{ "data": { "similar": [ { "grade": "C", "json": "https://www.anchorterminal.com/tools/ashby.json", "name": "Ashby", "score": 61.3, "shared": [ "recruiting.candidates", "recruiting.jobs", "recruiting.applications", "recruiting.interviews", "recruiting.offer-letters" ], "slug": "ashby" }, { "grade": "C", "json": "https://www.anchorterminal.com/tools/smartrecruiters.json", "name": "SmartRecruiters", "score": 60.4, "shared": [ "recruiting.candidates", "recruiting.jobs", "recruiting.applications", "recruiting.interviews", "recruiting.offer-letters" ], "slug": "smartrecruiters" }, { "grade": "C", "json": "https://www.anchorterminal.com/tools/zoho-recruit.json", "name": "Zoho Recruit", "score": 59.8, "shared": [ "recruiting.candidates", "recruiting.jobs", "recruiting.applications", "recruiting.interviews", "recruiting.offer-letters" ], "slug": "zoho-recruit" }, { "grade": "D", "json": "https://www.anchorterminal.com/tools/lever.json", "name": "Lever", "score": 53.6, "shared": [ "recruiting.candidates", "recruiting.jobs", "recruiting.applications", "recruiting.interviews", "recruiting.offer-letters" ], "slug": "lever" }, { "grade": "D", "json": "https://www.anchorterminal.com/tools/recruitee.json", "name": "Recruitee", "score": 52.9, "shared": [ "recruiting.candidates", "recruiting.jobs", "recruiting.applications", "recruiting.interviews", "recruiting.offer-letters" ], "slug": "recruitee" }, { "grade": "C", "json": "https://www.anchorterminal.com/tools/workable.json", "name": "Workable", "score": 61.7, "shared": [ "recruiting.candidates", "recruiting.jobs", "recruiting.applications", "recruiting.offer-letters" ], "slug": "workable" } ], "tool": { "slug": "greenhouse", "name": "Greenhouse", "vendor": "Greenhouse Software, Inc.", "vendorUrl": "https://www.greenhouse.com", "kind": "http-api", "category": "recruiting", "summary": "Applicant tracking system from Greenhouse Software in New York. The Harvest v3 REST API reads and writes jobs, candidates, applications, interviews, scorecards and offer records, and a hosted MCP server in open beta exposes a subset of it.", "url": "https://www.anchorterminal.com/tools/greenhouse", "markdownUrl": "https://www.anchorterminal.com/tools/greenhouse.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/greenhouse.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/greenhouse.json", "repo": "https://github.com/grnhse/greenhouse-api-docs", "license": "Proprietary service under Greenhouse's Master Subscription Agreement. The docs repository for the older APIs on GitHub is Apache-2.0", "transports": [ "http" ], "remoteUrl": "https://harvest.greenhouse.io/v3", "packages": [], "auth": "oauth", "authNotes": "Access is granted inside a paying customer's account. For a customer's own integration, a user with the developer permission creates Harvest V3 (OAuth) credentials under API Credentials, picks scopes, and exchanges the client ID and secret at https://auth.greenhouse.io/token for a Bearer token. An optional `sub` names the Greenhouse user the token works for, and all list endpoints need a Site Admin. Partners use the OAuth 2.0 authorisation code grant after signing a partnership agreement, with credentials and scope changes issued by partner support. The MCP server uses OAuth 2.0 with PKCE and dynamic client registration, per user.", "pricing": "paid", "pricingNotes": "No public prices. greenhouse.com/pricing names three tiers (Core, Plus and Pro) and says pricing is customised to hiring needs, through a demo or sales contact. No free tier or trial was found. A sandbox is a Pro-tier feature, so an agent can't start without a customer contract. The MCP article says access and pricing for the beta come from the account team, and the Audit Log API is a paid add-on (checked 2026-10-07).", "priceSummary": "Paid", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the Harvest v3 docs, the MCP articles or the pricing page (checked 2026-10-07).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-07" }, "docsUrl": "https://harvestdocs.greenhouse.io", "llmsTxt": "https://harvestdocs.greenhouse.io/llms.txt", "capabilities": [ "recruiting.candidates", "recruiting.jobs", "recruiting.applications", "recruiting.interviews", "recruiting.offer-letters" ], "tags": [ "hosted", "enterprise", "oauth", "mcp", "openapi", "llms-txt", "webhooks", "sales-led", "status-page", "bug-bounty", "soc2" ], "lastRelease": "2026-10-07", "graded": true, "anchor": { "graded": true, "score": 64.8, "grade": "B", "agentReady": false, "rank": 271, "ranked": true, "rankOf": 722, "categoryRank": 1, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 63, "maintenance": 65, "payments": 0, "reliability": 71, "schema": 79, "security": 85, "transparency": 79 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 71, "points": 14.2, "reason": "Read with the hosted rubric, for the Harvest v3 API. Statuspage at status.greenhouse.io with a Greenhouse Harvest API component and per-silo components (20). From 9 July to 7 October 2026 the page lists 14 incidents, three marked major. One was a partial disruption on Silo 1 on 5 August, opened at 02:18 UTC with a fix at 03:56 and closed at 13:29, covering scorecards, notes, emails and offer letters. The others were 26 minutes on Silo 201 on 2 September and 38 minutes of MyGreenhouse job search on 21 September. None names the Harvest API, so we scored between minor-only and one major (15). The v3 limit is a fixed 30-second window whose size arrives in `X-RateLimit-Limit`, with no number published beyond an example of 75 (8). 429 carries `Retry-After` and the docs give backoff guidance, but no idempotency keys were found for writes (10). The SLA commits to 99.5 per cent for Greenhouse Recruiting with service credits and does not name the API (8). Harvest v3 is generally available, while the MCP server is in open beta (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 79, "points": 12.84, "reason": "Every v3 reference page has a Markdown twin with an OpenAPI 3.1 definition for that endpoint. No single downloadable spec was found (20). llms.txt indexes 179 reference pages and the guides, all served as Markdown (10). Descriptions state purpose, required fields and limits, for example that stage moves are not handled by the update call and that `from_stage_id` guards against stale moves (16). Request bodies set `additionalProperties` to false with required fields, enums and length limits (13). Success examples are given, but reference pages list 401, 403 and 422 without bodies, and error bodies appear only in the guides (8). The path is versioned and the changelog had ten entries in 27 days, titled by commit hash with relative dates (12)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 63, "points": 10.24, "reason": "`per_page` runs from 1 to 500 and v3 no longer embeds child records in parents, but no field selection was found (15). Cursor pagination through the `Link` header, with filters for ids, parent ids, status, `created_at` and `updated_at` (20). Errors return a `message` and an `errors` array that names the fault, such as a cursor combined with other parameters, though reference pages don't show them (13). No idempotency keys found. Moving an application needs the current stage as a guard, and the MCP server blocks DELETE and confirms five actions. Its tool annotations couldn't be read without an account (8). Creating a candidate needs two fields, but no official SDKs were found (7)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 85, "points": 14.88, "reason": "OAuth 2.0 with a scope per endpoint, client credentials or the authorisation code grant, one-hour partner access tokens and secret rotation that keeps the old secret for up to a week. The MCP server adds PKCE and dynamic client registration (30). Read-only access is possible by scope, the MCP defaults to seven read-only scopes, blocks every DELETE and asks for confirmation on five actions. All list endpoints need a Site Admin as the authorising user (16). The MCP security FAQ covers prompt injection (structured tool calls only, permission-bound and rate-limited), with no guidance on treating candidate text in responses as untrusted (9). The Audit Log API records Harvest and MCP calls with user, client and arguments for thirty days, as a paid add-on (12). SOC 2 Type II, ISO 27001, 27701 and 42001, a HackerOne bug bounty and annual penetration tests. security.txt expired on 1 February 2026 (18)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 0, "points": 0, "reason": "Read with the hosted rubric. No x402, MPP or L402 (0). No public prices. The pricing page names Core, Plus and Pro and says pricing is customised (0). No free tier or trial found, and the sandbox is a Pro-tier feature (0). Credentials are created by a person inside a customer account, and the MCP server's dynamic client registration still needs a paying organisation and a user's consent in a browser (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 65, "points": 5.69, "reason": "The Harvest v3 changelog showed an entry about four hours old when read on 7 October 2026 (30). Ten entries in the previous 27 days (20). Closed service with a changelog, monthly release notes that list API changes (the September 2026 notes add the `interview_media` endpoint) and a partner support address. Changelog entries are titled by commit hash, which makes them hard to follow (10). No official SDKs found, and the MCP server is not in the official MCP registry, where a search returned only a third-party scraper (0). No package to assess. The docs repository for the older APIs had commits up to 10 September 2026 (5)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 79, "points": 6.91, "note": "editorial 67, provenance 90", "reason": "Closed service with a public Master Subscription Agreement last updated 1 February 2026, and an Apache-2.0 docs repository (15). The agreement queues customer data for deletion 90 days after termination, a DPA is published, and the MCP FAQ says the server stores no customer data. The privacy policy of 28 May 2026 says personal information may be used to develop and train AI models and gives no retention periods (20). The removal of Harvest v1 and v2 was announced for 31 August 2026 with migration guides, but five weeks later the banner still read as future and v1 still answered. No written deprecation policy with a notice period was found (12). A public sub-processor list with purposes and locations, AWS hosting in the United States, Germany and Australia, and the MCP server stated as US-only (20)." } ], "assessment": { "date": "2026-10-07", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "`per_page` runs from 1 to 500 and v3 no longer embeds child records in parents, but no field selection was found (15). Cursor pagination through the `Link` header, with filters for ids, parent ids, status, `created_at` and `updated_at` (20). Errors return a `message` and an `errors` array that names the fault, such as a cursor combined with other parameters, though reference pages don't show them (13). No idempotency keys found. Moving an application needs the current stage as a guard, and the MCP server blocks DELETE and confirms five actions. Its tool annotations couldn't be read without an account (8). Creating a candidate needs two fields, but no official SDKs were found (7).", "maintenance": "The Harvest v3 changelog showed an entry about four hours old when read on 7 October 2026 (30). Ten entries in the previous 27 days (20). Closed service with a changelog, monthly release notes that list API changes (the September 2026 notes add the `interview_media` endpoint) and a partner support address. Changelog entries are titled by commit hash, which makes them hard to follow (10). No official SDKs found, and the MCP server is not in the official MCP registry, where a search returned only a third-party scraper (0). No package to assess. The docs repository for the older APIs had commits up to 10 September 2026 (5).", "payments": "Read with the hosted rubric. No x402, MPP or L402 (0). No public prices. The pricing page names Core, Plus and Pro and says pricing is customised (0). No free tier or trial found, and the sandbox is a Pro-tier feature (0). Credentials are created by a person inside a customer account, and the MCP server's dynamic client registration still needs a paying organisation and a user's consent in a browser (0).", "reliability": "Read with the hosted rubric, for the Harvest v3 API. Statuspage at status.greenhouse.io with a Greenhouse Harvest API component and per-silo components (20). From 9 July to 7 October 2026 the page lists 14 incidents, three marked major. One was a partial disruption on Silo 1 on 5 August, opened at 02:18 UTC with a fix at 03:56 and closed at 13:29, covering scorecards, notes, emails and offer letters. The others were 26 minutes on Silo 201 on 2 September and 38 minutes of MyGreenhouse job search on 21 September. None names the Harvest API, so we scored between minor-only and one major (15). The v3 limit is a fixed 30-second window whose size arrives in `X-RateLimit-Limit`, with no number published beyond an example of 75 (8). 429 carries `Retry-After` and the docs give backoff guidance, but no idempotency keys were found for writes (10). The SLA commits to 99.5 per cent for Greenhouse Recruiting with service credits and does not name the API (8). Harvest v3 is generally available, while the MCP server is in open beta (10).", "schema": "Every v3 reference page has a Markdown twin with an OpenAPI 3.1 definition for that endpoint. No single downloadable spec was found (20). llms.txt indexes 179 reference pages and the guides, all served as Markdown (10). Descriptions state purpose, required fields and limits, for example that stage moves are not handled by the update call and that `from_stage_id` guards against stale moves (16). Request bodies set `additionalProperties` to false with required fields, enums and length limits (13). Success examples are given, but reference pages list 401, 403 and 422 without bodies, and error bodies appear only in the guides (8). The path is versioned and the changelog had ten entries in 27 days, titled by commit hash with relative dates (12).", "security": "OAuth 2.0 with a scope per endpoint, client credentials or the authorisation code grant, one-hour partner access tokens and secret rotation that keeps the old secret for up to a week. The MCP server adds PKCE and dynamic client registration (30). Read-only access is possible by scope, the MCP defaults to seven read-only scopes, blocks every DELETE and asks for confirmation on five actions. All list endpoints need a Site Admin as the authorising user (16). The MCP security FAQ covers prompt injection (structured tool calls only, permission-bound and rate-limited), with no guidance on treating candidate text in responses as untrusted (9). The Audit Log API records Harvest and MCP calls with user, client and arguments for thirty days, as a paid add-on (12). SOC 2 Type II, ISO 27001, 27701 and 42001, a HackerOne bug bounty and annual penetration tests. security.txt expired on 1 February 2026 (18).", "transparency": "Closed service with a public Master Subscription Agreement last updated 1 February 2026, and an Apache-2.0 docs repository (15). The agreement queues customer data for deletion 90 days after termination, a DPA is published, and the MCP FAQ says the server stores no customer data. The privacy policy of 28 May 2026 says personal information may be used to develop and train AI models and gives no retention periods (20). The removal of Harvest v1 and v2 was announced for 31 August 2026 with migration guides, but five weeks later the banner still read as future and v1 still answered. No written deprecation policy with a notice period was found (12). A public sub-processor list with purposes and locations, AWS hosting in the United States, Germany and Australia, and the MCP server stated as US-only (20)." }, "sources": [ { "what": "Harvest v3 docs index (llms.txt)", "url": "https://harvestdocs.greenhouse.io/llms.txt", "seen": "2026-10-07" }, { "what": "Harvest v3 authentication guide", "url": "https://harvestdocs.greenhouse.io/docs/authentication.md", "seen": "2026-10-07" }, { "what": "Harvest v3 rate limiting guide", "url": "https://harvestdocs.greenhouse.io/docs/api-rate-limiting.md", "seen": "2026-10-07" }, { "what": "Harvest v3 pagination guide", "url": "https://harvestdocs.greenhouse.io/docs/pagination.md", "seen": "2026-10-07" }, { "what": "Partner OAuth guide", "url": "https://harvestdocs.greenhouse.io/docs/harvest-partner-oauth.md", "seen": "2026-10-07" }, { "what": "Create candidate reference with OpenAPI definition", "url": "https://harvestdocs.greenhouse.io/reference/post_v3-candidates.md", "seen": "2026-10-07" }, { "what": "Harvest v3 changelog", "url": "https://harvestdocs.greenhouse.io/changelog", "seen": "2026-10-07" }, { "what": "Harvest v1 and v2 docs with deprecation