Talent intelligence, connected

Your talent platform.
Built to connect.

Bring authorized applications into AceHR, follow resume analysis, and synchronize recruiting changes with your ATS or HRIS.

Create an API key OpenAPI 3.1 specification

REST API

Versioned endpoints for jobs, candidates, applications, and processing. Scoped access, pagination, and idempotent writes.

MCP tools

Read organization records from an MCP client using a scoped bearer key over Streamable HTTP.

Signed events

Receive committed recruiting changes with signature verification, durable retries, and replayable event cursors.

Start with a scoped request

An organization administrator creates a key in API & Webhooks. Keep the secret in your backend environment. The key determines the tenant; never send an organization ID.

Use jobs:read to list requirements.
Follow nextCursor with the after query parameter.
Read X-Request-Id to trace a request.
Respect HTTP 429 and its Retry-After header.

Terminal

curl 'https://acehr.ai/api/v1/jobs?limit=50' \
  -H "Authorization: Bearer $ACEHR_API_KEY"

# Other read endpoints
GET /api/v1/candidates
GET /api/v1/applications/{id}
GET /api/v1/processing?jobId=JOB_UUID
GET /api/v1/health
GET /api/v1/events?after=CURSOR

From application to analysis

Create the requirement.
POST /jobs creates an unpublished role. An employer confirms its analysis specification and publishes it in Staffing.
Submit the authorized resume.
POST /applications with Idempotency-Key matching the body id. A 202 response confirms durable acceptance. PDF, DOCX, and TXT up to 15 MB.
Follow the evidence.
Read application and processing status or subscribe to events. AI findings support recruiter review; the employer makes hiring decisions.

Verify every webhook

Verify the HMAC-SHA256 signature over the exact request body before parsing it. Reject timestamps more than five minutes old. Deduplicate by the body’s stable event id, process durably, then return 2xx. Deliveries are at least once; retries stop after ten failures.

New endpoints start at the current event cursor. Event history lasts seven days. For initial synchronization, save /health’s currentCursor, paginate the resources, then consume events after that cursor. On a 410 response, repeat that synchronization.

TypeScript

import { createHmac, timingSafeEqual } from 'node:crypto';

const match = /^t=(\d+),v1=([a-f0-9]{64})$/.exec(header);
if (!match) throw new Error('Invalid signature');
const [, timestamp, signature] = match;
if (Math.abs(Date.now()/1000 - Number(timestamp)) > 300)
  throw new Error('Expired signature');
const expected = createHmac('sha256', webhookSecret)
  .update(timestamp + '.' + rawBody).digest();
if (!timingSafeEqual(expected, Buffer.from(signature, 'hex')))
  throw new Error('Invalid signature');

Give your agents governed access

Connect to https://acehr.ai/api/mcp using Streamable HTTP and an Authorization bearer header. The tool list reflects your key’s read scopes. Each request authenticates independently.

This endpoint supports clients that accept configured bearer credentials. Interactive OAuth and one-click marketplace installation are not provided. Use REST for application uploads and writes.

TypeScript

import { Client } from '@modelcontextprotocol/sdk/client/index.js';
import { StreamableHTTPClientTransport }
  from '@modelcontextprotocol/sdk/client/streamableHttp.js';

const client = new Client({ name: 'your-ats', version: '1.0.0' });
await client.connect(new StreamableHTTPClientTransport(
  new URL('https://acehr.ai/api/mcp'),
  { requestInit: { headers: {
    Authorization: 'Bearer ' + process.env.ACEHR_API_KEY
  } } }
));
const tools = await client.listTools();