English
Candidate Login Employer Login

Developer API

Integrate AssessFit with your ATS, Zapier, or internal tooling — create jobs, invite candidates, pull results, and receive signed webhooks the moment a candidate finishes.

Authentication

Generate an API key in Employer Dashboard → Settings → API & integrations and send it on every request:

curl https://assessfit.com/api/v1/jobs \
  -H "X-Api-Key: tp_live_…"

Keys are workspace-scoped. Rotating a key immediately invalidates the previous one. Requests are rate-limited to 300/min per IP.

Endpoints

GET/api/v1/jobs

List job openings with invitation and completion counts.

POST/api/v1/jobs

Create a job and invite candidates in one call. Invitation emails are sent automatically; each invitation consumes one credit.

curl -X POST https://assessfit.com/api/v1/jobs \
  -H "X-Api-Key: tp_live_…" -H "Content-Type: application/json" \
  -d '{
    "title": "Senior Accountant",
    "roleKey": "accountant",
    "tests": ["attention", "financial", "numerical", "conscientiousness"],
    "cameraRequired": true,
    "shareResults": false,
    "candidates": [
      { "name": "Ana Putri", "email": "ana@example.com" }
    ]
  }'

Role keys: accountant, engineer, sales, support, marketing, analyst, custom. Omit tests? No — pass the test keys you want; fetch the library via the dashboard.

GET/api/v1/jobs/:id

Full job detail: every invite with funnel timestamps (tracking.sent/opened/loggedIn), personal invitation link, and the result object once completed.

POST/api/v1/jobs/:id/invites

Add candidates to an existing job: {"candidates":[{"name":"…","email":"…"}]}. Returns the created invites with their links.

GET/api/v1/invites/:id/result

Pull one candidate's completed result: overall score, per-test scores, integrity score, verdict and flags, and timing analysis. Returns 404 until the candidate finishes.

Webhooks

Set a webhook URL in Settings. AssessFit POSTs JSON events with an HMAC-SHA256 signature computed over the raw body using your API key as the secret:

POST https://your-app.example.com/hooks/assessfit
X-AssessFit-Event: candidate.completed
X-AssessFit-Signature: sha256=3f5a…

{
  "event": "candidate.completed",
  "createdAt": "2026-07-22T09:14:03.000Z",
  "data": {
    "inviteId": "inv_…",
    "jobId": "job_…",
    "jobTitle": "Senior Accountant",
    "candidate": { "name": "Ana Putri", "email": "ana@example.com" },
    "overall": 84,
    "scores": { "attention": 83, "numerical": 100 },
    "integrity": { "score": 100, "verdict": "clean" }
  }
}

Verify the signature before trusting a payload:

// Node.js
const crypto = require("crypto");
function verify(rawBody, signatureHeader, apiKey) {
  const expected = "sha256=" +
    crypto.createHmac("sha256", apiKey).update(rawBody).digest("hex");
  return crypto.timingSafeEqual(Buffer.from(signatureHeader), Buffer.from(expected));
}

Delivery is retried 3× (immediately, +2s, +8s). Every attempt is visible in Settings → Recent webhook deliveries, and you can fire a webhook.test event any time with the "Send Test Event" button. Events: candidate.completed, webhook.test.

Integration recipes