TO
TalentOSAPI · Changelog

API · Changelog

What changed in the API.

Semver-tracked history of every public endpoint. The current stable surface is v1.0.0. Pilot integrators can pin to /api/v1/ for the life of v1 — breaking changes will ship at /api/v2/ with a documented deprecation window for v1.

PATCH 1.0.x

Backward-compatible fixes. No action required — re-deploy when you like.

MINOR 1.x.0

New endpoint or optional field. Existing calls keep working unchanged.

MAJOR 2.0.0

Breaking. Lives at /api/v2/. v1 stays online for the deprecation window.

Back to /api-docsStatus pageSubscribed to api.changelog RSS? We'll publish one when v1.1+ ships — for now follow this page.

v1.0.0

2026-06-02

Initial stable v1 surface. 60+ HTTP endpoints across auth, tenants, vacancies, candidates, offers, interviews, AI, library, uploads, webhooks, audit, and account/NDPR. Versioned routing alias (/api/v1/X) shipped; future breaking changes will live at /api/v2/* with this surface preserved for a deprecation window.

Added

  • ·Versioned routing — /api/v1/X is internally aliased to /api/X (middleware rewrite). Lets us promise a stable v1 surface to pilot customers.
  • ·Postman collection auto-generator — emits public/talentos-postman.json from app/api-docs/sections.ts. Downloadable from /api-docs. ref
  • ·Webhook payload simulator — /api/_dev/webhook-test returns the signed envelope + X-TalentOS-Signature header so integrators can verify their handler before wiring real events. ref
  • ·Webhooks: 8 event types (candidate.applied, candidate.stage_changed, vacancy.published, offer.sent, offer.accepted, offer.declined, interview.scheduled, interview.completed). HMAC-SHA256 signed, exponential-backoff retries (30s → 6h, 6 attempts), auto-disable after 20 consecutive failures. ref
  • ·Offers — full CRUD at /api/offers with status transitions sent/accepted/declined; acceptance auto-bumps candidate to hired + vacancy.hired counter. ref
  • ·Interviews — full CRUD at /api/interviews with inline scorecards; status=completed fires interview.completed webhook. ref
  • ·Bearer-token auth alongside cookie sessions. Mint at /account → API keys; every protected endpoint accepts Authorization: Bearer tk_… ref
  • ·AI decision log — every AI screen / draft-offer / attrition-risk call records inputs, outputs, model, tokens, cost, and tenant. EU AI Act art. 26 transparency. ref
  • ·SCIM 2.0 provisioning — /api/scim/v2/{Users,Groups} for enterprise IDPs (Okta, Azure AD, Google Workspace). Per-tenant bearer token.
  • ·GDPR/NDPR data-rights endpoints — GET /api/account/export and POST /api/account/delete (typed tenant-id confirmation). ref
  • ·Public careers API — GET /api/careers/vacancies and POST /api/careers/apply for the candidate-facing portal. Auth=public; tenant-scoped writes via vacancyId. ref

Changed

  • ·Bumped from internal/alpha to v1.0.0 stable. This page (and semver) is the contract going forward.

Security

  • ·Origin/Referer CSRF defence on every mutating /api/* call. Bearer-authed callers and GET/HEAD/OPTIONS bypass.
  • ·AES-256-GCM at-rest encryption for per-tenant secrets (Anthropic API keys, SSO client secrets, SCIM tokens). Platform key never exposed client-side.
  • ·Cross-tenant reads/writes return 404 (never 403) to avoid leaking the existence of records in other tenants.

Coming up

On the v1 surface (no breaking changes): cursor pagination for list endpoints, ETag/If-None-Match on individual records, per-tenant rate-limit headers (X-RateLimit-Limit / Remaining / Reset), additional webhook events for assessments and offers. Subscribed to this page so we'll repost here when each lands.

Found something missing? Email api@talentosglobal.co — pilot feedback shapes the v1.1 minor.