OVERALL CONTROL / 0.6-customer-control
Grades and scoring
Data access
25% of the overall score before applicability adjustment.
Scored answers and evidence
Read interface 7.5/10
Structured API for the declared product scope
Workable recruiting / job-associated candidate collection, candidate create/update and candidate-deletion webhooks through scoped account or authorized integration tokens; Talent pool reads and HR employee data are excluded.
GET /candidates lists job-associated profiles under r_candidates; Talent pool retrieval is excluded by the setup guide.
Workable candidate collection ↗
GET /candidates; paging.next; max 100; updated_after; r_candidates · Checked 2026-10-16
Bulk delivery 8.8/10
Batched or iterable API requests
Workable recruiting / job-associated candidate collection, candidate create/update and candidate-deletion webhooks through scoped account or authorized integration tokens; Talent pool reads and HR employee data are excluded.
Complete the documented pagination to retrieve the permitted current collection; a page alone is not a complete copy.
Workable candidate collection ↗
GET /candidates; paging.next; max 100; updated_after; r_candidates · Checked 2026-10-16
Query expressiveness 8.8/10
Documented structured API filters
Workable recruiting / job-associated candidate collection, candidate create/update and candidate-deletion webhooks through scoped account or authorized integration tokens; Talent pool reads and HR employee data are excluded.
Query by email, job, stage, creation time or updated_after; the API does not establish arbitrary joined queries.
Workable candidate collection ↗
GET /candidates; paging.next; max 100; updated_after; r_candidates · Checked 2026-10-16
Access cost barrier -
-
Workable recruiting / job-associated candidate collection, candidate create/update and candidate-deletion webhooks through scoped account or authorized integration tokens; Talent pool reads and HR employee data are excluded.
The reviewed API documentation establishes a technical route; lowest-paid-plan entitlement, partner charges and fixed API access fees remain unresolved.
Workable API token setup and scope ↗
Generate an API access token; scopes; unsupported Talent pool reads; revocation · Checked 2026-10-16
Third-party accessibility
20% of the overall score before applicability adjustment.
Scored answers and evidence
Third-party eligibility 10.0/10
Customer authorization without discretionary provider approval
Workable recruiting / job-associated candidate collection, candidate create/update and candidate-deletion webhooks through scoped account or authorized integration tokens; Talent pool reads and HR employee data are excluded.
Customers generate scoped revocable account tokens. The rate-limit guide explicitly supports third-party providers using account tokens; registering a partner client is a separate route.
Workable API token setup and scope ↗
Generate an API access token; scopes; unsupported Talent pool reads; revocation · Checked 2026-10-16
Workable rate limiting by client type ↗
Account 10 requests/10 seconds; OAuth and partner 50/10 seconds; response headers; third-party account tokens · Checked 2026-10-16
Downstream permission -
-
Workable recruiting / job-associated candidate collection, candidate create/update and candidate-deletion webhooks through scoped account or authorized integration tokens; Talent pool reads and HR employee data are excluded.
The authentication and operation guides do not establish applicable processing, AI-use or redistribution rights.
Workable API token setup and scope ↗
Generate an API access token; scopes; unsupported Talent pool reads; revocation · Checked 2026-10-16
External action
15% of the overall score before applicability adjustment.
Scored answers and evidence
Write interface 7.5/10
Create and update in one business domain
Workable recruiting / job-associated candidate collection, candidate create/update and candidate-deletion webhooks through scoped account or authorized integration tokens; Talent pool reads and HR employee data are excluded.
Create candidates on a job and PATCH profile fields using w_candidates. PATCH array fields replace existing arrays; sourced=false can send an application acknowledgement.
Workable create candidate on a job ↗
POST /jobs/{shortcode}/candidates; w_candidates; sourced/email behavior · Checked 2026-10-16
Workable update candidate ↗
PATCH /candidates/{id}; w_candidates; replacement semantics for array keys · Checked 2026-10-16
Custom application path 10.0/10
Customer applications using fixed APIs without provider selection
Workable recruiting / job-associated candidate collection, candidate create/update and candidate-deletion webhooks through scoped account or authorized integration tokens; Talent pool reads and HR employee data are excluded.
Customers can build or choose a client using the documented customer credential route.
Workable API token setup and scope ↗
Generate an API access token; scopes; unsupported Talent pool reads; revocation · Checked 2026-10-16
Workable rate limiting by client type ↗
Account 10 requests/10 seconds; OAuth and partner 50/10 seconds; response headers; third-party account tokens · Checked 2026-10-16
Continuity
15% of the overall score before applicability adjustment.
