Ashby API Review 2026: Can You Build Your Recruiting Stack on It?

What can you actually build on the Ashby API, and where does its scope end?

Ashby's API is an RPC-style REST surface at https://api.ashbyhq.com, covering its recruiting platform: candidates, applications, jobs, interviews, offers, scheduling, and organizational data.

The developer documentation is public, the changelog carries 13+ pages of versioned entries, and API access ships on every paid plan starting at $400/month. For an ATS serving 4,000+ customers, that developer investment is above average.

But investment and scope are different questions.

The Ashby API gives you programmatic control over recruiting operations: creating and managing candidates, moving applications through pipeline stages, scheduling interviews, submitting structured feedback, managing job postings and openings, and pulling reporting data. If your integration needs to automate or extend a hiring workflow, this API covers it. If you need B2B intelligence on the same programmatic surface (verified contact data beyond what candidates submitted, company attributes, technographics, org charts, buyer intent signals, or direct-dial phone numbers for sourcing), that is a different layer of the stack.

This is where ZoomInfo enters the picture. ZoomInfo's Enterprise API covers search, enrichment, and AI intelligence across 500M contacts and 100M companies, with an MCP server for AI-agent workflows. The two APIs are layers of the same talent acquisition pipeline, not rivals. The right question is whether your build needs one or both.

This review covers the Ashby API in technical depth first, then reviews ZoomInfo's API as the data intelligence layer that picks up where recruiting workflow management stops.

Ashby API at a Glance

Ashby API: What Works Well & What to Plan Around

Ashby API: Authentication & Getting Started

Source: Ashby

API access starts with any paid Ashby subscription. You create keys in the admin panel at Admin > API > Keys, and each key is scoped to read and/or write access per module: Jobs, Candidates, Interviews, Offers, Organization, Hiring Process, Approvals, Reports, Notetaker, and Audit Logs.

Additional permission flags control access to confidential jobs and projects, non-offer private fields, and a beta Act on Behalf of mode that attributes API actions to a named user via the X-On-Behalf-Of header. An account can hold multiple API keys, each with different permission sets.

Authentication is straightforward. Every request sends the API key as the HTTP Basic Auth username with an empty password:

curl -X POST "https://api.ashbyhq.com/candidate.list" \

-u "YOUR_API_KEY:" \

-H "Content-Type: application/json" \

-H "Accept: application/json; version=1" \

-d '{}'

The trailing colon after the API key matters: it signals an empty password to Basic Auth. There is no OAuth flow, no token exchange, and no rotating credentials.

Ashby's documentation warns against using the API in browser contexts because CORS is not configured. Proxy frontend requests through a backend service.

Two things to know before you start:

• No self-service developer sandbox: Ashby does not offer a public sandbox. Integration partners must go through Ashby's partner onboarding process for sandbox access. If you are building an internal integration, your production subscription is your development environment.

• Non-standard REST conventions: Ashby's API follows an RPC-style naming pattern where endpoints use /CATEGORY.method paths (e.g., /candidate.list, /application.create). Most endpoints accept POST requests even for reads, with parameters sent as JSON bodies rather than query strings. If you expect conventional REST (GET for reads, resource-based URLs), plan for this difference in your client code.

Ashby API: Core Endpoints & Capabilities

The API is organized into ten permission modules, each covering a distinct resource area. All requests and responses use JSON, and list endpoints paginate with an opaque cursor model: responses return a nextCursor string and a moreDataAvailable boolean.

Source: Ashby

The API also supports incremental sync via a syncToken parameter for pulling only records changed since the last call.

One important convention: all API responses return HTTP 200, even for errors. The success field in the response body indicates error state, not the HTTP status code. Your error handling must check the response body.

Jobs & Openings

The Jobs module covers job requisitions and headcount slots.

Source: Ashby

Key endpoints: job.info, job.list, job.search, job.create, job.setStatus, job.update, job.updateCompensation, jobPosting.info, jobPosting.list, jobPosting.update, jobBoard.list, jobInterviewPlan.info, jobTemplate.list.

