Workable API Review 2026: Can You Build Recruiting Workflows on It?

The first question a developer asks about an ATS API is not whether it has endpoints, but whether those endpoints cover enough of the recruiting and HR lifecycle to justify building on them instead of on the platform's UI.

Workable's REST API, currently at v3.21.0, is a documented surface covering jobs, candidates, offers, requisitions, talent pools, employees, time off, time tracking, and performance reviews. Bearer token authentication with scope-based permissions, an MCP server exposing 53 tools for AI agent integration, and an llms.txt index for machine-readable documentation show real developer investment from a platform used by 35,000+ teams.

But scope and depth are different questions.

Workable's API covers the full recruiting and HR lifecycle: creating jobs, managing candidates through pipeline stages, handling offers, tracking employees, processing time-off requests, and running performance reviews. What it does not cover is the intelligence layer upstream of recruiting: who these candidates' current employers are, what those companies look like, which accounts show buying intent, or what the broader org chart reveals about a prospect's decision-making structure. That is a different layer of the stack.

This is where ZoomInfo enters the picture. ZoomInfo is a GTM platform whose Enterprise API is a REST suite covering search, enrichment, AI intelligence, and audience management across 500M contacts and 100M companies, with an MCP server for AI-agent workflows. For developers building recruiting pipelines that need B2B intelligence (company enrichment, org charts, technographics, intent signals) alongside ATS operations, ZoomInfo's API adds the data layer that Workable's recruiting-focused surface does not.

This review covers the Workable API in full technical depth first (authentication, endpoints, webhooks, SDKs, rate limits, and pricing), then reviews ZoomInfo's API as the intelligence layer that picks up where recruiting operations stop.

Workable API at a Glance

Workable API: What Works Well & What to Plan Around

Workable API: Authentication & Getting Started

Source: Workable

API access starts with any paid Workable plan.

The pricing page lists API access across Standard ($299/month), Premier ($599/month), and Enterprise ($719/month) tiers, with no separate developer signup or additional charge. There is no free plan, though a 15-day free trial is available (no credit card required).

You generate tokens in account settings under Integrations. Each token appears only once at creation and can be revoked at any time (revocation immediately disables all applications using that token). All API requests include the token in the Authorization header:

curl "https://yourcompany.workable.com/spi/v3/jobs" \

-H "Authorization: Bearer YOUR_ACCESS_TOKEN"

The API distinguishes between two token types:

• Account tokens: cover most endpoints (jobs, candidates, employees, departments, members, time off, time tracking).

• User tokens: required for specific operations such as offer approval and rejection.

Scope-based permissions are assigned at token creation. Available scopes include: r_jobs, r_candidates / w_candidates, r_employees / w_employees (which grants access to confidential data), r_account / w_members / w_departments, r_requisitions / w_requisitions, r_offers / w_offers (user tokens only), r_reviews / w_reviews, r_timeoff / w_timeoff, and r_time_tracking / w_time_tracking.

This is a step above a flat API key: you can create a token that reads candidates but cannot modify them, or one that manages employees but cannot touch offers. For teams running multiple integrations, the scope model gives you real access control without requiring OAuth.

One constraint: the API does not support CORS, so it is server-side and backend only. Browser-based JavaScript applications cannot call the API directly; you need a backend proxy.

For AI agent integration, the MCP server uses a separate authentication flow: OAuth2 with Dynamic Client Registration (RFC 7591), letting AI clients self-register without manual credential setup via discovery endpoints /.well-known/oauth-authorization-server and /.well-known/oauth-protected-resource.

Workable API: Core Endpoints & Capabilities

The API is organized by resource group, covering the full recruiting lifecycle plus HR operations. All endpoints follow the /spi/v3/{resource} pattern with JSON responses. The llms.txt index enumerates the complete endpoint surface.

Jobs

The jobs surface handles creating, listing, and retrieving job postings along with their configuration.

Key endpoints:

• GET /jobs: list all jobs with filtering options

• GET /jobs/:shortcode: retrieve a specific job by shortcode

• GET /jobs/:shortcode/questions: get the application form questions for a job

• GET /jobs/:shortcode/stages: list pipeline stages for a job

• GET /jobs/:shortcode/application_form: retrieve the full application form configuration

A public, unauthenticated endpoint (GET api/accounts/:subdomain) also lists published jobs, useful for building custom careers pages or job widgets without exposing API credentials.

