OVERALL CONTROL / 0.6-customer-control
Grades and scoring
Data access
25% of the overall score before applicability adjustment.
Scored answers and evidence
Read interface 7.5/10
Structured API for the declared product scope
SmartRecruiters / candidates with at least one job application, candidate-profile updates and current collection traversal through the General Partner Integration; public postings and deprecated authorization-code onboarding are separate.
The candidate search API returns candidates having at least one application; it does not establish all prospects or application-free people.
SmartRecruiters candidate search and pagination ↗
Candidates must have application; updatedAfter; limit max 100; pageId/nextPageId/Link · Checked 2026-10-16
Bulk delivery 8.8/10
Batched or iterable API requests
SmartRecruiters / candidates with at least one job application, candidate-profile updates and current collection traversal through the General Partner Integration; public postings and deprecated authorization-code onboarding are separate.
Complete the documented pagination to retrieve the permitted current collection; a page alone is not a complete copy.
SmartRecruiters candidate search and pagination ↗
Candidates must have application; updatedAfter; limit max 100; pageId/nextPageId/Link · Checked 2026-10-16
Query expressiveness 8.8/10
Documented structured API filters
SmartRecruiters / candidates with at least one job application, candidate-profile updates and current collection traversal through the General Partner Integration; public postings and deprecated authorization-code onboarding are separate.
Filters include updatedAfter, job, status, tag and consent; pageId continues the exact selected search.
SmartRecruiters candidate search and pagination ↗
Candidates must have application; updatedAfter; limit max 100; pageId/nextPageId/Link · Checked 2026-10-16
Access cost barrier -
-
SmartRecruiters / candidates with at least one job application, candidate-profile updates and current collection traversal through the General Partner Integration; public postings and deprecated authorization-code onboarding are separate.
The reviewed API documentation establishes a technical route; lowest-paid-plan entitlement, partner charges and fixed API access fees remain unresolved.
SmartRecruiters General Partner Integration ↗
Master credentials; scope approval; customer-level credentials; customer consent; application visibility · Checked 2026-10-16
Third-party accessibility
20% of the overall score before applicability adjustment.
Scored answers and evidence
Third-party eligibility 5.0/10
Separate provider consent or partner agreement required
SmartRecruiters / candidates with at least one job application, candidate-profile updates and current collection traversal through the General Partner Integration; public postings and deprecated authorization-code onboarding are separate.
New partner applications enter SAP PartnerEdge Build and obtain reviewed scopes/master credentials, then customer-specific credentials after consent. Customer-only keys do not establish this eligibility.
SmartRecruiters application registration ↗
New technology partnerships through SAP PartnerEdge Build Program · Checked 2026-10-16
SmartRecruiters General Partner Integration ↗
Master credentials; scope approval; customer-level credentials; customer consent; application visibility · Checked 2026-10-16
SmartRecruiters customer API route scope ↗
Customer-only API key versus productized OAuth applications · Checked 2026-10-16
Downstream permission -
-
SmartRecruiters / candidates with at least one job application, candidate-profile updates and current collection traversal through the General Partner Integration; public postings and deprecated authorization-code onboarding are separate.
The authentication and operation guides do not establish applicable processing, AI-use or redistribution rights.
SmartRecruiters General Partner Integration ↗
Master credentials; scope approval; customer-level credentials; customer consent; application visibility · Checked 2026-10-16
External action
15% of the overall score before applicability adjustment.
Scored answers and evidence
Write interface 2.5/10
Named operations in a limited domain
SmartRecruiters / candidates with at least one job application, candidate-profile updates and current collection traversal through the General Partner Integration; public postings and deprecated authorization-code onboarding are separate.
PATCH /candidates/{id} updates personal fields. Permissions and duplicate email/last-name conflicts apply; candidate creation is outside this assessed write proof.
SmartRecruiters update candidate profile ↗
PATCH /candidates/{id}; personal information; PERMISSION_DENIED; duplicate email/last-name conflicts · Checked 2026-10-16
Custom application path 5.0/10
Approved third-party applications using fixed interfaces
SmartRecruiters / candidates with at least one job application, candidate-profile updates and current collection traversal through the General Partner Integration; public postings and deprecated authorization-code onboarding are separate.
A chosen provider integration must complete the disclosed approval route before customer authorization.
SmartRecruiters application registration ↗
New technology partnerships through SAP PartnerEdge Build Program · Checked 2026-10-16
SmartRecruiters General Partner Integration ↗
Master credentials; scope approval; customer-level credentials; customer consent; application visibility · Checked 2026-10-16
SmartRecruiters customer API route scope ↗
Customer-only API key versus productized OAuth applications · Checked 2026-10-16
Continuity
15% of the overall score before applicability adjustment.
Scored answers and evidence
Refresh mechanism 7.5/10
Documented updated-since filters or webhooks
SmartRecruiters / candidates with at least one job application, candidate-profile updates and current collection traversal through the General Partner Integration; public postings and deprecated authorization-code onboarding are separate.
Poll updatedAfter and periodically repeat the unfiltered permitted application-bearing collection.
SmartRecruiters candidate search and pagination ↗
Candidates must have application; updatedAfter; limit max 100; pageId/nextPageId/Link · Checked 2026-10-16
Limit visibility 10.0/10
Published numeric quotas and recovery instructions
SmartRecruiters / candidates with at least one job application, candidate-profile updates and current collection traversal through the General Partner Integration; public postings and deprecated authorization-code onboarding are separate.
Limits apply per Customer API user: 10 requests/second and 8 concurrent requests, with GET /candidates limited to one concurrent. Observe rate/concurrency headers and 429 handling.
SmartRecruiters customer API throttling ↗
Individual Customer API user: 10 requests/sec; 8 concurrent; GET /candidates one concurrent; headers/429 · Checked 2026-10-16
CDC and deletion capture 5.0/10
Updates identified; deletion capture not established
SmartRecruiters / candidates with at least one job application, candidate-profile updates and current collection traversal through the General Partner Integration; public postings and deprecated authorization-code onboarding are separate.
updatedAfter identifies changed profiles; native deletion identities and retained deleted payloads are unverified.
SmartRecruiters candidate search and pagination ↗
Candidates must have application; updatedAfter; limit max 100; pageId/nextPageId/Link · Checked 2026-10-16
Replay and gap recovery 2.5/10
Rebuild from a fresh snapshot; no historical replay established
SmartRecruiters / candidates with at least one job application, candidate-profile updates and current collection traversal through the General Partner Integration; public postings and deprecated authorization-code onboarding are separate.
Follow nextPageId/Link from a fresh traversal to rebuild current candidates with applications; deleted records and application-free prospects are excluded.
SmartRecruiters candidate search and pagination ↗
Candidates must have application; updatedAfter; limit max 100; pageId/nextPageId/Link · Checked 2026-10-16
Data exit
20% of the overall score before applicability adjustment.
Scored answers and evidence
Export custody 7.5/10
Customer-held structured files or API records
SmartRecruiters / candidates with at least one job application, candidate-profile updates and current collection traversal through the General Partner Integration; public postings and deprecated authorization-code onboarding are separate.
The API returns structured records that a permitted client can retain as a customer-held copy.
SmartRecruiters candidate search and pagination ↗
Candidates must have application; updatedAfter; limit max 100; pageId/nextPageId/Link · Checked 2026-10-16
Post-cancellation access Disclosure
-
Disclosure only; does not reduce planned-exit credit.
SmartRecruiters / candidates with at least one job application, candidate-profile updates and current collection traversal through the General Partner Integration; public postings and deprecated authorization-code onboarding are separate.
Current API retrieval does not establish contractual retrieval rights after cancellation.
SmartRecruiters candidate search and pagination ↗
Candidates must have application; updatedAfter; limit max 100; pageId/nextPageId/Link · Checked 2026-10-16
Planned migration fidelity 7.5/10
Portable structured records on documented routes; whole-product completeness unverified
SmartRecruiters / candidates with at least one job application, candidate-profile updates and current collection traversal through the General Partner Integration; public postings and deprecated authorization-code onboarding are separate.
Portable records cover the declared collection. Files, full activity history, workflow configuration and a whole-product restore remain outside the established scope.
SmartRecruiters candidate search and pagination ↗
Candidates must have application; updatedAfter; limit max 100; pageId/nextPageId/Link · Checked 2026-10-16
Business logic and customization
5% of the overall score before applicability adjustment.
Scored answers and evidence
Logic authoring 2.5/10
External integration code; native business logic portability not established
SmartRecruiters / candidates with at least one job application, candidate-profile updates and current collection traversal through the General Partner Integration; public postings and deprecated authorization-code onboarding are separate.
Customers can implement logic in an external API client; native workflow authoring or portable native definitions are not established (client code is a separate artifact).
SmartRecruiters General Partner Integration ↗
Master credentials; scope approval; customer-level credentials; customer consent; application visibility · Checked 2026-10-16
Rights to custom logic -
-
SmartRecruiters / candidates with at least one job application, candidate-profile updates and current collection traversal through the General Partner Integration; public postings and deprecated authorization-code onboarding are separate.
