Ashby

This documentation for the Ashby integration describes the technical capabilities of this integration, including authorization, scopes/permissions, and utilized endpoints. For more information on how to integrate Ashby, visit our connection instructions.

Version

This integration utilizes the Ashby Ashby API.

Base URL

The base URL used for all Ashby API endpoints:

https://api.ashbyhq.com

---

Authentication & Authorization

The DataGrail Ashby integration connects using basic authentication which requires an API Key.

Sensitive Credentials

Publicly exposing your API credentials can allow unauthorized access to Ashby API endpoints by a third party. DataGrail stores your API credentials encrypted and protected.

Scopes

The Ashby integration requires specific scopes that must be granted in order to function for a given capability.

Scope	Base	Access	Deletion
Candidates (Read)	✅	✅
Candidates (Write)			✅
Hiring Process (Read)		✅
Interviews (Read)		✅
Offers (Read)		✅

Base Scopes

All base scopes must be granted in order to connect the integration with DataGrail. The remaining scopes are only required if enabling those capabilities

Endpoints Utilized

DataGrail uses the following endpoints to authorize and test the connection:

Method	Endpoint	Purpose	Docs
POST	/candidate.list	Validate the connection

---

Limits

Limits in Ashby are calculated using the leaky bucket algorithm. All requests that are made after rate limits have been exceeded are throttled and an HTTP 429 Too Many Requests error is returned. Requests succeed again after enough requests have emptied out of the bucket.

• DataGrail supports requests throttling to stay within 70-80% of specified service rate limits.
• DataGrail processes API responses with HTTP 429 status to interrupt requests, waiting and retrying (using an exponential backoff strategy).

---

Capabilities

Access

DataGrail's Ashby integration provides Synchronous Access capabilities for the following supported identifier category: Email.

Data Interactions

For Access requests, DataGrail will take the following actions:

1. Search for Candidates using the Data Subject email address. Every candidate profile that has the email address (primary or secondary) is included.
2. Retrieve each candidate's notes and client info.
3. Retrieve the candidates' applications.
4. For each application, retrieve its feedback, offers, interview schedules, referrals, and criteria evaluations.

Lookups for resources turned off in field-level controls are not made.

Endpoints Utilized

Method	Endpoint	Purpose	Docs
POST	/application.info	Retrieve each of a candidate's applications by ID
POST	/application.listCriteriaEvaluations	Retrieve the criteria evaluations for an application
POST	/applicationFeedback.list	Retrieve the feedback submitted for an application
POST	/candidate.listClientInfo	Retrieve a candidate's client info
POST	/candidate.listNotes	Retrieve a candidate's notes
POST	/candidate.search	Search for candidates by email address
POST	/interviewSchedule.list	Retrieve the interview schedules for an application
POST	/offer.list	Retrieve the offers for an application
POST	/referral.list	Retrieve the referrals for an application

---

Deletion

DataGrail's Ashby integration provides Synchronous Deletion capabilities for the following supported identifier category: Email.

Ashby doesn't offer a way to delete candidates, so DataGrail anonymizes the candidate profile. Anonymization removes the person's identifying data and leaves the hiring records, such as interviewer feedback and offers, intact.

Anonymization Limitation

Ashby only anonymizes a candidate once all of their applications are archived. If the candidate has an active application, Ashby rejects the request and the deletion fails until the applications are archived.

Data Interactions

For Deletion requests, DataGrail will take the following actions:

1. Search for Candidates using the Data Subject email address.
2. Anonymize each matching candidate by their ID. A candidate that is already anonymized or no longer exists is treated as a completed deletion.

Endpoints Utilized

Method	Endpoint	Purpose	Docs
POST	/candidate.anonymize	Anonymize a candidate by ID

---