100Hires Forms API

openapi: 3.2.0
info:
  title: 100Hires Forms API
  version: 2.0.0
  description: '## Introduction to the 100Hires ATS API

    The 100Hires ATS API (v2) helps you automate recruiting workflows end-to-end: candidates, applications, jobs, forms, notes, and partner-company operations. All endpoints return JSON and use bearer authentication. ## OpenAPI Spec

    The 100Hires ATS API follows the OpenAPI 3.x specification. Download the machine-readable spec for use in MCP servers, Cursor, Claude Code, or any OpenAPI tooling:


    `GET https://api.100hires.com/v2/openapi.json`


    ## Authentication

    Send API token in the `Authorization` header for every request:


    `Authorization: Bearer `


    Each API key is tied to a specific **user + company** pair. If the same user belongs to multiple companies, they need a separate key for each company. All actions performed through the API are attributed to the key owner. You can generate or view your API key at https://app.100hires.com/settings/integrations


    ### API Key Verification

    API keys for **unverified companies** are created in a disabled state and will return `401 Unauthorized` until the company passes verification. Once your company is verified, API keys start working automatically — no action required. If your key returns `401` and you believe your company should be verified, contact **support@100hires.com**. ## Rate Limits

    API keys that are not yet approved, such as keys created during the free trial, are subject to a hard rate limit of **1,000 requests per 10 minutes** per company. All API keys and MCP connections of a company share this limit. If your company is managed by a partner, it shares the partner''s limit. Personal API keys are approved automatically when the company starts a paid subscription. Requests over the limit receive a `429 Too Many Requests` response. ### Rate limit headers

    Unapproved keys include these headers on every response:


    | Header | Description |

    |--------|-------------|

    | `X-RateLimit-Limit` | Maximum requests allowed in the current window |

    | `X-RateLimit-Remaining` | Requests remaining in the current window |

    | `X-RateLimit-Reset` | Unix timestamp (seconds) when the window resets |


    ### Handling 429 responses

    When you receive a `429` response, wait until `X-RateLimit-Reset` before retrying. Do not retry immediately — repeated 429s may extend the cooldown. To remove rate limits for your integration, contact **support@100hires.com** with your use case. ## Content-Type

    All request bodies **must** use `Content-Type: application/json`. Sending `application/x-www-form-urlencoded`, `multipart/form-data`, or any other content type

    will result in a `415 Unsupported Media Type` error. ## Responses and Errors

    Standard HTTP status codes are used (`2xx`, `4xx`, `5xx`). All error responses are wrapped in an `error` object containing `name`, `message`, `code`, and `status`. Validation errors additionally include field-level details in `error.validation_errors`. See the Error handling section below for the full format and status table. ## Pagination

    List endpoints use `page` (1-based) and `size` (1-100, default 20). Paginated responses follow:

    `{ "": [...], "pagination": { "page_size", "page_count", "page", "total_count" } }`. ## Lists

    List routes are optimized for synchronization and operational dashboards. Most list endpoints support tenant scoping through optional `company_id` (when allowed by API key context). ## Confidential Data

    Some candidate profile values can be masked by account-level pricing/access rules. Integrations should not assume all profile fields are always fully visible. ## Customizing the Response

    Use endpoint filters (`status`, `job_id`, timestamps, taxonomy IDs, etc.) to minimize payload size and improve sync efficiency. Build incremental sync flows around timestamp filters where available. ## Supported File Formats

    File uploads use base64 payloads with metadata:

