{ "data": { "similar": [ { "grade": "B", "json": "https://www.anchorterminal.com/tools/greenhouse.json", "name": "Greenhouse", "score": 64.8, "shared": [ "recruiting.candidates", "recruiting.jobs", "recruiting.applications", "recruiting.interviews" ], "slug": "greenhouse" }, { "grade": "C", "json": "https://www.anchorterminal.com/tools/ashby.json", "name": "Ashby", "score": 61.3, "shared": [ "recruiting.candidates", "recruiting.jobs", "recruiting.applications", "recruiting.interviews" ], "slug": "ashby" }, { "grade": "C", "json": "https://www.anchorterminal.com/tools/smartrecruiters.json", "name": "SmartRecruiters", "score": 60.4, "shared": [ "recruiting.candidates", "recruiting.jobs", "recruiting.applications", "recruiting.interviews" ], "slug": "smartrecruiters" }, { "grade": "C", "json": "https://www.anchorterminal.com/tools/zoho-recruit.json", "name": "Zoho Recruit", "score": 59.8, "shared": [ "recruiting.candidates", "recruiting.jobs", "recruiting.applications", "recruiting.interviews" ], "slug": "zoho-recruit" }, { "grade": "D", "json": "https://www.anchorterminal.com/tools/lever.json", "name": "Lever", "score": 53.6, "shared": [ "recruiting.candidates", "recruiting.jobs", "recruiting.applications", "recruiting.interviews" ], "slug": "lever" }, { "grade": "D", "json": "https://www.anchorterminal.com/tools/gem.json", "name": "Gem", "score": 53.3, "shared": [ "recruiting.candidates", "recruiting.jobs", "recruiting.applications", "recruiting.interviews" ], "slug": "gem" } ], "tool": { "slug": "bullhorn", "name": "Bullhorn", "vendor": "Bullhorn, Inc.", "vendorUrl": "https://www.bullhorn.com", "kind": "http-api", "category": "recruiting", "summary": "Applicant tracking and CRM software for staffing and recruitment agencies from Bullhorn, Inc. in Boston. Its REST API reads and writes candidates, job orders, submissions, placements and notes with OAuth 2.0, under credentials Bullhorn issues to customers and contracted partners.", "url": "https://www.anchorterminal.com/tools/bullhorn", "markdownUrl": "https://www.anchorterminal.com/tools/bullhorn.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/bullhorn.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/bullhorn.json", "repo": "https://github.com/bullhorn/rest-api-docs", "license": "Proprietary service under a Bullhorn customer or partner agreement that is not published, with a public API Fair Use Policy. The `sdk-rest` Java library and the `@bullhorn/taurus` and `@bullhorn/bullhorn-types` packages are MIT per npm and the repositories", "transports": [ "http" ], "remoteUrl": "https://rest.bullhornstaffing.com/rest-services", "packages": [ { "registry": "npm", "name": "@bullhorn/taurus" }, { "registry": "npm", "name": "@bullhorn/bullhorn-types" } ], "auth": "oauth", "authNotes": "Access is granted by Bullhorn, not self-serve. A customer asks for OAuth keys (client ID, client secret, redirect URI) through a support ticket. A vendor building for customers must sign the API Access Agreement, pay an annual platform fee and pass a security assessment before getting a sandbox. The flow is the OAuth 2.0 authorisation code grant at `auth-{dc}.bullhornstaffing.com`, a ten-minute access token and a rotating refresh token, then `POST /rest-services/login` for a `BhRestToken` session sent as a header, cookie or query parameter. No scopes were found. The API Fair Use Policy requires Bullhorn's explicit written permission before the API is connected to third-party AI or LLM tools or MCP.", "pricing": "paid", "pricingNotes": "Bullhorn Starter is $99 and Bullhorn Core $165 per user per month, and Pro, Max and the plans for larger agencies are quoted. No free trial. API access for integrators is an annual platform fee, not published, covering a sandbox and 200,000 calls a month with overage charges. No sandbox or free tier lets an agent start without a contract (checked 2026-10-08).", "priceSummary": "$99 / seat-mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the REST API reference, the getting started guide, the API Fair Use Policy or the pricing pages (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 13, "npmWeekly": 1728, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://bullhorn.github.io/rest-api-docs/", "capabilities": [ "recruiting.candidates", "recruiting.jobs", "recruiting.applications", "recruiting.interviews" ], "tags": [ "hosted", "enterprise", "oauth", "staffing", "java", "typescript", "partner-approval", "sales-led", "status-page", "soc2" ], "lastRelease": "2026-09-29", "graded": true, "anchor": { "graded": true, "score": 46.7, "grade": "D", "agentReady": false, "rank": 644, "ranked": true, "rankOf": 722, "categoryRank": 10, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 64, "maintenance": 56, "payments": 5, "reliability": 53, "schema": 55, "security": 31, "transparency": 67 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 53, "points": 10.6, "reason": "Read with the hosted rubric, for the REST API. Statuspage at status.bullhorn.com with 96 components by product and cluster and incident history, but no REST API component (20). From 12 July to 7 October 2026 the page lists 50 incidents across all products, 37 minor, seven major and two critical. On Bullhorn ATS/CRM clusters the majors were performance issues on CLS43 for 2 hours 3 minutes on 26 August, on CLS40 for 22 minutes on 27 August, and a Greenshades integration fault from 1 to 2 September. We read that as one major outage of the core product on one cluster (10). No numeric rate limit is in the API reference. The partner FAQ gives an allowance of 200,000 calls a month, and the guide says login rates are strictly limited without a figure (5). The error table says to wait one second on 429 and retry until successful. No idempotency keys were found for writes (8). No SLA was found on the public site (0). The API is generally available at version 2.0 (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 55, "points": 8.94, "reason": "No OpenAPI or other downloadable contract was found. `/meta/{entityType}` returns field names, types and lengths to an authenticated caller, and `@bullhorn/bullhorn-types` publishes TypeScript interfaces for the entities (8). The docs are one HTML page built from Markdown sources in a public GitHub repository, and www.bullhorn.com/llms.txt is a product index that links to the developer site. No Markdown is served for agents (4). Each operation states its purpose with parameter tables, and the entity guide describes 91 entities field by field (12). Parameters are marked required or optional and entity fields carry types and lengths, but `query` and `where` are free-form Lucene and JPQL strings (9). Every operation has a curl example and a sample response. Errors are a table of ten status codes with no bodies (9). Login takes a `version` parameter, and a change log lists releases from 2024.5 to 2026.6 (13)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 64, "points": 10.4, "reason": "Every read must name its `fields`, with nested sub-fields and a count per to-many association, and `fields=*` is blocked outside `/meta` (22). `start` and `count` paging with a default of 20 and a maximum of 500 (300 on some calls), Lucene search, JPQL where clauses and `orderBy` (20). Errors are status codes with one-line meanings, and the reference shows no error body to branch on (8). No idempotency keys. The only retry guidance is one second on 429, and the event queue can re-read a batch by `lastRequestId` (4). Official Java and TypeScript libraries exist, but a first call takes four requests (data centre lookup, authorisation code, token, REST login) and the base URL differs per customer (10)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 31, "points": 5.43, "reason": "OAuth 2.0 authorisation code grant with a client ID and secret issued by Bullhorn, ten-minute access tokens and rotating refresh tokens, exchanged for a `BhRestToken` session. No scopes were found, so a session carries all the rights of the API user (20). The guide shows the username, password, client secret and access token as URL query parameters, and `BhRestToken` may be sent in the query string, which takes 10 off (10). Access follows the API user's entitlements per entity and action, readable at `/entitlements`. No read-only mode or confirmation step for deletes or `/massUpdate` was found (8). Candidate CVs and notes are untrusted text, and no guidance on handling them was found. The fair use policy requires written permission before any AI tool is connected, which is a contract term and not a mitigation (0). `EntityEditHistory` records field changes and events carry the user and transaction. No per-call API log for the operator was found (5). The GDPR commitment statement reports annual SOC 1 Type 2 and SOC 2 Type 2 