{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "zoho-recruit", "name": "Zoho Recruit", "vendor": "Zoho", "vendorUrl": "https://www.zoho.com/recruit/", "kind": "http-api", "category": "recruiting", "summary": "Zoho Recruit is a hosted applicant tracking system from Zoho for in-house HR teams and staffing agencies. Agents reach it through the REST API v2 and asynchronous bulk read and write APIs, behind OAuth 2.0.", "url": "https://www.anchorterminal.com/tools/zoho-recruit", "markdownUrl": "https://www.anchorterminal.com/tools/zoho-recruit.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/zoho-recruit.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/zoho-recruit.json", "license": "Proprietary service under Zoho's Terms of Service", "transports": [ "http" ], "packages": [], "auth": "oauth", "authNotes": "OAuth 2.0 only. A person registers a client in the Zoho API console (a web application, or a self client for one organisation) and approves scopes, which narrow to one module and one operation. The access token lasts one hour and goes in `Authorization: Zoho-oauthtoken \u003ctoken\u003e`. The refresh token lasts until revoked. Each data centre has its own accounts host and API host. Registration is self-serve, with no app review or sales approval for use inside one's own organisation.", "pricing": "freemium", "pricingNotes": "Free edition with 5,000 API credits a day, and the home page says no credit card is required. Paid editions cost $25 to $75 a recruiter licence a month billed yearly ($30 to $90 monthly) and a 15-day trial of Enterprise comes first. API calls draw on a daily credit allowance set by edition and user licences. Extra API calls are an add-on at $11.50 per 250 calls billed monthly (https://www.zoho.com/recruit/pricing.html and the price file it loads, checked 2026-10-08).", "priceSummary": "$25 / seat-mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API docs or the pricing page (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://www.zoho.com/recruit/developer-guide/apiv2/", "llmsTxt": "https://www.zoho.com/recruit/developer-guide/llms.txt", "capabilities": [ "recruiting.candidates", "recruiting.jobs", "recruiting.applications", "recruiting.interviews", "recruiting.offer-letters" ], "tags": [ "hosted", "closed-source", "oauth", "llms-txt", "webhooks", "free-tier", "no-card", "status-page", "bug-bounty", "soc2" ], "graded": true, "anchor": { "graded": true, "score": 59.8, "grade": "C", "agentReady": false, "rank": 421, "ranked": true, "rankOf": 722, "categoryRank": 6, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 64, "maintenance": 48, "payments": 35, "reliability": 76, "schema": 46, "security": 65, "transparency": 77 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 76, "points": 15.2, "reason": "Graded on the REST API v2, read as a hosted service. status.zoho.com redirects to us.zohostatus.com, which has a Zoho Recruit component and 198 incidents across all Zoho services since 3 November 2025 (20). In the last 90 days one incident names Recruit, 2 minutes 32 seconds on 4 August 2026, and the Recruit component changed state at the end of a 9 minute 35 second incident on 10 August that named Zoho WhiteBoard and other components. Both are brief, though the page marks them as major outages (25 of 30). Only the US page was read. Daily credits and concurrency are published with numbers per edition (15). 429 is documented for the daily and concurrency limits, with no Retry-After or backoff guidance found. Upsert on duplicate check fields makes creates safer to retry (6 of 15). No SLA found (0). v2 is the current documented version (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 46, "points": 7.48, "reason": "No OpenAPI description found, and the public repository zoho/recruit-oas has no commits (0 of 25). The developer guide has an llms.txt index of 79 pages, each with a Markdown twin (10). Each endpoint page states a purpose, URL, method and scopes, with little on when not to use a call (12 of 20). Parameter tables give types, defaults and possible values, and a field-type table gives length limits. Record bodies accept any field because modules are customisable, and search criteria are a string grammar (8 of 15). Pages carry curl samples, sample responses and a Possible Errors table, though the upload page's sample URL omits `/v2` and the status code page is generic (11 of 15). The version is in the path. What's New in API v2 is undated, and the limits page, the What's New page and the Corporate HR plan comparison disagree on daily allowances (5 of 15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 64, "points": 10.4, "reason": "Graded on the REST API. `fields` is optional on list calls and `per_page` goes to 200, so responses can be narrowed, but the default returns every field (18 of 25). `page`, `per_page` and `more_records`, sorting, custom views, `If-Modified-Since`, search by criteria, email, phone or word, and bulk read for large exports (18 of 20). Errors carry a code, message, details and status, with a table per endpoint, some of them short (14 of 20). Upsert on `duplicate_check_fields`, with no idempotency key (9 of 20). No official SDK for Recruit was found. Defaults are sensible, but the one-hour token, the refresh step and per-data-centre hosts add setup (5 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 65, "points": 11.38, "reason": "OAuth 2.0 with scopes down to one module and one operation, one-hour access tokens and revocable refresh tokens (30). Less 10 because the documented refresh and revoke calls carry the refresh token and client secret in the URL query string (20 of 30). READ-only scopes per module, and calls are bound by the user's profile (the Notes module answers admins only). No approval step for deletes, which take 100 records a call (13 of 20). Candidate records and résumés hold text from outside parties and no prompt-injection guidance was found (3 of 15). Audit logs kept 60 days and activity logs 90 days per the shared responsibility page. No per-application API usage view was found in the reviewed pages (9 of 15). security.txt valid to 30 June 2028, a bug bounty, SOC 2 Type 2 and ISO/IEC 27001, 27701, 27017 and 27018 (20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 35, "points": 4.38, "reason": "No x402, MPP or L402 (0). Edition prices are public, $25 to $75 a recruiter licence a month billed yearly, read from the price values the pricing page loads by script. Extra API calls are an add-on at $11.50 per 250 calls billed monthly, and the page does not say whether that is a daily or monthly allowance (15 of 20). The Free edition includes 5,000 API credits a day, and the home page says no credit card is required (20). A person signs up in a browser, registers an OAuth client in the API console and approves scopes (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 48, "points": 4.2, "reason": "No SDK or dated API changelog exists to date a release. The product's What's New page is dated by month and its newest entries are from September 2026, so the last change is between 8 and 38 days old. We scored it as within 90 days (20 of 30). Ten entries from July to September 2026 (20). A public product changelog and a community forum on help.zoho.com, which we did not test for replies. No API changelog (8 of 25). No official SDK for the Recruit API found (0 of 15). No package or public CI to assess (0 of 10). The Markdown limits page was last modified on 1 April 2026 per its HTTP header." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 77, "points": 6.74, "note": "editorial 59, provenance 95", "reason": "Closed service under the Zoho Terms of Service, last updated 2 March 2022 (15 of 30). The privacy policy of 22 December 2025 says Zoho does not sell personal information, and that data is deleted from the active database within six months of account termination and from backups three months later. The DPA is sent on request by email (24 of 30). No API deprecation policy found. One dated notice was found, the retirement of auth tokens on 28 February 2021 (5 of 20). A sub-processor page exists, but its directory loads by script and we could not read the list. The data centre page names locations and their certifications (15 of 20)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Graded on the REST API. `fields` is optional on list calls and `per_page` goes to 200, so responses can be narrowed, but the default returns every field (18 of 25). `page`, `per_page` and `more_records`, sorting, custom views, `If-Modified-Since`, search by criteria, email, phone or word, and bulk read for large exports (18 of 20). Errors carry a code, message, details and status, with a table per endpoint, some of them short (14 of 20). Upsert on `duplicate_check_fields`, with no idempotency key (9 of 20). No official SDK for Recruit was found. Defaults are sensible, but the one-hour token, the refresh step and per-data-centre hosts add setup (5 of 15).", "maintenance": "No SDK or dated API changelog exists to date a release. The product's What's New page is dated by month and its newest entries are from September 2026, so the last change is between 8 and 38 days old. We scored it as within 90 days (20 of 30). Ten entries from July to September 2026 (20). A public product changelog and a community forum on help.zoho.com, which we did not test for replies. No API changelog (8 of 25). No official SDK for the Recruit API found (0 of 15). No package or public CI to assess (0 of 10). The Markdown limits page was last modified on 1 April 2026 per its HTTP header.", "payments": "No x402, MPP or L402 (0). Edition prices are public, $25 to $75 