2026-10-31 · Offers, Vault, signature checks and safe retries
- Offers API (scope offers:read): GET /offers, GET /offers/{id} and GET /offers/approvals: terms, approval chain (who decided, who is still due), sent and signed status, and the Vault copies.
- Vault API (scope vault:read): GET /vault lists your organisation's offer paperwork with SHA-256 fingerprints; GET /vault/{id}/download returns a link that works for 15 minutes.
- Public GET /verify/signature/{ref}: anyone can check a One-Career e-signed document by its OC-SIGN reference or SHA-256, with no key. Built for background-check firms, banks and HR systems.
- GET /me: the key's scopes, expiry, rate limit and 30-day usage by day and operation.
- Webhooks: PATCH /webhooks/{id} (change events, pause, re-enable a paused endpoint), GET /webhooks/{id}/deliveries (delivery log with HTTP status and errors), POST /webhook-deliveries/{id}/redeliver (replay with the same event id).
- 6 new webhook events: offer.approval_requested, offer.approved, offer.changes_requested, offer.sent, offer.signed, vault.document_added.
- Idempotency-Key on every write: retry within 24 hours without doing the action twice (Idempotent-Replayed: true).
- @one-career/sdk 1.1: offers, vault, me, webhooks.update / deliveries / redeliver, public.verifySignature, and automatic idempotency keys on writes so retries are safe.
2026-10-24 · API v1, SDK 1.0 and embeds v1
- REST API v1 at /api/v1: organisation, postings, applications, assessments, interviews and webhooks, plus public company, job board, card and certificate verification and profile cards.
- Scoped organisation API keys (live and test), shown once and stored hashed, with rotation, expiry and usage stats.
- Signed webhooks (OC-Signature, HMAC-SHA256 with timestamp) for 8 events, with retries for about a day and automatic pausing of failing endpoints.
- @one-career/sdk 1.0: typed client, pagination helpers, retries, webhook verification.
- embed/v1.js: <oc-jobs>, <oc-company-grade>, <oc-verified-badge>, <oc-apply-button>, <oc-profile-card>, with allowed-domain controls.
- OpenAPI 3.1 document at /api/v1/openapi.json.