100Hires Billing API

openapi: 3.2.0
info:
  title: 100Hires Billing API
  version: 2.0.0
  description: '## Introduction to the 100Hires ATS API

    The 100Hires ATS API (v2) helps you automate recruiting workflows end-to-end: candidates, applications, jobs, forms, notes, and partner-company operations. All endpoints return JSON and use bearer authentication. ## OpenAPI Spec

    The 100Hires ATS API follows the OpenAPI 3.x specification. Download the machine-readable spec for use in MCP servers, Cursor, Claude Code, or any OpenAPI tooling:


    `GET https://api.100hires.com/v2/openapi.json`


    ## Authentication

    Send API token in the `Authorization` header for every request:


    `Authorization: Bearer `


    Each API key is tied to a specific **user + company** pair. If the same user belongs to multiple companies, they need a separate key for each company. All actions performed through the API are attributed to the key owner. You can generate or view your API key at https://app.100hires.com/settings/integrations


    ### API Key Verification

    API keys for **unverified companies** are created in a disabled state and will return `401 Unauthorized` until the company passes verification. Once your company is verified, API keys start working automatically — no action required. If your key returns `401` and you believe your company should be verified, contact **support@100hires.com**. ## Rate Limits

    API keys that are not yet approved, such as keys created during the free trial, are subject to a hard rate limit of **1,000 requests per 10 minutes** per company. All API keys and MCP connections of a company share this limit. If your company is managed by a partner, it shares the partner''s limit. Personal API keys are approved automatically when the company starts a paid subscription. Requests over the limit receive a `429 Too Many Requests` response. ### Rate limit headers

    Unapproved keys include these headers on every response:


    | Header | Description |

    |--------|-------------|

    | `X-RateLimit-Limit` | Maximum requests allowed in the current window |

    | `X-RateLimit-Remaining` | Requests remaining in the current window |

    | `X-RateLimit-Reset` | Unix timestamp (seconds) when the window resets |


    ### Handling 429 responses

    When you receive a `429` response, wait until `X-RateLimit-Reset` before retrying. Do not retry immediately — repeated 429s may extend the cooldown. To remove rate limits for your integration, contact **support@100hires.com** with your use case. ## Content-Type

    All request bodies **must** use `Content-Type: application/json`. Sending `application/x-www-form-urlencoded`, `multipart/form-data`, or any other content type

    will result in a `415 Unsupported Media Type` error. ## Responses and Errors

    Standard HTTP status codes are used (`2xx`, `4xx`, `5xx`). All error responses are wrapped in an `error` object containing `name`, `message`, `code`, and `status`. Validation errors additionally include field-level details in `error.validation_errors`. See the Error handling section below for the full format and status table. ## Pagination

    List endpoints use `page` (1-based) and `size` (1-100, default 20). Paginated responses follow:

    `{ "": [...], "pagination": { "page_size", "page_count", "page", "total_count" } }`. ## Lists

    List routes are optimized for synchronization and operational dashboards. Most list endpoints support tenant scoping through optional `company_id` (when allowed by API key context). ## Confidential Data

    Some candidate profile values can be masked by account-level pricing/access rules. Integrations should not assume all profile fields are always fully visible. ## Customizing the Response

    Use endpoint filters (`status`, `job_id`, timestamps, taxonomy IDs, etc.) to minimize payload size and improve sync efficiency. Build incremental sync flows around timestamp filters where available. ## Supported File Formats

    File uploads use base64 payloads with metadata:

