Purpose
This page is the one-screen orientation for developers: how the API is shaped, how it’s scoped to your organization, and how a typical integration flow works end to end. Everything on this page describes what’s planned, not what’s live — the full operation-by-operation technical reference publishes once partner authentication ships.How the API is shaped
- GraphQL-first, one endpoint. A single endpoint serves every intelligence capability: create the entities, trigger an evaluation, then read the result. A small REST surface exists only for a health check and typed bulk-file ingest (candidate and job uploads) — everything else is GraphQL.
- Scoped to your organization. Every request runs inside your organization. Your organization and role are derived from your credentials on the server, never trusted from the request body — there is no access to another customer’s data.
- Poll-based, no outbound webhooks. Exterview does not send outbound webhooks to partner integrations today. Long-running operations, like an AI phone screen, are read by polling the relevant record until its status is ready, rather than waiting for a push notification.
- Filtered and paginated reads. List operations accept arguments to narrow results (by status, by parent entity, by search term) and are paginated rather than returned in one call.
A typical integration flow
Regardless of which evaluation you’re driving, the shape is the same:1
Create or locate the entities
A job and a candidate must exist first — created individually or in bulk.
2
Trigger the evaluation
Call the capability’s trigger operation. This starts async work; it doesn’t
return the finished result.
3
Poll for completion
There’s no outbound webhook. Poll the record until its status reaches a
terminal state.
4
Read the AI output
Once ready, read the report — the structured, cited evaluation.
5
Read the stack rank
See where the candidate now sits, rolled up across every completed round for
the job.
Authentication
Access will use API-key or OAuth client-credentials with scopes (read, write, and higher-sensitivity scopes for actions that spend money, message candidates, or change a hiring decision). This is a prerequisite that hasn’t shipped yet. See Authentication for the full scope model and current status.
Conventions
- Errors follow the standard GraphQL
{ data, errors }shape; a custom error-code taxonomy isn’t published yet. - Rate limits and idempotency are planned — per-key limits, quota headers, and required idempotency keys on money- or comms-impacting mutations — but not enforced yet.
- Pagination will use Relay-style (
edges/pageInfo) for GraphQL connections and REST-style (perPage/pageNumber) for a few endpoints like the stack-rank read.
FAQs
Can I call the API today?
Can I call the API today?
Only the public Career Page surface. Everything else requires partner authentication, which has not shipped. See Authentication.
Is it REST or GraphQL?
Is it REST or GraphQL?
GraphQL-first. REST exists only for a health check and typed bulk-file ingest
— see Bulk Ingest.
How is my data isolated from other customers?
How is my data isolated from other customers?
Every request is scoped to your organization, derived from your credentials on
the server. There is no access to another customer’s data.
Are outbound webhooks available?
Are outbound webhooks available?
Not today. Long-running operations are read by polling the relevant record
until it’s ready. Whether outbound webhooks ship later isn’t confirmed or
currently on the Roadmap.
Where's the full technical reference — exact fields, types, and operation names?
Where's the full technical reference — exact fields, types, and operation names?
It publishes here once partner authentication ships. Publishing exact operation names ahead of access controls being in place is an exposure we avoid by design.
Related
Authentication
The scope model and the prerequisite that gates the API.
Bulk Ingest
The REST routes for loading candidates and jobs in bulk.
Jobs & Candidates
The base entities every evaluation runs on.
Capabilities
What each capability does and why you’d use it.