a recruiter licence a month billed yearly, read from the price values the pricing page loads by script. Extra API calls are an add-on at $11.50 per 250 calls billed monthly, and the page does not say whether that is a daily or monthly allowance (15 of 20). The Free edition includes 5,000 API credits a day, and the home page says no credit card is required (20). A person signs up in a browser, registers an OAuth client in the API console and approves scopes (0).", "reliability": "Graded on the REST API v2, read as a hosted service. status.zoho.com redirects to us.zohostatus.com, which has a Zoho Recruit component and 198 incidents across all Zoho services since 3 November 2025 (20). In the last 90 days one incident names Recruit, 2 minutes 32 seconds on 4 August 2026, and the Recruit component changed state at the end of a 9 minute 35 second incident on 10 August that named Zoho WhiteBoard and other components. Both are brief, though the page marks them as major outages (25 of 30). Only the US page was read. Daily credits and concurrency are published with numbers per edition (15). 429 is documented for the daily and concurrency limits, with no Retry-After or backoff guidance found. Upsert on duplicate check fields makes creates safer to retry (6 of 15). No SLA found (0). v2 is the current documented version (10).", "schema": "No OpenAPI description found, and the public repository zoho/recruit-oas has no commits (0 of 25). The developer guide has an llms.txt index of 79 pages, each with a Markdown twin (10). Each endpoint page states a purpose, URL, method and scopes, with little on when not to use a call (12 of 20). Parameter tables give types, defaults and possible values, and a field-type table gives length limits. Record bodies accept any field because modules are customisable, and search criteria are a string grammar (8 of 15). Pages carry curl samples, sample responses and a Possible Errors table, though the upload page's sample URL omits `/v2` and the status code page is generic (11 of 15). The version is in the path. What's New in API v2 is undated, and the limits page, the What's New page and the Corporate HR plan comparison disagree on daily allowances (5 of 15).", "security": "OAuth 2.0 with scopes down to one module and one operation, one-hour access tokens and revocable refresh tokens (30). Less 10 because the documented refresh and revoke calls carry the refresh token and client secret in the URL query string (20 of 30). READ-only scopes per module, and calls are bound by the user's profile (the Notes module answers admins only). No approval step for deletes, which take 100 records a call (13 of 20). Candidate records and résumés hold text from outside parties and no prompt-injection guidance was found (3 of 15). Audit logs kept 60 days and activity logs 90 days per the shared responsibility page. No per-application API usage view was found in the reviewed pages (9 of 15). security.txt valid to 30 June 2028, a bug bounty, SOC 2 Type 2 and ISO/IEC 27001, 27701, 27017 and 27018 (20).", "transparency": "Closed service under the Zoho Terms of Service, last updated 2 March 2022 (15 of 30). The privacy policy of 22 December 2025 says Zoho does not sell personal information, and that data is deleted from the active database within six months of account termination and from backups three months later. The DPA is sent on request by email (24 of 30). No API deprecation policy found. One dated notice was found, the retirement of auth tokens on 28 February 2021 (5 of 20). A sub-processor page exists, but its directory loads by script and we could not read the list. The data centre page names locations and their certifications (15 of 20)." }, "sources": [ { "what": "API v2 index", "url": "https://www.zoho.com/recruit/developer-guide/apiv2/", "seen": "2026-10-08" }, { "what": "developer guide llms.txt", "url": "https://www.zoho.com/recruit/developer-guide/llms.txt", "seen": "2026-10-08" }, { "what": "product llms.txt", "url": "https://www.zoho.com/recruit/llms.txt", "seen": "2026-10-08" }, { "what": "API limits", "url": "https://www.zoho.com/recruit/developer-guide/apiv2/limits.html", "seen": "2026-10-08" }, { "what": "OAuth overview and scopes", "url": "https://www.zoho.com/recruit/developer-guide/apiv2/oauth-overview.html", "seen": "2026-10-08" }, { "what": "authorisation request", "url": "https://www.zoho.com/recruit/developer-guide/apiv2/auth-request.html", "seen": "2026-10-08" }, { "what": "access and refresh tokens", "url": "https://www.zoho.com/recruit/developer-guide/apiv2/access-refresh.html", "seen": "2026-10-08" }, { "what": "refresh access tokens", "url": "https://www.zoho.com/recruit/developer-guide/apiv2/refresh.html", "seen": "2026-10-08" }, { "what": "revoke tokens", "url": "https://www.zoho.com/recruit/developer-guide/apiv2/revoke-tokens.html", "seen": "2026-10-08" }, { "what": "register