Workable

What your agents can doCopy Anchor Link

Agents search 87 operations from Workable's REST API reference, including jobs, candidates, employees, requisitions, offers, time off, time tracking, review templates, and public careers endpoints. Available operations depend on your token's scopes, Workable permissions, and product access.

Connect WorkableCopy Anchor Link

Choose Account API token, the default method. An administrator creates a token under Settings > Integrations > Apps > API Access Tokens. Enter it in Access token, and set Base URL to https://YOUR-SUBDOMAIN.workable.com/spi/v3.

Enable r_jobs for the connection check, which requests one job. Enable r_candidates and r_employees for recruiting and employee subscriptions, plus the scopes needed for your workflows. Account tokens expire and must be renewed in Workable. See token management.

Partner OAuth appCopy Anchor Link

OAuth is available only to approved Workable partners and remains untested with Workable. Enter Client ID, Client secret, and the same customer Base URL before authorizing. Register your Helios deployment's /integrations/workable/oauth_callback URL with Workable. Helios stores the returned access and refresh tokens, refreshes after an expired-token response, and schedules weekly refreshes.

Helios requests all 19 scopes found in the reference:

r_account r_candidates r_employees r_jobs r_requisitions r_timeoff
w_candidates w_comments w_departments w_employees w_members w_requisitions w_timeoff
r_offers w_offers r_time_tracking w_time_tracking r_reviews w_reviews

Offers and reviews require user tokens. Review operations also require template permissions.

TriggersCopy Anchor Link

Helios registers nine subscription labels automatically and exposes these ten events:

Candidate filters include candidate ID, job shortcode, job title, stage name, email, tags, and account subdomain. Employee creation and update filters include employee ID, status, department, legal entity, and work email. Employee publication supports employee ID and work email. Onboarding supports employee ID and department. Time off supports employee ID, request ID, category, and state. Job deletion supports job ID when supplied. All filters accept glob patterns; email filters ignore case. Empty filters match every delivery of that event. Selected filters require the corresponding field, which may be absent in partial updates or deletion payloads.

Setup reuses working subscriptions, checks them weekly, and replaces them before they expire. Events that Workable refuses appear as unavailable, with Workable's reason. Deleting the Helios connection removes its subscriptions.

Webhook verification and limitsCopy Anchor Link

Workable signs X-Workable-Signature with HMAC-SHA256 using the account API token, or the OAuth app's client secret. Helios verifies the raw request body. Rotating the account token breaks verification for subscriptions signed with the old token. Remove the old subscriptions and reconnect with the new token to register replacements. Updating the saved token alone does not recreate existing subscriptions.

The docs do not specify signature encoding. Helios expects an unprefixed hexadecimal digest. No signed delivery timestamp is documented, so event timestamps are not used to reject delayed deliveries. Helios accepts one event object per delivery. Helios deduplicates deliveries per connection, so two identical employee updates count as one.

Account tokens allow 10 requests per 10 seconds; OAuth apps allow 50. A 401 usually means an expired or revoked token; 403 can indicate missing scopes or product permissions. See rate limits and subscription setup.

Use curl for file transfers to signed URLs returned by Workable. Do not attach the Workable bearer token to those downloads.