    `data`, `file_name`, `mime_type` (and optionally `size`). This format is used for candidate files, resumes, attachments, and logos.'
servers:
- url: https://api.100hires.com/v2
  description: Production API endpoint
security:
- BearerAuth: []
tags:
- name: Billing
  description: Pricing state checks to gate paid-only API capabilities.
paths:
  /billing:
    get:
      tags:
      - Billing
      summary: Billing/pricing flags for current company
      operationId: getBillingFlags
      responses:
        '200':
          description: Billing state
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BillingResponse'
              example:
                success: true
                is_pricing_enabled: true
                is_paid: true
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/TooManyRequests'
      description: Returns pricing/billing capability flags for the current company context. Use before invoking paid-only API behaviors.
components:
  headers:
    RateLimitRemaining:
      description: Remaining requests in the current rate-limit window. Returned for unapproved API keys.
      schema:
        type: integer
    RateLimitReset:
      description: Unix timestamp when the current rate-limit window resets. Returned for unapproved API keys.
      schema:
        type: integer
        format: int64
    RateLimitLimit:
      description: Request limit for the current rate-limit window. Returned for unapproved API keys.
      schema:
        type: integer
  responses:
    TooManyRequests:
      description: Too many requests
      headers:
        X-RateLimit-Limit:
          $ref: '#/components/headers/RateLimitLimit'
        X-RateLimit-Remaining:
          $ref: '#/components/headers/RateLimitRemaining'
        X-RateLimit-Reset:
          $ref: '#/components/headers/RateLimitReset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              name: Too Many Requests
              message: Rate limit exceeded
              code: 0
              status: 429
    Forbidden:
      description: Forbidden
      headers:
        X-RateLimit-Limit:
          $ref: '#/components/headers/RateLimitLimit'
        X-RateLimit-Remaining:
          $ref: '#/components/headers/RateLimitRemaining'
        X-RateLimit-Reset:
          $ref: '#/components/headers/RateLimitReset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              name: Forbidden
              message: You are not allowed to perform this action.
              code: 0
              status: 403
    Unauthorized:
      description: Unauthorized
      headers:
        X-RateLimit-Limit:
          $ref: '#/components/headers/RateLimitLimit'
        X-RateLimit-Remaining:
          $ref: '#/components/headers/RateLimitRemaining'
        X-RateLimit-Reset:
          $ref: '#/components/headers/RateLimitReset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              name: Unauthorized
              message: Your request was made with invalid credentials.
              code: 0
              status: 401
  schemas:
    BillingResponse:
      type: object
      required:
      - success
      - is_pricing_enabled
      - is_paid
      properties:
        success:
          type: boolean
          description: Whether the request succeeded.
        is_pricing_enabled:
          type: boolean
          description: Whether pricing features are enabled.
        is_paid:
          type: boolean
          description: Whether the company has an active paid plan.
    Error:
      type: object
      required:
      - error
      properties:
        error:
          type: object
          description: Error details object.
          required:
          - name
          - message
          - code
          - status
          properties:
            name:
              type: string
              description: Human-readable error type (e.g. "Not Found", "Bad Request", "Forbidden")
              example: Not Found
            message:
              type: string
              description: Detailed error message
              example: Candidate not found
            code:
              type: integer
              description: Application error code (0 for generic errors)
              example: 0
            status:
              type: integer
              description: HTTP status code
              example: 404
      example:
        error:
          name: Not Found
          message: Candidate not found
          code: 0
          status: 404
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: APIKey
      description: 'Provide API token in header: `Authorization: Bearer <token>`. Each key is scoped to a specific user + company pair.'
    CompanySlugAuth:
      type: apiKey
      in: header
      name: X-Company-Slug
      description: 'Company slug for career site public endpoints. Alternative: pass as query param `company_slug`.'
x-tagGroups:
- name: Recruiting Operations
  tags:
  - Candidates
  - Applications
  - Interviews
  - Jobs
  - Evaluations
  - Notes
  - Messages
  - Notification Messages
  - Forms
  - Questions
  - Email Templates
  - Nurture Campaigns
  - Template Placeholders
  - Users
  - Attachments
- name: Organization and Settings
  tags:
  - Companies
  - Taxonomy
  - Billing
  - Feedback
- name: Career Site (Public)
  tags:
  - Career Site