{
 "categories": [
  "hr",
  "enterprise"
 ],
 "deployment": "saas",
 "evidence": [
  {
   "date": "2026-09-19",
   "fact": "homepage",
   "note": "Ashby presents all-in-one recruiting software covering ATS, CRM and sourcing, scheduling, and analytics for startups through enterprises.",
   "source": "https://www.ashbyhq.com/",
   "tier": "declared"
  },
  {
   "date": "2026-09-19",
   "fact": "license",
   "note": "Opened pricing compares paid All-in-One plans Foundations, Plus, and Enterprise, sized by company headcount, plus a separate Analytics add-on. No permanent free tenant is offered on the opened page.",
   "source": "https://www.ashbyhq.com/pricing",
   "tier": "declared"
  },
  {
   "date": "2026-09-19",
   "fact": "modalities.api.exists",
   "note": "Ashby documents a public API at the developers site. Endpoints follow /CATEGORY.method and accept JSON request bodies.",
   "source": "https://developers.ashbyhq.com/reference/introduction",
   "tier": "declared"
  },
  {
   "date": "2026-09-19",
   "fact": "modalities.api.kinds[0]",
   "note": "The introduction states the Ashby API is RPC-style, not REST-style, and that most endpoints take POST even for reads.",
   "source": "https://developers.ashbyhq.com/reference/introduction",
   "tier": "declared"
  },
  {
   "date": "2026-09-19",
   "fact": "modalities.api.auth[0]",
   "note": "Authentication is HTTP Basic. The API key is the username and the password is blank. Example host is https://api.ashbyhq.com/application.list. Missing keys return 401; wrong or deactivated keys return 403.",
   "source": "https://developers.ashbyhq.com/reference/authentication",
   "tier": "declared"
  },
  {
   "date": "2026-09-19",
   "fact": "modalities.api.coverage",
   "note": "Permission modules cover jobs, candidates, projects, interviews, hiring-process metadata, organization, offers, webhooks, approvals, reports, and audit logs, with create, update, stage-change, and offer writes. Confidential jobs and private fields stay gated unless the matching key flags are enabled.",
   "source": "https://developers.ashbyhq.com/reference/authentication",
   "tier": "declared"
  },
  {
   "date": "2026-09-19",
   "fact": "modalities.api.docs",
   "note": "Opened as the current public API introduction, including RPC naming, Basic auth, and JSON Content-Type requirements.",
   "source": "https://developers.ashbyhq.com/reference/introduction",
   "tier": "declared"
  },
  {
   "date": "2026-09-19",
   "fact": "modalities.mcp.first_party",
   "note": "Ashby documents a vendor-hosted MCP Server (Beta) at https://mcp.ashbyhq.com/mcp/v1 with per-user OAuth and setup for ChatGPT, Claude, Cursor, Glean, and Gemini CLI.",
   "source": "https://docs.ashbyhq.com/ashby-mcp-server-beta",
   "tier": "declared"
  },
  {
   "date": "2026-09-19",
   "fact": "modalities.mcp.verdict",
   "note": "The same page lists first-party tools for search, filter, candidate details, interviews, pipeline, pending tasks, create_candidate, add_note_to_candidate, change_application_stage, and consider_candidate_for_job. An org admin must enable the MCP Server opt-in. Analytics-only orgs are excluded.",
   "source": "https://docs.ashbyhq.com/ashby-mcp-server-beta",
   "tier": "declared"
  },
  {
   "date": "2026-09-19",
   "fact": "modalities.extensibility.webhooks",
   "note": "Ashby documents webhooks under Admin > Integrations > Webhooks. Each webhook has an event type, request URL, and optional secret token. Requests carry user agent Ashby-Webhook and, when a secret is set, an Ashby-Signature header.",
   "source": "https://developers.ashbyhq.com/docs/setting-up-webhooks",
   "tier": "declared"
  },
  {
   "date": "2026-09-19",
   "fact": "modalities.data_access.export",
   "note": "Read endpoints such as application.list, candidate.list, job.list, and offer.list return JSON collections the API key is permitted to see.",
   "source": "https://developers.ashbyhq.com/reference/authentication",
   "tier": "declared"
  },
  {
   "date": "2026-09-19",
   "fact": "modalities.data_access.import",
   "note": "Write endpoints such as candidate.create, application.create, application.changeStage, and offer.create accept JSON bodies that create or update ATS records.",
   "source": "https://developers.ashbyhq.com/reference/authentication",
   "tier": "declared"
  },
  {
   "date": "2026-09-19",
   "fact": "modalities.agent_docs.llms_txt",
   "note": "Opened https://developers.ashbyhq.com/llms.txt as a first-party documentation index listing guides, authentication, webhook setup, and API reference pages.",
   "source": "https://developers.ashbyhq.com/llms.txt",
   "tier": "declared"
  },
  {
   "date": "2026-09-19",
   "fact": "verdict.scores.api",
   "note": "The RPC API is a broad documented production surface with module-scoped keys, JSON writes, incremental sync, and signed webhooks. API-key-only auth, confidential-job gates, and RPC rather than REST keep the path in the practical-and-broad band rather than unusually complete hyperscaler tooling.",
   "source": "https://developers.ashbyhq.com/reference/authentication",
   "tier": "declared"
  },
  {
   "date": "2026-09-19",
   "fact": "verdict.scores.mcp",