a client", "url": "https://www.zoho.com/recruit/developer-guide/apiv2/register-client.html", "seen": "2026-10-08" }, { "what": "multi data centre support", "url": "https://www.zoho.com/recruit/developer-guide/apiv2/multi-dc.html", "seen": "2026-10-08" }, { "what": "modules API", "url": "https://www.zoho.com/recruit/developer-guide/apiv2/modules-api.html", "seen": "2026-10-08" }, { "what": "get records", "url": "https://www.zoho.com/recruit/developer-guide/apiv2/get-records.html", "seen": "2026-10-08" }, { "what": "search records", "url": "https://www.zoho.com/recruit/developer-guide/apiv2/search-records.html", "seen": "2026-10-08" }, { "what": "insert records", "url": "https://www.zoho.com/recruit/developer-guide/apiv2/insert-records.html", "seen": "2026-10-08" }, { "what": "upsert records", "url": "https://www.zoho.com/recruit/developer-guide/apiv2/upsert-records.html", "seen": "2026-10-08" }, { "what": "delete records", "url": "https://www.zoho.com/recruit/developer-guide/apiv2/delete-records.html", "seen": "2026-10-08" }, { "what": "associate candidate", "url": "https://www.zoho.com/recruit/developer-guide/apiv2/associate-candidate.html", "seen": "2026-10-08" }, { "what": "change status", "url": "https://www.zoho.com/recruit/developer-guide/apiv2/change-status.html", "seen": "2026-10-08" }, { "what": "cancel interview", "url": "https://www.zoho.com/recruit/developer-guide/apiv2/cancel-interview.html", "seen": "2026-10-08" }, { "what": "upload a document", "url": "https://www.zoho.com/recruit/developer-guide/apiv2/upload-document.html", "seen": "2026-10-08" }, { "what": "status codes", "url": "https://www.zoho.com/recruit/developer-guide/apiv2/status-codes.html", "seen": "2026-10-08" }, { "what": "what's new in API v2", "url": "https://www.zoho.com/recruit/developer-guide/apiv2/whats-new.html", "seen": "2026-10-08" }, { "what": "migration to OAuth", "url": "https://www.zoho.com/recruit/developer-guide/apiv2/migration-v2.html", "seen": "2026-10-08" }, { "what": "GDPR changes in the API", "url": "https://www.zoho.com/recruit/developer-guide/apiv2/gdpr-compliance.html", "seen": "2026-10-08" }, { "what": "bulk read limitations", "url": "https://www.zoho.com/recruit/developer-guide/apiv2/bulk-read/limitations.html", "seen": "2026-10-08" }, { "what": "bulk write limitations", "url": "https://www.zoho.com/recruit/developer-guide/apiv2/bulk-write/limitations.html", "seen": "2026-10-08" }, { "what": "unauthenticated API request (401)", "url": "https://recruit.zoho.com/recruit/v2/Candidates", "seen": "2026-10-08" }, { "what": "pricing", "url": "https://www.zoho.com/recruit/pricing.html", "seen": "2026-10-08" }, { "what": "price values read by the pricing page", "url": "https://www.zohowebstatic.com/sites/zweb/json/pricing/recruit-pricing-val.json", "seen": "2026-10-08" }, { "what": "plan comparison (staffing agency)", "url": "https://www.zoho.com/recruit/plan-comparison.html", "seen": "2026-10-08" }, { "what": "plan comparison (corporate HR)", "url": "https://www.zoho.com/recruit/corporate-plan-comparison.html", "seen": "2026-10-08" }, { "what": "product home page", "url": "https://www.zoho.com/recruit/", "seen": "2026-10-08" }, { "what": "product What's New", "url": "https://www.zoho.com/recruit/whats-new.html", "seen": "2026-10-08" }, { "what": "shared responsibility model", "url": "https://www.zoho.com/recruit/shared-responsibility-model.html", "seen": "2026-10-08" }, { "what": "status page", "url": "https://us.zohostatus.com/", "seen": "2026-10-08" }, { "what": "status incident history", "url": "https://us.zohostatus.com/incident_history", "seen": "2026-10-08" }, { "what": "status RSS", "url": "https://us.zohostatus.com/rss", "seen": "2026-10-08" }, { "what": "terms of service", "url": "https://www.zoho.com/terms.html", "seen": "2026-10-08" }, { "what": "contracting entities", "url": "https://www.zoho.com/legal/zoho-contracting-entities.html", "seen": "2026-10-08" }, { "what": "developer agreement", "url": "https://www.zoho.com/developer/terms.html", "seen": "2026-10-08" }, { "what": "privacy policy", "url": "https://www.zoho.com/privacy.html", "seen": "2026-10-08" }, { "what": "sub-processors", "url": "https://www.zoho.com/privacy/sub-processors.html", "seen": "2026-10-08" }, { "what": "GDPR and DPA", "url": "https://www.zoho.com/gdpr.html", "seen": "2026-10-08" }, { "what": "data centres", "url": "https://www.zoho.com/know-your-datacenter.html", "seen": "2026-10-08" }, { "what": "compliance", "url": "https://www.zoho.com/compliance.html", "seen": "2026-10-08" }, { "what": "security.txt", "url": "https://www.zoho.com/.well-known/security.txt", "seen": "2026-10-08" }, { "what": "Zoho MCP", "url": "https://www.zoho.com/mcp/", "seen": "2026-10-08" }, { "what": "empty OpenAPI repository (clone)", "url": "https://github.com/zoho/recruit-oas", "seen": "2026-10-08" }, { "what": "RDAP for zoho.com", "url": "https://rdap.verisign.com/com/v1/domain/zoho.com", "seen": "2026-10-08" } ], "openQuestions": [ "unchecked: the sub-processor directory at zoho.com/privacy/sub-processors.html, which loads by script", "unchecked: status pages for data centres other than the US", "unchecked: whether Zoho MCP has tools for Recruit. The Zoho MCP landing page does not name Recruit and the tool list needs a signed-in session, so the listing grades the REST API only", "unchecked: GitHub and package registries were probed by name only (five repository names under github.com/zoho, three PyPI names), so an official SDK under another name is possible", "unchecked: the rendered prices on the pricing page. Prices were read from the JSON file the page loads, taking its USD column", "The add-on price of $11.50 per 250 API calls does not state whether the allowance is daily or monthly, so it is left out of the unit prices", "The limits page gives Enterprise 1,000,000 credits a day, What's New in API v2 gives Enterprise 500,000 and an Ultimate edition 1,000,000, and the Corporate HR plan comparison gives 500, 5,000 and 30,000 calls a day. The listing follows the limits page", "No day-dated change was found, so `lastRelease` is empty. The product's What's New page is dated by month, newest September 2026", "No SLA page, API deprecation policy, dated API changelog or notification API page was found. Whether failed calls and 429 responses use credits is not stated", "The lead was right on the vendor, URL, docs link and interface" ] }, "negative": 0, "verdict": "OAuth scopes narrow to one module and one operation, the docs have an llms.txt index with a Markdown page per endpoint, and the Free edition includes 5,000 API credits a day. No OpenAPI description, official SDK, SLA or dated API changelog was found, and the documented token refresh puts the client secret in the URL.", "bestFor": "Small businesses and staffing agencies on Zoho that want an agent to read and write candidates, job openings, applications and interviews with narrow scopes, and teams that want a free edition with API access.", "strengths": [ "OAuth scopes narrow to one module and one operation, such as `ZohoRecruit.modules.candidates.READ`", "`https://www.zoho.com/recruit/developer-guide/llms.txt` indexes 79 API pages, each with a Markdown twin", "Free edition with 5,000 API credits a day, and the home page says no credit card is required", "Upsert matches on `duplicate_check_fields`, so a repeated create updates the record", "Daily credits and concurrency limits are published per edition, with no per-minute cap" ], "weaknesses": [ "No OpenAPI description found. The public repository zoho/recruit-oas is empty", "No official SDK for the Recruit API found in the docs, on PyPI under three likely names or under five likely repository names", "The documented refresh and revoke calls put the refresh token and client secret in the URL query string", "429 is documented without a Retry-After header or backoff guidance, and no SLA was found", "The limits page, the What's New page and the Corporate HR plan comparison give different daily API allowances" ], "agentNotes": [ "Use the `api_domain` returned with the token, or the regional host (recruit.zoho.com, recruit.zoho.eu, recruit.zoho.in and others). Tokens from one data centre fail on another", "Send `Authorization: Zoho-oauthtoken \u003ctoken\u003e` and refresh hourly. Put refresh parameters in the POST body, not the URL", "Pass `fields` on list calls and page with `page` and `per_page` (200 at most) until `more_records` is false", "Create through `/{module_api_name}/upsert` with `duplicate_check_fields` so a retry updates instead of duplicating", "Move a candidate with `PUT /{module_api_name}/status`, not upsert. Pass `trigger: []` on writes to skip workflows, approvals and blueprints" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 59.8 } ], "editorialScores": { "ergonomics": 64, "maintenance": 48, "payments": 35, "reliability": 76, "schema": 46, "security": 65, "transparency": 59 }, "provenanceScore": 95 }, "connect": { "http": "curl \"https://recruit.zoho.com/recruit/v2/Candidates?fields=Last_Name,Email\u0026per_page=5\" \\\n -X GET -H \"Authorization: Zoho-oauthtoken $ZOHO_ACCESS_TOKEN\"" }, "letme": { "capability": "https://letme.dev/recruiting.candidates", "tool": "https://letme.dev/zoho-recruit" }, "sameCompany": [ "zoho-books", "zoho-zeptomail", "zoho-crm", "zoho-people" ], "notable": [ "API usage is counted in credits over a rolling 24 hours. Free has 5,000, Standard 5,000 plus 250 a user licence up to 100,000, Professional 10,000 plus 500 up to 500,000, Enterprise 15,000 plus 1,000 up to 1,000,000 (https://www.zoho.com/recruit/developer-guide/apiv2/limits.html)", "Concurrent calls