audits. No security.txt, disclosure policy or bug bounty was found, and www.bullhorn.com/security describes only the Salesforce-based Talent Rover product (8)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 5, "points": 0.63, "reason": "Read with the hosted rubric. No x402, MPP or L402 (0). The pricing page gives Bullhorn Starter at $99 and Bullhorn Core at $165 per user per month and quotes the other plans. The partner route to the API is an annual platform fee with overage charges, neither published (5). The small agency pricing page says Bullhorn has no free trial at present, and the partner FAQ says free access is given to nobody (0). Customers get OAuth keys through a support ticket and partners through a signed contract, an invoice and a security assessment (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 56, "points": 4.9, "reason": "The REST API change log's newest entry is the June 2026 release (2026.6), over 90 days old. The docs repository had commits on 17 September, 1 October and 5 October 2026, and `sdk-rest` 3.0.0 was tagged on 29 September 2026. We scored between the two (20). Three `sdk-rest` tags in 90 days (2.6.3 on 12 August, 2.7.0 and 3.0.0 on 29 September) and no dated API change log entry in that time (10). Closed service with a public change log, a developer ticket form and forums named in the guide. We could not read the help centre (6). Current official libraries in Java and TypeScript (15). `@bullhorn/taurus` 3.9.8 dates from 22 April 2026 with 51 weekly downloads, and `sdk-rest` moved to Spring 7 and Java 17 in September (5)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 67, "points": 5.86, "note": "editorial 51, provenance 82", "reason": "Closed service. The Master Subscription Agreement is not published, and the legal terms page links only to product supplements. The API Fair Use Policy is public and lets Bullhorn suspend access or discontinue the APIs at any time (10). The privacy policy of 20 May 2026 covers the service platforms, lists machine learning and product enhancement among its purposes, and keeps data while an account is active with no fixed periods. No public DPA was found beyond the standard contractual clauses pages (18). No deprecation policy was found. The reference notes that `fields=*` is deprecated and will be blocked, without a date (3). The sub-processor list, version 25 August 2026, gives each provider's purpose, location and covered services, with a form to subscribe to changes (20)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Every read must name its `fields`, with nested sub-fields and a count per to-many association, and `fields=*` is blocked outside `/meta` (22). `start` and `count` paging with a default of 20 and a maximum of 500 (300 on some calls), Lucene search, JPQL where clauses and `orderBy` (20). Errors are status codes with one-line meanings, and the reference shows no error body to branch on (8). No idempotency keys. The only retry guidance is one second on 429, and the event queue can re-read a batch by `lastRequestId` (4). Official Java and TypeScript libraries exist, but a first call takes four requests (data centre lookup, authorisation code, token, REST login) and the base URL differs per customer (10).", "maintenance": "The REST API change log's newest entry is the June 2026 release (2026.6), over 90 days old. The docs repository had commits on 17 September, 1 October and 5 October 2026, and `sdk-rest` 3.0.0 was tagged on 29 September 2026. We scored between the two (20). Three `sdk-rest` tags in 90 days (2.6.3 on 12 August, 2.7.0 and 3.0.0 on 29 September) and no dated API change log entry in that time (10). Closed service with a public change log, a developer ticket form and forums named in the guide. We could not read the help centre (6). Current official libraries in Java and TypeScript (15). `@bullhorn/taurus` 3.9.8 dates from 22 April 2026 with 51 weekly downloads, and `sdk-rest` moved to Spring 7 and Java 17 in September (5).", "payments": "Read with the hosted rubric. No x402, MPP or L402 (0). The pricing page gives Bullhorn Starter at $99 and Bullhorn Core at $165 per user per month and quotes the other plans. The partner route to the API is an annual platform fee with overage charges, neither published (5). The small agency pricing page says Bullhorn has no free trial at present, and the partner FAQ says free access is given to nobody (0). Customers get OAuth keys through a support ticket and partners through a signed contract, an invoice and a security assessment (0).", "reliability": "Read with the hosted rubric, for the REST API. Statuspage at status.bullhorn.com with 96 components by product and cluster and incident history, but no REST API component (20). From 12 July to 7 October 2026 the page lists 50 incidents across all products, 37 minor, seven major and two critical. On Bullhorn ATS/CRM clusters the majors were performance issues on CLS43 for 2 hours 3 minutes on 26 August, on CLS40 for 22 minutes on 27 August, and a Greenshades integration fault from 1 to 2 September. We read that as one major outage of the core product on one cluster (10). No numeric rate limit is in the API reference. The partner FAQ gives an allowance of 200,000 calls a month, and the guide says login rates are strictly limited without a figure (5). The error table says to wait one second on 429 and retry until successful. No idempotency keys were found for writes (8). No SLA was found on the public site (0). The API is generally available at version 2.0 (10).", "schema": "No OpenAPI or other downloadable contract was found. `/meta/{entityType}` returns field names, types and lengths to an authenticated caller, and `@bullhorn/bullhorn-types` publishes TypeScript interfaces for the entities (8). The docs are one HTML page built from Markdown sources in a public GitHub repository, and www.bullhorn.com/llms.txt is a product index that links to the developer site. No Markdown is served for agents (4). Each operation states its purpose with parameter tables, and the entity guide describes 91 entities field by field (12). Parameters are marked required or optional and entity fields carry types and lengths, but `query` and `where` are free-form Lucene and JPQL strings (9). Every operation has a curl example and a sample response. Errors are a table of ten status codes with no bodies (9). Login takes a `version` parameter, and a change log lists releases from 2024.5 to 2026.6 (13).", "security": "OAuth 2.0 authorisation code grant with a client ID and secret issued by Bullhorn, ten-minute access tokens and rotating refresh tokens, exchanged for a `BhRestToken` session. No scopes were found, so a session carries all the rights of the API user (20). The guide shows the username, password, client secret and access token as URL query parameters, and `BhRestToken` may be sent in the query string, which takes 10 off (10). Access follows the API user's entitlements per entity and action, readable at `/entitlements`. No read-only mode or confirmation step for deletes or `/massUpdate` was found (8). Candidate CVs and notes are untrusted text, and no guidance on handling them was found. The fair use policy requires written permission before any AI tool is connected, which is a contract term and not a mitigation (0). `EntityEditHistory` records field changes and events carry the user and transaction. No per-call API log for the operator was found (5). The GDPR commitment statement reports annual SOC 1 Type 2 and SOC 2 Type 2 audits. No security.txt, disclosure policy or bug bounty was found, and www.bullhorn.com/security describes only the Salesforce-based Talent Rover product (8).", "transparency": "Closed service. The Master Subscription Agreement is not published, and the legal terms page links only to product supplements. The API Fair Use Policy is public and lets Bullhorn suspend access or discontinue the APIs at any time (10). The privacy policy of 20 May 2026 covers the service platforms, lists machine learning and product enhancement among its purposes, and keeps data while an account is active with no fixed periods. No public DPA was found beyond the standard contractual clauses pages (18). No deprecation policy was found. The reference notes that `fields=*` is deprecated and will be blocked, without a date (3). The sub-processor list, version 25 August 2026, gives each provider's purpose, location and covered services, with a form to subscribe to changes (20)." }, "sources": [ { "what": "REST API reference", "url": "https://bullhorn.github.io/rest-api-docs/", "seen": "2026-10-08" }, { "what": "REST API change log", "url": "https://bullhorn.github.io/rest-api-docs/changelog.html", "seen": "2026-10-08" }, { "what": "Get Started with the Bullhorn REST