Connect an agent
- 1
Authenticate
Use delegated OAuth for public clients or a scoped key for a private integration.
- 2
Configure the client
Use Streamable HTTP, the MCP URL, and a Bearer authorization header.
- 3
Verify tools
The client discovers only tools allowed by the key's scopes.
MCP endpoint
https://head-honta-production.up.railway.app/api/v1/mcp
Generic client configuration
{
"name": "headhonta",
"transport": "streamable-http",
"url": "https://head-honta-production.up.railway.app/api/v1/mcp",
"headers": {
"Authorization": "Bearer <HEADHONTA_API_KEY>"
}
}Client configuration formats vary. The universal values are the Streamable HTTP endpoint andAuthorization: Bearer …. Never paste a live key into documentation, support tickets, or source control.
Available tools
Tool discovery is filtered by credential scope and server-side operational controls.
list_jobsjobs:readList accessible jobsget_jobjobs:readRead a job and its requirementssearch_candidatescandidates:readSearch the organization talent poolget_candidatecandidates:readRead an accessible candidate profilelist_candidatescandidates:readList organization candidateslist_pipeline_stagespipeline:readRead configured pipeline stagesget_candidate_pipelinepipeline:readRead a candidate's current stagelist_interviewsinterviews:readList accessible interviews with minimized personal dataget_interviewinterviews:readRead an accessible interview without transcripts or raw CVslist_sequencessequences:readList communication sequence definitionsget_sequencesequences:readRead a communication sequence definitionlist_job_publicationspublishing:readRead job publication statusHuman-approved write proposals
When write tools are enabled by the HeadHonta operator, agents can propose these changes but cannot approve them.
propose_create_jobjobs:writePropose a draft jobpropose_move_candidatepipeline:writePropose a candidate pipeline movepropose_create_pipeline_stagepipeline:writePropose a pipeline stageAuthentication and isolation
- Every request requires a revocable, scoped credential.
- The key is bound to its creator and organization.
- Active membership and job-level permissions are rechecked.
- Organization IDs supplied by agents are never trusted.
- Revoking the key stops subsequent requests.
Private and public connections
Scoped API keys support private workspace and developer integrations. OAuth 2.1 with PKCE supports public, multi-user, and one-click connections without sharing a workspace key.
How write actions work
Write tools create expiring action proposals instead of mutating hiring data immediately. A named user reviews the exact change, approves it, and HeadHonta executes it once with a complete audit trail.
High-impact actions such as rejection, outbound communication, offers, and final hiring decisions will always retain stronger human approval requirements.