The reviewed API guides do not establish ownership, reusable export or independent execution rights for native workflow artifacts.
SmartRecruiters General Partner Integration ↗
Master credentials; scope approval; customer-level credentials; customer consent; application visibility · Checked 2026-10-16
Scores are out of 10. * Incomplete evidence discounts verified capabilities (unknown answers stay unknown). Planned migration drives data exit. Scoring method ↗
CUSTOMER CHOICE
Third-party accessibility
New partner applications enter SAP PartnerEdge Build and obtain reviewed scopes/master credentials, then customer-specific credentials after consent. Customer-only keys do not establish this eligibility.
Confirm who can connect, who owns the credentials and which uses are permitted. Customer consent and provider approval can be separate requirements; the selected plan and contract still matter.
READ / INTEGRATE
API and export routes
The candidate search API returns candidates having at least one application; it does not establish all prospects or application-free people. Complete the documented pagination to retrieve the permitted current collection; a page alone is not a complete copy. Filters include updatedAfter, job, status, tag and consent; pageId continues the exact selected search.
| Access route | Authentication | Credential owner | Provider approval | Access requirement | Last checked |
|---|---|---|---|---|---|
| General Partner Integration customer credentials | OAuth client credentials | Integration provider | Yes | partner agreement | 2026-10-16 |
Availability depends on your product, plan and agreement. See the documentation below for the requirements of each route.
ECONOMIC ACCESS
Cost, authentication and limits
The reviewed API documentation establishes a technical route; lowest-paid-plan entitlement, partner charges and fixed API access fees remain unresolved.
Check API entitlement, credential ownership and rate limits for the route you intend to use. Include review fees, customer-plan upgrades and ongoing access charges in the total.
ACT FROM OUTSIDE
External action
PATCH /candidates/{id} updates personal fields. Permissions and duplicate email/last-name conflicts apply; candidate creation is outside this assessed write proof.
Validate the supported operation, acting identity and permission scope (read access does not imply write permission). Ambiguous retries and revoked credentials also affect whether an external workflow can run safely.
KEEP ACCESS USEFUL
Continuity
Poll updatedAfter and periodically repeat the unfiltered permitted application-bearing collection. updatedAfter identifies changed profiles; native deletion identities and retained deleted payloads are unverified. Follow nextPageId/Link from a fresh traversal to rebuild current candidates with applications; deleted records and application-free prospects are excluded. Limits apply per Customer API user: 10 requests/second and 8 concurrent requests, with GET /candidates limited to one concurrent. Observe rate/concurrency headers and 429 handling.
CDC, deletions and recovery
| Question | Answer / applicable route | Evidence |
|---|---|---|
| Can ongoing extraction identify updates and deleted records on the declared route? | Updates identified; deletion capture not establishedSmartRecruiters / candidates with at least one job application, candidate-profile updates and current collection traversal through the General Partner Integration; public postings and deprecated authorization-code onboarding are separate. updatedAfter identifies changed profiles; native deletion identities and retained deleted payloads are unverified. | SmartRecruiters candidate search and pagination ↗Candidates must have application; updatedAfter; limit max 100; pageId/nextPageId/LinkChecked 2026-10-16 |
| How can extraction recover after missed events or an interrupted consumer? | Rebuild from a fresh snapshot; no historical replay establishedSmartRecruiters / candidates with at least one job application, candidate-profile updates and current collection traversal through the General Partner Integration; public postings and deprecated authorization-code onboarding are separate. Follow nextPageId/Link from a fresh traversal to rebuild current candidates with applications; deleted records and application-free prospects are excluded. | SmartRecruiters candidate search and pagination ↗Candidates must have application; updatedAfter; limit max 100; pageId/nextPageId/LinkChecked 2026-10-16 |
Useful ongoing access includes corrections and deletions, not only the first export. A failed request, changed filter or lost resource permission should not be interpreted as a deleted record.
LEAVE WITH YOUR DATA
Data exit and portability
Portable records cover the declared collection. Files, full activity history, workflow configuration and a whole-product restore remain outside the established scope. Current API retrieval does not establish contractual retrieval rights after cancellation.
Test the output against the destination’s required fields and history. Check stable identifiers, relationships, attachments and extraction time; a sample file proves only the coverage of that sample.
BUILD / INSPECT / REUSE
Business logic and customization
Customers can implement logic in an external API client; native workflow authoring or portable native definitions are not established (client code is a separate artifact). The reviewed API guides do not establish ownership, reusable export or independent execution rights for native workflow artifacts.