The Openings resource adds: opening.info, opening.list, opening.search, opening.create, opening.update, plus mutations for adding/removing jobs and locations from openings and managing opening state.

What you would build with this: a headcount planning integration that creates jobs and openings from an HRIS system, syncs approval status back, and manages job postings across boards programmatically.

Candidates & Applications

This is the largest module, covering the core ATS workflow from candidate creation through hiring.

Candidate operations: candidate.info, candidate.list, candidate.search, candidate.create, candidate.update, candidate.uploadResume, candidate.uploadFile, candidate.anonymize, candidate.addTag, candidate.removeTag, candidate.addEmailMessage, candidate.pushToHris, candidate.listNotes, candidate.listProjects, candidate.listFraudChecks.

Application operations: application.info, application.list, application.listHistory, application.listCriteriaEvaluations, application.create, application.update, application.changeStage, application.changeSource, application.transfer.

Supporting operations: applicationFeedback.list, applicationFeedback.submit, applicationForm.submit, customField.setValue, referral.create, surveyRequest.list, surveySubmission.list, surveySubmission.create, file.info.

The application.changeStage endpoint is the one most integrations call frequently: it moves a candidate through your interview pipeline programmatically. The application.listCriteriaEvaluations endpoint returns AI-assisted application review results, giving you programmatic access to Ashby's AI evaluation data.

What you would build with this: a sourcing integration that creates candidates from an external platform, attaches their resume, and enrolls them into a job's pipeline. Or an analytics pipeline that pulls application history and feedback data into a BI tool for reporting beyond what Ashby's native analytics provides.

Interviews & Scheduling

Programmatic access to interview management and scheduling.

Source: Ashby

Key endpoints: interview.info, interview.list, interviewSchedule.list, interviewSchedule.create, interviewSchedule.update, interviewSchedule.cancel, interviewStage.info, interviewStage.list, interviewPlan.list, interviewEvent.list, interviewBriefing.info.

Use the scheduling endpoints to create and manage interview schedules programmatically, build custom scheduling flows, or sync interview data to external systems.

Offers & Approvals

Source: Ashby

Key endpoints: offer.info, offer.list, offer.create, offer.update, offer.approve, offer.start, offer.startApprovalProcess, offerProcess.start. The Approvals module adds approval.list and approvalDefinition.update.

What you would build with this: an offer-approval workflow that triggers external sign-off processes (finance, legal) and advances offers through Ashby's approval chain programmatically.

Organization, Hiring Process & Reports

Organization: department.info, department.list, location.info, location.list, user.info, user.list, user.search, brand.list, hiringTeamRole.list, plus lifecycle mutations for departments, locations, and hiring team membership.

The user.interviewerSettings and user.createInterviewerPause endpoints give you programmatic control over interviewer availability.

Hiring Process: candidateTag.list, candidateTag.create, candidateTag.archive, customField.info, customField.list, customField.create, interviewerPool.info, interviewerPool.list (plus create, update, archive, add/remove user), source.list, archiveReason.list, closeReason.list, communicationTemplate.list, feedbackFormDefinition.info, feedbackFormDefinition.list, surveyFormDefinition.*.

Reports: report.generate and report.synchronous give you programmatic access to Ashby's reporting engine. Pull recruiting metrics without relying on dashboard exports.

Audit & Notetaker: auditLog.list for compliance-relevant activity tracking, and notetakerTranscript.info for accessing AI-generated interview transcripts.

Ashby API: Webhooks & Events

Ashby provides a webhook system configured in the admin panel under Admin > Integrations > Webhooks. Each subscription targets a single event type and a single destination URL. You can also manage webhooks programmatically: webhook.create, webhook.update, webhook.delete, and webhook.info.

Event categories cover the core recruiting lifecycle: candidate stage changes, application submissions, job posting updates, interview scheduling changes, and offer events. The action field in the common payload identifies the event type, and each payload carries a webhookActionId that stays stable across retries, enabling idempotent processing.

Signature verification: Optional but recommended. You configure a secret token per webhook, and Ashby sends an Ashby-Signature header with a cryptographic digest of the payload signed with that token. This lets your receiver verify that payloads came from Ashby and were not tampered with.

Retry behavior: Failed deliveries use exponential backoff with the formula Delay = (2^attempt_number - 1) x 10 seconds, up to 10 attempts.

The schedule starts at 10 seconds for the first retry, 30 seconds for the second, 70 seconds for the third, and continues through the tenth. Responses returning 401, 403, 404, 405, or 410 are not retried (treated as permanent failures). Server errors (5xx), timeouts, and other failures trigger retries.

What you would build with this: a real-time integration that pushes candidate stage changes to a Slack channel, triggers HRIS record creation when an offer is accepted, or syncs interview scheduling events to an external calendar without polling.

Ashby API: SDKs, Docs & Rate Limits

SDKs & Libraries

Ashby does not publish official SDKs in any language. Developers make direct HTTP calls using Basic Auth and JSON. No community-maintained SDK wrappers appear in the official documentation.

One alternative: the Ashby API is accessible through Merge's unified ATS API, which maps Merge Common Models to Ashby's endpoints and provides SDKs in multiple languages.

This is a third-party product (not maintained by Ashby), but it offers a conventional REST interface with client libraries for developers who prefer that over raw HTTP against Ashby's RPC-style surface.

For AI development workflows, Ashby publishes a machine-readable llms.txt index with all documentation pages in Markdown and all endpoints in OpenAPI format. An MCP server integration is listed as coming soon, which would expose Ashby data to MCP-compatible AI agents.

Documentation & Developer Experience

The developer documentation at developers.ashbyhq.com is hosted on ReadMe and organized into three sections:

• Guides: How-to articles covering authentication, pagination, incremental sync, webhook setup, custom careers page implementation, assessments integration building, and partner job feeds. Each topic gets a dedicated page with code examples (mostly cURL).

• API Reference: Endpoint-level documentation with request parameters, response shapes, and an interactive "Try It!" explorer for testing calls in the browser.

• Changelog: Actively maintained (13+ pages as of mid-2026), covering endpoint behavior changes, validation improvements, and new error codes with dates and links to affected reference pages. Recent June 2026 entries include interviewSchedule.* validation improvements, location.* validation, jobPosting.* behavior fixes, and auditLog.list schema additions.

Developer support is email-only at support@ashbyhq.com. No public developer forum, Slack community, or GitHub issue tracker exists. No Postman collection or downloadable OpenAPI spec file is mentioned, though the llms.txt index provides OpenAPI-format endpoint definitions.

Rate Limits & Constraints

Ashby does not publish rate limit numbers, request-per-minute caps, or bulk-operation limits. No rate-limit tiers by plan are described, and no rate-limit response headers (e.g., X-RateLimit-Remaining) are documented. Developers who hit limits should contact support@ashbyhq.com and include the x-ashby-request-id header from the response.

For a developer sizing a production integration, undocumented rate limits mean you discover the throughput ceiling through testing, not documentation. This is a real constraint for high-volume integrations: you cannot design retry logic or batch sizing against a known ceiling.

The only documented hard constraint is pagination: list endpoints return results via cursor-based pagination with no documented maximum page size. File uploads and record creation are individual endpoint calls, not bulk batch endpoints.

Ashby API Pricing & Access Costs

Ashby bundles API access into its platform subscription rather than charging per call. There is no separate API tier, no metered pricing, and no per-request credit cost. The API draws from the same subscription that powers the dashboard.

The entry point is the Foundations plan at $400/month, covering up to 100 employees with API access included. Foundations pricing is a flat monthly fee based on workforce size, not per-seat. A 10% discount applies on annual commitments.

