Obtain a Harvest API key from Greenhouse Settings > Dev Center > API Credential Management; keys have per-endpoint permissions — ensure 'Create Candidate' and 'Create Application' are enabled.
Authenticate using HTTP Basic auth: set the API key as the username and leave the password blank; base64-encode 'apikey:' and pass it in the Authorization header.
POST to https://harvest.greenhouse.io/v1/candidates with a JSON body containing at minimum 'first_name', 'last_name', and 'applications' array; include 'On-Behalf-Of' header set to the Greenhouse user ID performing the action.
Each object in the 'applications' array requires a 'job_id' (integer); optionally include 'source', 'referrer', and 'initial_stage_id' to control pipeline placement.
To attach a resume, first create the candidate, then POST to /v1/candidates/{id}/attachments with a multipart/form-data body containing 'resume' as a file field and 'type' set to 'resume'.
Confirm creation by GETting /v1/applications/{application_id} and verifying the 'status' field is 'active'.
Known gotchas
The 'On-Behalf-Of' header is required for most write operations and must be a valid Greenhouse user ID (integer), not an email; omitting it returns a 401 or 422 even with a valid API key.
Job IDs and stage IDs are environment-specific (sandbox vs. production); copying IDs across environments silently creates applications on the wrong job or fails with a 422.
Rate limit is 50 requests per 10 seconds per API key; bulk imports that exceed this get 429 responses — implement exponential backoff rather than fixed delays.
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp