Delivery API

The delivery API gives your website or app everything your hosted career pages show. The Careers SDK and the SDKs for PHP, Swift and Kotlin wrap it, but any language can call it. It is in every plan.

Base address: https://api.bifrostorbit.com/careers/v1/, which is the same as https://app.bifrostorbit.com/careers/api/cdn/v1/. Staging is https://api-stage.bifrostorbit.com/careers/v1/.

GraphQL: the reads below are also one GraphQL endpoint, with the same keys.

Key: every call needs a public key as Authorization: Bearer careers_pk_..., X-Api-Key: careers_pk_... or ?key=careers_pk_....

Language: add locale=de (or lang=de) to any read. Text missing in that language comes in your main language, field by field. Responses say which language they used, and a job lists the fields that fell back in fallback.

Endpoints

A key with Read internal-only jobs also sees internal jobs in /jobs, /jobs/{slug} and /filters.

Filtering jobs

GET/jobs takes department (a department id), location (a location id), remote (onsite, hybrid or remote), type (fullTime, partTime, contract, temporary, internship, apprenticeship or workingStudent), q (words in the title, summary, department or location), page and perPage (50 by default, up to 100). The ids come from GET/filters.

A job

Each job has id, slug, url (on your website if you set job addresses, otherwise on your hosted pages), title, summary, department, locations (name, street, postal code, city, region, country and workplace), employmentType with a label, remote with a label, salary (only when you chose to show it, with a ready-made text such as "42.000 NOK – 48.000 NOK pro Monat"), publishedAt, closesAt and internal.

GET/jobs/{slug} adds locale, locales, fallback, description (cleaned HTML), seo, form (the standard fields and the questions to ask, without any screening rules), privacy (version and text) and jobPosting, the schema.org data to put in a <script type="application/ld+json"> for Google for Jobs. A closed, scheduled or unpublished job is 404.

Sending an application

Send multipart/form-data with:

• data: JSON with firstName, lastName, email, the standard fields the form asks for (phone, coverLetter, linkedin, location, salaryExpectation, startDate), answers keyed by question id, privacyVersion (from the job), privacyAccepted: true, and optionally talentPool, texting (["sms"], ["whatsapp"] or both), locale, source (such as northwilds.com), utm ({ source, medium, campaign }), referrer and referral (the ref from a colleague's referral link)
• cv: the CV, a PDF or Word file up to 10 MB
• file:<questionId>: a file for each file question

Without files, a JSON body works too. Choice answers are option ids; yes or no answers are "yes" or "no". A second application to the same job from the same email updates the first.

1curl -X POST "https://api.bifrostorbit.com/careers/v1/jobs/mountain-guide-lofoten/applications" \2  -H "Authorization: Bearer careers_pk_..." \3  -F 'data={"firstName":"Kari","lastName":"Nordmann","email":"kari@northwilds.com","privacyVersion":3,"privacyAccepted":true,"source":"northwilds.com"}' \4  -F "cv=@kari-nordmann.pdf"

If the privacy notice changed since the page was opened, the call fails with a request to reload, so nobody agrees to text they didn't read.

Talent pool and job alerts

POST/talent-pool takes JSON with firstName, lastName (optional), email, privacyVersion, privacyAccepted: true, locale, jobAlerts (true to get an email when a new job opens) and departmentIds (up to 30, to hear only about jobs in those departments).

Counting views

POST/jobs/{slug}/track takes { "kind": "view" } when a job page shows, or { "kind": "start" } when someone starts the form, with an optional source and utmSource. It stores no cookies and nothing about the person, and ignores bots. The SDKs' trackJob calls it.

Candidate portal

The portal calls take the public key too, and the candidate's session in X-Careers-Session. They are never cached.

Calls that change something answer with the whole portal again, as GET/portal/me does. A code lasts ten minutes and allows five tries, and a new one can be sent every 45 seconds. Sign-in calls have their own, tighter rate limits per network.

Errors

Errors come as { error: { code, message } }, with messages candidates can read in the language of the request:

See Troubleshooting for each message and its fix.

Limits

• Reads: about 120 requests a minute for each key and network.
• Applications and talent pool sign-ups: a burst of six, then two a minute, for each network.
• Views and starts: 30 a minute for each network.

Browsers and caching

Any website may call the API from a browser unless you list allowed websites under Career site › Address and website; calls from servers are always allowed. Reads carry Cache-Control: public, max-age=60, stale-while-revalidate=300. Set the website webhook to refresh sooner.