For larger organizations:

• Plus (101 to 1,000 employees): Seat-based pricing, quote-required. Adds custom reports, AI report builder, approvals workflows, confidential jobs, and SSO/SCIM.

• Enterprise (1,000+ employees): Quote-required. Adds unlimited custom roles, scheduling automation, newsletters, global application rules, and expanded integrations (including Workday).

Two categories of metered costs sit on top of the subscription:

• AI credits: Allocations start at 1,500 credits/month on Foundations and scale to 12,500/year per paid seat on Enterprise. Additional credits cost $0.10 each. These credits fuel AI-Assisted Application Review (1 credit per candidate evaluation), not standard API calls.

• Email lookups: Used by the Chrome Extension's data enrichment feature, sold in batches of 300 on a recurring basis.

Ashby offers no free plan and no self-serve free trial. New month-to-month subscribers get a 30-day money-back guarantee, which serves as a risk-free evaluation period.

For a developer sizing costs: the API is free once you pay for Ashby. The real cost driver is the platform subscription tier, which determines your employee cap, feature access, and included AI credit allocation.

Where the Ashby API Falls Short

These are practical limits to plan around, not criticisms. Several reflect deliberate scope decisions about what Ashby is (a recruiting workflow platform) and what it is not.

The API covers recruiting operations. That is all it covers. No endpoints exist for contact enrichment, company attribute lookup, technographic data, org chart traversal, buyer intent signals, or verified phone number discovery.

If your pipeline needs to find candidates (not just manage ones already in the system), enrich company data beyond what a candidate submitted on an application form, or detect hiring signals at target accounts, you need a separate data intelligence layer.

This is less a gap than a scope boundary, but it is the biggest constraint for developers whose recruiting operations are one step in a larger sourcing or enrichment pipeline.

Rate limits are undocumented. Ashby publishes no rate-limit numbers, throttle tiers, or quota headers. The throughput ceiling is unknown until you hit it. High-volume integrations (bulk candidate imports, real-time pipeline syncs across thousands of records) require cautious rollout and empirical testing.

No OAuth, no delegated access. Authentication is a static API key via HTTP Basic Auth. No OAuth 2.0 flow exists for multi-tenant integrations where each customer authenticates with their own Ashby instance. If you build a SaaS product connecting to many Ashby accounts, each customer must generate and share an API key manually.

No official SDKs. Every integration is raw HTTP with manual JSON serialization, error handling, and retry logic. The Merge ATS API offers a third-party abstraction layer with SDKs, but that adds a dependency and cost. For a simple webhook listener, raw HTTP works fine. For a production system touching a dozen endpoint groups, you are building and maintaining a client library yourself.

Non-standard error handling. All API responses return HTTP 200, with success or failure indicated by the success field in the response body. Standard HTTP client libraries, middleware, and monitoring tools that rely on status codes will miss errors without custom handling. You must parse every response body.

RPC-style conventions require adjustment. POST for reads, dot-namespaced endpoint paths, and JSON body parameters for all requests (including list operations) differ from conventional REST. Developers using API testing tools, code generators, or SDK scaffolding that assumes standard REST will need to adapt.

ZoomInfo API: The Data Intelligence Layer Ashby's API Does Not Cover

Ashby's API tells you everything about a candidate once they enter your pipeline: which stage they reached, what feedback interviewers left, whether the offer was approved.

ZoomInfo's API tells you who is out there to begin with, what companies they work for, what technology those companies run, whether those accounts are researching your category, and how to reach the right people with verified contact data.

The two APIs operate at different layers of a talent acquisition workflow. Behind ZoomInfo's API sits the GTM Context Graph, which processes 1.5B+ data points daily by combining ZoomInfo's B2B data with your first-party data.

A developer building a complete recruiting pipeline would use Ashby's API to manage the hiring process and ZoomInfo's API to fuel the top of the funnel with candidates and account intelligence worth pursuing.

What It Covers: Search, Enrichment, and AI Intelligence

ZoomInfo's Enterprise API is a REST suite at https://api.zoominfo.com/gtm, organized into four areas documented in the interactive API reference.