   "note": "The official remote server has useful recruiting reads and selected writes, but Ashby marks it Beta, requires an org-admin opt-in, excludes Analytics-only orgs, and says tool inputs may change without notice. That matches a limited vendor preview, not a generally available official server.",
   "source": "https://docs.ashbyhq.com/ashby-mcp-server-beta",
   "tier": "declared"
  },
  {
   "date": "2026-09-19",
   "fact": "freshness.watch[0].url",
   "note": "Opened and verified as the current Ashby API introduction, including RPC naming, Basic auth, and JSON body rules.",
   "source": "https://developers.ashbyhq.com/reference/introduction",
   "tier": "declared"
  },
  {
   "date": "2026-09-19",
   "fact": "freshness.watch[1].url",
   "note": "Opened and verified as the current authentication and permission-module page for API keys.",
   "source": "https://developers.ashbyhq.com/reference/authentication",
   "tier": "declared"
  },
  {
   "date": "2026-09-19",
   "fact": "freshness.watch[2].url",
   "note": "Opened and verified as the current Ashby MCP Server (Beta) article, including endpoint, OAuth, tool list, and rate limits.",
   "source": "https://docs.ashbyhq.com/ashby-mcp-server-beta",
   "tier": "declared"
  },
  {
   "date": "2026-09-19",
   "fact": "freshness.watch[3].url",
   "note": "Opened and verified as the current webhook configuration guide, including Admin panel setup and optional Ashby-Signature verification.",
   "source": "https://developers.ashbyhq.com/docs/setting-up-webhooks",
   "tier": "declared"
  }
 ],
 "freshness": {
  "last_verified": "2026-09-19",
  "volatility": "high",
  "watch": [
   {
    "type": "docs",
    "url": "https://developers.ashbyhq.com/reference/introduction"
   },
   {
    "type": "docs",
    "url": "https://developers.ashbyhq.com/reference/authentication"
   },
   {
    "type": "mcp",
    "url": "https://docs.ashbyhq.com/ashby-mcp-server-beta"
   },
   {
    "type": "docs",
    "url": "https://developers.ashbyhq.com/docs/setting-up-webhooks"
   }
  ]
 },
 "homepage": "https://www.ashbyhq.com/",
 "id": "ashby",
 "license": "commercial",
 "modalities": {
  "agent_docs": {
   "llms_txt": true
  },
  "api": {
   "auth": [
    "api-key"
   ],
   "coverage": "partial",
   "docs": "https://developers.ashbyhq.com/reference/introduction",
   "exists": true,
   "kinds": [
    "rpc"
   ]
  },
  "cli": {
   "exists": "unknown"
  },
  "computer_use": {
   "issues": [],
   "viability": "unknown"
  },
  "data_access": {
   "export": [
    "json"
   ],
   "import": [
    "json"
   ]
  },
  "extensibility": {
   "scripting": [],
   "webhooks": true
  },
  "integrations": {
   "make": "unknown",
   "n8n": "unknown",
   "power_automate": "unknown",
   "zapier": "unknown"
  },
  "mcp": {
   "first_party": true,
   "third_party": [],
   "verdict": "official"
  },
  "rpa": {
   "drivability": "unknown",
   "notes": "No repeatable UI probe was run. Ashby's RPC API, signed webhooks, and the first-party hosted MCP cover recruiting automation without browser control of the ATS UI.\n",
   "ui_stack": [
    "web-dom"
   ],
   "vendor_support": []
  },
  "sdk": {
   "exists": "unknown",
   "languages": [],
   "official": "unknown"
  }
 },
 "name": "Ashby",
 "platforms": [
  "web"
 ],
 "related": {
  "alternatives": [
   "greenhouse",
   "teamtailor",
   "jobbnorge"
  ],
  "our_products": []
 },
 "schema_version": 1,
 "score_version": 1,
 "status": "active",
 "vendor": "Ashby",
 "verdict": {
  "best_path": "api",
  "scores": {
   "api": 8,
   "cli": null,
   "computer_use": null,
   "integrations": null,
   "mcp": 6,
   "overall": 8,
   "rpa": null
  },
  "summary": "Ashby is automatable today through its public RPC API. This record is Ashby recruiting (candidates, jobs, applications, interviews, offers, and tasks), including the vendor-hosted MCP at https://mcp.ashbyhq.com/mcp/v1. It is not Greenhouse, Teamtailor, Webcruiter, or Jobbnorge. The API at https://api.ashbyhq.com is RPC-style: most endpoints are POST /CATEGORY.method with JSON bodies and Content-Type application/json. Authentication is HTTP Basic with the API key as username and a blank password. Keys carry module permissions (jobs, candidates, interviews, offers, and others). Confidential jobs and projects and non-offer private fields are off unless an admin enables those key flags. Documented writes include candidate.create, application.create, application.changeStage, candidate.createNote, and offer.create. Webhooks are configured in Admin > Integrations > Webhooks or via webhook.create, with optional HMAC signing in the Ashby-Signature header. First-party MCP is beta. An org admin must enable it under Admin > Organization Setup > Opt-in features. It is available on Foundations, Legacy, Plus, and Enterprise, not Analytics-only orgs. Auth is per-user OAuth. Tools search and filter candidates, jobs, applications, interviews, and offers, and can create a candidate, add a note, change an application stage, and consider a candidate for a job. Tool inputs may change; Ashby tells integrators who need a stable contract to use the public API. Rate limits are 120 requests per minute per token and 120 tool-budget units per minute. Official SDK, CLI, and iPaaS catalogs were not established from the opened pages. Computer-use viability is unassessed. API scores 8 and is the best path because it is the complete control plane and does not depend on the MCP beta or an org-admin opt-in.\n"
 }
}