Bullhorn vs Greenhouse

Bullhorn

The REST API covers 91 documented entities with required field selection, Lucene and JPQL queries and an event queue. Access is by support ticket or a paid partner contract, and the API Fair Use Policy bars connecting third-party AI or LLM tools or MCP without Bullhorn's written permission. No OpenAPI file or numeric rate limit was found.

Greenhouse

Harvest v3 pairs per-endpoint OAuth scopes with Markdown docs that embed an OpenAPI 3.1 definition for each call, and the beta MCP server blocks every DELETE. Access needs a paying customer account, with no public price, trial or self-serve sandbox, and no numeric rate limit or idempotency key was found in the reviewed documentation.

Bullhorn

1. Confirm the customer holds Bullhorn's written permission for AI or LLM access before any call. The API Fair Use Policy forbids it otherwise
2. Call /rest-services/loginInfo?username= first to learn the data centre, then use the returned OAuth and REST URLs and follow any 307 redirect
3. Log in once and reuse BhRestToken until a call returns 401, then use the refresh token. Bullhorn limits login rates and may block frequent logins
4. Send BhRestToken as a header, never in the URL, and always pass fields. fields=* is blocked outside /meta
5. On 429 wait one second and retry. Writes have no idempotency key, so read the record back before repeating a PUT

Greenhouse

1. Request a token from https://auth.greenhouse.io/token with client credentials, then send it as a Bearer token to https://harvest.greenhouse.io/v3. Tokens expire, so repeat on 401
2. Put filters and per_page on the first list request only. A cursor must be the only query parameter, or the call returns 422
3. Send the current stage as from_stage_id when moving an application. It guards against stale moves. Other writes have no idempotency key, so check before retrying
4. Read X-RateLimit-Remaining on every response and wait for Retry-After on 429. The window is 30 seconds
5. Expect empty list results or 403 unless the token's user is a Site Admin with the needed permissions