banner", "url": "https://docs.greenhouse.io/harvest.html", "seen": "2026-10-07" }, { "what": "status incidents", "url": "https://status.greenhouse.io/api/v2/incidents.json", "seen": "2026-10-07" }, { "what": "Greenhouse MCP overview", "url": "https://support.greenhouse.io/hc/en-us/articles/52090956642075-Greenhouse-MCP", "seen": "2026-10-07" }, { "what": "Greenhouse MCP setup", "url": "https://support.greenhouse.io/hc/en-us/articles/52096319906971-Set-up-Greenhouse-MCP-with-supported-AI-tools", "seen": "2026-10-07" }, { "what": "Greenhouse MCP security FAQ", "url": "https://support.greenhouse.io/hc/en-us/articles/53944054829083-Greenhouse-MCP-security-FAQ", "seen": "2026-10-07" }, { "what": "Release notes, September 2026", "url": "https://support.greenhouse.io/hc/en-us/articles/56448809129755-Release-Notes-September-2026", "seen": "2026-10-07" }, { "what": "pricing", "url": "https://www.greenhouse.com/pricing", "seen": "2026-10-07" }, { "what": "Master Subscription Agreement", "url": "https://www.greenhouse.com/master-subscription-agreement", "seen": "2026-10-07" }, { "what": "Service Level Agreement", "url": "https://www.greenhouse.com/service-level-agreement", "seen": "2026-10-07" }, { "what": "privacy policy", "url": "https://www.greenhouse.com/privacy-policy", "seen": "2026-10-07" }, { "what": "sub-processors", "url": "https://www.greenhouse.com/subprocessors-in-use", "seen": "2026-10-07" }, { "what": "trust centre", "url": "https://trust.greenhouse.com/", "seen": "2026-10-07" }, { "what": "security.txt", "url": "https://www.greenhouse.com/.well-known/security.txt", "seen": "2026-10-07" }, { "what": "docs repository for audit log and webhooks", "url": "https://github.com/grnhse/greenhouse-api-docs", "seen": "2026-10-07" }, { "what": "official MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=greenhouse", "seen": "2026-10-07" } ], "openQuestions": [ "unchecked: the numeric Harvest v3 rate limit. The guide gives a 30-second window and an example header of 75 but no fixed figure", "unchecked: the MCP server's tool list, count, input schemas and annotations, which need an authorised customer account", "unchecked: whether Harvest v1 and v2 still serve data after the announced removal date of 31 August 2026. An unauthenticated request to /v1/candidates returned 401 on 7 October 2026", "unchecked: most Harvest v3 changelog entry texts and the migration guides, because harvestdocs.greenhouse.io answered several requests with a bot check", "unchecked: the Data Processing Addendum text and the AI terms the Master Subscription Agreement refers to", "unchecked: GitHub stars for grnhse/greenhouse-api-docs and the registration date of greenhouse.io", "Not found in the reviewed documentation: idempotency keys, field selection, official SDKs, a single OpenAPI file, and a deprecation policy with a notice period" ] }, "negative": 0, "verdict": "Harvest v3 pairs per-endpoint OAuth scopes with Markdown docs that embed an OpenAPI 3.1 definition for each call, and the beta MCP server blocks every DELETE. Access needs a paying customer account, with no public price, trial or self-serve sandbox, and no numeric rate limit or idempotency key was found in the reviewed documentation.", "bestFor": "An agent working inside a company that already runs hiring on Greenhouse and needs to read pipelines, move applications, schedule interviews or draft offer records under scoped OAuth.", "strengths": [ "OAuth 2.0 with per-endpoint scopes such as `harvest:applications:move`, and secret rotation that keeps the old secret for up to a week", "Every Harvest v3 reference page has a Markdown twin with an OpenAPI 3.1 definition, indexed by llms.txt", "The MCP server blocks every DELETE endpoint and asks for human confirmation on five actions, including reject, hire and merge", "Cursor pagination with `per_page` up to 500 and `created_at` or `updated_at` filters on list endpoints", "Audit Log API records `harvest_access`, `mcp_access` and `mcp_tool_call` events with the OAuth client and user" ], "weaknesses": [ "No public price, free tier or trial. Pricing is customised through sales, and the sandbox is a Pro-tier feature", "The v3 rate limit is a 30-second window with no published number. The limit arrives in `X-RateLimit-Limit`", "No idempotency keys found, and reference pages list 401, 403 and 422 without error body examples", "All list endpoints need a Site Admin as the authorising user, per the authentication guide", "No official SDKs found, and the MCP server is in open beta and absent from the official MCP registry" ], "agentNotes": [ "Request a token from https://auth.greenhouse.io/token with client credentials, then send it as a Bearer token to https://harvest.greenhouse.io/v3. Tokens expire, so repeat on 401", "Put filters and `per_page` on the first list request only. A `cursor` must be the only query parameter, or the call returns 422", "Send the current stage as `from_stage_id` when moving an application. It guards against stale moves. Other writes have no idempotency key, so check before retrying", "Read `X-RateLimit-Remaining` on every response and wait for `Retry-After` on 429. The window is 30 seconds", "Expect empty list results or 403 unless the token's user is a Site Admin with the needed permissions" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 64.8 } ], "editorialScores": { "ergonomics": 63, "maintenance": 65, "payments": 0, "reliability": 71, "schema": 79, "security": 85, "transparency": 67 }, "provenanceScore": 90 }, "connect": { "http": "curl --location 'https://harvest.greenhouse.io/v3/job_posts' \\\n --header 'Authorization: Bearer \u003c\u003cACCESS_TOKEN\u003e\u003e'", "claudeCode": "claude mcp add greenhouse --transport http https://mcp.us.greenhouse.io/mcp" }, "letme": { "capability": "https://letme.dev/recruiting.candidates", "tool": "https://letme.dev/greenhouse" }, "notable": [ "Harvest v3 lists 179 reference pages in llms.txt (74 GET, 54 POST, 26 PATCH, 23 DELETE, 2 PUT), each with a Markdown twin holding an OpenAPI 3.1 definition (https://harvestdocs.greenhouse.io/llms.txt)", "The older Harvest docs carry a banner saying v1 and v2 are deprecated and will be removed on August 31, 2026. On 7 October 2026 the banner was unchanged and /v1/candidates still answered 401 to an unauthenticated request (https://docs.greenhouse.io/harvest.html)", "Greenhouse MCP is a remote server at https://mcp.greenhouse.io/mcp in open beta for Core, Plus and Pro tiers, using OAuth 2.0 with PKCE and dynamic client registration (https://support.greenhouse.io/hc/en-us/articles/52096319906971-Set-up-Greenhouse-MCP-with-supported-AI-tools)", "The MCP server blocks every DELETE endpoint and requires human confirmation before rejecting, hiring, merging candidates, anonymising a candidate or bulk-revoking permissions (https://support.greenhouse.io/hc/en-us/articles/53944054829083-Greenhouse-MCP-security-FAQ)", "Without admin configuration the MCP server applies seven read-only default scopes (list applications, candidates, job interview stages, jobs, rejection reasons, scorecards and users)", "Partner integrations need a signed partnership agreement, and credentials and scope changes come from partner support by email (https://harvestdocs.greenhouse.io/docs/harvest-partner-oauth)", "The SLA commits to 99.5 per cent for Greenhouse Recruiting with credits of one day of fees, last updated 1 February 2026. It does not name the API (https://www.greenhouse.com/service-level-agreement)", "Webhooks are signed with HMAC SHA-256 and retried up to 7 times over about 15 hours (https://developers.greenhouse.io/webhooks.html)" ], "area": "business", "details": [ { "label": "Surface graded", "value": "Harvest v3 REST API at https://harvest.greenhouse.io/v3, generally available. The Greenhouse MCP server is described from its help centre articles and is in open beta" }, { "label": "API", "value": "179 reference pages (74 GET, 54 POST, 26 PATCH, 23 DELETE, 2 PUT) covering applications, candidates, jobs, job posts, interviews, scorecards, offer records, approvals, users and custom fields. OpenAPI 3.1 per endpoint, info version v3" }, { "label": "Credentials", "value": "OAuth 2.0 client credentials for a customer's own integration, created under API Credentials in Greenhouse with chosen scopes. OAuth 2.0 authorisation code grant for partners (access token 1 hour, refresh token 14 days). Scopes per endpoint, such as `harvest:candidates:list`" }, { "label": "Rate limits", "value": "Fixed 30-second window, with the limit returned in `X-RateLimit-Limit` (the docs' example shows 75). Token requests use a separate 60-second window. 