Scored answers and evidence
Refresh mechanism 7.5/10
Documented updated-since filters or webhooks
Workable recruiting / job-associated candidate collection, candidate create/update and candidate-deletion webhooks through scoped account or authorized integration tokens; Talent pool reads and HR employee data are excluded.
Use updated_after polling and candidate-created/moved/deleted webhook hints; payloads reflect delivery-time state, not necessarily event-time state.
Workable candidate collection ↗
GET /candidates; paging.next; max 100; updated_after; r_candidates · Checked 2026-10-16
Workable candidate and employee webhooks ↗
Candidate Created/Deleted/Moved; current-at-delivery payload; HMAC signature · Checked 2026-10-16
Limit visibility 10.0/10
Published numeric quotas and recovery instructions
Workable recruiting / job-associated candidate collection, candidate create/update and candidate-deletion webhooks through scoped account or authorized integration tokens; Talent pool reads and HR employee data are excluded.
Per account token: 10 requests per 10 seconds; OAuth/partner clients: 50 per 10 seconds. Rate headers expose remaining/reset; excess returns 429.
Workable rate limiting by client type ↗
Account 10 requests/10 seconds; OAuth and partner 50/10 seconds; response headers; third-party account tokens · Checked 2026-10-16
CDC and deletion capture 7.5/10
Updates and deletion identities documented for the stated resources
Workable recruiting / job-associated candidate collection, candidate create/update and candidate-deletion webhooks through scoped account or authorized integration tokens; Talent pool reads and HR employee data are excluded.
Updated-after queries identify changed profiles; candidate_deleted supplies a deletion event for the scoped recruiting resource. Retained replay is not established.
Workable candidate collection ↗
GET /candidates; paging.next; max 100; updated_after; r_candidates · Checked 2026-10-16
Workable candidate and employee webhooks ↗
Candidate Created/Deleted/Moved; current-at-delivery payload; HMAC signature · Checked 2026-10-16
Replay and gap recovery 2.5/10
Rebuild from a fresh snapshot; no historical replay established
Workable recruiting / job-associated candidate collection, candidate create/update and candidate-deletion webhooks through scoped account or authorized integration tokens; Talent pool reads and HR employee data are excluded.
Repeat the permitted candidate traversal without time filters to rebuild current job-candidate state. Deletion history and Talent pool candidates are not recovered.
Workable candidate collection ↗
GET /candidates; paging.next; max 100; updated_after; r_candidates · Checked 2026-10-16
Data exit
20% of the overall score before applicability adjustment.
Scored answers and evidence
Export custody 7.5/10
Customer-held structured files or API records
Workable recruiting / job-associated candidate collection, candidate create/update and candidate-deletion webhooks through scoped account or authorized integration tokens; Talent pool reads and HR employee data are excluded.
The API returns structured records that a permitted client can retain as a customer-held copy.
Workable candidate collection ↗
GET /candidates; paging.next; max 100; updated_after; r_candidates · Checked 2026-10-16
Post-cancellation access Disclosure
-
Disclosure only; does not reduce planned-exit credit.
Workable recruiting / job-associated candidate collection, candidate create/update and candidate-deletion webhooks through scoped account or authorized integration tokens; Talent pool reads and HR employee data are excluded.
Current API retrieval does not establish contractual retrieval rights after cancellation.
Workable candidate collection ↗
GET /candidates; paging.next; max 100; updated_after; r_candidates · Checked 2026-10-16
Planned migration fidelity 7.5/10
Portable structured records on documented routes; whole-product completeness unverified
Workable recruiting / job-associated candidate collection, candidate create/update and candidate-deletion webhooks through scoped account or authorized integration tokens; Talent pool reads and HR employee data are excluded.
Portable records cover the declared collection. Files, full activity history, workflow configuration and a whole-product restore remain outside the established scope.
Workable candidate collection ↗
GET /candidates; paging.next; max 100; updated_after; r_candidates · Checked 2026-10-16
Business logic and customization
5% of the overall score before applicability adjustment.
Scored answers and evidence
Logic authoring 2.5/10
External integration code; native business logic portability not established
Workable recruiting / job-associated candidate collection, candidate create/update and candidate-deletion webhooks through scoped account or authorized integration tokens; Talent pool reads and HR employee data are excluded.
Customers can implement logic in an external API client; native workflow authoring or portable native definitions are not established (client code is a separate artifact).
Workable API token setup and scope ↗
Generate an API access token; scopes; unsupported Talent pool reads; revocation · Checked 2026-10-16
Rights to custom logic -
-
Workable recruiting / job-associated candidate collection, candidate create/update and candidate-deletion webhooks through scoped account or authorized integration tokens; Talent pool reads and HR employee data are excluded.
The reviewed API guides do not establish ownership, reusable export or independent execution rights for native workflow artifacts.
Workable API token setup and scope ↗
Generate an API access token; scopes; unsupported Talent pool reads; revocation · Checked 2026-10-16
Scores are out of 10. * Incomplete evidence discounts verified capabilities (unknown answers stay unknown). Planned migration drives data exit. Scoring method ↗
CUSTOMER CHOICE
Third-party accessibility
Customers generate scoped revocable account tokens. The rate-limit guide explicitly supports third-party providers using account tokens; registering a partner client is a separate route.
Confirm who can connect, who owns the credentials and which uses are permitted. Customer consent and provider approval can be separate requirements; the selected plan and contract still matter.
READ / INTEGRATE
API and export routes
GET /candidates lists job-associated profiles under r_candidates; Talent pool retrieval is excluded by the setup guide. Complete the documented pagination to retrieve the permitted current collection; a page alone is not a complete copy. Query by email, job, stage, creation time or updated_after; the API does not establish arbitrary joined queries.
| Access route | Authentication | Credential owner | Provider approval | Access requirement | Last checked |
|---|---|---|---|---|---|
| Customer-scoped Workable account token | API key | Customer | No | customer authorization | 2026-10-16 |
Availability depends on your product, plan and agreement. See the documentation below for the requirements of each route.
ECONOMIC ACCESS
Cost, authentication and limits
The reviewed API documentation establishes a technical route; lowest-paid-plan entitlement, partner charges and fixed API access fees remain unresolved.
Check API entitlement, credential ownership and rate limits for the route you intend to use. Include review fees, customer-plan upgrades and ongoing access charges in the total.
ACT FROM OUTSIDE
External action
Create candidates on a job and PATCH profile fields using w_candidates. PATCH array fields replace existing arrays; sourced=false can send an application acknowledgement.
Validate the supported operation, acting identity and permission scope (read access does not imply write permission). Ambiguous retries and revoked credentials also affect whether an external workflow can run safely.
KEEP ACCESS USEFUL
Continuity
Use updated_after polling and candidate-created/moved/deleted webhook hints; payloads reflect delivery-time state, not necessarily event-time state. Updated-after queries identify changed profiles; candidate_deleted supplies a deletion event for the scoped recruiting resource. Retained replay is not established. Repeat the permitted candidate traversal without time filters to rebuild current job-candidate state. Deletion history and Talent pool candidates are not recovered. Per account token: 10 requests per 10 seconds; OAuth/partner clients: 50 per 10 seconds. Rate headers expose remaining/reset; excess returns 429.
CDC, deletions and recovery
| Question | Answer / applicable route | Evidence |
|---|---|---|
| Can ongoing extraction identify updates and deleted records on the declared route? | Updates and deletion identities documented for the stated resourcesWorkable recruiting / job-associated candidate collection, candidate create/update and candidate-deletion webhooks through scoped account or authorized integration tokens; Talent pool reads and HR employee data are excluded. Updated-after queries identify changed profiles; candidate_deleted supplies a deletion event for the scoped recruiting resource. Retained replay is not established. | Workable candidate collection ↗GET /candidates; paging.next; max 100; updated_after; r_candidatesChecked 2026-10-16 Workable candidate and employee webhooks ↗Candidate Created/Deleted/Moved; current-at-delivery payload; HMAC signatureChecked 2026-10-16 |
| How can extraction recover after missed events or an interrupted consumer? | Rebuild from a fresh snapshot; no historical replay establishedWorkable recruiting / job-associated candidate collection, candidate create/update and candidate-deletion webhooks through scoped account or authorized integration tokens; Talent pool reads and HR employee data are excluded. Repeat the permitted candidate traversal without time filters to rebuild current job-candidate state. Deletion history and Talent pool candidates are not recovered. | Workable candidate collection ↗GET /candidates; paging.next; max 100; updated_after; r_candidatesChecked 2026-10-16 |
Useful ongoing access includes corrections and deletions, not only the first export. A failed request, changed filter or lost resource permission should not be interpreted as a deleted record.
LEAVE WITH YOUR DATA
Data exit and portability
Portable records cover the declared collection. Files, full activity history, workflow configuration and a whole-product restore remain outside the established scope. Current API retrieval does not establish contractual retrieval rights after cancellation.
Test the output against the destination’s required fields and history. Check stable identifiers, relationships, attachments and extraction time; a sample file proves only the coverage of that sample.
BUILD / INSPECT / REUSE
Business logic and customization
Customers can implement logic in an external API client; native workflow authoring or portable native definitions are not established (client code is a separate artifact). The reviewed API guides do not establish ownership, reusable export or independent execution rights for native workflow artifacts.
Custom API access, ownership of workflows and the right to export their definitions are separate questions. A custom-app capability alone does not establish that business rules can move to another system.
AGREEMENTS / API DOCS / PROGRAM REQUIREMENTS
Documented conditions
Answers below come from public provider materials. Every answer retains its source check date, scope (a partner agreement does not describe every customer route). Customer contracts and live behavior still need verification.
| Question | Answer / applicable route | Evidence |
|---|---|---|
| What structured read interface is documented? | Structured API for the declared product scopeWorkable recruiting / job-associated candidate collection, candidate create/update and candidate-deletion webhooks through scoped account or authorized integration tokens; Talent pool reads and HR employee data are excluded. GET /candidates lists job-associated profiles under r_candidates; Talent pool retrieval is excluded by the setup guide. | Workable candidate collection ↗GET /candidates; paging.next; max 100; updated_after; r_candidatesChecked 2026-10-16 |
| How can customers retrieve data in bulk? | Batched or iterable API requestsWorkable recruiting / job-associated candidate collection, candidate create/update and candidate-deletion webhooks through scoped account or authorized integration tokens; Talent pool reads and HR employee data are excluded. Complete the documented pagination to retrieve the permitted current collection; a page alone is not a complete copy. | Workable candidate collection ↗GET /candidates; paging.next; max 100; updated_after; r_candidatesChecked 2026-10-16 |
| What queries can a customer issue outside the provider UI? | Documented structured API filtersWorkable recruiting / job-associated candidate collection, candidate create/update and candidate-deletion webhooks through scoped account or authorized integration tokens; Talent pool reads and HR employee data are excluded. Query by email, job, stage, creation time or updated_after; the API does not establish arbitrary joined queries. | Workable candidate collection ↗GET /candidates; paging.next; max 100; updated_after; r_candidatesChecked 2026-10-16 |
| Who decides whether a chosen third party may connect? | Customer authorization without discretionary provider approvalWorkable recruiting / job-associated candidate collection, candidate create/update and candidate-deletion webhooks through scoped account or authorized integration tokens; Talent pool reads and HR employee data are excluded. Customers generate scoped revocable account tokens. The rate-limit guide explicitly supports third-party providers using account tokens; registering a partner client is a separate route. | Workable API token setup and scope ↗Generate an API access token; scopes; unsupported Talent pool reads; revocationChecked 2026-10-16 Workable rate limiting by client type ↗Account 10 requests/10 seconds; OAuth and partner 50/10 seconds; response headers; third-party account tokensChecked 2026-10-16 |
| What extra commercial condition applies to the routes supplying the assessed read capability, relative to the lowest paid plan? | -Workable recruiting / job-associated candidate collection, candidate create/update and candidate-deletion webhooks through scoped account or authorized integration tokens; Talent pool reads and HR employee data are excluded. The reviewed API documentation establishes a technical route; lowest-paid-plan entitlement, partner charges and fixed API access fees remain unresolved. | Workable API token setup and scope ↗Generate an API access token; scopes; unsupported Talent pool reads; revocationChecked 2026-10-16 |
| What permission is needed for the documented downstream use? | -Workable recruiting / job-associated candidate collection, candidate create/update and candidate-deletion webhooks through scoped account or authorized integration tokens; Talent pool reads and HR employee data are excluded. The authentication and operation guides do not establish applicable processing, AI-use or redistribution rights. | Workable API token setup and scope ↗Generate an API access token; scopes; unsupported Talent pool reads; revocationChecked 2026-10-16 |
| Which external write operations are documented? | Create and update in one business domainWorkable recruiting / job-associated candidate collection, candidate create/update and candidate-deletion webhooks through scoped account or authorized integration tokens; Talent pool reads and HR employee data are excluded. Create candidates on a job and PATCH profile fields using w_candidates. PATCH array fields replace existing arrays; sourced=false can send an application acknowledgement. | Workable create candidate on a job ↗POST /jobs/{shortcode}/candidates; w_candidates; sourced/email behaviorChecked 2026-10-16 Workable update candidate ↗PATCH /candidates/{id}; w_candidates; replacement semantics for array keysChecked 2026-10-16 |
| How can customers connect an application they build or choose? | Customer applications using fixed APIs without provider selectionWorkable recruiting / job-associated candidate collection, candidate create/update and candidate-deletion webhooks through scoped account or authorized integration tokens; Talent pool reads and HR employee data are excluded. Customers can build or choose a client using the documented customer credential route. | Workable API token setup and scope ↗Generate an API access token; scopes; unsupported Talent pool reads; revocationChecked 2026-10-16 Workable rate limiting by client type ↗Account 10 requests/10 seconds; OAuth and partner 50/10 seconds; response headers; third-party account tokensChecked 2026-10-16 |
| What mechanism supports repeatable extraction of changes? | Documented updated-since filters or webhooksWorkable recruiting / job-associated candidate collection, candidate create/update and candidate-deletion webhooks through scoped account or authorized integration tokens; Talent pool reads and HR employee data are excluded. Use updated_after polling and candidate-created/moved/deleted webhook hints; payloads reflect delivery-time state, not necessarily event-time state. | Workable candidate collection ↗GET /candidates; paging.next; max 100; updated_after; r_candidatesChecked 2026-10-16 Workable candidate and employee webhooks ↗Candidate Created/Deleted/Moved; current-at-delivery payload; HMAC signatureChecked 2026-10-16 |
| How are integration limits disclosed? | Published numeric quotas and recovery instructionsWorkable recruiting / job-associated candidate collection, candidate create/update and candidate-deletion webhooks through scoped account or authorized integration tokens; Talent pool reads and HR employee data are excluded. Per account token: 10 requests per 10 seconds; OAuth/partner clients: 50 per 10 seconds. Rate headers expose remaining/reset; excess returns 429. | Workable rate limiting by client type ↗Account 10 requests/10 seconds; OAuth and partner 50/10 seconds; response headers; third-party account tokensChecked 2026-10-16 |
| Where can a usable data copy be delivered? | Customer-held structured files or API recordsWorkable recruiting / job-associated candidate collection, candidate create/update and candidate-deletion webhooks through scoped account or authorized integration tokens; Talent pool reads and HR employee data are excluded. The API returns structured records that a permitted client can retain as a customer-held copy. | Workable candidate collection ↗GET /candidates; paging.next; max 100; updated_after; r_candidatesChecked 2026-10-16 |
| What retrieval rights are documented at cancellation? | -Workable recruiting / job-associated candidate collection, candidate create/update and candidate-deletion webhooks through scoped account or authorized integration tokens; Talent pool reads and HR employee data are excluded. Current API retrieval does not establish contractual retrieval rights after cancellation. | Workable candidate collection ↗GET /candidates; paging.next; max 100; updated_after; r_candidatesChecked 2026-10-16 |
| How can customers define their own business logic? | External integration code; native business logic portability not establishedWorkable recruiting / job-associated candidate collection, candidate create/update and candidate-deletion webhooks through scoped account or authorized integration tokens; Talent pool reads and HR employee data are excluded. Customers can implement logic in an external API client; native workflow authoring or portable native definitions are not established (client code is a separate artifact). | Workable API token setup and scope ↗Generate an API access token; scopes; unsupported Talent pool reads; revocationChecked 2026-10-16 |
| What rights or portability are documented for custom workflow artifacts? | -Workable recruiting / job-associated candidate collection, candidate create/update and candidate-deletion webhooks through scoped account or authorized integration tokens; Talent pool reads and HR employee data are excluded. The reviewed API guides do not establish ownership, reusable export or independent execution rights for native workflow artifacts. | Workable API token setup and scope ↗Generate an API access token; scopes; unsupported Talent pool reads; revocationChecked 2026-10-16 |
| What usable data or native definitions can leave before cancellation? | Portable structured records on documented routes; whole-product completeness unverifiedWorkable recruiting / job-associated candidate collection, candidate create/update and candidate-deletion webhooks through scoped account or authorized integration tokens; Talent pool reads and HR employee data are excluded. Portable records cover the declared collection. Files, full activity history, workflow configuration and a whole-product restore remain outside the established scope. | Workable candidate collection ↗GET /candidates; paging.next; max 100; updated_after; r_candidatesChecked 2026-10-16 |
SOURCES / SCOPE / HISTORY
Sources and open questions
This review is based on the documentation below. Live account behavior and customer-specific agreements haven’t been tested.
Still to confirm
- Complete lowest-plan entitlement and fixed API fees
- Applicable downstream processing, AI-use and redistribution rights
- Contractual post-cancellation retrieval terms
- Native workflow artifact ownership, reusable export and independent execution
Documentation
Assessment checked 2026-10-16. Each answer retains its source and applicable route; the check date does not establish live account behavior.