AllJobs Developer API

Overview

The AllJobs API exposes the same primitives the product is built on: companies, jobs, and applications. Every call is authenticated with a company-scoped API key, all data lives in Supabase Postgres, and Row Level Security keeps tenants strictly isolated.

Quick start

Register a company, have its owner claim it, then publish with a key the owner creates.

1. 1. Register the company
   bashCopy

   curl -X POST https://humanlike.co/api/v1/register \
     -H "Content-Type: application/json" \
     -d '{
       "company": { "name": "Acme Robotics", "website": "https://acme.io" },
       "owner":   { "email": "founder@acme.io" }
     }'

   The response has a read-only api_key.key (companies:read, jobs:read), shown only once, and owner.claim_url.

2. 2. Send the claim link to the owner

   Nothing is emailed for you. The owner opens owner.claim_url, signs in with that email (a one-time code or a magic link) and confirms, which makes them the owner and revokes the read-only key. They then create a key with companies:write and jobs:write in Settings, API keys, and share it with you.

3. 3. Publish the company profile
   bashCopy

   curl -X PATCH https://humanlike.co/api/v1/companies/me \
     -H "X-API-Key: $HK_KEY" \
     -H "Content-Type: application/json" \
     -d '{ "description": "Building...", "logo_url": "https://...", "setup_completed": true }'

4. 4. Create & publish a job
   bashCopy

   curl -X POST https://humanlike.co/api/v1/jobs \
     -H "X-API-Key: $HK_KEY" \
     -H "Content-Type: application/json" \
     -d '{
       "title": "Senior Robotics Engineer",
       "description": "Design, build, ship.",
       "location": "Athens, Greece",
       "location_type": "hybrid",
       "employment_type": "full-time",
       "status": "published"
     }'

   The job is now live at /alljobs/company/<slug>.

Authentication

Every /api/v1/* endpoint (except /register) requires an API key in the X-API-Key header. Keys start with hk_live_ and are stored as SHA-256 hashes in Supabase.

X-API-Key: hk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

• Keys are scoped to one company. You cannot access another tenant.
• Default rate limit: 60 requests / minute / key.
• Revoke a key any time from the dashboard. Revoked keys get 401 immediately.

Agentic registration

POST /api/v1/register creates the company row and a read-only partner API key (companies:read, jobs:read). No account is created, no existing one is linked, and nothing is sent to owner.email: the company has no members until it is claimed. Hand owner.claim_url to the owner, who signs in with that email (a one-time code or a magic link) and confirms. The read-only key is revoked on claim. The response is the same whether or not that email has an account.

Other scopes you ask for are not granted; they come back in requires_approval. Write scopes, webhooks:write and calls:write come from a key the owner creates in Settings, API keys.

{
  "company": {
    "name": "Acme Robotics",
    "website": "https://acme.io",
    "description": "We build humanoid robots.",
    "logo_url": "https://acme.io/logo.png",
    "hq_location": "Athens, Greece",
    "industry": "Robotics"
  },
  "owner": {
    "email": "founder@acme.io"
  },
  "key_name": "Acme agent",
  "scopes": ["companies:read", "jobs:read"]
}

{
  "success": true,
  "data": {
    "company": {
      "id": "…",
      "slug": "acme-robotics",
      "name": "Acme Robotics",
      "public_url": "https://humanlike.co/alljobs/company/acme-robotics"
    },
    "owner": {
      "email": "founder@acme.io",
      "claim_url": "https://humanlike.co/api/v1/register/claim?token=…",
      "claim_expires_at": "…"
    },
    "api_key": {
      "id": "…",
      "name": "Acme agent",
      "key": "hk_live_…",   // shown once, read-only
      "key_prefix": "hk_live_a3b",
      "scopes": ["companies:read", "jobs:read"],
      "rate_limit_per_minute": 60
    },
    "requires_approval": [],
    "next_steps": [ "…" ]
  }
}

Publish a job

Create with status: "draft"first, then patch to publish once you're happy:

# Create as draft
curl -X POST https://humanlike.co/api/v1/jobs \
  -H "X-API-Key: $HK_KEY" -H "Content-Type: application/json" \
  -d '{ "title": "Backend Engineer", "description": "Go + Postgres.", "status": "draft" }'

# Publish it
curl -X PATCH https://humanlike.co/api/v1/jobs/$JOB_ID \
  -H "X-API-Key: $HK_KEY" -H "Content-Type: application/json" \
  -d '{ "status": "published" }'

Receive applications

Submit applications inbound from your own platform, then poll or subscribe to webhooks for status changes.

curl -X POST https://humanlike.co/api/v1/applications \
  -H "X-API-Key: $HK_KEY" -H "Content-Type: application/json" \
  -d '{
    "job_id": "$JOB_ID",
    "candidate": {
      "first_name": "Mina", "last_name": "Doe",
      "email": "mina@example.com", "phone": "+30 697 000 0000"
    },
    "source": "my-platform",
    "external_id": "abc-123"
  }'

All endpoints

Scopes & rate limits

A key from /register has only companies:read and jobs:read. The company owner grants every other scope when creating a key in Settings, API keys.

Each key has a per-minute rate limit (default 60/min). Going over returns 429 with the limit echoed in the message.

Errors

All errors share one shape:

{
  "success": false,
  "error": {
    "message": "Job not found.",
    "details": "…optional context…"
  }
}

• 400: validation failure. Read error.message.
• 401: missing, invalid, expired, or revoked API key.
• 403: the key lacks the required scope, or the job belongs to another company.
• 404: resource not found.
• 409: conflict (e.g. candidate already applied).
• 429: rate limit exceeded.
• 500: server error. Safe to retry with backoff.

For LLM agents

Two machine-readable spec endpoints are served alongside this page. Point your agent at either:

Agents typically: (1) POST /register with only owner.email to get a read-only key, (2) hand owner.claim_url to the owner, who signs in with that email and confirms, (3) once the owner shares a key with write scopes from Settings, API keys, PATCH /companies/me + POST /jobs to publish.