Custom API access, ownership of workflows and the right to export their definitions are separate questions. A custom-app capability alone does not establish that business rules can move to another system.
AGREEMENTS / API DOCS / PROGRAM REQUIREMENTS
Documented conditions
Answers below come from public provider materials. Every answer retains its source check date, scope (a partner agreement does not describe every customer route). Customer contracts and live behavior still need verification.
| Question | Answer / applicable route | Evidence |
|---|---|---|
| What structured read interface is documented? | Structured API for the declared product scopeSmartRecruiters / candidates with at least one job application, candidate-profile updates and current collection traversal through the General Partner Integration; public postings and deprecated authorization-code onboarding are separate. The candidate search API returns candidates having at least one application; it does not establish all prospects or application-free people. | SmartRecruiters candidate search and pagination ↗Candidates must have application; updatedAfter; limit max 100; pageId/nextPageId/LinkChecked 2026-10-16 |
| How can customers retrieve data in bulk? | Batched or iterable API requestsSmartRecruiters / candidates with at least one job application, candidate-profile updates and current collection traversal through the General Partner Integration; public postings and deprecated authorization-code onboarding are separate. Complete the documented pagination to retrieve the permitted current collection; a page alone is not a complete copy. | SmartRecruiters candidate search and pagination ↗Candidates must have application; updatedAfter; limit max 100; pageId/nextPageId/LinkChecked 2026-10-16 |
| What queries can a customer issue outside the provider UI? | Documented structured API filtersSmartRecruiters / candidates with at least one job application, candidate-profile updates and current collection traversal through the General Partner Integration; public postings and deprecated authorization-code onboarding are separate. Filters include updatedAfter, job, status, tag and consent; pageId continues the exact selected search. | SmartRecruiters candidate search and pagination ↗Candidates must have application; updatedAfter; limit max 100; pageId/nextPageId/LinkChecked 2026-10-16 |
| Who decides whether a chosen third party may connect? | Separate provider consent or partner agreement requiredSmartRecruiters / candidates with at least one job application, candidate-profile updates and current collection traversal through the General Partner Integration; public postings and deprecated authorization-code onboarding are separate. New partner applications enter SAP PartnerEdge Build and obtain reviewed scopes/master credentials, then customer-specific credentials after consent. Customer-only keys do not establish this eligibility. | SmartRecruiters application registration ↗New technology partnerships through SAP PartnerEdge Build ProgramChecked 2026-10-16 SmartRecruiters General Partner Integration ↗Master credentials; scope approval; customer-level credentials; customer consent; application visibilityChecked 2026-10-16 SmartRecruiters customer API route scope ↗Customer-only API key versus productized OAuth applicationsChecked 2026-10-16 |
| What extra commercial condition applies to the routes supplying the assessed read capability, relative to the lowest paid plan? | -SmartRecruiters / candidates with at least one job application, candidate-profile updates and current collection traversal through the General Partner Integration; public postings and deprecated authorization-code onboarding are separate. The reviewed API documentation establishes a technical route; lowest-paid-plan entitlement, partner charges and fixed API access fees remain unresolved. | SmartRecruiters General Partner Integration ↗Master credentials; scope approval; customer-level credentials; customer consent; application visibilityChecked 2026-10-16 |
| What permission is needed for the documented downstream use? | -SmartRecruiters / candidates with at least one job application, candidate-profile updates and current collection traversal through the General Partner Integration; public postings and deprecated authorization-code onboarding are separate. The authentication and operation guides do not establish applicable processing, AI-use or redistribution rights. | SmartRecruiters General Partner Integration ↗Master credentials; scope approval; customer-level credentials; customer consent; application visibilityChecked 2026-10-16 |
| Which external write operations are documented? | Named operations in a limited domainSmartRecruiters / candidates with at least one job application, candidate-profile updates and current collection traversal through the General Partner Integration; public postings and deprecated authorization-code onboarding are separate. PATCH /candidates/{id} updates personal fields. Permissions and duplicate email/last-name conflicts apply; candidate creation is outside this assessed write proof. | SmartRecruiters update candidate profile ↗PATCH /candidates/{id}; personal information; PERMISSION_DENIED; duplicate email/last-name conflictsChecked 2026-10-16 |