per user and app are capped at 5 on Free, 10 on Standard, 15 on Professional and 20 on Enterprise, with a sub-limit of 10 for heavy calls (https://www.zoho.com/recruit/developer-guide/apiv2/limits.html)", "The developer guide has an llms.txt index of 79 pages, each served as Markdown at the same path with `.md` (https://www.zoho.com/recruit/developer-guide/llms.txt)", "The refresh call is documented as a POST with `refresh_token`, `client_id` and `client_secret` in the query string (https://www.zoho.com/recruit/developer-guide/apiv2/refresh.html)", "The US status page lists a Zoho Recruit component. Its one Recruit-named incident since November 2025 lasted 2 minutes 32 seconds on 4 August 2026 (https://us.zohostatus.com/incident_history)", "Audit logs are kept for 60 days and activity logs for 90 days, per Zoho Recruit's shared responsibility page (https://www.zoho.com/recruit/shared-responsibility-model.html)", "github.com/zoho/recruit-oas is a public repository with no commits, and no OpenAPI file for Recruit was found (https://github.com/zoho/recruit-oas)" ], "area": "business", "details": [ { "label": "API", "value": "REST API v2 at https://recruit.zoho.com/recruit/v2 (US). Records, search, upsert, status change, candidate association, submissions, reviews, assessments, notes, tags, attachments, résumé upload to the parser, module and field metadata, users, roles and profiles, plus bulk read and bulk write jobs" }, { "label": "Read and write", "value": "Candidates, Job Openings, Applications, Interviews, Clients, Contacts, Departments, Tasks, Events, Vendors, Campaigns and custom modules. Insert covers Candidates, Job Openings, Interviews, Clients, Contacts, Departments, Tasks, Events, Vendors and custom modules" }, { "label": "Recruiting actions", "value": "`PUT /Candidates/actions/associate` links candidates to job openings. `PUT /{module_api_name}/status` changes a candidate, application, job opening or offer status. `PUT /Interviews/{record_id}/action/cancel` cancels an interview. `POST /Candidates/actions/import_document` sends a résumé to the parser" }, { "label": "Credentials", "value": "OAuth 2.0 authorisation code grant, or a self client for one organisation. Access tokens last one hour. Refresh tokens last until revoked, 20 a user at most" }, { "label": "Auth scopes", "value": "`ZohoRecruit.\u003cgroup\u003e.\u003cname\u003e.\u003coperation\u003e` with operations ALL, READ, CREATE, UPDATE and DELETE. Groups are users, org, settings, modules, bulk, notifications and search. Module scopes name one module, such as `ZohoRecruit.modules.candidates.READ`" }, { "label": "Rate limits", "value": "Credits per rolling 24 hours. Free 5,000. Standard 5,000 plus 250 a user licence, at most 100,000. Professional 10,000 plus 500 a licence, at most 500,000. Enterprise 15,000 plus 1,000 a licence, at most 1,000,000. Concurrency 5, 10, 15 and 20 by edition, sub-concurrency 10" }, { "label": "Credit costs", "value": "Most calls 1. Get records with `cvid` 3. Deleted record IDs 2. Insert or update 1 per 10 records (100 records a call). Bulk read 50. Bulk write 500" }, { "label": "Pagination", "value": "`page` and `per_page` up to 200, with `more_records` in the `info` object. `fields`, `sort_by`, `sort_order`, `cvid` and the `If-Modified-Since` header on list calls. Search takes up to 10 criteria" }, { "label": "Bulk", "value": "Bulk read exports up to 200,000 records a job as zipped CSV, with polling or a callback. Bulk write takes one zipped CSV of up to 25,000 records and 25 MB" }, { "label": "Webhooks", "value": "Workflow webhooks on Professional (10,000 calls a day) and Enterprise (20,000 a day) per the plan comparison. Notification scopes are listed, with no notification API page found" }, { "label": "Data centres", "value": "US, EU, India, Australia, China, Japan, Canada and Saudi Arabia accounts hosts are listed. API hosts are documented for the US, EU, China, India and Japan" }, { "label": "SDKs", "value": "None found for the Recruit API" }, { "label": "Free tier", "value": "Free edition, one active job a recruiter licence, 5,000 API credits a day. 15-day trial of Enterprise, then the account moves to Free" }, { "label": "Audit", "value": "Audit and activity logs of user actions, kept 60 and 90 days, per the shared responsibility page" }, { "label": "Certifications", "value": "SOC 2 Type 2, ISO/IEC 27001, 27701, 27017 and 27018 per zoho.com/compliance.html. Bug bounty at bugbounty.zohocorp.com" }, { "label": "Status", "value": "status.zoho.com redirects to us.zohostatus.com, with a Zoho Recruit component and incident history back to 3 November 2025" } ], "unitPrices": [ { "item": "Corporate HR Standard", "unit": "seat-month", "usd": 25, "note": "per recruiter licence, billed yearly; $30 billed monthly" }, { "item": "Corporate HR Enterprise", "unit": "seat-month", "usd": 