Authentication
All requests go to your tenant base URL over HTTPS:
https://{your-agency}.kazily.app/api/v1
Pass an API key in the Authorization header. Keys are created per user under Settings → API keys and inherit that user's role permissions — a client-portal key can only read what that client may see.
# curl curl https://acme.kazily.app/api/v1/candidates \ -H "Authorization: Bearer kz_live_4f9c…" \ -H "Content-Type: application/json"
Candidates
Boolean search uses the same syntax as the UI — AND, OR, NOT, quotes and parentheses:
# "sales" marketers, 5+ years, not interns GET /candidates?q=("sales" OR "marketing") AND years>=5 NOT intern
Jobs
# Publish a role — goes to your board, Google for Jobs, # the XML partner feeds and Postiz in one call POST /jobs { "title": "Territory Sales Manager", "client_ref": "cl_204", "client_name_public": false, // anonymised unless client opted in "location": "Nairobi", "salary_range": "KES 180k–250k", "deadline_days": 30, "description": "…" }
Pipeline & feedback policy
Stage moves are governed by the feedback-delay policy: moving a candidate queues the message — positive news releases after 24h, rejections after 48h. If the stage changes again before release, only the latest message sends. The queue is inspectable:
Notes & reports
Webhooks
Register an endpoint under Settings → Webhooks. Every delivery is signed with HMAC-SHA256 in X-Kazily-Signature — verify it with your webhook secret before trusting the payload.
| Event | Fires when | Key fields |
|---|---|---|
| application.created | A candidate applies via your board or the API | application, candidate, job |
| stage.changed | Any kanban move (UI or API) | application, from_stage, to_stage, actor |
| feedback.released | A queued 24h/48h message is actually sent | application, stage, channel, sent_at |
| interview.slot_picked | Candidate picks a slot from a scheduling link | application, slot, interviewer |
| self_interview.completed | Async video answers are submitted | application, recording_url, duration |
{
"event": "feedback.released",
"application": "app_9182",
"stage": "Offer",
"channel": "email",
"sent_at": "2026-10-27T09:00:00+03:00"
}
Limits & errors
| Item | Limit / behaviour |
|---|---|
| Rate limit | 120 requests/min per key — headers X-RateLimit-Remaining, Retry-After |
| Pagination | ?limit=50&cursor=… — cursor-based, stable under writes |
| Errors | RFC 7807 problem JSON: {"type","title","status","detail"} |
| Versioning | Path versioned (/api/v1); breaking changes get a new version and 12 months' notice |
Need Zapier instead of code? Every event above is a Zapier trigger, and every endpoint a Zapier action — connect it under Settings → Integrations.