429 carries `Retry-After`. Audit Log API 50 requests per 10 seconds and 3 paginated requests per 30 seconds" }, { "label": "Pagination", "value": "Cursor in the `Link` header (`rel=\"next\"` only), `per_page` default 100, maximum 500, ordered by id descending" }, { "label": "Errors", "value": "401, 403, 422 and 429 with a JSON body of `message` and an `errors` array, shown in the guides. Reference pages list status codes without bodies" }, { "label": "MCP server", "value": "https://mcp.greenhouse.io/mcp (the Claude Code and ChatGPT steps use https://mcp.us.greenhouse.io/mcp), hosted in the US. A subset of Harvest v3 as tools. OAuth 2.0 with PKCE and dynamic client registration, redirect URLs checked against an allowlist. Named tools are Claude, ChatGPT, Google Antigravity, Glean, Copilot Studio, Amazon Q and Grok" }, { "label": "MCP controls", "value": "Site Admins set the scope ceiling under Dev Centre \u003e MCP Access. Seven read-only scopes by default. DELETE blocked. Five actions need human confirmation. Access tokens last one hour, refresh tokens until 14 days of inactivity" }, { "label": "Audit", "value": "Audit Log API (a paid add-on) keeps thirty days of events, with types `harvest_access`, `mcp_access` and `mcp_tool_call`, the OAuth client, the authorising user and redacted arguments" }, { "label": "Webhooks", "value": "Recruiting webhooks signed with HMAC SHA-256 in a `Signature` header, up to 7 attempts over about 15 hours" }, { "label": "Sandbox", "value": "A sandbox environment is a Pro-tier feature per the help centre. No self-serve developer account found" }, { "label": "Certifications", "value": "SOC 1 Type II, SOC 2 Type II, ISO 27001:2022, ISO 27701:2019 and ISO 42001:2023 per greenhouse.com/security and trust.greenhouse.com. Bug bounty on HackerOne, annual third-party penetration tests" }, { "label": "Status", "value": "status.greenhouse.io on Statuspage, with a Greenhouse Harvest API component and per-silo components" }, { "label": "Sub-processors", "value": "Public list with purposes and locations at greenhouse.com/subprocessors-in-use. AWS hosting in the United States, Germany and Australia" } ], "provenance": { "legalEntity": "Greenhouse Software, Inc.", "domain": "greenhouse.com", "domainRegistered": "1997-07-30", "endpointOnVendorDomain": true, "terms": "https://www.greenhouse.com/master-subscription-agreement", "privacy": "https://www.greenhouse.com/privacy-policy", "statusPage": "https://status.greenhouse.io", "changelog": "https://harvestdocs.greenhouse.io/changelog", "securityTxt": "expired", "checked": "2026-10-07", "notes": [ "The Master Subscription Agreement, last updated 1 February 2026, names Greenhouse Software, Inc. and is governed by New York law.", "The API answers at harvest.greenhouse.io, token requests at auth.greenhouse.io and the MCP server at mcp.greenhouse.io. Docs and status also sit on greenhouse.io, which the vendor's pages link to. We did not look up the registration of greenhouse.io.", "https://www.greenhouse.com/.well-known/security.txt lists security@greenhouse.io and a HackerOne policy link, with an Expires line of 2026-02-01, so it had expired when read.", "RDAP for greenhouse.com gives a registration date of 1997-07-30.", "The privacy policy is dated May 28, 2026. The SLA at greenhouse.com/service-level-agreement was last updated 1 February 2026." ], "score": 90, "checks": [ { "check": "Legal entity named", "value": "Greenhouse Software, Inc.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "greenhouse.com, registered 1997-07-30 (29 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "harvest.greenhouse.io", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 6 of the 7 things a reader expects, and has 1 clause that costs points", "points": 7.1, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 8 of the 8 things a reader expects, and has 1 clause that costs points", "points": 8, "max": 10, "state": "part" }, { "check": "Status page", "value": "status.greenhouse.io", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "published but past its Expires date", "points": 5, "max": 10, "state": "part" } ], "policies": [ { "kind": "terms", "url": "https://www.greenhouse.com/master-subscription-agreement", "state": "read", "readAt": "2026-10-08", "statedDate": "2026-02-01", "words": 7081, "points": 7.1, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated: February 1, 2026", "says": "Last updated 2026-02-01" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "The Agreement is governed by and construed under the laws of the State of New York without reference to conflict of laws principles.", "says": "The law of the State of New York" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "…PERMISSIBLE BY LAW, WITHOUT ANY REPRESENTATION OR WARRANTY, WHETHER EXPRESS, IMPLIED OR STATUTORY, AND IN NO EVENT SHALL GREENHOUSE’S LIABILITY UNDER OR IN CONNECTION WITH A BETA PROGRAM EXCEED USD $1,000.", "says": "Capped at USD $1,000" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "…law or third party rights and, notwithstanding anything to the contrary in this MSA, Greenhouse may, without liability to Customer: (I) suspend access to the Greenhouse Services for the duration of any such violation, or (II) immediately terminate this Agreement upon reasonable suspicion that the Greenhouse Services a…" }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": false }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "Customer will not, and will not permit any third party to: (i) make the Greenhouse Services available to any third party (except any Affiliate or Customer Personnel), (ii) sell, resell, rent, lend, sublicense, assign, distribute, publish, transfer, lease or otherwise use the Greenhouse Services for the benefit of thir…" }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": true, "quote": "“SLA” means Greenhouse’s Service Level Agreement, which is located at https://www.greenhouse.io/service-level-agreement." } ], "toKnow": [ { "key": "terms.benchmark", "label": "Restricts benchmarking or competitive use", "found": true, "quote": "(x) use or view the Greenhouse Services for the purposes of developing, directly or indirectly, a product or service competitive to the Greenhouse Services.", "costsPoints": true } ], "notes": [ { "date": "2026-10-08", "text": "API access by a third party acting as the customer's agent or at its instruction counts as the customer's own use for usage limits, rate limits and fees.", "quote": "For the avoidance of doubt, use of or access to the Greenhouse API by a third party that is acting as agent of or at the instruction of Customer shall be considered Customer's use for the purposes of this Section 4(d)." }, { "date": "2026-10-08", "text": "Subscriptions renew automatically for one year unless either party gives written notice of cancellation at least 30 days before the next renewal term.", "quote": "subscriptions for each Greenhouse Service will automatically renew for an additional one (1) year period (each, a “Renewal Term”) unless either Party provides written notice of cancellation at least thirty (30) days prior to commencement of the next renewal term." }, { "date": "2026-10-08", "text": "Customer Data is queued for deletion 90 days after the agreement expires or is terminated.", "quote": "All Customer Data will be queued for deletion ninety (90) days following expiration or termination of this Agreement for any reason." } ] }, { "kind": "privacy", "url": "https://www.greenhouse.com/privacy-policy", "state": "read", "readAt": "2026-10-08", "statedDate": "2026-05-28", "words": 4516, "points": 8, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Date last updated: May 28, 2026", "says": "Last updated 2026-05-28" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "This Privacy Policy explains who we are, how we collect, share, and use personal information about you, and how you can exercise your privacy rights." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "…or anonymize it or, if this is not possible (for example, because your Personal Information has been stored in backup archives), then we will securely store your Personal Information and isolate it from any further processing until deletion is possible." }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "Greenhouse’s privacy commitments to our customers are governed by a separate customer agreement that authorizes us to collect, process, and store Personal Information on their behalf, as a processor under the EU GDPR and the UK GDPR, and a service provider under the CCPA." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "Please note that Greenhouse is not a data broker, does not sell or share personal data of job candidates or individuals with whom it does not have a direct relationship, and is not subject to data broker laws or registries.", "says": "Says it does not sell personal data" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "This Privacy Policy explains who we are, how we collect, share, and use personal information about you, and how you can exercise your privacy rights." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "If you have questions about or need further information concerning the legal basis on which we collect and use your Personal Information, please contact us at privacy@greenhouse.io.", "says": "privacy@greenhouse.io" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.", "says": "Relies on the Data Privacy Framework" } ], "toKnow": [ { "key": "training", "label": "Says it may use customer content to train or improve models, and no opt-out was found", "found": true, "quote": "As part of this processing, we may use your Personal Information to improve, develop, and provide products and services, develop and train artificial intelligence (AI) models, develop, provide and personalize our services, and gain insights with the help of AI, automated systems and inferences, so that our services ca…", "costsPoints": true }, { "key": "privacy.sells", "label": "Says it sells personal data or shares it for advertising", "found": true, "quote": "We may also share information about our users with these companies to facilitate interest-based advertising to those or similar users on other online platforms." } ], "notes": [ { "date": "2026-10-08", "text": "The section that holds the AI model training sentence applies only to users of the MyGreenhouse service.", "quote": "This “MyGreenhouse” section is applicable only to users of the MyGreenhouse service, which requires authentication and agreement with the MyGreenhouse User Agreement." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/greenhouse.json", "live": { "slug": "greenhouse", "probe": { "target": "https://harvest.greenhouse.io/v3", "method": "get", "lastAt": "2026-10-08T19:52:51.938306734Z", "lastOk": true, "lastStatus": 401, "lastMs": 216, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 290, "p95ms24h": 363, "samples24h": 50, "samples30d": 50, "days": [ { "date": "2026-10-08", "probes": 50, "ok": 50 } ] }, "vendorStatus": { "page": "https://status.greenhouse.io", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-08T19:50:44.073565394Z" }, "githubStars": 141, "securityTxt": { "url": "https://greenhouse.com/.well-known/security.txt", "state": "expired", "expires": "2026-02-01T04:59:00.000Z", "checkedAt": "2026-10-08T15:38:47.213641717Z" }, "pages": [ { "url": "https://harvestdocs.greenhouse.io/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-10-08T18:20:48.376020909Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "de13976c1b65" }, { "url": "https://www.greenhouse.com/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-10-08T18:28:08.264000017Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "2ae182cde941" }, { "url": "https://www.greenhouse.com/master-subscription-agreement", "kind": "terms", "status": 200, "checkedAt": "2026-10-08T18:28:06.187813013Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "6de5c365ccc0" } ], "updatedAt": "2026-10-08T19:52:51.938306734Z" } }, "verify": { "accepts": "a page on greenhouse.com or one of its subdomains, or the README of github.com/grnhse/greenhouse-api-docs", "badgeUrl": "https://www.anchorterminal.com/badges/greenhouse.svg", "body": { "slug": "greenhouse", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/greenhouse", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/greenhouse\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/greenhouse.svg\" alt=\"Greenhouse on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![Greenhouse on Anchor Terminal](https://www.anchorterminal.com/badges/greenhouse.svg)](https://www.anchorterminal.com/tools/greenhouse)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/greenhouse\"\u003eGreenhouse on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/greenhouse", "json": "https://www.anchorterminal.com/tools/greenhouse.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/greenhouse.md", "slim": "https://www.anchorterminal.com/tools/greenhouse.min.md" }, "markdown": "## Overview\n\n**Grade B · 64.8/100 · rank #271 of 722 · #1 in Recruiting \u0026 applicant tracking · not agent-ready · confidence medium**\n\n\n## Assessment\n\nHarvest v3 pairs per-endpoint OAuth scopes with Markdown docs that embed an OpenAPI 3.1 definition for each call, and the beta MCP server blocks every DELETE. Access needs a paying customer account, with no public price, trial or self-serve sandbox, and no numeric rate limit or idempotency key was found in the reviewed documentation.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | Greenhouse Software, Inc. (https://www.greenhouse.com) |\n| Kind | HTTP API |\n| Category | Recruiting \u0026 applicant tracking (https://www.anchorterminal.com/categories/recruiting) |\n| Transport | HTTP |\n| Endpoint | `https://harvest.greenhouse.io/v3` |\n| Auth | OAuth · Access is granted inside a paying customer's account. For a customer's own integration, a user with the developer permission creates Harvest V3 (OAuth) credentials under API Credentials, picks scopes, and exchanges the client ID and secret at https://auth.greenhouse.io/token for a Bearer token. An optional `sub` names the Greenhouse user the token works for, and all list endpoints need a Site Admin. Partners use the OAuth 2.0 authorisation code grant after signing a partnership agreement, with credentials and scope changes issued by partner support. The MCP server uses OAuth 2.0 with PKCE and dynamic client registration, per user. |\n| Pricing | Paid (Paid) · No public prices. greenhouse.com/pricing names three tiers (Core, Plus and Pro) and says pricing is customised to hiring needs, through a demo or sales contact. No free tier or trial was found. A sandbox is a Pro-tier feature, so an agent can't start without a customer contract. The MCP article says access and pricing for the beta come from the account team, and the Audit Log API is a paid add-on (checked 2026-10-07). |\n| x402 | No · No x402, MPP or L402 in the Harvest v3 docs, the MCP articles or the pricing page (checked 2026-10-07). |\n| Licence | Proprietary service under Greenhouse's Master Subscription Agreement. The docs repository for the older APIs on GitHub is Apache-2.0 |\n| Source | https://github.com/grnhse/greenhouse-api-docs |\n| Docs | https://harvestdocs.greenhouse.io |\n| llms.txt | https://harvestdocs.greenhouse.io/llms.txt |\n| Last release | 2026-10-07 |\n| Surface graded | Harvest v3 REST API at https://harvest.greenhouse.io/v3, generally available. The Greenhouse MCP server is described from its help centre articles and is in open beta |\n| API | 179 reference pages (74 GET, 54 POST, 26 PATCH, 23 DELETE, 2 PUT) covering applications, candidates, jobs, job posts, interviews, scorecards, offer records, approvals, users and custom fields. OpenAPI 3.1 per endpoint, info version v3 |\n| Credentials | OAuth 2.0 client credentials for a customer's own integration, created under API Credentials in Greenhouse with chosen scopes. OAuth 2.0 authorisation code grant for partners (access token 1 hour, refresh token 14 days). Scopes per endpoint, such as `harvest:candidates:list` |\n| Rate limits | Fixed 30-second window, with the limit returned in `X-RateLimit-Limit` (the docs' example shows 75). Token requests use a separate 60-second window. 