Skip to main content
Upcoming. Partner API credentials are not available yet. This page documents the requirement. To connect an AI assistant today, use the MCP server: OAuth 2.1 with Microsoft sign-in, scoped to the person asking.

​
Purpose

The authentication and scope model the API must have before the intelligence surface publishes for external integrations.

​
What is required before this publishes

  1. API-key or OAuth client-credentials auth, replacing first-party login JWTs.
  2. Scopes, at minimum:
    • read
    • write
    • destructive
    • billing/comms-impacting, for operations that spend money or message candidates (phone calls, AI interviews, invite sends)
  3. Per-key rate limits and quotas across every published endpoint, at parity with the protections already enforced on Exterview’s other production services (request throttling, quota headers, idempotency keys).
  4. Per-organization data-access controls enforced at the API gateway for every published operation.
  5. GraphQL versioning and a deprecation policy.
  6. DPA and legal sign-off for any operation returning candidate PII (reports, transcripts, recordings).

​
Scope-gated operations

Some operations are scoped even once auth exists:
The Career Page capability is exempt. It is public and unauthenticated by design.

​
Tracking

Progress against this checklist is tracked internally. Nothing in the Capabilities section of this site goes live until every box is checked.

​
FAQs

Not as a partner API client. API-key or OAuth client-credentials auth is Upcoming. Connected assistants can use the MCP server today.
At minimum read, write, destructive, and billing/comms-impacting, plus decisions:write for decision overrides.
Because they spend money, message candidates, or change the hiring audit trail. Those are never in the default read tier.
Yes, the Career Page. Every other capability sits behind this checklist.
  • API Introduction. The MCP server available today, and how the partner API is shaped.