Skip to main content
Not implemented yet. Today the platform uses a first-party human-login session, which is not a partner integration model. This page documents the requirement, not a shipped feature.

​
Purpose

The authentication and scope model the API must have before the intelligence surface publishes for external integrations.

​
What is required before this publishes

  1. API-key or OAuth client-credentials auth, replacing first-party login JWTs.
  2. Scopes, at minimum:
    • read
    • write
    • destructive
    • billing/comms-impacting, for operations that spend money or message candidates (phone calls, AI interviews, invite sends)
  3. Per-key rate limits and quotas across every published endpoint, at parity with the protections already enforced on Exterview’s other production services (request throttling, quota headers, idempotency keys).
  4. Per-organization data-access controls enforced at the API gateway for every published operation.
  5. GraphQL versioning and a deprecation policy.
  6. DPA and legal sign-off for any operation returning candidate PII (reports, transcripts, recordings).

​
Scope-gated operations

Some operations are scoped even once auth exists:
The Career Page capability is exempt. It is public and unauthenticated by design.

​
Tracking

Progress against this checklist is tracked internally. Nothing in the Capabilities section of this site goes live until every box is checked.

​
FAQs

Not as a partner. The only credential today is a first-party login token. API-key or OAuth client-credentials auth is required first.
At minimum read, write, destructive, and billing/comms-impacting, plus decisions:write for decision overrides.
Because they spend money, message candidates, or change the hiring audit trail. Those are never in the default read tier.
Yes, the Career Page. Every other capability sits behind this checklist.

Developer Preview

How the API is shaped, scoped, and planned to work.