    `data`, `file_name`, `mime_type` (and optionally `size`). This format is used for candidate files, resumes, attachments, and logos.'
servers:
- url: https://api.100hires.com/v2
  description: Production API endpoint
security:
- BearerAuth: []
tags:
- name: Forms
  description: Application forms and per-question required/optional/hidden status control.
paths:
  /forms:
    get:
      tags:
      - Forms
      summary: List forms
      operationId: listForms
      parameters:
      - $ref: '#/components/parameters/CompanyIdQuery'
      - $ref: '#/components/parameters/PageQuery'
      - $ref: '#/components/parameters/SizeQuery'
      - $ref: '#/components/parameters/ViewQuery'
      responses:
        '200':
          description: Form list
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/FormListResponse'
              example:
                forms:
                - id: 10
                  name: Software Engineer Application
                  job_ids:
                  - 5001
                  questions:
                  - id: 201
                    text: Years of experience?
                    type: short_text
                    options: []
                    status: required
                pagination:
                  page_size: 25
                  page_count: 1
                  page: 1
                  total_count: 1
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/TooManyRequests'
      description: Returns paginated application forms for the target company. Use to bootstrap questionnaire builders and sync form catalogs.
    post:
      tags:
      - Forms
      summary: Create form
      operationId: createForm
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/FormCreateRequest'
      responses:
        '200':
          description: Created form
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Form'
              example:
                id: 11
                name: Designer Application
                questions: []
        '415':
          $ref: '#/components/responses/UnsupportedMediaType'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '400':
          $ref: '#/components/responses/ValidationError'
      description: Creates a new form and optionally attaches existing questions. Useful for standardized intake process setup.
  /forms/{id}:
    get:
      tags:
      - Forms
      summary: Get form
      operationId: getForm
      parameters:
      - $ref: '#/components/parameters/IdPath'
      responses:
        '200':
          description: Form
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Form'
              example:
                id: 10
                name: Software Engineer Application
                url_backoffice: https://app.100hires.com/settings/forms/10/edit
                job_ids:
                - 5001
                questions:
                - id: 201
                  text: Years of experience?
                  type: short_text
                  status: required
                - id: 202
                  text: Preferred programming language?
                  type: single_choice
                  options:
                  - Python
                  - Java
                  - Go
                  - TypeScript
                  status: optional
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '404':
          $ref: '#/components/responses/NotFound'
      description: Returns form details with included question statuses. Use as canonical read endpoint for form rendering.
    put:
      tags:
      - Forms
      summary: Update form
      operationId: updateForm
      parameters:
      - $ref: '#/components/parameters/IdPath'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/FormUpdateRequest'
      responses:
        '200':
          description: Updated form
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Form'
              example:
                id: 10
                name: Software Engineer Application
                url_backoffice: https://app.100hires.com/settings/forms/10/edit
                job_ids:
                - 5001
                questions:
                - id: 201
                  text: Years of experience?
                  type: short_text
                  status: required
                - id: 202
                  text: Preferred programming language?
                  type: single_choice
                  options:
                  - Python
                  - Java
                  - Go
                  - TypeScript
                  status: optional
        '415':
          $ref: '#/components/responses/UnsupportedMediaType'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '404':
          $ref: '#/components/responses/NotFound'
        '400':
          $ref: '#/components/responses/ValidationError'
      description: Updates form metadata and question composition. Supports iterative form design and rollout workflows.
    delete:
      tags:
      - Forms
      summary: Delete form
      operationId: deleteForm
      parameters:
      - $ref: '#/components/parameters/IdPath'
      responses:
        '200':
          description: Deleted
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SuccessResponse'
              example:
                success: true
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '404':
          $ref: '#/components/responses/NotFound'
      description: Deletes a form from active usage. Use when retiring obsolete intake flows.
  /forms/{form_id}/questions/{question_id}:
    put:
      tags:
      - Forms
      summary: Update question status inside form
      operationId: updateFormQuestionStatus
      parameters:
      - $ref: '#/components/parameters/FormIdPath'
      - $ref: '#/components/parameters/QuestionIdPath'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/FormQuestionStatusRequest'
      responses:
        '200':
          description: Updated form
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Form'
              example:
                id: 10
                name: Software Engineer Application
                url_backoffice: https://app.100hires.com/settings/forms/10/edit
                job_ids:
                - 5001
                questions:
                - id: 201
                  text: Years of experience?
                  type: short_text
                  status: required
                - id: 202
                  text: Preferred programming language?
                  type: single_choice
                  options:
                  - Python
                  - Java
                  - Go
                  - TypeScript
                  status: optional
        '415':
          $ref: '#/components/responses/UnsupportedMediaType'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '404':
          $ref: '#/components/responses/NotFound'
        '400':
          $ref: '#/components/responses/ValidationError'
      description: Changes the status (required/optional/hidden) of a form-question relation. Use for fine-grained validation control.
components:
  responses:
    NotFound:
      description: Not found
      headers:
        X-RateLimit-Limit:
          $ref: '#/components/headers/RateLimitLimit'
        X-RateLimit-Remaining:
          $ref: '#/components/headers/RateLimitRemaining'
        X-RateLimit-Reset:
          $ref: '#/components/headers/RateLimitReset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              name: Not Found
              message: Candidate not found
              code: 0
              status: 404
    Unauthorized:
      description: Unauthorized
      headers:
        X-RateLimit-Limit:
          $ref: '#/components/headers/RateLimitLimit'
        X-RateLimit-Remaining:
          $ref: '#/components/headers/RateLimitRemaining'
        X-RateLimit-Reset:
          $ref: '#/components/headers/RateLimitReset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              name: Unauthorized
              message: Your request was made with invalid credentials.
              code: 0
              status: 401
    TooManyRequests:
      description: Too many requests
      headers:
        X-RateLimit-Limit:
          $ref: '#/components/headers/RateLimitLimit'
        X-RateLimit-Remaining:
          $ref: '#/components/headers/RateLimitRemaining'
        X-RateLimit-Reset:
          $ref: '#/components/headers/RateLimitReset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              name: Too Many Requests
              message: Rate limit exceeded
              code: 0
              status: 429
    Forbidden:
      description: Forbidden
      headers:
        X-RateLimit-Limit:
          $ref: '#/components/headers/RateLimitLimit'
        X-RateLimit-Remaining:
          $ref: '#/components/headers/RateLimitRemaining'
        X-RateLimit-Reset:
          $ref: '#/components/headers/RateLimitReset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              name: Forbidden
              message: You are not allowed to perform this action.
              code: 0
              status: 403
    UnsupportedMediaType:
      description: Content-Type must be application/json
      headers:
        X-RateLimit-Limit:
          $ref: '#/components/headers/RateLimitLimit'
        X-RateLimit-Remaining:
          $ref: '#/components/headers/RateLimitRemaining'
        X-RateLimit-Reset:
          $ref: '#/components/headers/RateLimitReset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              name: Unsupported Media Type
              message: Content-Type must be application/json
              code: 0
              status: 415
    ValidationError:
      description: Validation error
      headers:
        X-RateLimit-Limit:
          $ref: '#/components/headers/RateLimitLimit'
        X-RateLimit-Remaining:
          $ref: '#/components/headers/RateLimitRemaining'
        X-RateLimit-Reset:
          $ref: '#/components/headers/RateLimitReset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ValidationError'
  parameters:
    QuestionIdPath:
      name: question_id
      in: path
      required: true
      description: Question ID.
      schema:
        type: integer
    SizeQuery:
      name: size
      in: query
      required: false
      description: Number of items per page (1–100). Defaults to 20.
      schema:
        type: integer
        minimum: 1
        maximum: 100
        default: 20
    CompanyIdQuery:
      name: company_id
      in: query
      required: false
      schema:
        type: integer
      description: Optional target company ID. Since each API key is already bound to one company, this is only needed when the key owner has access to multiple companies.
    IdPath:
      name: id
      in: path
      required: true
      description: Resource ID (numeric).
      schema:
        type: integer
    ViewQuery:
      name: view
      in: query
      required: false
      description: 'Response shape selector for list endpoints. `full` (default) returns every field

