Roles and access
Organization, Client and Job scope: why a key or person sees exactly what their role reaches.
Every call acts in one organization, with a role.
- Admins can do everything in the organization.
- Everyone else holds one or more roles (Team Lead, Recruiter, Hiring Manager, Analyst, Developer, or roles your admins create).
Each role is a set of permissions held at a scope:
- Organization: every Job.
- Client: every Job of that Client.
- Job: that Job only.
A person's AI client acts with that person's roles. An API key holds its own role, given when the key is created, and no one can give a key more than they hold themselves.
What this means for your integration
GET /operationsalready reflects the role. An operation that isn't listed isn't allowed.- Lists are filtered.
jobs.listreturns only the Jobs the caller can see. - A Client-scoped key for "Acme" can never read another Client's Jobs, even by id.
The Developer role
The Developer role can create and manage API keys and read the API request log. On its own it sees no candidates or Jobs: give each key the role its job needs.