What you would build with this: a custom careers portal that pulls live job data from Workable, displays role-specific application forms, and syncs pipeline stages into an internal dashboard.

Candidates

The candidate surface is the deepest resource group in the API, covering the full applicant lifecycle.

Key endpoints:

• GET /jobs/:shortcode/candidates: list candidates on a specific job

• POST /jobs/:shortcode/candidates: create a new candidate on a job

• GET /candidates/:id: retrieve a candidate's full profile

• PATCH /candidates/:id: partial update of candidate data

• POST /candidates/:id/move: advance to another pipeline stage

• POST /candidates/:id/disqualify: disqualify a candidate

• POST /candidates/:id/revert: reverse a disqualification

• POST /candidates/:id/copy: copy a candidate to another job

• POST /candidates/:id/relocate: move a candidate to another job

• POST /candidates/:id/tags: manage candidate tags

• POST /candidates/:id/ratings: submit evaluations

• POST /candidates/:id/comments: add internal notes

• GET /candidates/:id/offer: retrieve offer data

The candidate profile includes name, email, phone, stage, tags, skills, education and experience entries, social profiles (40+ supported networks), resume URL, cover letter, and boolean flags for sourced, disqualified, and withdrawn status.

What you would build with this: a CRM sync that pushes qualified contacts from your sales pipeline into Workable as candidates, tags them by source, moves them through stages based on external signals, and pulls evaluation data back for reporting.

Talent Pool

• GET /talent_pool/candidates: list candidates in the talent pool

• POST /talent_pool/candidates: add candidates to the talent pool

The talent pool endpoints let you build long-term candidate databases outside of active job pipelines.

Requisitions

• GET /requisitions: list all requisitions

• POST /requisitions: create a requisition

• PATCH /requisitions: update a requisition

• POST /requisitions/:code/approve: approve a requisition

• POST /requisitions/:code/reject: reject a requisition

These endpoints are available only for accounts with the Hiring Plan feature enabled. They cover the pre-job workflow: headcount approval, budget allocation, and requisition routing.

Offers

• GET /offers/:id: retrieve offer details

• POST /offers/:id/approve: approve an offer

• POST /offers/:id/reject: reject an offer

Offer endpoints require user tokens (not account tokens), reflecting the approval-chain nature of offer workflows. This is a deliberate access control decision: automated systems should not approve offers without a human in the loop.

Employees (HR Operations)

• GET /employees: list employees

• POST /employees: create an employee record

• PATCH /employees/:id: update employee data

• GET /employees/orgchart: retrieve organizational chart nodes

• GET /employees/:id/documents / POST /employees/:id/documents: manage employee documents

The employee surface extends the API beyond recruiting into HR operations, covering the post-hire lifecycle. The org chart endpoint is useful for building internal tools or feeding organizational data into other systems.

Time Off and Time Tracking

• GET /timeoff/requests / POST /timeoff/requests: manage time-off requests

• POST /timeoff/approvals/:key: approve or deny time-off requests

• GET /timeoff/balances / GET /timeoff/categories: retrieve balances and policy configuration

• POST /time-tracking/time-entries: bulk create time entries (max 500 per request), plus single entry CRUD

What you would build with this: a payroll integration that pulls approved time-off data and time-tracking entries from Workable, formats them for your payroll provider, and syncs back any adjustments.

Performance Reviews

• GET /review-cycles/templates / POST /review-cycles/templates: manage performance review templates

Account Configuration

• GET /accounts / GET /accounts/:subdomain: multi-account access

• GET /departments / POST /departments / PUT /departments / DELETE /departments/:id / POST /departments/:id/merge: full department management

• GET /members / PUT /members / POST /members/invite / DELETE /members/:id: team member management

• GET /stages: global pipeline stages

• GET /disqualification_reasons: disqualification reason taxonomy

• GET /permission_sets / GET /collaboration_permissions / GET /legal_entities: access control configuration

• GET /custom_attributes / PATCH /candidates/:id/update_custom_attribute_value: custom field management

Events

• GET /events / GET /events/:id: audit event stream

The events endpoint provides a queryable audit trail of all actions, useful for compliance logging and change-tracking integrations.

