Eightfold API Authorization Guide

Overview

The Eightfold API uses a permission-based authorization system to secure endpoints. Each API key can be configured with specific permissions that determine which API endpoints it can access. This document explains how permissions work and provides a comprehensive reference for configuring API access.

Authorization Process

• API Key Generation: Users generate an API key from the Eightfold platform via the API tab in the Integration section.
• Permission Assignment: Each API key is assigned specific permissions through the permission configuration UI.
• Permission Structure: Permissions follow a hierarchical structure:
  logical_entity[:logical_subentity]:SCOPE
  Where:
  • logical_entity is the primary resource (e.g., ATS Position, Profile)
  • logical_subentity is optional and represents a sub-resource (e.g., Application, Feedback)
  • SCOPE is either READ or WRITE
    
    
• Access Control: When making API requests, the system verifies that your API key has the required permission for the endpoint. If the permission is missing, access is denied.

Configuring API Permissions

Accessing the Permission Configuration UI

1. Navigate to the Eightfold Admin Console and Go to Integration → Eightfold API

2. Click on the edit icon next to an existing API key or click "Generate a new API key" to create a new one

   

Using the Permission Configuration UI

The permission configuration interface is organized hierarchically:

• Entity Level: The top level shows all available entities (e.g., Ats Position, Profile, Position)

• Sub-Entity Level: Some entities have a few associated sub-entities (eg Profile->Skills)

• Read/Write Toggle: Each entity/subentity has checkboxes for READ and WRITE permissions

• Global Read/Write Toggle: Alternatively, if we want to allow access permissions to all READ or all WRITE endpoints, we can select the global toggles on top.

  

Here are a few examples of API permissions selected and what endpoints they give access to:

• ATS Position Permissions
  Ats Position:READ - Grants access to:

  1. GET /api/v2/core/ats-systems/{systemId}/ats-positions/{atsPositionId} (ATS Position Get)
  2. GET /api/v2/core/ats-systems/{systemId}/ats-positions (ATS Position List)

  ats_position:WRITE - Grants access to:

  1. PUT /api/v2/core/ats-systems/{systemId}/ats-positions/{atsPositionId} (ATS Position Update)
  2. PATCH /api/v2/core/ats-systems/{systemId}/ats-positions/{atsPositionId} (ATS Position Patch)
  3. POST /api/v2/core/ats-systems/{systemId}/ats-positions (ATS Position Create)

API endpoints and required permissions reference

Below is a comprehensive table listing all API endpoints with their HTTP methods and required permissions from the Eightfold API.