50, "note": "per recruiter licence, billed yearly; $60 billed monthly" }, { "item": "Staffing Agency Standard", "unit": "seat-month", "usd": 25, "note": "billed yearly; $30 billed monthly" }, { "item": "Staffing Agency Professional", "unit": "seat-month", "usd": 50, "note": "billed yearly; $60 billed monthly" }, { "item": "Staffing Agency Enterprise", "unit": "seat-month", "usd": 75, "note": "billed yearly; $90 billed monthly" } ], "provenance": { "legalEntity": "Zoho Corporation Private Limited", "domain": "zoho.com", "domainRegistered": "2004-01-16", "endpointOnVendorDomain": true, "terms": "https://www.zoho.com/terms.html", "privacy": "https://www.zoho.com/privacy.html", "statusPage": "https://status.zoho.com", "changelog": "https://www.zoho.com/recruit/whats-new.html", "securityTxt": "valid", "checked": "2026-10-08", "notes": [ "The Terms of Service (last updated 2 March 2022) are the service agreement for Zoho's online services. The contracting entity depends on the customer's region, Zoho Corporation Private Limited for India and Zoho Corporation for the United States (https://www.zoho.com/legal/zoho-contracting-entities.html).", "A separate Zoho Developer Agreement at https://www.zoho.com/developer/terms.html covers the developer platform and names Zoho Corporation Private Limited and its affiliates.", "The privacy policy was last updated on 22 December 2025 and covers Zoho's websites and the products on them.", "security.txt at www.zoho.com gives a bug bounty contact, security@zohocorp.com, a policy link and an expiry of 30 June 2028.", "API calls go to recruit.zoho.com and its regional equivalents, or to the `api_domain` returned with the token (www.zohoapis.com). An unauthenticated request to https://recruit.zoho.com/recruit/v2/Candidates answered 401 with a JSON error on 8 October 2026.", "The changelog link is the product's What's New page, dated by month. No dated API changelog was found.", "RDAP for zoho.com gives a registration date of 2004-01-16." ], "score": 95, "checks": [ { "check": "Legal entity named", "value": "Zoho Corporation Private Limited", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "zoho.com, registered 2004-01-16 (22 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "zoho.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 6 of the 7 things a reader expects, and has 1 clause that costs points", "points": 7.1, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 8 of the 8 things a reader expects, and has 1 clause that costs points", "points": 8, "max": 10, "state": "part" }, { "check": "Status page", "value": "status.zoho.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "valid", "points": 10, "max": 10, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "https://www.zoho.com/terms.html", "state": "read", "readAt": "2026-10-08", "statedDate": "2022-03-02", "words": 4052, "points": 7.1, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last updated on: 2nd March 2022.", "says": "Last updated 2022-03-02" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "Accordingly, each party agrees to the governing law (without regard to choice or conflicts of law rules) and to the exclusive jurisdiction of the courts mentioned herein in case of any dispute or lawsuit arising out of or in connection with this Agreement ." }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "IN NO EVENT SHALL ZOHO’S ENTIRE LIABILITY TO YOU IN RESPECT OF ANY SERVICE, WHETHER DIRECT OR INDIRECT, EXCEED ONE THOUSAND DOLLARS ($1000) OR THE FEES PAID BY YOU DURING THE TWELVE (12) MONTHS PRIOR TO THE FIRST EVENT GIVING RISE TO SUCH LIABILITY, WHICHEVER IS HIGHER.", "says": "Capped at the fees paid in the 12 months before the claim or $1000" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "If you provide any information that is untrue, inaccurate, outdated, or incomplete, or if Zoho has reasonable grounds to suspect that such information is untrue, inaccurate, outdated, or incomplete, Zoho may terminate your user account and refuse current or future use of any or all of the Services." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "If we make significant changes to the Agreement that affect your rights, you will be provided with at least 30 days advance notice of the changes by email to your primary email address.", "says": "Gives 30 days of notice before a change" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "In addition to all other terms and conditions of this Agreement, you shall not: (i) transfer the Services or otherwise make it available to any third party;" }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": false } ], "toKnow": [ { "key": "terms.benchmark", "label": "Restricts benchmarking or competitive use", "found": true, "quote": "use the Services for any form of competitive or benchmarking purposes", "costsPoints": true }, { "key": "old", "label": "Has not been updated for three years or more", "found": true, "quote": "Last updated on: 2nd March 2022." } ], "notes": [ { "date": "2026-10-08", "text": "Subscriptions renew automatically and the customer must give at least seven days' notice before the renewal date to stop renewal.", "quote": "If you do not wish to renew the subscription, you must inform us at least seven days prior to the renewal date." }, { "date": "2026-10-08", "text": "Unpaid accounts inactive for 120 continuous days may be terminated and their data deleted, with prior notice, and activity in one service does not keep another active.", "quote": "We reserve the right to terminate unpaid user accounts that are inactive for a continuous period of 120 days." }, { "date": "2026-10-08", "text": "If the customer does not answer a forwarded complaint within 10 days, Zoho may give the customer's name and contact information to the complainant.", "quote": "If you do not respond to the complainant within 10 days from the date of our email to you, we may disclose your name and contact information to the complainant for enabling the complainant to take legal action against you." } ] }, { "kind": "privacy", "url": "https://www.zoho.com/privacy.html", "state": "read", "readAt": "2026-10-08", "statedDate": "2025-12-22", "words": 6377, "points": 8, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last updated on: 22nd Dec 2025.", "says": "Last updated 2025-12-22" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "This policy tells you what information we collect from you, what we do with it, who can access it, and what you can do about it." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "After you terminate your account, your data will be automatically deleted from our active database within 6 months and from our backups within 3 months after that.", "says": "Names a period of 6 months" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "If you ask about our products through one of our referral programs or reselling partners, or sign in to one of our products through an authentication service provider like LinkedIn or Google, they'll pass on your contact information to us." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "We share your information only in the ways that are described in this Privacy Policy, and only with parties who adopt appropriate confidentiality and security measures." }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "The European Economic Area (EEA) provides certain rights to data subjects (including access, rectification, erasure, restriction of processing, data portability, and the right to object and to complain)." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "If you wish to update or delete your testimonial, you can contact us at privacy@zohocorp.com", "says": "privacy@zohocorp.com" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "…or otherwise providing personal information or service data to us, you understand that the processing, transfer, and storage of your personal information or Service Data within the United States of America, the European Economic Area (EEA) and other countries where Zoho operates.", "says": "Data goes to the United States" } ], "toKnow": [ { "key": "training", "label": "Says it may use customer content to train or improve models, and no opt-out was found", "found": true, "quote": "In keeping with Zoho's promise not to exploit your data in a way that is not respectful of your privacy and confidentiality expectations, we make only the following limited use of service data for these technologies: (i) using anonymized crops of service data to improve accuracy of the algorithms;", "costsPoints": true } ], "notes": [ { "date": "2026-10-08", "text": "Zoho employees and contractors may open service data to resolve errors and to check by hand emails reported as spam and scanned images.", "quote": "so that they can (i) identify, analyze and resolve errors, (ii) manually verify emails reported as spam to improve spam detection, or (iii) manually verify scanned images that you submit to us to verify the accuracy of optical character recognition." }, { "date": "2026-10-08", "text": "Zoho says it uses an organisation's data to develop models specific to that organisation.", "quote": "(ii) using your organization's data for developing models specific for your organization." }, { "date": "2026-10-08", "text": "After an account is terminated, data leaves the active database at a clean-up run once every six months and leaves backups three months later.", "quote": "Once you terminate your Zoho user account, your data will eventually get deleted from active database during the next clean-up that occurs once in 6 months." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/zoho-recruit.json" } }