API", "url": "https://bullhorn.github.io/Getting-Started-with-REST/", "seen": "2026-10-08" }, { "what": "API Fair Use Policy", "url": "https://bullhorn.github.io/api-fair-use-policy/", "seen": "2026-10-08" }, { "what": "API access FAQs for integrators", "url": "https://www.bullhorn.com/bullhorn-api-access-faqs/", "seen": "2026-10-08" }, { "what": "Integrate with Bullhorn", "url": "https://www.bullhorn.com/integrate-with-bullhorn/", "seen": "2026-10-08" }, { "what": "Developer programme guide", "url": "https://www.bullhorn.com/partner-program-guide/developer-program-guide-2/", "seen": "2026-10-08" }, { "what": "pricing", "url": "https://www.bullhorn.com/pricing/", "seen": "2026-10-08" }, { "what": "small agency pricing", "url": "https://www.bullhorn.com/small-agency-software/pricing/", "seen": "2026-10-08" }, { "what": "status incidents", "url": "https://status.bullhorn.com/api/v2/incidents.json", "seen": "2026-10-08" }, { "what": "status components", "url": "https://status.bullhorn.com/api/v2/components.json", "seen": "2026-10-08" }, { "what": "privacy policy", "url": "https://www.bullhorn.com/privacy/", "seen": "2026-10-08" }, { "what": "sub-processor list", "url": "https://www.bullhorn.com/legal/sub-processors/", "seen": "2026-10-08" }, { "what": "legal terms and supplemental terms", "url": "https://www.bullhorn.com/legal-terms/supplemental-terms/", "seen": "2026-10-08" }, { "what": "GDPR commitment statement", "url": "https://www.bullhorn.com/gdpr-commitment-statement/", "seen": "2026-10-08" }, { "what": "security page (Talent Rover)", "url": "https://www.bullhorn.com/security/", "seen": "2026-10-08" }, { "what": "docs repository", "url": "https://github.com/bullhorn/rest-api-docs", "seen": "2026-10-08" }, { "what": "Java SDK repository", "url": "https://github.com/bullhorn/sdk-rest", "seen": "2026-10-08" }, { "what": "npm, @bullhorn/bullhorn-types", "url": "https://registry.npmjs.org/@bullhorn/bullhorn-types", "seen": "2026-10-08" }, { "what": "npm, @bullhorn/taurus", "url": "https://registry.npmjs.org/@bullhorn/taurus", "seen": "2026-10-08" }, { "what": "site index for agents", "url": "https://www.bullhorn.com/llms.txt", "seen": "2026-10-08" }, { "what": "official MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=bullhorn", "seen": "2026-10-08" }, { "what": "RDAP for bullhorn.com", "url": "https://rdap.org/domain/bullhorn.com", "seen": "2026-10-08" } ], "openQuestions": [ "The API Fair Use Policy of 17 December 2025 forbids connecting third-party AI or LLM tools, or MCP, without Bullhorn's explicit written permission. How that permission is requested and how often it is granted was not found", "unchecked: the API usage limits the fair use policy refers to. The reference gives no number, and help.bullhorn.com did not answer our requests", "unchecked: the Master Subscription Agreement, the API Access Agreement, any SLA and any DPA. None is published on the pages we read", "unchecked: the annual platform fee and overage price for partner API access, and whether customer API keys cost extra on each plan", "unchecked: which Bullhorn products hold SOC 2 Type 2 or ISO 27001. The GDPR commitment statement says many do without naming them, and trust.bullhorn.com did not answer", "unchecked: the 90-day window before 12 July 2026. The status feed returns the 50 most recent incidents, which reach back to that date", "unchecked: security.txt. The path redirects to the home page, which we recorded as none", "Not found in the reviewed documentation: an OpenAPI file, OAuth scopes, idempotency keys, error response bodies, a deprecation policy and an official MCP server" ] }, "negative": 0, "verdict": "The REST API covers 91 documented entities with required field selection, Lucene and JPQL queries and an event queue. Access is by support ticket or a paid partner contract, and the API Fair Use Policy bars connecting third-party AI or LLM tools or MCP without Bullhorn's written permission. No OpenAPI file or numeric rate limit was found.", "bestFor": "An integration built for a staffing agency that already runs on Bullhorn, with Bullhorn's permission for AI use in writing, and needs candidates, job orders, submissions and placements.", "strengths": [ "Every read names its `fields`, with nested associations and per-association counts, so responses can be kept small", "`/search` takes Lucene queries and `/query` takes JPQL where clauses, with `start` and `count` paging up to 500 records", "91 entity reference pages give field names, types and lengths, and `/meta/{entityType}` returns the same model at run time", "Java `sdk-rest` 3.0.0 was tagged on 29 September 2026 and `@bullhorn/bullhorn-types` 1.142.0 was published on 28 September 2026", "Sub-processor list dated 25 August 2026 names each provider, its location and the Bullhorn services it covers" ], "weaknesses": [ "The API Fair Use Policy of 17 December 2025 bars connecting third-party AI or LLM tools, or MCP, without Bullhorn's explicit written permission", "Credentials come from a support ticket for customers or a paid annual partner contract with a security assessment. No self-serve key, trial or free sandbox", "The documented flow puts the username, password, client secret, access token and `BhRestToken` in URL query strings", "No OpenAPI file, no OAuth scopes, no idempotency keys and no numeric rate limit were found in the reviewed documentation", "The status page listed 50 incidents from 12 July to 7 October 2026, seven marked major and two critical, with no API component" ], "agentNotes": [ "Confirm the customer holds Bullhorn's written permission for AI or LLM access before any call. The API Fair Use Policy forbids it otherwise", "Call `/rest-services/loginInfo?username=` first to learn the data centre, then use the returned OAuth and REST URLs and follow any 307 redirect", "Log in once and reuse `BhRestToken` until a call returns 401, then use the refresh token. Bullhorn limits login rates and may block frequent logins", "Send `BhRestToken` as a header, never in the URL, and always pass `fields`. `fields=*` is blocked outside `/meta`", "On 429 wait one second and retry. Writes have no idempotency key, so read the record back before repeating a PUT" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 46.7 } ], "editorialScores": { "ergonomics": 64, "maintenance": 56, "payments": 5, "reliability": 53, "schema": 55, "security": 31, "transparency": 51 }, "provenanceScore": 82 }, "connect": { "http": "curl \"https://rest.bullhornstaffing.com/rest-services/loginInfo?username={API_Username}\"" }, "letme": { "capability": "https://letme.dev/recruiting.candidates", "tool": "https://letme.dev/bullhorn" }, "notable": [ "The API Fair Use Policy, dated December 17, 2025, says the API must not be connected to any third-party AI or LLM tools for viewing or updating data, or used with MCP to export, import, update or delete data, without Bullhorn's explicit written permission (https://bullhorn.github.io/api-fair-use-policy/)", "The same policy lets Bullhorn approve, deny, suspend or terminate API access at its sole discretion and discontinue the APIs at any time", "The integrator FAQ says customers will not be given an API key to pass to a vendor that has no contract with Bullhorn, and that connector or middleware companies may not build integrations (https://www.bullhorn.com/bullhorn-api-access-faqs/)", "The reference documents 69 operations under 21 groups (27 GET, 20 POST, 12 PUT, 10 DELETE), among them `/entity`, `/search`, `/query`, `/meta`, `/massUpdate`, `/resume/parseToCandidate` and `/event/subscription` (https://bullhorn.github.io/rest-api-docs/)", "The getting started guide shows `username`, `password` and `client_secret` as query parameters on the OAuth URLs, and the reference allows `BhRestToken` in the query string (https://bullhorn.github.io/Getting-Started-with-REST/)", "Each customer sits in a data centre, found with `GET /rest-services/loginInfo?username=`. A call to the wrong one returns a 307 redirect", "The official MCP registry returned no server for a search on bullhorn, and no Bullhorn MCP server was found on the vendor's pages (https://registry.modelcontextprotocol.io/v0/servers?search=bullhorn)", "status.bullhorn.com listed 50 incidents from 12 July to 7 October 2026 across all products, seven marked major and two critical (https://status.bullhorn.com/api/v2/incidents.json)" ], "area": "business", "details": [ { "label": "Surface graded", "value": "Bullhorn REST API version 2.0 for Bullhorn ATS and CRM, generally available. No official MCP server was found" }, { "label": "AI and MCP use", "value": "The API Fair Use Policy (17 December 2025) requires Bullhorn's explicit written permission before the API is connected to third-party AI or LLM tools, or used with MCP to move or change data" }, { "label": "API", "value": "69 documented operations (27 GET, 20 POST, 12 PUT, 10 DELETE) across `/entity`, `/search`, `/query`, `/find`, `/meta`, `/file`, `/resume`, `/massUpdate`, `/savedSearch`, `/services`, `/settings` and `/event/subscription`. JSON, with optional JSONP" }, { "label": "Entities", "value": "91 entity reference pages, among them Candidate, ClientContact, ClientCorporation, JobOrder, JobSubmission, Sendout, Appointment, Placement, Note, Lead, Opportunity and Tearsheet, plus Pay and Bill entities" }, { "label": "Credentials", "value": "OAuth 2.0 authorisation code grant with a client ID and secret issued by Bullhorn. Access token valid 10 minutes, rotating refresh token where enabled, then a `BhRestToken` session from `/login` with an optional `ttl`. No scopes found" }, { "label": "Access", "value": "Customers request keys by support ticket. Integrators sign the API Access Agreement, pay an annual platform fee and pass a security assessment. Each partner application gets its own API key" }, { "label": "Rate limits", "value": "No number in the reference. 