429 carries `Retry-After`. Audit Log API 50 requests per 10 seconds and 3 paginated requests per 30 seconds |\n| Pagination | Cursor in the `Link` header (`rel=\"next\"` only), `per_page` default 100, maximum 500, ordered by id descending |\n| Errors | 401, 403, 422 and 429 with a JSON body of `message` and an `errors` array, shown in the guides. Reference pages list status codes without bodies |\n| MCP server | https://mcp.greenhouse.io/mcp (the Claude Code and ChatGPT steps use https://mcp.us.greenhouse.io/mcp), hosted in the US. A subset of Harvest v3 as tools. OAuth 2.0 with PKCE and dynamic client registration, redirect URLs checked against an allowlist. Named tools are Claude, ChatGPT, Google Antigravity, Glean, Copilot Studio, Amazon Q and Grok |\n| MCP controls | Site Admins set the scope ceiling under Dev Centre \u003e MCP Access. Seven read-only scopes by default. DELETE blocked. Five actions need human confirmation. Access tokens last one hour, refresh tokens until 14 days of inactivity |\n| Audit | Audit Log API (a paid add-on) keeps thirty days of events, with types `harvest_access`, `mcp_access` and `mcp_tool_call`, the OAuth client, the authorising user and redacted arguments |\n| Webhooks | Recruiting webhooks signed with HMAC SHA-256 in a `Signature` header, up to 7 attempts over about 15 hours |\n| Sandbox | A sandbox environment is a Pro-tier feature per the help centre. No self-serve developer account found |\n| Certifications | SOC 1 Type II, SOC 2 Type II, ISO 27001:2022, ISO 27701:2019 and ISO 42001:2023 per greenhouse.com/security and trust.greenhouse.com. Bug bounty on HackerOne, annual third-party penetration tests |\n| Status | status.greenhouse.io on Statuspage, with a Greenhouse Harvest API component and per-silo components |\n| Sub-processors | Public list with purposes and locations at greenhouse.com/subprocessors-in-use. AWS hosting in the United States, Germany and Australia |\n| Capabilities | recruiting.candidates, recruiting.jobs, recruiting.applications, recruiting.interviews, recruiting.offer-letters |\n| Tags | hosted, enterprise, oauth, mcp, openapi, llms-txt, webhooks, sales-led, status-page, bug-bounty, soc2 |\n| JSON | https://www.anchorterminal.com/api/v1/tools/greenhouse.json |\n\n## Score breakdown (methodology v0.4, October 2026 research run)\n\nAssessed 2026-10-07 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 71 | 14.2 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 79 | 12.8 |\n| Agent ergonomics | 13% | 16.2 | 63 | 10.2 |\n| Security \u0026 auth | 14% | 17.5 | 85 | 14.9 |\n| Payments \u0026 pricing | 10% | 12.5 | 0 | 0.0 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 65 | 5.7 |\n| Transparency \u0026 trust (editorial 67, provenance 90) | 7% | 8.8 | 79 | 6.9 |\n| Negative events | up to −15 | up to −15 | none recorded | 0 |\n| **Total** | | | | **64.8 → B** |\n\n### Why each score\n\n- Reliability 71: Read with the hosted rubric, for the Harvest v3 API. Statuspage at status.greenhouse.io with a Greenhouse Harvest API component and per-silo components (20). From 9 July to 7 October 2026 the page lists 14 incidents, three marked major. One was a partial disruption on Silo 1 on 5 August, opened at 02:18 UTC with a fix at 03:56 and closed at 13:29, covering scorecards, notes, emails and offer letters. The others were 26 minutes on Silo 201 on 2 September and 38 minutes of MyGreenhouse job search on 21 September. None names the Harvest API, so we scored between minor-only and one major (15). The v3 limit is a fixed 30-second window whose size arrives in `X-RateLimit-Limit`, with no number published beyond an example of 75 (8). 429 carries `Retry-After` and the docs give backoff guidance, but no idempotency keys were found for writes (10). The SLA commits to 99.5 per cent for Greenhouse Recruiting with service credits and does not name the API (8). Harvest v3 is generally available, while the MCP server is in open beta (10).\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 79: Every v3 reference page has a Markdown twin with an OpenAPI 3.1 definition for that endpoint. No single downloadable spec was found (20). llms.txt indexes 179 reference pages and the guides, all served as Markdown (10). Descriptions state purpose, required fields and limits, for example that stage moves are not handled by the update call and that `from_stage_id` guards against stale moves (16). Request bodies set `additionalProperties` to false with required fields, enums and length limits (13). Success examples are given, but reference pages list 401, 403 and 422 without bodies, and error bodies appear only in the guides (8). The path is versioned and the changelog had ten entries in 27 days, titled by commit hash with relative dates (12).\n- Agent ergonomics 63: `per_page` runs from 1 to 500 and v3 no longer embeds child records in parents, but no field selection was found (15). Cursor pagination through the `Link` header, with filters for ids, parent ids, status, `created_at` and `updated_at` (20). Errors return a `message` and an `errors` array that names the fault, such as a cursor combined with other parameters, though reference pages don't show them (13). No idempotency keys found. Moving an application needs the current stage as a guard, and the MCP server blocks DELETE and confirms five actions. Its tool annotations couldn't be read without an account (8). Creating a candidate needs two fields, but no official SDKs were found (7).\n- Security \u0026 auth 85: OAuth 2.0 with a scope per endpoint, client credentials or the authorisation code grant, one-hour partner access tokens and secret rotation that keeps the old secret for up to a week. The MCP server adds PKCE and dynamic client registration (30). Read-only access is possible by scope, the MCP defaults to seven read-only scopes, blocks every DELETE and asks for confirmation on five actions. All list endpoints need a Site Admin as the authorising user (16). The MCP security FAQ covers prompt injection (structured tool calls only, permission-bound and rate-limited), with no guidance on treating candidate text in responses as untrusted (9). The Audit Log API records Harvest and MCP calls with user, client and arguments for thirty days, as a paid add-on (12). SOC 2 Type II, ISO 27001, 27701 and 42001, a HackerOne bug bounty and annual penetration tests. security.txt expired on 1 February 2026 (18).\n- Payments \u0026 pricing 0: Read with the hosted rubric. No x402, MPP or L402 (0). No public prices. The pricing page names Core, Plus and Pro and says pricing is customised (0). No free tier or trial found, and the sandbox is a Pro-tier feature (0). Credentials are created by a person inside a customer account, and the MCP server's dynamic client registration still needs a paying organisation and a user's consent in a browser (0).\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 65: The Harvest v3 changelog showed an entry about four hours old when read on 7 October 2026 (30). Ten entries in the previous 27 days (20). Closed service with a changelog, monthly release notes that list API changes (the September 2026 notes add the `interview_media` endpoint) and a partner support address. Changelog entries are titled by commit hash, which makes them hard to follow (10). No official SDKs found, and the MCP server is not in the official MCP registry, where a search returned only a third-party scraper (0). No package to assess. The docs repository for the older APIs had commits up to 10 September 2026 (5).\n- Transparency \u0026 trust 79: Closed service with a public Master Subscription Agreement last updated 1 February 2026, and an Apache-2.0 docs repository (15). The agreement queues customer data for deletion 90 days after termination, a DPA is published, and the MCP FAQ says the server stores no customer data. The privacy policy of 28 May 2026 says personal information may be used to develop and train AI models and gives no retention periods (20). The removal of Harvest v1 and v2 was announced for 31 August 2026 with migration guides, but five weeks later the banner still read as future and v1 still answered. No written deprecation policy with a notice period was found (12). A public sub-processor list with purposes and locations, AWS hosting in the United States, Germany and Australia, and the MCP server stated as US-only (20).\n\nFix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (17 items): https://www.anchorterminal.com/fixes/greenhouse.md (JSON https://www.anchorterminal.com/fixes/greenhouse.json)\n\n### What we couldn't check\n\n- unchecked: the numeric Harvest v3 rate limit. The guide gives a 30-second window and an example header of 75 but no fixed figure\n- unchecked: the MCP server's tool list, count, input schemas and annotations, which need an authorised customer account\n- unchecked: whether Harvest v1 and v2 still serve data after the announced removal date of 31 August 2026. An unauthenticated request to /v1/candidates returned 401 on 7 October 2026\n- unchecked: most Harvest v3 changelog entry texts and the migration guides, because harvestdocs.greenhouse.io answered several requests with a bot check\n- unchecked: the Data Processing Addendum text and the AI terms the Master Subscription Agreement refers to\n- unchecked: GitHub stars for grnhse/greenhouse-api-docs and the registration date of greenhouse.io\n- Not found in the reviewed documentation: idempotency keys, field selection, official SDKs, a single OpenAPI file, and a deprecation policy with a notice period\n\n### Sources\n\n- Harvest v3 docs index (llms.txt): \u003chttps://harvestdocs.greenhouse.io/llms.txt\u003e (seen 2026-10-07)\n- Harvest v3 authentication guide: \u003chttps://harvestdocs.greenhouse.io/docs/authentication.md\u003e (seen 2026-10-07)\n- Harvest v3 rate limiting guide: \u003chttps://harvestdocs.greenhouse.io/docs/api-rate-limiting.md\u003e (seen 2026-10-07)\n- Harvest v3 pagination guide: \u003chttps://harvestdocs.greenhouse.io/docs/pagination.md\u003e (seen 2026-10-07)\n- Partner OAuth guide: \u003chttps://harvestdocs.greenhouse.io/docs/harvest-partner-oauth.md\u003e (seen 2026-10-07)\n- Create candidate reference with OpenAPI definition: \u003chttps://harvestdocs.greenhouse.io/reference/post_v3-candidates.md\u003e (seen 2026-10-07)\n- Harvest v3 changelog: \u003chttps://harvestdocs.greenhouse.io/changelog\u003e (seen 2026-10-07)\n- Harvest v1 and v2 docs with deprecation banner: \u003chttps://docs.greenhouse.io/harvest.html\u003e (seen 2026-10-07)\n- status incidents: \u003chttps://status.greenhouse.io/api/v2/incidents.json\u003e (seen 2026-10-07)\n- Greenhouse MCP overview: \u003chttps://support.greenhouse.io/hc/en-us/articles/52090956642075-Greenhouse-MCP\u003e (seen 2026-10-07)\n- Greenhouse MCP setup: \u003chttps://support.greenhouse.io/hc/en-us/articles/52096319906971-Set-up-Greenhouse-MCP-with-supported-AI-tools\u003e (seen 2026-10-07)\n- Greenhouse MCP security FAQ: \u003chttps://support.greenhouse.io/hc/en-us/articles/53944054829083-Greenhouse-MCP-security-FAQ\u003e (seen 2026-10-07)\n- Release notes, September 2026: \u003chttps://support.greenhouse.io/hc/en-us/articles/56448809129755-Release-Notes-September-2026\u003e (seen 2026-10-07)\n- pricing: \u003chttps://www.greenhouse.com/pricing\u003e (seen 2026-10-07)\n- Master Subscription Agreement: \u003chttps://www.greenhouse.com/master-subscription-agreement\u003e (seen 2026-10-07)\n- Service Level Agreement: \u003chttps://www.greenhouse.com/service-level-agreement\u003e (seen 2026-10-07)\n- privacy policy: \u003chttps://www.greenhouse.com/privacy-policy\u003e (seen 2026-10-07)\n- sub-processors: \u003chttps://www.greenhouse.com/subprocessors-in-use\u003e (seen 2026-10-07)\n- trust centre: \u003chttps://trust.greenhouse.com/\u003e (seen 2026-10-07)\n- security.txt: \u003chttps://www.greenhouse.com/.well-known/security.txt\u003e (seen 2026-10-07)\n- docs repository for audit log and webhooks: \u003chttps://github.com/grnhse/greenhouse-api-docs\u003e (seen 2026-10-07)\n- official MCP registry search: \u003chttps://registry.modelcontextprotocol.io/v0/servers?search=greenhouse\u003e (seen 2026-10-07)\n\n## Who's behind it (provenance 90/100, checked 2026-10-07)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | Greenhouse Software, Inc. | 20/20 |\n| Domain age | greenhouse.com, registered 1997-07-30 (29 years) | 15/15 |\n| Endpoint on the vendor's domain | harvest.greenhouse.io | 15/15 |\n| Terms of service | read, states 6 of the 7 things a reader expects, and has 1 clause that costs points | 7.1/10 |\n| Privacy policy | read, states 8 of the 8 things a reader expects, and has 1 clause that costs points | 8/10 |\n| Status page | status.greenhouse.io | 10/10 |\n| Changelog | published | 10/10 |\n| security.txt | published but past its Expires date | 5/10 |\n\nThe Master Subscription Agreement, last updated 1 February 2026, names Greenhouse Software, Inc. and is governed by New York law.\n\nThe API answers at harvest.greenhouse.io, token requests at auth.greenhouse.io and the MCP server at mcp.greenhouse.io. Docs and status also sit on greenhouse.io, which the vendor's pages link to. We did not look up the registration of greenhouse.io.\n\nhttps://www.greenhouse.com/.well-known/security.txt lists security@greenhouse.io and a HackerOne policy link, with an Expires line of 2026-02-01, so it had expired when read.\n\nRDAP for greenhouse.com gives a registration date of 1997-07-30.\n\nThe privacy policy is dated May 28, 2026. The SLA at greenhouse.com/service-level-agreement was last updated 1 February 2026.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service** (https://www.greenhouse.com/master-subscription-agreement), read 2026-10-08, dated 2026-02-01, states 6 of the 7 things a reader expects.\n\n- To know. Restricts benchmarking or competitive use (costs points). \"(x) use or view the Greenhouse Services for the purposes of developing, directly or indirectly, a product or service competitive to the Greenhouse Services.\"\n- Gives the date it was last updated. Last updated 2026-02-01.\n- Names the governing law or courts. The law of the State of New York.\n- States a limit on its liability. Capped at USD $1,000.\n- Not found in the text. Says how changes to the terms are announced.\n- Also in the text (2026-10-08). API access by a third party acting as the customer's agent or at its instruction counts as the customer's own use for usage limits, rate limits and fees. \"For the avoidance of doubt, use of or access to the Greenhouse API by a third party that is acting as agent of or at the instruction of Customer shall be considered Customer's use for the purposes of this Section 4(d).\"\n- Also in the text (2026-10-08). Subscriptions renew automatically for one year unless either party gives written notice of cancellation at least 30 days before the next renewal term. \"subscriptions for each Greenhouse Service will automatically renew for an additional one (1) year period (each, a “Renewal Term”) unless either Party provides written notice of cancellation at least thirty (30) days prior to commencement of the next renewal term.\"\n- Also in the text (2026-10-08). Customer Data is queued for deletion 90 days after the agreement expires or is terminated. \"All Customer Data will be queued for deletion ninety (90) days following expiration or termination of this Agreement for any reason.\"\n\n**Privacy policy** (https://www.greenhouse.com/privacy-policy), read 2026-10-08, dated 2026-05-28, states 8 of the 8 things a reader expects.\n\n- To know. Says it may use customer content to train or improve models, and no opt-out was found (costs points). \"As part of this processing, we may use your Personal Information to improve, develop, and provide products and services, develop and train artificial intelligence (AI) models, develop, provide and personalize our services, and gain insights with the help of AI, automated systems and inferences, so that our services ca…\"\n- To know. Says it sells personal data or shares it for advertising. \"We may also share information about our users with these companies to facilitate interest-based advertising to those or similar users on other online platforms.\"\n- Gives the date it was last updated. Last updated 2026-05-28.\n- Says whether personal data is sold or shared for advertising. Says it does not sell personal data.\n- Gives a privacy contact. privacy@greenhouse.io.\n- Says where data is transferred or stored. Relies on the Data Privacy Framework.\n- Also in the text (2026-10-08). The section that holds the AI model training sentence applies only to users of the MyGreenhouse service. \"This “MyGreenhouse” section is applicable only to users of the MyGreenhouse service, which requires authentication and agreement with the MyGreenhouse User Agreement.\"\n\n## Live (updated 2026-10-08 19:52 UTC)\n\n- Right now: up, HTTP 401, 216 ms, checked 2026-10-08 19:52 UTC (get on `https://harvest.greenhouse.io/v3`, asks for auth)\n- Uptime 24h 100.0% (50 probes) · 30 days 100.0% (50 probes) · p50 290 ms · p95 363 ms\n- Vendor status page: none, All Systems Operational\n- security.txt: expired, expires 2026-02-01T04:59:00.000Z\n- Watching changelog \u003chttps://harvestdocs.greenhouse.io/changelog\u003e\n- Watching privacy \u003chttps://www.greenhouse.com/privacy-policy\u003e\n- Watching terms \u003chttps://www.greenhouse.com/master-subscription-agreement\u003e\n- Always current: https://www.anchorterminal.com/api/v1/live/greenhouse.json\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Strengths\n\n- OAuth 2.0 with per-endpoint scopes such as `harvest:applications:move`, and secret rotation that keeps the old secret for up to a week\n- Every Harvest v3 reference page has a Markdown twin with an OpenAPI 3.1 definition, indexed by llms.txt\n- The MCP server blocks every DELETE endpoint and asks for human confirmation on five actions, including reject, hire and merge\n- Cursor pagination with `per_page` up to 500 and `created_at` or `updated_at` filters on list endpoints\n- Audit Log API records `harvest_access`, `mcp_access` and `mcp_tool_call` events with the OAuth client and user\n\n## Weaknesses\n\n- No public price, free tier or trial. Pricing is customised through sales, and the sandbox is a Pro-tier feature\n- The v3 rate limit is a 30-second window with no published number. The limit arrives in `X-RateLimit-Limit`\n- No idempotency keys found, and reference pages list 401, 403 and 422 without error body examples\n- All list endpoints need a Site Admin as the authorising user, per the authentication guide\n- No official SDKs found, and the MCP server is in open beta and absent from the official MCP registry\n\n## Before you call it (notes for agents)\n\n1. Request a token from https://auth.greenhouse.io/token with client credentials, then send it as a Bearer token to https://harvest.greenhouse.io/v3. Tokens expire, so repeat on 401\n2. Put filters and `per_page` on the first list request only. A `cursor` must be the only query parameter, or the call returns 422\n3. Send the current stage as `from_stage_id` when moving an application. It guards against stale moves. Other writes have no idempotency key, so check before retrying\n4. Read `X-RateLimit-Remaining` on every response and wait for `Retry-After` on 429. The window is 30 seconds\n5. Expect empty list results or 403 unless the token's user is a Site Admin with the needed permissions\n\n## Connect\n\nFirst request:\n\n```bash\ncurl --location 'https://harvest.greenhouse.io/v3/job_posts' \\\n --header 'Authorization: Bearer \u003c\u003cACCESS_TOKEN\u003e\u003e'\n```\n\nClaude Code:\n\n```bash\nclaude mcp add greenhouse --transport http https://mcp.us.greenhouse.io/mcp\n```\n\nThrough letme (picks today, calling later): https://letme.dev/greenhouse (letme picks it for recruiting.interviews, the top-graded tool for the job, letme picks it for recruiting.offer-letters, the top-graded tool for the job). letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| Ashby | C | 61.3 | 369 | recruiting.candidates, recruiting.jobs, recruiting.applications, recruiting.interviews, recruiting.offer-letters | no | https://www.anchorterminal.com/tools/ashby.md |\n| SmartRecruiters | C | 60.4 | 403 | recruiting.candidates, recruiting.jobs, recruiting.applications, recruiting.interviews, recruiting.offer-letters | no | https://www.anchorterminal.com/tools/smartrecruiters.md |\n| Zoho Recruit | C | 59.8 | 421 | recruiting.candidates, recruiting.jobs, recruiting.applications, recruiting.interviews, recruiting.offer-letters | no | https://www.anchorterminal.com/tools/zoho-recruit.md |\n| Lever | D | 53.6 | 541 | recruiting.candidates, recruiting.jobs, recruiting.applications, recruiting.interviews, recruiting.offer-letters | no | https://www.anchorterminal.com/tools/lever.md |\n| Recruitee | D | 52.9 | 557 | recruiting.candidates, recruiting.jobs, recruiting.applications, recruiting.interviews, recruiting.offer-letters | no | https://www.anchorterminal.com/tools/recruitee.md |\n| Workable | C | 61.7 | 359 | recruiting.candidates, recruiting.jobs, recruiting.applications, recruiting.offer-letters | no | https://www.anchorterminal.com/tools/workable.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- Harvest v3 lists 179 reference pages in llms.txt (74 GET, 54 POST, 26 PATCH, 23 DELETE, 2 PUT), each with a Markdown twin holding an OpenAPI 3.1 definition (source: \u003chttps://harvestdocs.greenhouse.io/llms.txt\u003e)\n- The older Harvest docs carry a banner saying v1 and v2 are deprecated and will be removed on August 31, 2026. On 7 October 2026 the banner was unchanged and /v1/candidates still answered 401 to an unauthenticated request (source: \u003chttps://docs.greenhouse.io/harvest.html\u003e)\n- Greenhouse MCP is a remote server at https://mcp.greenhouse.io/mcp in open beta for Core, Plus and Pro tiers, using OAuth 2.0 with PKCE and dynamic client registration (source: \u003chttps://support.greenhouse.io/hc/en-us/articles/52096319906971-Set-up-Greenhouse-MCP-with-supported-AI-tools\u003e)\n- The MCP server blocks every DELETE endpoint and requires human confirmation before rejecting, hiring, merging candidates, anonymising a candidate or bulk-revoking permissions (source: \u003chttps://support.greenhouse.io/hc/en-us/articles/53944054829083-Greenhouse-MCP-security-FAQ\u003e)\n- Without admin configuration the MCP server applies seven read-only default scopes (list applications, candidates, job interview stages, jobs, rejection reasons, scorecards and users)\n- Partner integrations need a signed partnership agreement, and credentials and scope changes come from partner support by email (source: \u003chttps://harvestdocs.greenhouse.io/docs/harvest-partner-oauth\u003e)\n- The SLA commits to 99.5 per cent for Greenhouse Recruiting with credits of one day of fees, last updated 1 February 2026. It does not name the API (source: \u003chttps://www.greenhouse.com/service-level-agreement\u003e)\n- Webhooks are signed with HMAC SHA-256 and retried up to 7 times over about 15 hours (source: \u003chttps://developers.greenhouse.io/webhooks.html\u003e)\n\n## Compare\n\n- [Ashby vs Greenhouse](https://www.anchorterminal.com/compare/ashby-vs-greenhouse.md): C 61.3 vs B 64.8\n- [Bullhorn vs Greenhouse](https://www.anchorterminal.com/compare/bullhorn-vs-greenhouse.md): D 46.7 vs B 64.8\n- [Gem vs Greenhouse](https://www.anchorterminal.com/compare/gem-vs-greenhouse.md): D 53.3 vs B 64.8\n- [Greenhouse vs Lever](https://www.anchorterminal.com/compare/greenhouse-vs-lever.md): B 64.8 vs D 53.6\n- [Greenhouse vs Pinpoint](https://www.anchorterminal.com/compare/greenhouse-vs-pinpoint.md): B 64.8 vs C 61.2\n- [Greenhouse vs Recruitee](https://www.anchorterminal.com/compare/greenhouse-vs-recruitee.md): B 64.8 vs D 52.9\n- [Greenhouse vs SmartRecruiters](https://www.anchorterminal.com/compare/greenhouse-vs-smartrecruiters.md): B 64.8 vs C 60.4\n- [Greenhouse vs Workable](https://www.anchorterminal.com/compare/greenhouse-vs-workable.md): B 64.8 vs C 61.7\n- [Greenhouse vs Zoho Recruit](https://www.anchorterminal.com/compare/greenhouse-vs-zoho-recruit.md): B 64.8 vs C 59.8\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on greenhouse.com or one of its subdomains, or the README of github.com/grnhse/greenhouse-api-docs. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"greenhouse\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/greenhouse\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/greenhouse.svg\" alt=\"Greenhouse on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![Greenhouse on Anchor Terminal](https://www.anchorterminal.com/badges/greenhouse.svg)](https://www.anchorterminal.com/tools/greenhouse)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/greenhouse\"\u003eGreenhouse on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say Greenhouse is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/greenhouse-dark.png\n- Light: https://www.anchorterminal.com/assets/share/greenhouse-light.png\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Recruiting \u0026 applicant tracking", "url": "https://www.anchorterminal.com/categories/recruiting" }, { "name": "Greenhouse", "url": "" } ], "description": "Applicant tracking system from Greenhouse Software in New York. The Harvest v3 REST API reads and writes jobs, candidates, applications, interviews, scorecards and offer records, and a hosted MCP server in open beta exposes a subset of it.", "facts": [ "rank #271 of 722", "OAuth auth", "0 desk reviews" ], "h1": "Greenhouse", "image": "https://www.anchorterminal.com/assets/og/tools-greenhouse.png", "path": "/tools/greenhouse", "published": "2026-10-01", "section": "tools", "title": "Greenhouse review for AI agents, grade B (64.8/100) | Anchor Terminal", "toc": null, "updated": "2026-10-08", "url": "https://www.anchorterminal.com/tools/greenhouse" }, "tokens": { "markdown": 7850, "slim": 2030 }, "version": 1 }