Greenhouse API Guide: Harvest v3, Auth, Resumes and Rate Limits

curl --location 'https://auth.greenhouse.io/token' \
  --user "$GH_CLIENT_ID:$GH_CLIENT_SECRET" \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data 'grant_type=client_credentials'

# {"token_type": "Bearer", "access_token": "eyJ...", "expires_in": 3600}

curl --location 'https://harvest.greenhouse.io/v3/applications?per_page=2' \
  --header "Authorization: Bearer $ACCESS_TOKEN"

import os
import time
from datetime import datetime, timedelta, timezone
import requests

GH_API = "https://harvest.greenhouse.io/v3"
session = requests.Session()


def greenhouse_token() -> str:
    """OAuth client credentials: Basic auth with the client ID and secret."""
    response = session.post(
        "https://auth.greenhouse.io/token",
        auth=(os.environ["GH_CLIENT_ID"], os.environ["GH_CLIENT_SECRET"]),
        data={"grant_type": "client_credentials"},
        timeout=30,
    )
    response.raise_for_status()
    return response.json()["access_token"]  # valid for expires_in seconds


def list_all(path: str, params: dict):
    """Yield every record, waiting on 429 and following the Link header."""
    headers = {"Authorization": f"Bearer {greenhouse_token()}"}
    url = f"{GH_API}/{path}"
    while url:
        response = session.get(url, params=params, headers=headers, timeout=30)
        if response.status_code == 429:
            time.sleep(float(response.headers.get("Retry-After", "30")))
            continue
        response.raise_for_status()
        yield from response.json()  # list endpoints return a JSON array
        # The next URL carries an opaque cursor: call it as is, no other params.
        url, params = response.links.get("next", {}).get("url"), None

since = datetime.now(timezone.utc) - timedelta(days=1)
resumes = list_all(
    "attachments",
    {"type": "resume", "created_at": f"gte|{since:%Y-%m-%dT%H:%M:%SZ}", "per_page": 500},
)

HIRELAYER_URL = "https://hirelayer.co/api/v3/parser"


def parse_resume(content: bytes, filename: str, application_id: int) -> dict | None:
    """Send one resume to HireLayer CV Extract. 1 credit per HTTP 200."""
    for attempt in range(4):
        response = requests.post(
            HIRELAYER_URL,
            headers={"X-API-Key": os.environ["HIRELAYER_API_KEY"]},
            files={"file": (filename, content)},
            data={"application_id": f"greenhouse-{application_id}"},
            timeout=150,  # about 35 s per resume, 504 after 145 s
        )
        if response.status_code >= 500 and attempt < 3:
            time.sleep(float(response.headers.get("Retry-After", 2**attempt)))
            continue
        if response.status_code != 200:  # 4xx is never retried unchanged
            print(application_id, response.status_code, response.text[:200])
            return None
        return response.json()
    return None


for attachment in resumes:
    # The url expires after seven days: download now (redirects are followed).
    file = requests.get(attachment["url"], timeout=60)
    file.raise_for_status()
    parsed = parse_resume(file.content, attachment["filename"], attachment["application_id"])
    if parsed:
        candidate = parsed["info_candidate"]
        skills = [s["skill_title"] for s in parsed["skills"][:5]]
        print(attachment["application_id"], candidate["job_title"], skills)

{
  "status": "success",
  "info_resume": { "application_id": "greenhouse-71980812", "language": "EN" },
  "info_candidate": {
    "full_name": "Alex MORGAN",
    "job_title": "Senior Software Engineer",
    "experience_level": "5 to 10 years"
  },
  "work_experiences": [{ "company_name": "Northstar Labs", "start_date": "2022-03-01", "currently_active": true }],
  "skills": [{ "skill_title": "React", "skill_type": "Software skill" }]
}

import hashlib
import hmac
import json
import os


def is_from_greenhouse(raw_body: bytes, signature_header: str) -> bool:
    """The Signature header reads "sha256 <hex digest>", computed on the raw body."""
    expected = hmac.new(
        os.environ["GH_WEBHOOK_SECRET"].encode(), raw_body, hashlib.sha256
    ).hexdigest()
    _, _, received = signature_header.partition(" ")
    return hmac.compare_digest(received, expected)


def handle(raw_body: bytes, headers: dict) -> int:
    if not is_from_greenhouse(raw_body, headers.get("Signature", "")):
        return 401
    event = json.loads(raw_body)
    if event.get("action") != "new_candidate_application":
        return 200
    application = event["payload"]["application"]
    for attachment in application["candidate"]["attachments"]:
        if attachment["type"] == "resume":
            # Answer fast: your own queue runs the download and parse later.
            enqueue(application["id"], attachment["url"], attachment["filename"])
    return 200