429 means wait 1 second and retry. Partner allowance of 200,000 calls a month with overage charges. Login rates are strictly limited, with no figure" }, { "label": "Pagination", "value": "`start` and `count`, default 20, maximum 500 (300 on some calls). To-many associations return 5 by default. `orderBy` and `showTotalMatched` on searches" }, { "label": "Field selection", "value": "`fields` or `layout` is required on reads, with nested sub-fields, per-association counts and sub-where filters. `fields=*` is blocked outside `/meta`" }, { "label": "Errors", "value": "Status codes 400, 401, 403, 404, 405, 406, 410, 429, 500 and 503 with one-line meanings. 412 when `BhRestToken` is missing. No error bodies documented" }, { "label": "Events", "value": "Polling event queue. `PUT /event/subscription` creates a subscription, `GET` reads up to `maxEvents`, and `lastRequestId` re-reads the last batch. No outbound webhooks documented in the reference" }, { "label": "SDKs", "value": "Java `sdk-rest` 3.0.0 (29 September 2026, Java 17), TypeScript `@bullhorn/taurus` 3.9.8 (22 April 2026) and `@bullhorn/bullhorn-types` 1.142.0 (28 September 2026)" }, { "label": "Audit", "value": "`EntityEditHistory` and `EntityEditHistoryFieldChange` entities record changes, and events carry `PERSON_ID` and `TRANSACTION_ID`. No per-call API log found" }, { "label": "Certifications", "value": "Annual SOC 1 Type 2 and SOC 2 Type 2 audits per the GDPR commitment statement, which says many services hold SOC 2 Type 2 or ISO 27001 without naming them" }, { "label": "Status", "value": "status.bullhorn.com on Statuspage, 96 components by product and cluster (CLS numbers for ATS/CRM), no REST API component" }, { "label": "Sub-processors", "value": "List version 25 August 2026 with purpose, location and covered services. Bullhorn ATS is hosted on Amazon Web Services and Bullhorn's own data centres in Australia, Canada, Germany, Ireland, the Netherlands, the United Kingdom and the United States" } ], "unitPrices": [ { "item": "Bullhorn Starter, per user", "unit": "seat-month", "usd": 99, "note": "Small agency plan. API keys are issued separately by Bullhorn" }, { "item": "Bullhorn Core, per user", "unit": "seat-month", "usd": 165, "note": "Small agency plan with the app marketplace" } ], "provenance": { "legalEntity": "Bullhorn, Inc.", "domain": "bullhorn.com", "domainRegistered": "1997-07-31", "endpointOnVendorDomain": true, "terms": "https://bullhorn.github.io/api-fair-use-policy/", "privacy": "https://www.bullhorn.com/privacy/", "statusPage": "https://status.bullhorn.com", "changelog": "https://bullhorn.github.io/rest-api-docs/changelog.html", "securityTxt": "none", "checked": "2026-10-08", "notes": [ "The terms link is the API Fair Use Policy, dated December 17, 2025, which governs use of Bullhorn's APIs and supplements the customer or partner agreement. The Master Subscription Agreement and the API Access Agreement are not published. www.bullhorn.com/legal is a website terms page and www.bullhorn.com/legal-terms links only to product supplements.", "The privacy policy, effective 20 May 2026, names Bullhorn, Inc. and its group companies and says it applies to the service platform at www.bullhornstaffing.com as well as the website.", "The API answers at rest.bullhornstaffing.com and auth-{dc}.bullhornstaffing.com. RDAP gives bullhornstaffing.com a registration date of 2000-12-11 and bullhorn.com 1997-07-31. The developer docs are on bullhorn.github.io, linked from www.bullhorn.com/llms.txt.", "https://www.bullhorn.com/.well-known/security.txt redirects to the home page, so no security.txt was found.", "The site footer and the developer site give the address 100 Summer Street, 17th Floor, Boston, MA 02210." ], "score": 82, "checks": [ { "check": "Legal entity named", "value": "Bullhorn, Inc.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "bullhorn.com, registered 1997-07-31 (29 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "rest.bullhornstaffing.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 2 of the 7 things a reader expects, and has 2 clauses that cost points", "points": 1.7, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 8 of the 8 things a reader expects", "points": 10, "max": 10, "state": "ok" }, { "check": "Status page", "value": "status.bullhorn.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "https://bullhorn.github.io/api-fair-use-policy/", "state": "read", "readAt": "2026-10-08", "words": 1392, "points": 1.7, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": false }, { "key": "terms.law", "label": "Names the governing law or courts", "found": false }, { "key": "terms.liability", "label": "States a limit on its liability", "found": false }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "Bullhorn can approve, deny, suspend, or terminate your access to the APIs at its sole discretion." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": false }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "No Competing with Bullhorn: You must not use the APIs for any purpose that competes with Bullhorn’s services or helps others do so, except as disclosed by you in advance and explicitly permitted by Bullhorn." }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": false } ], "toKnow": [ { "key": "terms.automated", "label": "Restricts automated access", "found": true, "quote": "No Scraping Data: You must not scrape, extract or harvest more data than what’s necessary to service a Bullhorn customer’s permitted usage.", "costsPoints": true }, { "key": "terms.benchmark", "label": "Restricts benchmarking or competitive use", "found": true, "quote": "No Competing with Bullhorn: You must not use the APIs for any purpose that competes with Bullhorn’s services or helps others do so, except as disclosed by you in advance and explicitly permitted by Bullhorn.", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "Bullhorn can suspend or terminate your API access at any time, with or without a reason, and without any liability." } ], "notes": [ { "date": "2026-10-08", "text": "The API may not be connected to any third-party AI or LLM tool for viewing or updating data without Bullhorn's explicit written permission.", "quote": "No Undisclosed Artificial Intelligence (“AI”)/Large Language Model (“LLM”) Tools: You must not use the API to connect to any 3rd party AI or LLM tools for viewing or updating data without Bullhorn’s explicit written permission." }, { "date": "2026-10-08", "text": "Exporting, importing, updating or deleting data through unauthorised solutions or models, with Model Context Protocols named as an example, needs Bullhorn's explicit written permission.", "quote": "there can be no export of data to, import of data from, or any updating or deleting of data by any unauthorized solutions or models, like Model Context Protocols (i.e. MCPs), without Bullhorn’s explicit written permission" }, { "date": "2026-10-08", "text": "Using the APIs for or on behalf of a third party needs Bullhorn's explicit written permission.", "quote": "No Access on Behalf of Others: You must not access or use the APIs for or on behalf of a third party without Bullhorn’s explicit written permission." } ] }, { "kind": "privacy", "url": "https://www.bullhorn.com/privacy/", "state": "read", "readAt": "2026-10-08", "statedDate": "2026-05-20", "words": 5969, "points": 10, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Version (Effective): May 20, 2026", "says": "Last updated 2026-05-20" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "We may collect and/or process the following categories of personal data from our customers, customers’ candidates and Site visitors:" }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "We will retain personal data for as long as a customer’s account is active or as needed to provide the Service to our customer, as required under customer agreements and/or for as long as Bullhorn needs the personal data to fulfill the purposes for which the personal data was initially collected, unless otherwise requ…" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "Facilitate the services provided to our customers by Bullhorn partners and other third party service providers." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "We do not sell your personal data to third parties.", "says": "Says it does not sell personal data" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "Under the Standard Contractual Clauses, the Data Privacy Framework Principles and other applicable law, you have the right to opt out of (i) disclosures of your personal data to third parties;" }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "Customers or Site visitors may also email privacy@bullhorn.com directly with a request to be removed from such communications.", "says": "privacy@bullhorn.com" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "…our customer agreements, and in no event, less than a reasonable standard of care in accordance with the Standard Contractual Clauses as set forth in Section 13 of this Privacy Policy, the Data Privacy Framework and other applicable law.", "says": "Relies on standard contractual clauses and the Data Privacy Framework" } ], "toKnow": [ { "key": "privacy.sells", "label": "Says it sells personal data or shares it for advertising", "found": true, "quote": "As described above in Section 2, we may share your personal information with third-parties to show you advertising on other sites." } ], "notes": [ { "date": "2026-10-08", "text": "Bullhorn may use, disclose and publish aggregated or anonymised data for machine learning and for product and service testing and enhancement.", "quote": "Bullhorn may use, disclose, distribute, and publish aggregated and/or anonymized data for statistical, analytical, machine learning and product and Service testing and enhancement purposes." }, { "date": "2026-10-08", "text": "On request, customers receive a copy of their personal data held by Bullhorn when the customer agreement expires or ends, unless the law prohibits it.", "quote": "In accordance with customer agreements, Bullhorn will, upon request, provide our customers with a copy of their personal data stored by Bullhorn upon expiration or termination of the customer agreements, unless prohibited by applicable law." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/bullhorn.json", "live": { "slug": "bullhorn", "probe": { "target": "https://rest.bullhornstaffing.com/rest-services", "method": "get", "lastAt": "2026-10-08T21:53:18.619529904Z", "lastOk": true, "lastStatus": 400, "lastMs": 38, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 47, "p95ms24h": 86, "samples24h": 28, "samples30d": 28, "days": [ { "date": "2026-10-08", "probes": 28, "ok": 28 } ] }, "vendorStatus": { "page": "https://status.bullhorn.com", "indicator": "maintenance", "summary": "Service Under Maintenance", "checkedAt": "2026-10-08T21:57:44.368817755Z" }, "updatedAt": "2026-10-08T21:57:44.368817755Z" } }, "verify": { "accepts": "a page on bullhorn.com or one of its subdomains, or the README of github.com/bullhorn/rest-api-docs", "badgeUrl": "https://www.anchorterminal.com/badges/bullhorn.svg", "body": { "slug": "bullhorn", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/bullhorn", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/bullhorn\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/bullhorn.svg\" alt=\"Bullhorn on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![Bullhorn on Anchor Terminal](https://www.anchorterminal.com/badges/bullhorn.svg)](https://www.anchorterminal.com/tools/bullhorn)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/bullhorn\"\u003eBullhorn on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/bullhorn", "json": "https://www.anchorterminal.com/tools/bullhorn.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/bullhorn.md", "slim": "https://www.anchorterminal.com/tools/bullhorn.min.md" }, "markdown": "## Overview\n\n**Grade D · 46.7/100 · rank #644 of 722 · #10 in Recruiting \u0026 applicant tracking · not agent-ready · confidence medium**\n\n\n## Assessment\n\nThe REST API covers 91 documented entities with required field selection, Lucene and JPQL queries and an event queue. Access is by support ticket or a paid partner contract, and the API Fair Use Policy bars connecting third-party AI or LLM tools or MCP without Bullhorn's written permission. No OpenAPI file or numeric rate limit was found.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | Bullhorn, Inc. (https://www.bullhorn.com) |\n| Kind | HTTP API |\n| Category | Recruiting \u0026 applicant tracking (https://www.anchorterminal.com/categories/recruiting) |\n| Transport | HTTP |\n| Endpoint | `https://rest.bullhornstaffing.com/rest-services` |\n| Auth | OAuth · Access is granted by Bullhorn, not self-serve. A customer asks for OAuth keys (client ID, client secret, redirect URI) through a support ticket. A vendor building for customers must sign the API Access Agreement, pay an annual platform fee and pass a security assessment before getting a sandbox. The flow is the OAuth 2.0 authorisation code grant at `auth-{dc}.bullhornstaffing.com`, a ten-minute access token and a rotating refresh token, then `POST /rest-services/login` for a `BhRestToken` session sent as a header, cookie or query parameter. No scopes were found. The API Fair Use Policy requires Bullhorn's explicit written permission before the API is connected to third-party AI or LLM tools or MCP. |\n| Pricing | Paid ($99 / seat-mo) · Bullhorn Starter is $99 and Bullhorn Core $165 per user per month, and Pro, Max and the plans for larger agencies are quoted. No free trial. API access for integrators is an annual platform fee, not published, covering a sandbox and 200,000 calls a month with overage charges. No sandbox or free tier lets an agent start without a contract (checked 2026-10-08). |\n| x402 | No · No x402, MPP or L402 in the REST API reference, the getting started guide, the API Fair Use Policy or the pricing pages (checked 2026-10-08). |\n| Licence | Proprietary service under a Bullhorn customer or partner agreement that is not published, with a public API Fair Use Policy. The `sdk-rest` Java library and the `@bullhorn/taurus` and `@bullhorn/bullhorn-types` packages are MIT per npm and the repositories |\n| Packages | npm: `@bullhorn/taurus`; npm: `@bullhorn/bullhorn-types` |\n| Source | https://github.com/bullhorn/rest-api-docs |\n| Docs | https://bullhorn.github.io/rest-api-docs/ |\n| llms.txt | not found |\n| Last release | 2026-09-29 |\n| GitHub stars | 13 (as of 2026-10-08) |\n| npm downloads / week | 1,728 |\n| Surface graded | Bullhorn REST API version 2.0 for Bullhorn ATS and CRM, generally available. No official MCP server was found |\n| AI and MCP use | The API Fair Use Policy (17 December 2025) requires Bullhorn's explicit written permission before the API is connected to third-party AI or LLM tools, or used with MCP to move or change data |\n| API | 69 documented operations (27 GET, 20 POST, 12 PUT, 10 DELETE) across `/entity`, `/search`, `/query`, `/find`, `/meta`, `/file`, `/resume`, `/massUpdate`, `/savedSearch`, `/services`, `/settings` and `/event/subscription`. JSON, with optional JSONP |\n| Entities | 91 entity reference pages, among them Candidate, ClientContact, ClientCorporation, JobOrder, JobSubmission, Sendout, Appointment, Placement, Note, Lead, Opportunity and Tearsheet, plus Pay and Bill entities |\n| Credentials | OAuth 2.0 authorisation code grant with a client ID and secret issued by Bullhorn. Access token valid 10 minutes, rotating refresh token where enabled, then a `BhRestToken` session from `/login` with an optional `ttl`. No scopes found |\n| Access | Customers request keys by support ticket. Integrators sign the API Access Agreement, pay an annual platform fee and pass a security assessment. Each partner application gets its own API key |\n| Rate limits | No number in the reference. 429 means wait 1 second and retry. Partner allowance of 200,000 calls a month with overage charges. Login rates are strictly limited, with no figure |\n| Pagination | `start` and `count`, default 20, maximum 500 (300 on some calls). To-many associations return 5 by default. `orderBy` and `showTotalMatched` on searches |\n| Field selection | `fields` or `layout` is required on reads, with nested sub-fields, per-association counts and sub-where filters. `fields=*` is blocked outside `/meta` |\n| Errors | Status codes 400, 401, 403, 404, 405, 406, 410, 429, 500 and 503 with one-line meanings. 412 when `BhRestToken` is missing. No error bodies documented |\n| Events | Polling event queue. `PUT /event/subscription` creates a subscription, `GET` reads up to `maxEvents`, and `lastRequestId` re-reads the last batch. No outbound webhooks documented in the reference |\n| SDKs | Java `sdk-rest` 3.0.0 (29 September 2026, Java 17), TypeScript `@bullhorn/taurus` 3.9.8 (22 April 2026) and `@bullhorn/bullhorn-types` 1.142.0 (28 September 2026) |\n| Audit | `EntityEditHistory` and `EntityEditHistoryFieldChange` entities record changes, and events carry `PERSON_ID` and `TRANSACTION_ID`. No per-call API log found |\n| Certifications | Annual SOC 1 Type 2 and SOC 2 Type 2 audits per the GDPR commitment statement, which says many services hold SOC 2 Type 2 or ISO 27001 without naming them |\n| Status | status.bullhorn.com on Statuspage, 96 components by product and cluster (CLS numbers for ATS/CRM), no REST API component |\n| Sub-processors | List version 25 August 2026 with purpose, location and covered services. Bullhorn ATS is hosted on Amazon Web Services and Bullhorn's own data centres in Australia, Canada, Germany, Ireland, the Netherlands, the United Kingdom and the United States |\n| Capabilities | recruiting.candidates, recruiting.jobs, recruiting.applications, recruiting.interviews |\n| Tags | hosted, enterprise, oauth, staffing, java, typescript, partner-approval, sales-led, status-page, soc2 |\n| JSON | https://www.anchorterminal.com/api/v1/tools/bullhorn.json |\n\n## Score breakdown (methodology v0.4, October 2026 research run)\n\nAssessed 2026-10-08 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 53 | 10.6 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 55 | 8.9 |\n| Agent ergonomics | 13% | 16.2 | 64 | 10.4 |\n| Security \u0026 auth | 14% | 17.5 | 31 | 5.4 |\n| Payments \u0026 pricing | 10% | 12.5 | 5 | 0.6 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 56 | 4.9 |\n| Transparency \u0026 trust (editorial 51, provenance 82) | 7% | 8.8 | 67 | 5.9 |\n| Negative events | up to −15 | up to −15 | none recorded | 0 |\n| **Total** | | | | **46.7 → D** |\n\n### Why each score\n\n- Reliability 53: Read with the hosted rubric, for the REST API. Statuspage at status.bullhorn.com with 96 components by product and cluster and incident history, but no REST API component (20). From 12 July to 7 October 2026 the page lists 50 incidents across all products, 37 minor, seven major and two critical. On Bullhorn ATS/CRM clusters the majors were performance issues on CLS43 for 2 hours 3 minutes on 26 August, on CLS40 for 22 minutes on 27 August, and a Greenshades integration fault from 1 to 2 September. We read that as one major outage of the core product on one cluster (10). No numeric rate limit is in the API reference. The partner FAQ gives an allowance of 200,000 calls a month, and the guide says login rates are strictly limited without a figure (5). The error table says to wait one second on 429 and retry until successful. No idempotency keys were found for writes (8). No SLA was found on the public site (0). The API is generally available at version 2.0 (10).\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 55: No OpenAPI or other downloadable contract was found. `/meta/{entityType}` returns field names, types and lengths to an authenticated caller, and `@bullhorn/bullhorn-types` publishes TypeScript interfaces for the entities (8). The docs are one HTML page built from Markdown sources in a public GitHub repository, and www.bullhorn.com/llms.txt is a product index that links to the developer site. No Markdown is served for agents (4). Each operation states its purpose with parameter tables, and the entity guide describes 91 entities field by field (12). Parameters are marked required or optional and entity fields carry types and lengths, but `query` and `where` are free-form Lucene and JPQL strings (9). Every operation has a curl example and a sample response. Errors are a table of ten status codes with no bodies (9). Login takes a `version` parameter, and a change log lists releases from 2024.5 to 2026.6 (13).\n- Agent ergonomics 64: Every read must name its `fields`, with nested sub-fields and a count per to-many association, and `fields=*` is blocked outside `/meta` (22). `start` and `count` paging with a default of 20 and a maximum of 500 (300 on some calls), Lucene search, JPQL where clauses and `orderBy` (20). Errors are status codes with one-line meanings, and the reference shows no error body to branch on (8). No idempotency keys. The only retry guidance is one second on 429, and the event queue can re-read a batch by `lastRequestId` (4). Official Java and TypeScript libraries exist, but a first call takes four requests (data centre lookup, authorisation code, token, REST login) and the base URL differs per customer (10).\n- Security \u0026 auth 31: OAuth 2.0 authorisation code grant with a client ID and secret issued by Bullhorn, ten-minute access tokens and rotating refresh tokens, exchanged for a `BhRestToken` session. No scopes were found, so a session carries all the rights of the API user (20). The guide shows the username, password, client secret and access token as URL query parameters, and `BhRestToken` may be sent in the query string, which takes 10 off (10). Access follows the API user's entitlements per entity and action, readable at `/entitlements`. No read-only mode or confirmation step for deletes or `/massUpdate` was found (8). Candidate CVs and notes are untrusted text, and no guidance on handling them was found. The fair use policy requires written permission before any AI tool is connected, which is a contract term and not a mitigation (0). `EntityEditHistory` records field changes and events carry the user and transaction. No per-call API log for the operator was found (5). The GDPR commitment statement reports annual SOC 1 Type 2 and SOC 2 Type 2 audits. No security.txt, disclosure policy or bug bounty was found, and www.bullhorn.com/security describes only the Salesforce-based Talent Rover product (8).\n- Payments \u0026 pricing 5: Read with the hosted rubric. No x402, MPP or L402 (0). The pricing page gives Bullhorn Starter at $99 and Bullhorn Core at $165 per user per month and quotes the other plans. The partner route to the API is an annual platform fee with overage charges, neither published (5). The small agency pricing page says Bullhorn has no free trial at present, and the partner FAQ says free access is given to nobody (0). Customers get OAuth keys through a support ticket and partners through a signed contract, an invoice and a security assessment (0).\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 56: The REST API change log's newest entry is the June 2026 release (2026.6), over 90 days old. The docs repository had commits on 17 September, 1 October and 5 October 2026, and `sdk-rest` 3.0.0 was tagged on 29 September 2026. We scored between the two (20). Three `sdk-rest` tags in 90 days (2.6.3 on 12 August, 2.7.0 and 3.0.0 on 29 September) and no dated API change log entry in that time (10). Closed service with a public change log, a developer ticket form and forums named in the guide. We could not read the help centre (6). Current official libraries in Java and TypeScript (15). `@bullhorn/taurus` 3.9.8 dates from 22 April 2026 with 51 weekly downloads, and `sdk-rest` moved to Spring 7 and Java 17 in September (5).\n- Transparency \u0026 trust 67: Closed service. The Master Subscription Agreement is not published, and the legal terms page links only to product supplements. The API Fair Use Policy is public and lets Bullhorn suspend access or discontinue the APIs at any time (10). The privacy policy of 20 May 2026 covers the service platforms, lists machine learning and product enhancement among its purposes, and keeps data while an account is active with no fixed periods. No public DPA was found beyond the standard contractual clauses pages (18). No deprecation policy was found. The reference notes that `fields=*` is deprecated and will be blocked, without a date (3). The sub-processor list, version 25 August 2026, gives each provider's purpose, location and covered services, with a form to subscribe to changes (20).