Authentication

The CV-Transformer API uses API keys for authentication. Create and manage them under Settings → API keys of your organization in the admin dashboard . Provide the key in the HTTP Authorization header as a bearer token.

A key is shown once, when you create it: CV-Transformer stores only a hash of it. Keep it secret, like a password. If a key may have leaked, rotate it from its page: the old key stops working immediately, and the key keeps its settings and request history.

Scopes#

A key has full access, or read or write access per area: candidates, layouts, members, organization and webhooks. Write access includes read access. A request without a valid key gets a 401 response, and a request the key's scopes don't allow gets a 403. Embedded resources the key can't read are left out of responses. Each endpoint in this reference names the scope it needs.

Trying requests#

Every example in this reference can be sent from the page: open it with the send button and enter an API key. The key stays in this browser tab, and requests run against your live data.