Data API (Search & Enrich): Search endpoints cover Contacts, Companies, Intent, News, and Scoops, returning matched records without consuming credits.

Enrich endpoints unlock the full record: business emails, direct dials, employment history, corporate hierarchy, org charts, technographics, and hashtag signals, up to 25 records per call.

The dataset spans 500M contacts, 100M companies, 135M+ verified phone numbers, and 200M+ verified business email addresses. The search-then-enrich pattern means you filter freely, then pay only for records you commit to.

AI Intelligence API (via GTM Workspace): Account Summary returns structured account intelligence with a free-form Q&A endpoint.

Find Similar Companies performs lookalike expansion.

Contact Recommendations returns AI-ranked buying-committee suggestions by motion (prospecting, deal acceleration, renewals).

The pairing with a recruiting API is direct: use ZoomInfo's search to find candidates matching your hiring criteria (job function, seniority, company size, technology stack), enrich them with verified contact data, then push them into Ashby via candidate.create and application.create.

ZoomInfo identifies who to source; Ashby manages the hiring workflow once they enter the pipeline.

Authentication, Rate Limits & Credits

Authentication uses OAuth 2.0 with PKCE via Okta, issuing 24-hour access tokens with rotating refresh tokens. Three flows are supported: Authorization Code with PKCE (for web applications), Client Credentials (for server-to-server), and Refresh Token.

Teams register applications through the ZoomInfo Developer Portal, where they generate credentials, define scopes, and test endpoints.

Rate limits are published by tier: Builder (5 req/sec), Standard (25 req/sec), and Scaling (35 req/sec), with per-hour and per-day sliding-window limits enforced simultaneously.

Every response includes quota headers with remaining capacity, and 429 responses include a Retry-After header with exact backoff timing. Credits follow a rolling 12-month window: enriching a record for the first time consumes one credit; re-enriching the same record within the year is free.

Webhooks, MCP & Developer Experience

Webhooks are available via the Agents API, tied to ZoomInfo's Agent Teams system. Event types cover bulk enrichment jobs completing, records changing, credit usage crossing thresholds, and new GTM signals (scoops, funding events, intent spikes) becoming available. Retry behavior and throttling are configurable per event type.

For developers building AI agents, ZoomInfo's MCP server at https://mcp.zoominfo.com/mcp exposes search, enrich, and account research as native tools for MCP-compatible assistants, currently supporting Claude and ChatGPT.

What you would build with this: an AI recruiting agent that uses ZoomInfo's MCP tools to research target companies, identify hiring decision-makers, and enrich their contact data, then calls Ashby's API to create candidates and schedule outreach sequences.

ZoomInfo does not publish official SDKs either, so both platforms require direct HTTP integration. Documentation lives at docs.zoominfo.com with an interactive API reference, OAuth recipes in five languages, and an llms.txt index for AI development tools.

ZoomInfo added API access to all relevant plans, with consumption-based pricing that is custom-quoted.

BDO Canada reported an 87% reduction in time spent updating internal data dashboards using the ZoomInfo API, with one analyst describing the integration as plug-and-play across any process. (ZoomInfo)

Final Verdict

Ashby's API is well-documented, actively maintained, and gives developers programmatic access to a modern recruiting platform.

Endpoint coverage is broad (candidates, applications, jobs, interviews, offers, scheduling, reports, and org data), the webhook system is production-grade with signature verification and documented retry behavior, and the changelog signals a team that treats the API as a first-class product.

Its limits are limits of scope, not quality: this is a recruiting-workflow API, and it covers that domain thoroughly.

Choose the Ashby API alone if your integration starts and ends with recruiting operations: syncing candidates from a sourcing tool, automating interview scheduling, building reporting pipelines, triggering HRIS workflows on offer acceptance, or extending Ashby's hiring platform with custom logic.