Workable API: Webhooks & Events

Workable supports outbound webhooks via a subscription API at /spi/v3/subscriptions, requiring r_candidates or r_employees scope.

Creating a subscription: POST /subscriptions with a target URL and event type. Returns a subscription ID (integer) on success (HTTP 201). Target URLs must be unique per account; duplicate registration returns HTTP 409.

Managing subscriptions: GET /subscriptions lists all active subscriptions; DELETE /subscriptions/:id removes one.

The supported event types cover two areas:

Candidate events:

Employee events:

Candidate subscriptions accept optional args with account_id (required), job_shortcode (empty string "" for all jobs), and stage_slug (e.g., "hired") to narrow event delivery. This filtering lets you build stage-specific automations: subscribe only to the hired stage to trigger onboarding, or to a specific job to power a real-time reporting dashboard.

Payload structure: Every event payload includes id (event identifier), event_type, fired_at (ISO 8601 timestamp), resource_type ("candidate" or "employee"), and a data object with the full candidate or employee record.

Three things to plan around:

• Event coverage is narrow. Two candidate events and five employee events is a limited surface. There are no webhooks for offer events, requisition changes, job status updates, interview scheduling, or evaluation submissions. If your integration depends on real-time notification for any of these, you need to poll the REST endpoints.

• No candidate disqualification event. The candidate_moved event fires on stage changes, but there is no dedicated event for disqualification or withdrawal. You would need to inspect the payload data to detect these state changes.

• Delivery guarantees are not documented. The public documentation does not describe retry policy, payload signing, or delivery guarantees for webhook payloads. Build your receiver to be idempotent.

Workable API: SDKs, Docs & Rate Limits

SDKs & Libraries

Workable does not publish first-party SDKs in any language. Developers integrate directly over HTTP.

Workable has, however, invested in a different approach: unified API platforms. The help center lists four official unified API integrations:

• Apideck: pre-built Workable connector within a unified ATS/HRIS API

• Merge: unified ATS/HRIS API with Workable support

• Unified.to: normalized ATS integration layer

• Kombo: unified ATS+HRIS API connector

StackOne appears within the API reference itself as an official integration partner, offering bi-directional real-time sync, pre-mapped data models, and tool-calling interfaces for AI agents.

For developers who want to skip building directly against the Workable REST API, these unified platforms handle authentication, pagination, and data normalization. The tradeoff: unified APIs typically expose a subset of the full API surface. If you need Workable-specific features (custom attributes, requisition workflows, performance review templates), you may still need direct integration.

No official SDKs means you own the auth layer, the request serialization, the error handling, and any retry logic. For a simple integration against a few endpoints, that is manageable. For a production system touching a dozen resource groups, it adds real engineering overhead.

Documentation & Developer Experience

Developer documentation lives at workable.readme.io, hosted on the ReadMe platform with version v3.21.0 labeled. The documentation includes:

• Full API Reference: all endpoints organized by resource group, with required scopes and token type compatibility noted per endpoint

• Getting started guide: covering token generation and base URL structure

• Webhook documentation: dedicated Candidate Events and Employee Events pages with full payload schemas and example JSON

• MCP server page: setup and configuration for AI agent integration

• StackOne integration page: unified API partner documentation

• llms.txt index: machine-readable index of all documentation pages in Markdown and all endpoints in OpenAPI format, designed for AI agent consumption

The llms.txt index is a practical developer experience choice. Rather than building SDK wrappers in seven languages, Workable made the full API spec available in a format that AI development tools (Cursor, Windsurf, Claude, ChatGPT) can consume directly. For developers working with AI-assisted tooling, this may be more useful than a traditional SDK.

The help center supplements the API reference with access token management guides, MCP server setup instructions, API troubleshooting articles, and unified API integration documentation. A developer partner program offers deeper API access for partners building integrations across sourcing, assessments, video interviews, background checks, and HRIS onboarding categories.

