Skip to main content
WEBHOOK

Headers

X-Webhook-Event
string
required

The event type of this delivery (e.g. resume.bulk_upload_parse.started); matches the event field in the request body.

X-Webhook-Timestamp
string<date-time>
required

ISO 8601 timestamp of when the event occurred.

X-Webhook-Key
string

Your webhook verification secret. When a webhook key has been generated in the dashboard (Account Settings → Developers → API Key Management, under Webhook Configuration), TapTalent sends it in this header; if no key has been set, the header may be empty. Verify it by plain equality against the key you stored when you generated or refreshed it, and reject mismatches (e.g. 401 Unauthorized). The key is shown only once when created or refreshed. HMAC signature verification is not yet available.

Body

application/json

Common envelope for every webhook delivery. Deliveries are always HTTP POST requests with Content-Type: application/json, sent to the single company-level HTTPS webhook endpoint configured in the TapTalent dashboard (Account Settings → Developers → API Key Management → Webhook Configuration); only one webhook URL can be configured per company, and configuration is dashboard-only (not available via this API). Job and candidate events are documented as triggered by recruiter actions in the dashboard; whether API-driven writes also emit them is not stated. Endpoints must respond with a 2xx status within 5 seconds; failed deliveries are retried at 200 ms, 400 ms and 800 ms before being marked failed. Make handlers idempotent, since retries can cause duplicate deliveries.

event
string
required

The event type (e.g. candidate.updated).

Allowed value: "candidate.added_to_job"
timestamp
string<date-time>
required

ISO 8601 UTC timestamp when the event occurred.

data
object
required

Payload for candidate.added_to_job.

companyId
integer

The TapTalent company ID the event belongs to. The documented payload-structure table declares this field (integer), but the examples in the canonical event reference omit it while examples on other pages include it — it is therefore modeled as optional. Docs elsewhere show placeholder strings like "companyId_1"; the underlying identifier is an integer.

Response

2XX

Acknowledge receipt within 5 seconds; non-2xx or timeout triggers retries at 200 ms, 400 ms and 800 ms before the delivery is marked failed.