The $400/month entry point with API access included, granular key-level permissions, and incremental sync support make it a capable surface for ATS automation.

Add the ZoomInfo API when the build needs to go upstream: identifying which companies to target, finding the right contacts at those companies, enriching candidate profiles with verified direct dials and business emails, or detecting hiring intent signals before a requisition opens.

ZoomInfo's search-then-enrich pattern (search is free, enrich consumes credits) and the MCP server for AI-agent workflows cover the data intelligence layer that recruiting APIs do not.

Explore the ZoomInfo Enterprise API or start with the developer docs to see the endpoint surface directly.

A developer who needs neither API should note that the Ashby API does not cover B2B data intelligence, and ZoomInfo's API does not manage hiring workflows. If your recruiting pipeline requires both finding candidates and managing their journey through interviews to offer, the two are complementary layers.

FAQ

Is the Ashby API free?

Not as a standalone product. API access is included on all paid Ashby plans, starting at $400/month for the Foundations tier (up to 100 employees).

There are no per-call charges or API-specific credit costs for standard endpoint usage. AI-Assisted Application Review consumes separate AI credits (1,500/month included on Foundations, additional credits at $0.10 each), but standard API operations (listing candidates, creating applications, managing jobs) do not consume credits.

Ashby offers no free plan and no self-serve free trial; new month-to-month subscribers get a 30-day money-back guarantee.

Does Ashby have a GraphQL API?

No. Ashby exposes an RPC-style REST API (currently v1.0) over HTTPS with JSON responses. There is no GraphQL endpoint. The API uses a dot-namespaced pattern (e.g., /candidate.list, /application.create) with POST requests for all operations, including reads. If you need GraphQL, you would need to build a wrapper on top of the REST API.

What is the Ashby API rate limit?

Ashby does not publish rate limit numbers, request-per-minute caps, or bulk-operation limits. No rate-limit tiers by plan exist, and no quota headers appear in API responses. Developers who hit throttling should contact support@ashbyhq.com with the x-ashby-request-id header from the response.

ZoomInfo's API, by contrast, publishes rate limits by tier (5 to 35 requests per second) with quota headers in every response.

Are there official Ashby SDKs?

No. Ashby publishes no official SDKs. Developers integrate directly over HTTP using Basic Auth and JSON. For teams that prefer SDK-backed integration, Ashby is accessible through the Merge ATS API, a third-party unified ATS abstraction that maps Common Models to Ashby's endpoints and provides client libraries in multiple languages.

Ashby also publishes an llms.txt index with all endpoints in OpenAPI format, which AI development tools can consume for code generation.

Does the Ashby API support webhooks?

Yes. Ashby has a webhook system managed through both the admin panel and the API. Each subscription targets a single event type and a single destination URL. Events cover candidate stage changes, application submissions, job posting updates, interview scheduling changes, and offer events.

Payloads include a stable webhookActionId for idempotent processing and optional signature verification via the Ashby-Signature header. Failed deliveries retry with exponential backoff up to 10 attempts; permanent-failure HTTP codes (401, 403, 404, 405, 410) skip retries.

Can I use the Ashby and ZoomInfo APIs together?

Yes, and there is a practical reason to. Ashby's API manages the recruiting workflow: candidates, applications, interview stages, feedback, and offers.

ZoomInfo's API provides the data intelligence that feeds it: searching across 500M contacts and 100M companies, enriching candidates with verified business emails, direct-dial phone numbers, employment history, and company attributes, and detecting intent signals that show when target accounts are hiring or expanding.

The integration pattern is direct: use ZoomInfo's search endpoints to find candidates matching your hiring criteria, enrich with verified contact data, then push them into Ashby via candidate.create and application.create.

ZoomInfo's MCP server extends this to AI-agent workflows, letting an agent research, enrich, and create candidates in Ashby in a single automated pipeline. The two APIs use different authentication (Basic Auth vs. OAuth 2.0) and different pricing (subscription-included vs. consumption-based), so plan your integration layer for both.