The documentation is clear and well-organized for an ATS platform. Per-endpoint scope requirements and token type compatibility are documented explicitly, which saves time when building multi-resource integrations. The interactive reference lets you test endpoints directly.

Rate Limits & Constraints

Workable's public documentation does not publish specific rate limit figures. There are no documented requests-per-second ceilings, burst limits, or per-tier quotas. The help center references API troubleshooting articles but does not surface numeric limits.

This is a real gap for any developer evaluating the API. Every other dimension of the developer experience (scopes, token types, endpoint coverage, payload schemas) is documented; rate limits are the exception. You will discover the throttling behavior in production, not in the docs.

Known documented constraints beyond rate limits:

• The API does not support CORS (server-side only)

• Offer endpoints require user tokens, not account tokens

• Requisition endpoints are available only for accounts with the Hiring Plan feature

• Time tracking bulk endpoint accepts a maximum of 500 entries per request

• Webhook target URLs must be unique per account (duplicate returns HTTP 409)

• Viewing talent pool candidates is not currently supported via the API

Workable API Pricing & Access Costs

Workable bundles API access into its paid plans rather than charging per call or per credit. The pricing page lists "API access" across all three tiers. The entry points:

• Standard: $299/month ($3,588/year) for 1-20 employees. Includes full API access, data export, and webhook support.

• Premier: $599/month ($7,188/year) for 1-20 employees. Everything in Standard plus bundled add-ons (texting, video interviews, assessments, referrals, performance reviews).

• Enterprise: $719/month ($8,628/year) for 1-20 employees. Annual billing only; additional features not publicly disclosed.

Pricing scales by employee headcount across nine bands (1-20 through 1,000+), so the actual monthly cost depends on company size. There are no published per-call charges, no API-specific credit deductions, and no metered API pricing.

The MCP server is available across all plans at no additional cost.

For a developer sizing costs: the API is effectively free if you already pay for Workable. The cost driver is the plan tier and headcount band, not API consumption. Two things to note:

• There is no free plan. The 15-day trial provides limited access, but Workable does not specify whether API access is included in the trial.

• Pricing scales with headcount, not API usage. A company growing from 20 to 50 employees moves to a higher pricing band regardless of API activity.

Where the Workable API Falls Short

These are the limits a developer should plan around when building on this API. Several reflect what Workable is (an ATS and HR platform) and what it is not.

No rate limit documentation.

The biggest gap for developers evaluating the API. Workable documents scopes, token types, payload schemas, and webhook event types, but publishes no rate limit figures. A developer building a production integration cannot plan capacity, implement backoff logic, or size batch operations without testing against the live API first.

Webhook event coverage is thin.

Two candidate events (candidate_created, candidate_moved) and five employee events. There are no webhooks for offer approvals, requisition changes, job status updates, interview scheduling, evaluation submissions, or assessment completions. For event-driven architectures, this means polling overhead for any workflow beyond basic candidate and employee lifecycle tracking.

No first-party SDKs.

Integration is raw HTTP in every language. Workable's answer is unified API platforms (Apideck, Merge, Kombo, Unified.to), which abstract the integration but expose only a subset of the API surface. Developers who need the full endpoint catalogue build and maintain the client layer themselves.

Bearer token auth only, no OAuth 2.0 for third-party apps.

The API uses static Bearer tokens with scope-based permissions. There is no delegated OAuth flow for multi-tenant integrations where each customer authenticates with their own Workable account.

If you are building a SaaS product that connects to many Workable instances, each customer must generate and share a token manually. (The MCP server uses OAuth2 with Dynamic Client Registration, but this flow is designed for AI clients, not general-purpose third-party applications.)

No B2B intelligence layer.

Workable's API covers recruiting and HR operations. There are no endpoints for company enrichment, company attributes, org chart intelligence beyond the company's own employees, technographic profiles, buyer intent signals, or contact data outside of candidates and employees.

If your pipeline needs to enrich a candidate's current employer with company size, funding status, technology stack, or executive contacts, that data requires a separate API.

No CORS support.

The API is server-side only. Browser-based single-page applications cannot call the API directly; you need a backend proxy layer. This rules out lightweight client-side integrations.

Talent pool visibility gap.