| How can customers connect an application they build or choose? | Approved third-party applications using fixed interfacesSmartRecruiters / candidates with at least one job application, candidate-profile updates and current collection traversal through the General Partner Integration; public postings and deprecated authorization-code onboarding are separate. A chosen provider integration must complete the disclosed approval route before customer authorization. | SmartRecruiters application registration ↗New technology partnerships through SAP PartnerEdge Build ProgramChecked 2026-10-16 SmartRecruiters General Partner Integration ↗Master credentials; scope approval; customer-level credentials; customer consent; application visibilityChecked 2026-10-16 SmartRecruiters customer API route scope ↗Customer-only API key versus productized OAuth applicationsChecked 2026-10-16 |
| What mechanism supports repeatable extraction of changes? | Documented updated-since filters or webhooksSmartRecruiters / candidates with at least one job application, candidate-profile updates and current collection traversal through the General Partner Integration; public postings and deprecated authorization-code onboarding are separate. Poll updatedAfter and periodically repeat the unfiltered permitted application-bearing collection. | SmartRecruiters candidate search and pagination ↗Candidates must have application; updatedAfter; limit max 100; pageId/nextPageId/LinkChecked 2026-10-16 |
| How are integration limits disclosed? | Published numeric quotas and recovery instructionsSmartRecruiters / candidates with at least one job application, candidate-profile updates and current collection traversal through the General Partner Integration; public postings and deprecated authorization-code onboarding are separate. Limits apply per Customer API user: 10 requests/second and 8 concurrent requests, with GET /candidates limited to one concurrent. Observe rate/concurrency headers and 429 handling. | SmartRecruiters customer API throttling ↗Individual Customer API user: 10 requests/sec; 8 concurrent; GET /candidates one concurrent; headers/429Checked 2026-10-16 |
| Where can a usable data copy be delivered? | Customer-held structured files or API recordsSmartRecruiters / candidates with at least one job application, candidate-profile updates and current collection traversal through the General Partner Integration; public postings and deprecated authorization-code onboarding are separate. The API returns structured records that a permitted client can retain as a customer-held copy. | SmartRecruiters candidate search and pagination ↗Candidates must have application; updatedAfter; limit max 100; pageId/nextPageId/LinkChecked 2026-10-16 |
| What retrieval rights are documented at cancellation? | -SmartRecruiters / candidates with at least one job application, candidate-profile updates and current collection traversal through the General Partner Integration; public postings and deprecated authorization-code onboarding are separate. Current API retrieval does not establish contractual retrieval rights after cancellation. | SmartRecruiters candidate search and pagination ↗Candidates must have application; updatedAfter; limit max 100; pageId/nextPageId/LinkChecked 2026-10-16 |
| How can customers define their own business logic? | External integration code; native business logic portability not establishedSmartRecruiters / candidates with at least one job application, candidate-profile updates and current collection traversal through the General Partner Integration; public postings and deprecated authorization-code onboarding are separate. Customers can implement logic in an external API client; native workflow authoring or portable native definitions are not established (client code is a separate artifact). | SmartRecruiters General Partner Integration ↗Master credentials; scope approval; customer-level credentials; customer consent; application visibilityChecked 2026-10-16 |
| What rights or portability are documented for custom workflow artifacts? | -SmartRecruiters / candidates with at least one job application, candidate-profile updates and current collection traversal through the General Partner Integration; public postings and deprecated authorization-code onboarding are separate. The reviewed API guides do not establish ownership, reusable export or independent execution rights for native workflow artifacts. | SmartRecruiters General Partner Integration ↗Master credentials; scope approval; customer-level credentials; customer consent; application visibilityChecked 2026-10-16 |
| What usable data or native definitions can leave before cancellation? | Portable structured records on documented routes; whole-product completeness unverifiedSmartRecruiters / candidates with at least one job application, candidate-profile updates and current collection traversal through the General Partner Integration; public postings and deprecated authorization-code onboarding are separate. Portable records cover the declared collection. Files, full activity history, workflow configuration and a whole-product restore remain outside the established scope. | SmartRecruiters candidate search and pagination ↗Candidates must have application; updatedAfter; limit max 100; pageId/nextPageId/LinkChecked 2026-10-16 |
SOURCES / SCOPE / HISTORY
Sources and open questions
This review is based on the documentation below. Live account behavior and customer-specific agreements haven’t been tested.
Still to confirm
- Complete lowest-plan entitlement and fixed API fees
- Applicable downstream processing, AI-use and redistribution rights
- Contractual post-cancellation retrieval terms
- Native workflow artifact ownership, reusable export and independent execution
Documentation
Assessment checked 2026-10-16. Each answer retains its source and applicable route; the check date does not establish live account behavior.