GraphQL

GraphQL reads the same jobs as the delivery API, with the same public keys. Use it when one page needs several things at once, such as the site, the job list and the filters, in a single request.

https://app.bifrostorbit.com/careers/api/cdn/graphql is the same endpoint.

GraphQL only reads. Applications, talent pool sign-ups and the candidate portal stay in the delivery API, and the management API has no GraphQL version.

Requests

Send a public key as Authorization: Bearer <key> or x-api-key: <key>, and POST a JSON body:

1curl 'https://api.bifrostorbit.com/careers/graphql' \2  -H 'Authorization: Bearer careers_pk_…' \3  -H 'Content-Type: application/json' \4  -d '{"query":"query ($slug: String) { job(slug: $slug, locale: \"de\") { title url } }","variables":{"slug":"mountain-guide"}}'

GET works too, with query, variables (as JSON text) and operationName in the query string. URL-encode them:

curl -G 'https://api.bifrostorbit.com/careers/graphql' \  -H 'Authorization: Bearer careers_pk_…' \  --data-urlencode 'query={ jobs { total items { slug title } } }'

Answers are JSON with data, and errors when something went wrong:

{ "data": { "job": { "title": "Bergführer", "url": "https://northwilds.com/de/careers/mountain-guide/" } } }

Browsers may call it like the delivery API: from any website, unless you list allowed websites under Career site › Address and website.

Queries

Every query that reads text takes locale, such as de. Leave it out for your main language. Text missing in that language comes in your main language, field by field, as in REST.

A key that reads internal jobs sees them in jobs, job and filters, as in REST. When a trial or plan has ended and its grace period is over, the queries answer with no jobs, as the REST endpoints do.

Types

JSON holds data without a fixed shape, such as jobPosting and the form's fields, and cannot be selected into. DateTime is an ISO 8601 timestamp.

Job lists leave the description out on purpose. Ask job for one.

Examples

A job list with its filters

1query Jobs($locale: String, $department: String) {2  site(locale: $locale) {3    name4    intro5    logoUrl6  }7  jobs(locale: $locale, department: $department, perPage: 20) {8    items {9      slug10      title11      url12      department {13        name14      }15      locations {16        city17      }18    }19    total20    hasMore21  }22  filters(locale: $locale) {23    departments {24      value25      label26      count27    }28  }29}

{ "locale": "de" }

A job page

1query Job($slug: String!) {2  job(slug: $slug, locale: "de") {3    title4    description5    seo {6      title7      description8    }9    form {10      fields11      questions {12        id13        kind14        label15        required16        options {17          id18          label19        }20      }21    }22    privacy {23      version24      text25    }26    jobPosting27  }28}

Put jobPosting in a <script type="application/ld+json"> for Google for Jobs, and send privacy.version with the application.

Errors

Errors come in errors, each with a message, a code under extensions, and the path and locations of the field that failed when there is one. The codes are the same as in REST:

1{2  "data": { "job": null },3  "errors": [4    {5      "message": "Job was not found",6      "locations": [{ "line": 1, "column": 3 }],7      "path": ["job"],8      "extensions": { "code": "not_found" }9    }10  ]11}

• When job fails, it is null and the other fields still answer.
• site, jobs, filters and sitemap never answer null, so when one of them fails the whole data is null.
• When several fields fail, the HTTP status comes from the first error.

Limits

• Each request counts once against the same rate limit as the delivery API's reads, per key and network.
• A query may be at most 20,000 characters long, nest at most 10 levels and ask for at most 300 fields. Each alias and each use of a fragment counts.
• Introspection is on and needs no key, so GraphQL tools can read the schema from the address. Introspection fields do not count towards the limits.
• Persisted queries are not supported. Send the full query each time.

Caching

Every GraphQL answer has Cache-Control: no-store and Vary: Authorization, so nothing between your website and the API keeps it. Cache in your website instead, and refresh on the website webhook. For pages a CDN should cache, the REST endpoints carry cache headers.