        — backward-compatible with pre-existing clients. `summary` returns a thinned

        payload designed for agent-friendly list browsing: heavy fields (description

        HTML, embedded profile answers, full message bodies, embedded relations, etc.)

        are omitted or replaced with `*_preview` truncations. Use `summary` when paging

        through large result sets and fetch a single record with the corresponding

        `GET /{resource}/{id}` endpoint when full data is needed.

        '
      schema:
        type: string
        enum:
        - full
        - summary
        default: full
    PageQuery:
      name: page
      in: query
      required: false
      description: Page number (1-based). Defaults to 1.
      schema:
        type: integer
        minimum: 1
        default: 1
    FormIdPath:
      name: form_id
      in: path
      required: true
      description: Application form ID.
      schema:
        type: integer
  headers:
    RateLimitRemaining:
      description: Remaining requests in the current rate-limit window. Returned for unapproved API keys.
      schema:
        type: integer
    RateLimitReset:
      description: Unix timestamp when the current rate-limit window resets. Returned for unapproved API keys.
      schema:
        type: integer
        format: int64
    RateLimitLimit:
      description: Request limit for the current rate-limit window. Returned for unapproved API keys.
      schema:
        type: integer
  schemas:
    FormUpdateRequest:
      type: object
      required:
      - name
      properties:
        name:
          type: string
          description: Form name.
        questions:
          type: array
          description: Array of question IDs to attach to this form.
          items:
            type: integer
      additionalProperties: false
    Question:
      type: object
      required:
      - id
      - text
      - type
      properties:
        id:
          type: integer
          description: Question ID.
        text:
          type: string
          description: Question text.
        type:
          type: string
          description: Question type.
        options:
          type: array
          description: Answer options for select/multiselect types.
          items:
            type: string
        status:
          type: string
          description: Visibility status on the form.
          enum:
          - required
          - optional
          - hidden
    FormListResponse:
      type: object
      required:
      - forms
      - pagination
      properties:
        forms:
          type: array
          description: Array of forms.
          items:
            $ref: '#/components/schemas/Form'
        pagination:
          $ref: '#/components/schemas/Pagination'
    Pagination:
      type: object
      required:
      - page_size
      - page_count
      - page
      - total_count
      properties:
        page_size:
          type: integer
          description: Items per page.
        page_count:
          type: integer
          description: Total number of pages.
        page:
          type: integer
          description: Current page number.
        total_count:
          type: integer
          description: Total number of items.
    Form:
      type: object
      required:
      - id
      - name
      properties:
        id:
          type: integer
          description: Form ID.
        name:
          type: string
          description: Form name.
        url_backoffice:
          type: string
          format: uri
          description: Absolute backoffice URL to edit this questionnaire form in the 100Hires recruiter app. Use to render deep-links in agent UIs.
          example: https://app.100hires.com/settings/forms/42/edit
        job_ids:
          type: array
          description: IDs of live jobs whose active application form this is, ascending. A job with no form attached falls back to the company default form but is NOT listed here — read the job's `form_id` for the effective form. Present in both `view=full` and `view=summary`.
          items:
            type: integer
          example:
          - 5001
        questions:
          type: array
          description: Array of questions on this form. Present only when `view=full` (default); omitted entirely when `view=summary` — forms can embed dozens of question definitions.
          items:
            $ref: '#/components/schemas/Question'
    FormCreateRequest:
      type: object
      required:
      - name
      properties:
        company_id:
          type: integer
          description: Target company ID.
        name:
          type: string
          description: Form name.
        questions:
          type: array
          description: Array of question IDs to attach to this form.
          items:
            type: integer
      additionalProperties: false
    FormQuestionStatusRequest:
      type: object
      required:
      - status
      properties:
        status:
          type: string
          description: 'Question visibility on this form: required, optional, or hidden.'
          enum:
          - required
          - optional
          - hidden
      additionalProperties: false
    ValidationError:
      type: object
      required:
      - error
      properties:
        error:
          type: object
          description: Validation error details object.
          required:
          - name
          - validation_errors
          properties:
            name:
              type: string
              description: Always "Validation Error" for validation failures
              example: Validation Error
            message:
              type: string
            code:
              type: integer
              example: 0
            status:
              type: integer
              example: 400
            validation_errors:
              type: object
              description: Field-level validation errors (field name to error message)
              additionalProperties:
                type: string
              example:
                email: Email cannot be blank.
                first_name: First Name cannot be blank.
      example:
        error:
          name: Validation Error
          message: ''
          code: 0
          status: 400
          validation_errors:
            email: Email cannot be blank.
            first_name: First Name cannot be blank.
    Error:
      type: object
      required:
      - error
      properties:
        error:
          type: object
          description: Error details object.
          required:
          - name
          - message
          - code
          - status
          properties:
            name:
              type: string
              description: Human-readable error type (e.g. "Not Found", "Bad Request", "Forbidden")
              example: Not Found
            message:
              type: string
              description: Detailed error message
              example: Candidate not found
            code:
              type: integer
              description: Application error code (0 for generic errors)
              example: 0
            status:
              type: integer
              description: HTTP status code
              example: 404
      example:
        error:
          name: Not Found
          message: Candidate not found
          code: 0
          status: 404
    SuccessResponse:
      type: object
      required:
      - success
      properties:
        success:
          type: boolean
          description: Always true on success.
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: APIKey
      description: 'Provide API token in header: `Authorization: Bearer <token>`. Each key is scoped to a specific user + company pair.'
    CompanySlugAuth:
      type: apiKey
      in: header
      name: X-Company-Slug
      description: 'Company slug for career site public endpoints. Alternative: pass as query param `company_slug`.'
x-tagGroups:
- name: Recruiting Operations
  tags:
  - Candidates
  - Applications
  - Interviews
  - Jobs
  - Evaluations
  - Notes
  - Messages
  - Notification Messages
  - Forms
  - Questions
  - Email Templates
  - Nurture Campaigns
  - Template Placeholders
  - Users
  - Attachments
- name: Organization and Settings
  tags:
  - Companies
  - Taxonomy
  - Billing
  - Feedback
- name: Career Site (Public)
  tags:
  - Career Site