Authenticate using HTTP Basic Auth with your Harvest API key as the username and an empty string as the password; all requests go to https://harvest.greenhouse.io/v1 (v1/v2) or use the v3 base at harvestdocs.greenhouse.io — note v1 and v2 are deprecated after August 31 2026, so target v3 for new integrations
Send GET /v1/candidates (or the v3 equivalent) with per_page set up to 500 to maximize page size and reduce round trips
Inspect the Link response header for a rel="next" URL; follow it on each iteration until no next link is returned — Harvest v3 uses cursor-based pagination ordered by id descending
Monitor X-RateLimit-Remaining on each response; if it approaches zero or you receive HTTP 429, pause for the number of seconds specified in the Retry-After header before resuming
Optionally filter the initial request with query parameters such as updated_after (ISO 8601 timestamp) to fetch only candidates modified since your last sync
Write each page of results to your destination store before requesting the next page to avoid re-fetching on failure
Known gotchas
Harvest v1 and v2 will be unavailable after August 31 2026; build new integrations against v3 which uses cursor pagination via the Link header, not offset-based page parameters
The rate limit window is 30 seconds; exceeding it returns HTTP 429 with a Retry-After header — ignoring this and retrying immediately will keep triggering 429s
Harvest API keys are scoped per user and carry only the permissions granted to that user; use a dedicated service-account API key with the minimum required permissions rather than a personal key
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp