Contract v2 - the same integration shape used across the AI Business OS suite. Generate a key from Settings → API access once you're signed in.
Every request to /integrations/v1/* must include a key you generate in Settings:
X-Integration-Key: sk_sift_...
Creates a candidate - or, if the email already exists in this org, merges into the existing record (the same duplicate-detection used by an in-app upload). Either resume_text or at minimum name is required. Publishes candidate.created to any subscribed webhook. Send X-Event-ID to make retries idempotent.
curl -X POST https://your-sift-host/integrations/v1/candidates \
-H "X-Integration-Key: sk_sift_..." \
-H "Content-Type: application/json" \
-H "X-Event-ID: unique-id-for-retries" \
-d '{"resume_text": "Jane Doe\nSenior Backend Engineer...", "name": "Jane Doe", "email": "jane@example.com"}'Confirms an API key is valid. No side effects.
curl https://your-sift-host/integrations/v1/ping -H "X-Integration-Key: sk_sift_..."
Live counts for a control-plane dashboard (e.g. Compass): candidates, open jobs, applications, hired.
curl https://your-sift-host/integrations/v1/summary -H "X-Integration-Key: sk_sift_..."
Subscribe a URL to an event from Settings → Webhook subscriptions. Every delivery is signed:
X-Webhook-Timestamp: 1710000000
X-Webhook-Signature: hex(hmac_sha256(secret, "{timestamp}.{raw_body}"))
X-Event-ID: evt_...Body is a JSON envelope: { event_id, event_type, tenant_id, payload, sent_at }. Reject anything with a timestamp older than 5 minutes or more than 60 seconds in the future. Failed deliveries retry up to 3 times (10s, 60s, 300s backoff), each attempt logged.
A new candidate is added, from a resume upload, manual entry, or another product calling POST /integrations/v1/candidates.
An application is moved to the "hired" stage.
An interview is scheduled for a candidate.
Sift is a zero-dependency Node.js prototype - no external services, no npm packages, no real third-party credentials. A few things from the original spec are deliberately out of scope for this build, rather than half-implemented against nothing real:
OCR for scanned/image-only resumes. Text extraction is hand-rolled (PDF content-stream parsing, DOCX XML parsing) and works well on real, text-based PDFs and Word documents. A resume that's actually a scanned image with no embedded text layer can't be read without an OCR engine, which isn't a zero-dependency capability - the upload flow detects this case and warns instead of silently returning nothing.
Real audio/video transcription for interviews. The Interview Copilot analyzes a transcript you paste in (from Zoom, Otter, Teams, wherever you already have one) - it does not record or transcribe audio itself.
Live third-party integrations - Slack, Microsoft Teams, real ATS/HRIS/payroll systems (Workday, BambooHR, Greenhouse, etc.), LinkedIn, and Zapier. Sift exposes the contract-v2 API and signed webhooks above precisely so a real integration (or another product in the suite, like Relay's automation engine) can be built against it without Sift needing to fake credentials it was never given. Sourcing connectors to LinkedIn/Indeed/GitHub follow the same logic - search runs against Sift's own candidate database.
Calendar sync (Google Calendar / Outlook). Interview scheduling stores date, time, and a location/link field for you to put in whatever calendar you use - there's no live two-way calendar connection.
A payments/billing layer. This is a single-tenant-per-org prototype with no subscription or seat-billing model attached.
Everything else in the spec - resume parsing, explainable AI scoring with manual override, job matching and talent rediscovery, AI shortlisting and candidate comparison, the full ATS pipeline, AI interview question generation and transcript analysis, natural-language search, the AI recruiter copilot grounded in your real data, the candidate self-service portal, recruitment analytics, and the API/webhook layer itself - is implemented and live in this build.