Viewing talent pool candidates via the API is not currently supported, limiting the ability to build automated talent nurturing workflows or long-term candidate relationship tools programmatically.

ZoomInfo API: The B2B Intelligence Layer Beyond Recruiting

Workable's API tells you where a candidate is in your pipeline, what stage they have reached, and whether they have been evaluated.

ZoomInfo's API tells you who that candidate's current employer is, what the company's tech stack looks like, how large the organization is, whether the account shows buying intent, and where the candidate sits in the corporate hierarchy.

Source: ZoomInfo

The two APIs operate at different layers.

Underlying ZoomInfo's API is the GTM Context Graph, an intelligence layer that processes 1.5B+ data points daily and combines B2B data with first-party signals to show not just what happened at an account, but why. A developer building recruiting intelligence (not just recruiting operations) would use Workable's API to manage the hiring workflow and ZoomInfo's API to power the data that informs hiring decisions, sourcing strategies, and account-based recruiting.

Source: ZoomInfo

What the API Covers: Search, Enrichment, and AI Intelligence

ZoomInfo's Enterprise API is a REST suite served from https://api.zoominfo.com/gtm, organized into four areas documented in the interactive API reference:

• Data API (Search & Enrich): Search endpoints cover Contacts, Companies, Intent, News, and Scoops, returning matched records without consuming credits. Enrich endpoints unlock the full payload: business emails, direct dials, employment history, corporate hierarchy, org charts, technographics, and hashtag signals, up to 25 records per call.

The underlying dataset spans 500M contacts and 100M companies, 135M+ verified phone numbers, and 200M+ verified business email addresses.

Source: ZoomInfo

• Copilot API (AI Intelligence): Account Summary returns structured account intelligence with a free-form Q&A endpoint. Find Similar Companies performs lookalike expansion. Contact Recommendations returns AI-ranked buying-committee suggestions by motion (prospecting, deal acceleration, renewals).

• Marketing API: CRUD endpoints for programmatic audience management.

• Platform API (Engagements, Beta): Bidirectional engagement data via the Engagements API.

The pairing with an ATS API is direct: when Workable tells you a candidate moved to the "hired" stage, ZoomInfo can enrich the candidate's employer record with company intelligence. For recruiting teams sourcing candidates from specific companies, ZoomInfo's search endpoints identify contacts matching a target profile (by title, seniority, company size, tech stack) without consuming credits, and the enrich endpoints unlock their verified contact data.

Source: ZoomInfo

Authentication, Rate Limits & Credits

ZoomInfo uses OAuth 2.0 with PKCE via Okta, supporting three flows: Authorization Code with PKCE (web applications), Client Credentials (server-to-server), and Refresh Token. Access tokens are 24-hour Bearer tokens with rotating refresh tokens. Teams register applications through the ZoomInfo Developer Portal, where they generate credentials, define scopes, and test endpoints.

This is a different authentication model from Workable's static Bearer tokens: it supports delegated access, credential rotation, and scoped permissions out of the box. For multi-tenant integrations and enterprise security requirements, OAuth 2.0 is the expected standard.

Rate limits are published by tier: Builder (5 req/sec), Standard (25 req/sec), and Scaling (35 req/sec), with per-hour and per-day sliding-window limits enforced simultaneously.

Every response includes quota headers with remaining capacity, and 429 responses include a Retry-After header with exact backoff timing. Credits follow a rolling 12-month window: a record enriched for the first time consumes one credit; re-enriching the same record within the year is free. Search and lookup operations are free.

Source: ZoomInfo

Webhooks, MCP & Developer Experience

Webhooks are available via the Agents API, tied to ZoomInfo's Agent Teams system. Event types cover bulk enrichment jobs completing, records changing, credit usage crossing thresholds, and new GTM signals (scoops, funding events, intent spikes) becoming available. Retry behavior and throttling are configurable per event type.

ZoomInfo's MCP server at https://mcp.zoominfo.com/mcp exposes search, enrich, and account research as native tools for MCP-compatible assistants, currently supporting Claude and ChatGPT. A separate Docs MCP server lets AI development tools generate integration code against the API spec.

