Recruit100x API v1
Authentication and scopes
Every call sends an agency API key as a bearer token; each key carries the scopes it was created with.
Send Authorization: Bearer <key> on every request. Owners create keys in Settings › Integrations › API keys; a key is shown once, can carry an expiry date, and can be revoked at any time. Live keys and test keys look alike (r100x_live_… or r100x_test_…); which mode a key is in is decided by the key itself, not by its prefix.
GET /api/v1/me tells you the workspace, the key's name and scopes, livemode and your limits.
Scopes
| Scope | Name | What it allows | Default |
|---|---|---|---|
read:reports | Read reports | Report details, including candidate contact details and quotes. | ticked |
read:roles | Read roles | Your roles and their invitation counts. | ticked |
write:invites | Send invitations | Add candidates and send them interview invitations (uses credits when they finish). | ticked |
manage:hooks | Manage hooks | Let Zapier or Make subscribe to events. | ticked |
mcp:read | AI agent: read | An AI agent (MCP) may see your roles, screening reports and usage. | offered, unticked (AI agents) |
mcp:manage | AI agent: manage roles | An AI agent (MCP) may create roles, approve screening guides and ask you for decisions. | offered, unticked (AI agents) |
mcp:screen | AI agent: send screenings | An AI agent (MCP) may invite candidates by email or text (uses credits when they finish). | offered, unticked (AI agents) |
mcp:share | AI agent: share shortlists | An AI agent (MCP) may create client shortlist links for candidates you advanced. | offered, unticked (AI agents) |
mcp:handoff | AI agent: send to ATS | An AI agent (MCP) may send candidates you advanced to your ATS. | offered, unticked (AI agents) |
write:roles | Create roles | Create and update roles, including from a job link. | offered, unticked |
A call that needs a scope the key lacks answers 403 API_SCOPE_MISSING. Create roles (write:roles) is offered but never ticked by default.
Webhook endpoints and keys
Endpoints created through the API belong to the key's workspace, and each event needs the matching read scope. An endpoint created with a test key receives test events only.
Keeping keys safe
Keep keys on your server, never in a browser or a mobile app. Revoke a key you no longer use; create a new one if a key may have leaked.