is usable as `attachment_uuid` in nurture voicemail steps); `candidate` (c
List publicly visible jobs for a company career site. Supports filtering by department, employment type, city, and country. Use to power a custom careers page.
Get full details of a single public job by ID. Returns salary, education level, experience level, and other extended fields. Returns 404 for draft, archived, or internal jobs.
Submit a job application on behalf of a candidate. Creates a candidate record and triggers the career-site pipeline automation.