Source: ZoomInfo

ZoomInfo does not publish official SDKs either, so both platforms require direct HTTP integration. Documentation lives at docs.zoominfo.com with an interactive API reference, OAuth recipes in five languages, and an llms.txt index for AI development tools. ZoomInfo has added API access to all relevant plans, with consumption-based pricing.

BDO Canada reported an 87% reduction in time spent updating internal data dashboards using the ZoomInfo API, with one analyst describing the integration as plug-and-play across any process. (ZoomInfo)

Final Verdict

Workable's API is a well-documented, scope-controlled surface that covers the full recruiting and HR lifecycle in a single REST interface. Bearer tokens with granular scopes, a 53-tool MCP server, and an llms.txt index for AI agent consumption reflect a platform that has invested in developer access.

Its limits are limits of scope and documentation: the webhook surface is thin, rate limits are undocumented, there are no first-party SDKs, and the data boundary stops at what is inside the ATS.

Choose the Workable API if your integration is recruiting-operations-first: managing jobs, moving candidates through pipelines, syncing employee records, automating time-off approvals, or building custom careers portals. The API covers what the platform does, and the $299/month entry with API access included makes it accessible without a separate developer contract.

Add the ZoomInfo API when the build needs the intelligence layer upstream of recruiting: identifying which companies to source from, enriching candidate employer data with company attributes and technographics, detecting buyer intent signals, mapping org charts at target accounts, or powering AI-driven account research.

Workable tells you where a candidate stands; ZoomInfo tells you where that candidate's company stands.

Explore the ZoomInfo Enterprise API or start with the developer docs to see the endpoint surface for yourself.

FAQ

Is the Workable API free?

API access is included on all paid Workable plans starting at $299/month for the Standard tier. There are no published per-call charges or API-specific credit costs. There is no permanent free plan; a 15-day free trial is available without a credit card, though Workable does not specify whether API access is included during the trial. The MCP server is available across all plans at no additional cost.

Does Workable have a GraphQL API?

No. Workable exposes a REST API (currently at v3.21.0) that communicates over HTTPS and returns JSON responses. There is no GraphQL endpoint. If you need a GraphQL interface for recruiting data, you would need to build a wrapper layer on top of the REST API.

What is the Workable API rate limit?

Workable does not publish specific rate limit figures in its public documentation. There are no documented requests-per-second ceilings, burst limits, or per-tier quotas. Known constraints include a maximum of 500 time tracking entries per bulk request and the requirement that webhook target URLs be unique per account, but the general request throttling behavior is not documented.

Are there official Workable SDKs?

No. Workable does not publish first-party SDKs in any language. The platform instead supports official integrations with unified API platforms (Apideck, Merge, Unified.to, Kombo, and StackOne) that provide pre-built Workable connectors within normalized ATS/HRIS API layers. For direct API access, developers integrate over HTTP using the documented REST endpoints.

Does the Workable API support webhooks?

Yes, through a subscription API at /spi/v3/subscriptions. Webhooks support two candidate event types (candidate_created, candidate_moved) and five employee event types (employee_created, employee_updated, employee_published, onboarding_completed, timeoff_updated).

Subscriptions filter by account, job shortcode, and pipeline stage. The event surface is narrower than some ATS APIs, with no webhook support for offer events, requisition changes, job status updates, or evaluation submissions.

What does ZoomInfo's API add to a Workable build?

ZoomInfo's API adds the B2B data and intelligence layer that Workable's recruiting-focused API does not cover.

Where Workable manages candidates, jobs, and employees, ZoomInfo provides the company and contact intelligence that informs sourcing strategy: search across 500M contacts and 100M companies, enrich with company attributes, org charts, technographics, and employment history, detect buyer intent signals, and generate AI-powered account research and buying-committee recommendations.

A recruiting team building on Workable's API could use ZoomInfo's search endpoints to identify sourcing targets at specific companies (by title, seniority, tech stack) and then push those contacts into Workable as candidates. The two APIs use different authentication models (Bearer token vs. OAuth 2.0) and different pricing structures (bundled subscription vs. consumption-based), so plan the integration layer to handle both. ZoomInfo's MCP server extends the same intelligence to AI-agent recruiting workflows alongside Workable's own MCP server.