\n\nFix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (17 items): https://www.anchorterminal.com/fixes/bullhorn.md (JSON https://www.anchorterminal.com/fixes/bullhorn.json)\n\n### What we couldn't check\n\n- The API Fair Use Policy of 17 December 2025 forbids connecting third-party AI or LLM tools, or MCP, without Bullhorn's explicit written permission. How that permission is requested and how often it is granted was not found\n- unchecked: the API usage limits the fair use policy refers to. The reference gives no number, and help.bullhorn.com did not answer our requests\n- unchecked: the Master Subscription Agreement, the API Access Agreement, any SLA and any DPA. None is published on the pages we read\n- unchecked: the annual platform fee and overage price for partner API access, and whether customer API keys cost extra on each plan\n- unchecked: which Bullhorn products hold SOC 2 Type 2 or ISO 27001. The GDPR commitment statement says many do without naming them, and trust.bullhorn.com did not answer\n- unchecked: the 90-day window before 12 July 2026. The status feed returns the 50 most recent incidents, which reach back to that date\n- unchecked: security.txt. The path redirects to the home page, which we recorded as none\n- Not found in the reviewed documentation: an OpenAPI file, OAuth scopes, idempotency keys, error response bodies, a deprecation policy and an official MCP server\n\n### Sources\n\n- REST API reference: \u003chttps://bullhorn.github.io/rest-api-docs/\u003e (seen 2026-10-08)\n- REST API change log: \u003chttps://bullhorn.github.io/rest-api-docs/changelog.html\u003e (seen 2026-10-08)\n- Get Started with the Bullhorn REST API: \u003chttps://bullhorn.github.io/Getting-Started-with-REST/\u003e (seen 2026-10-08)\n- API Fair Use Policy: \u003chttps://bullhorn.github.io/api-fair-use-policy/\u003e (seen 2026-10-08)\n- API access FAQs for integrators: \u003chttps://www.bullhorn.com/bullhorn-api-access-faqs/\u003e (seen 2026-10-08)\n- Integrate with Bullhorn: \u003chttps://www.bullhorn.com/integrate-with-bullhorn/\u003e (seen 2026-10-08)\n- Developer programme guide: \u003chttps://www.bullhorn.com/partner-program-guide/developer-program-guide-2/\u003e (seen 2026-10-08)\n- pricing: \u003chttps://www.bullhorn.com/pricing/\u003e (seen 2026-10-08)\n- small agency pricing: \u003chttps://www.bullhorn.com/small-agency-software/pricing/\u003e (seen 2026-10-08)\n- status incidents: \u003chttps://status.bullhorn.com/api/v2/incidents.json\u003e (seen 2026-10-08)\n- status components: \u003chttps://status.bullhorn.com/api/v2/components.json\u003e (seen 2026-10-08)\n- privacy policy: \u003chttps://www.bullhorn.com/privacy/\u003e (seen 2026-10-08)\n- sub-processor list: \u003chttps://www.bullhorn.com/legal/sub-processors/\u003e (seen 2026-10-08)\n- legal terms and supplemental terms: \u003chttps://www.bullhorn.com/legal-terms/supplemental-terms/\u003e (seen 2026-10-08)\n- GDPR commitment statement: \u003chttps://www.bullhorn.com/gdpr-commitment-statement/\u003e (seen 2026-10-08)\n- security page (Talent Rover): \u003chttps://www.bullhorn.com/security/\u003e (seen 2026-10-08)\n- docs repository: \u003chttps://github.com/bullhorn/rest-api-docs\u003e (seen 2026-10-08)\n- Java SDK repository: \u003chttps://github.com/bullhorn/sdk-rest\u003e (seen 2026-10-08)\n- npm, @bullhorn/bullhorn-types: \u003chttps://registry.npmjs.org/@bullhorn/bullhorn-types\u003e (seen 2026-10-08)\n- npm, @bullhorn/taurus: \u003chttps://registry.npmjs.org/@bullhorn/taurus\u003e (seen 2026-10-08)\n- site index for agents: \u003chttps://www.bullhorn.com/llms.txt\u003e (seen 2026-10-08)\n- official MCP registry search: \u003chttps://registry.modelcontextprotocol.io/v0/servers?search=bullhorn\u003e (seen 2026-10-08)\n- RDAP for bullhorn.com: \u003chttps://rdap.org/domain/bullhorn.com\u003e (seen 2026-10-08)\n\n## Who's behind it (provenance 82/100, checked 2026-10-08)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | Bullhorn, Inc. | 20/20 |\n| Domain age | bullhorn.com, registered 1997-07-31 (29 years) | 15/15 |\n| Endpoint on the vendor's domain | rest.bullhornstaffing.com | 15/15 |\n| Terms of service | read, states 2 of the 7 things a reader expects, and has 2 clauses that cost points | 1.7/10 |\n| Privacy policy | read, states 8 of the 8 things a reader expects | 10/10 |\n| Status page | status.bullhorn.com | 10/10 |\n| Changelog | published | 10/10 |\n| security.txt | not found | 0/10 |\n\nThe terms link is the API Fair Use Policy, dated December 17, 2025, which governs use of Bullhorn's APIs and supplements the customer or partner agreement. The Master Subscription Agreement and the API Access Agreement are not published. www.bullhorn.com/legal is a website terms page and www.bullhorn.com/legal-terms links only to product supplements.\n\nThe privacy policy, effective 20 May 2026, names Bullhorn, Inc. and its group companies and says it applies to the service platform at www.bullhornstaffing.com as well as the website.\n\nThe API answers at rest.bullhornstaffing.com and auth-{dc}.bullhornstaffing.com. RDAP gives bullhornstaffing.com a registration date of 2000-12-11 and bullhorn.com 1997-07-31. The developer docs are on bullhorn.github.io, linked from www.bullhorn.com/llms.txt.\n\nhttps://www.bullhorn.com/.well-known/security.txt redirects to the home page, so no security.txt was found.\n\nThe site footer and the developer site give the address 100 Summer Street, 17th Floor, Boston, MA 02210.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service** (https://bullhorn.github.io/api-fair-use-policy/), read 2026-10-08, gives no date, states 2 of the 7 things a reader expects.\n\n- To know. Restricts automated access (costs points). \"No Scraping Data: You must not scrape, extract or harvest more data than what’s necessary to service a Bullhorn customer’s permitted usage.\"\n- To know. Restricts benchmarking or competitive use (costs points). \"No Competing with Bullhorn: You must not use the APIs for any purpose that competes with Bullhorn’s services or helps others do so, except as disclosed by you in advance and explicitly permitted by Bullhorn.\"\n- To know. Says access can be ended without notice or for any reason. \"Bullhorn can suspend or terminate your API access at any time, with or without a reason, and without any liability.\"\n- Not found in the text. Gives the date it was last updated.\n- Not found in the text. Names the governing law or courts.\n- Not found in the text. States a limit on its liability.\n- Not found in the text. Says how changes to the terms are announced.\n- Not found in the text. Refers to a service level or uptime commitment.\n- Also in the text (2026-10-08). The API may not be connected to any third-party AI or LLM tool for viewing or updating data without Bullhorn's explicit written permission. \"No Undisclosed Artificial Intelligence (“AI”)/Large Language Model (“LLM”) Tools: You must not use the API to connect to any 3rd party AI or LLM tools for viewing or updating data without Bullhorn’s explicit written permission.\"\n- Also in the text (2026-10-08). Exporting, importing, updating or deleting data through unauthorised solutions or models, with Model Context Protocols named as an example, needs Bullhorn's explicit written permission. \"there can be no export of data to, import of data from, or any updating or deleting of data by any unauthorized solutions or models, like Model Context Protocols (i.e. MCPs), without Bullhorn’s explicit written permission\"\n- Also in the text (2026-10-08). Using the APIs for or on behalf of a third party needs Bullhorn's explicit written permission. \"No Access on Behalf of Others: You must not access or use the APIs for or on behalf of a third party without Bullhorn’s explicit written permission.\"\n\n**Privacy policy** (https://www.bullhorn.com/privacy/), read 2026-10-08, dated 2026-05-20, states 8 of the 8 things a reader expects.\n\n- To know. Says it sells personal data or shares it for advertising. \"As described above in Section 2, we may share your personal information with third-parties to show you advertising on other sites.\"\n- Gives the date it was last updated. Last updated 2026-05-20.\n- Says whether personal data is sold or shared for advertising. Says it does not sell personal data.\n- Gives a privacy contact. privacy@bullhorn.com.\n- Says where data is transferred or stored. Relies on standard contractual clauses and the Data Privacy Framework.\n- Also in the text (2026-10-08). Bullhorn may use, disclose and publish aggregated or anonymised data for machine learning and for product and service testing and enhancement. \"Bullhorn may use, disclose, distribute, and publish aggregated and/or anonymized data for statistical, analytical, machine learning and product and Service testing and enhancement purposes.\"\n- Also in the text (2026-10-08). On request, customers receive a copy of their personal data held by Bullhorn when the customer agreement expires or ends, unless the law prohibits it. \"In accordance with customer agreements, Bullhorn will, upon request, provide our customers with a copy of their personal data stored by Bullhorn upon expiration or termination of the customer agreements, unless prohibited by applicable law.\"\n\n## Live (updated 2026-10-08 21:57 UTC)\n\n- Right now: up, HTTP 400, 38 ms, checked 2026-10-08 21:53 UTC (get on `https://rest.bullhornstaffing.com/rest-services`)\n- Uptime 24h 100.0% (28 probes) · 30 days 100.0% (28 probes) · p50 47 ms · p95 86 ms\n- Vendor status page: maintenance, Service Under Maintenance\n- Always current: https://www.anchorterminal.com/api/v1/live/bullhorn.json\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Prices\n\n| Item | Price | Unit | Note |\n| --- | --- | --- | --- |\n| Bullhorn Starter, per user | $99 | per seat per month | Small agency plan. API keys are issued separately by Bullhorn |\n| Bullhorn Core, per user | $165 | per seat per month | Small agency plan with the app marketplace |\n\nAcross all listings: https://www.anchorterminal.com/prices/index.md\n\n## Strengths\n\n- Every read names its `fields`, with nested associations and per-association counts, so responses can be kept small\n- `/search` takes Lucene queries and `/query` takes JPQL where clauses, with `start` and `count` paging up to 500 records\n- 91 entity reference pages give field names, types and lengths, and `/meta/{entityType}` returns the same model at run time\n- Java `sdk-rest` 3.0.0 was tagged on 29 September 2026 and `@bullhorn/bullhorn-types` 1.142.0 was published on 28 September 2026\n- Sub-processor list dated 25 August 2026 names each provider, its location and the Bullhorn services it covers\n\n## Weaknesses\n\n- The API Fair Use Policy of 17 December 2025 bars connecting third-party AI or LLM tools, or MCP, without Bullhorn's explicit written permission\n- Credentials come from a support ticket for customers or a paid annual partner contract with a security assessment. No self-serve key, trial or free sandbox\n- The documented flow puts the username, password, client secret, access token and `BhRestToken` in URL query strings\n- No OpenAPI file, no OAuth scopes, no idempotency keys and no numeric rate limit were found in the reviewed documentation\n- The status page listed 50 incidents from 12 July to 7 October 2026, seven marked major and two critical, with no API component\n\n## Before you call it (notes for agents)\n\n1. Confirm the customer holds Bullhorn's written permission for AI or LLM access before any call. The API Fair Use Policy forbids it otherwise\n2. Call `/rest-services/loginInfo?username=` first to learn the data centre, then use the returned OAuth and REST URLs and follow any 307 redirect\n3. Log in once and reuse `BhRestToken` until a call returns 401, then use the refresh token. Bullhorn limits login rates and may block frequent logins\n4. Send `BhRestToken` as a header, never in the URL, and always pass `fields`. `fields=*` is blocked outside `/meta`\n5. On 429 wait one second and retry. Writes have no idempotency key, so read the record back before repeating a PUT\n\n## Connect\n\nFirst request:\n\n```bash\ncurl \"https://rest.bullhornstaffing.com/rest-services/loginInfo?username={API_Username}\"\n```\n\nThrough letme (picks today, calling later): https://letme.dev/bullhorn. letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| Greenhouse | B | 64.8 | 271 | recruiting.candidates, recruiting.jobs, recruiting.applications, recruiting.interviews | no | https://www.anchorterminal.com/tools/greenhouse.md |\n| Ashby | C | 61.3 | 369 | recruiting.candidates, recruiting.jobs, recruiting.applications, recruiting.interviews | no | https://www.anchorterminal.com/tools/ashby.md |\n| SmartRecruiters | C | 60.4 | 403 | recruiting.candidates, recruiting.jobs, recruiting.applications, recruiting.interviews | no | https://www.anchorterminal.com/tools/smartrecruiters.md |\n| Zoho Recruit | C | 59.8 | 421 | recruiting.candidates, recruiting.jobs, recruiting.applications, recruiting.interviews | no | https://www.anchorterminal.com/tools/zoho-recruit.md |\n| Lever | D | 53.6 | 541 | recruiting.candidates, recruiting.jobs, recruiting.applications, recruiting.interviews | no | https://www.anchorterminal.com/tools/lever.md |\n| Gem | D | 53.3 | 546 | recruiting.candidates, recruiting.jobs, recruiting.applications, recruiting.interviews | no | https://www.anchorterminal.com/tools/gem.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- The API Fair Use Policy, dated December 17, 2025, says the API must not be connected to any third-party AI or LLM tools for viewing or updating data, or used with MCP to export, import, update or delete data, without Bullhorn's explicit written permission (source: \u003chttps://bullhorn.github.io/api-fair-use-policy/\u003e)\n- The same policy lets Bullhorn approve, deny, suspend or terminate API access at its sole discretion and discontinue the APIs at any time\n- The integrator FAQ says customers will not be given an API key to pass to a vendor that has no contract with Bullhorn, and that connector or middleware companies may not build integrations (source: \u003chttps://www.bullhorn.com/bullhorn-api-access-faqs/\u003e)\n- The reference documents 69 operations under 21 groups (27 GET, 20 POST, 12 PUT, 10 DELETE), among them `/entity`, `/search`, `/query`, `/meta`, `/massUpdate`, `/resume/parseToCandidate` and `/event/subscription` (source: \u003chttps://bullhorn.github.io/rest-api-docs/\u003e)\n- The getting started guide shows `username`, `password` and `client_secret` as query parameters on the OAuth URLs, and the reference allows `BhRestToken` in the query string (source: \u003chttps://bullhorn.github.io/Getting-Started-with-REST/\u003e)\n- Each customer sits in a data centre, found with `GET /rest-services/loginInfo?username=`. A call to the wrong one returns a 307 redirect\n- The official MCP registry returned no server for a search on bullhorn, and no Bullhorn MCP server was found on the vendor's pages (source: \u003chttps://registry.modelcontextprotocol.io/v0/servers?search=bullhorn\u003e)\n- status.bullhorn.com listed 50 incidents from 12 July to 7 October 2026 across all products, seven marked major and two critical (source: \u003chttps://status.bullhorn.com/api/v2/incidents.json\u003e)\n\n## Compare\n\n- [Ashby vs Bullhorn](https://www.anchorterminal.com/compare/ashby-vs-bullhorn.md): C 61.3 vs D 46.7\n- [Bullhorn vs Gem](https://www.anchorterminal.com/compare/bullhorn-vs-gem.md): D 46.7 vs D 53.3\n- [Bullhorn vs Greenhouse](https://www.anchorterminal.com/compare/bullhorn-vs-greenhouse.md): D 46.7 vs B 64.8\n- [Bullhorn vs Lever](https://www.anchorterminal.com/compare/bullhorn-vs-lever.md): D 46.7 vs D 53.6\n- [Bullhorn vs Pinpoint](https://www.anchorterminal.com/compare/bullhorn-vs-pinpoint.md): D 46.7 vs C 61.2\n- [Bullhorn vs Recruitee](https://www.anchorterminal.com/compare/bullhorn-vs-recruitee.md): D 46.7 vs D 52.9\n- [Bullhorn vs SmartRecruiters](https://www.anchorterminal.com/compare/bullhorn-vs-smartrecruiters.md): D 46.7 vs C 60.4\n- [Bullhorn vs Workable](https://www.anchorterminal.com/compare/bullhorn-vs-workable.md): D 46.7 vs C 61.7\n- [Bullhorn vs Zoho Recruit](https://www.anchorterminal.com/compare/bullhorn-vs-zoho-recruit.md): D 46.7 vs C 59.8\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on bullhorn.com or one of its subdomains, or the README of github.com/bullhorn/rest-api-docs. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"bullhorn\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/bullhorn\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/bullhorn.svg\" alt=\"Bullhorn on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![Bullhorn on Anchor Terminal](https://www.anchorterminal.com/badges/bullhorn.svg)](https://www.anchorterminal.com/tools/bullhorn)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/bullhorn\"\u003eBullhorn on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say Bullhorn is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/bullhorn-dark.png\n- Light: https://www.anchorterminal.com/assets/share/bullhorn-light.png\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Recruiting \u0026 applicant tracking", "url": "https://www.anchorterminal.com/categories/recruiting" }, { "name": "Bullhorn", "url": "" } ], "description": "Applicant tracking and CRM software for staffing and recruitment agencies from Bullhorn, Inc. in Boston. Its REST API reads and writes candidates, job orders, submissions, placements and notes with OAuth 2.0, under credentials Bullhorn issues to customers and contracted partners.", "facts": [ "rank #644 of 722", "OAuth auth", "0 desk reviews" ], "h1": "Bullhorn", "image": "https://www.anchorterminal.com/assets/og/tools-bullhorn.png", "path": "/tools/bullhorn", "published": "2026-10-01", "section": "tools", "title": "Bullhorn review for AI agents, grade D (46.7/100) | Anchor Terminal", "toc": null, "updated": "2026-10-08", "url": "https://www.anchorterminal.com/tools/bullhorn" }, "tokens": { "markdown": 8250, "slim": 2080 }, "version": 1 }