Marketplace partner integrations
Getting started for approved HiBob Marketplace partners building OAuth app integrations via the Developer Portal
Before you begin — Partner OAuth integrations only
These guides assume your company’s Tech Partner application has been approved by the HiBob Tech Partnerships team, and you have access to both the HiBob Partner Portal and Developer Portal, including your OAuth credentials.
- If you have yet to apply to become a Tech Partner, first submit the Tech Partner Application form. Once approved, you will need to accept the Tech Partner Terms in the HiBob Partner Portal (via PartnerStack), then activate a Bob account, and then receive an invitation to the Developer Portal, where you can begin your marketplace app/s onboarding.
- Bob customers building integrations for their own company should use service users and Authorization, not OAuth.
OAuth app installation, Developer Portal access, and partner webhook behavior are not available to general Public API users.
Overview
This section is for approved partners who build Marketplace apps that customers install via OAuth. Every Marketplace app goes through the same partner journey, but what you build depends on your solution. HiBob provides a dedicated API, flow, and guide for each solution type below, so start with the one that matches your product.
OAuth reference material (authorization protocol, token exchange, refresh) lives under Core concepts for partners (OAuth only) in the API Reference.
If you are a Bob customer integrating with your own Bob account, start with Getting started with Bob's API and API service users instead.
Choose your integration path
To get started, pick the row that matches your product. Solutions with a dedicated flow have their own API contract, scopes, and way of exchanging data with Bob, so build on that API. Everything else builds on Bob's public APIs.
| Your solution | Build with | How data moves | Guide |
|---|---|---|---|
| Solutions without a dedicated flow | Bob's public APIs | You design the flow yourself, using the module APIs and partner webhooks. | Other Marketplace apps |
| Retirement payroll apps | Retirement Partners API | Bob sends a webhook when a US pay cycle is paid. You retrieve paychecks, then create or update deductions. | Integrate with Retirement Partners API |
| Payroll solutions | Access by request | You sync employee data based on Bob Payroll Hub reports. | To get access, contact [email protected] |
| ATS and EOR systems | Applicant API | You push a hired candidate into Bob. There is no Bob webhook in the hire flow. | Submit new hires to Bob with the Applicant API |
| Background check providers | Background Checks API | Bob sends a webhook when a recruiter orders or cancels a check. You retrieve the details, then patch status and results. | Integrate with Bob Hiring Background Checks API |
| Assessment providers | Assessments API | Bob sends a webhook when a recruiter orders or cancels an assessment. You retrieve the details, then patch status and results. | Integrate with Bob Hiring Assessments API |
Each dedicated guide lists the OAuth scopes your app needs and the rate limits that apply. Review both before you start building.
All integrations are OAuth only. Service users are not supported.
Partner journey
Every Marketplace app follows these steps, whichever solution you build. Your solution guide adds the solution-specific setup on top. Step 5 applies when Bob notifies you through webhooks, which is the case for every solution above except the Applicant API.
- Quick start guide — become a partner if needed, create your app in the Developer Portal, configure OAuth, scopes, and webhooks, complete marketing listing content (Overview and About), prepare the technical package (the certification video and user guide requirements depend on your solution), and submit for separate listing and technical reviews. Security Review follows a separate timeline (mandatory before go-live for Payroll and Global Payroll).
- Test apps in Bob Marketplace (Dev mode) — in Bob, open Bob products > Marketplace > Manage apps > In development to see your Developer Portal apps (Dev mode) on your partner company.
- OAuth 2.0 — authorization code flow, token exchange, refresh, and development uninstall (API Reference).
- Scopes mapping to endpoints — choose the minimum scopes your app needs.
- Getting started with partner webhooks — delivery, retries, and routing events by
companyId. - Managing customer installations — multi-tenant model: link Bob companies to your customers, store tokens, track status.
Dedicated flows by solution
The journey above is the same for everyone. What changes is the integration you build between installing your app and submitting it for review. Open your solution below for a summary of how it works, with a link to the full guide.
Retirement payroll apps (Retirement Partners API)
Retirement payroll apps sync US payroll data with Bob. They read payroll results from Bob US Payroll and send calculated deductions back, for example 401(k) contributions. The model is notify, pull, then push back.
- When a US pay cycle is completed and paid, Bob sends the
payroll.paycycle.paidwebhook with apayCycleId. - You retrieve the pay cycle details and the paychecks for that cycle. You can also retrieve employee census data and current deductions when needed.
- You calculate the required deductions in your system.
- You create or update employee deductions in Bob. Changes apply from the next pay cycle.
When you connect a new customer, you first confirm the connection status, then discover the employers, employer pay codes, deduction plans, employee roster, and historical pay cycles for an initial sync.
The customer company must have Payroll Hub enabled and your app installed.
Before you build: the full guide lists the required scopes and rate limits for this API. Review it first. See Integrate with Retirement Partners API.
ATS and EOR systems (Applicant API)
Applicant tracking systems, and also EOR or onboarding providers, use the Applicant API to push a hired candidate into Bob's existing ATS Pending Hires flow, where HR reviews candidates that an external system submitted before they become employees. This is a partner-push model: you own the setup experience, and there is no Bob-side configuration or field-mapping screen for these apps.
One-time setup per customer
- The customer installs your app and approves the OAuth scopes.
- Bob redirects to your first-time setup URL with the
company_id. - You retrieve Bob's employee field metadata and document folders.
- In your own UI, the customer maps their ATS fields to Bob field IDs and picks a document folder. You store the mapping.
Per hire
- A candidate is marked hired in your system.
- You send one applicant to
POST /v1/external-hires/applicants.root.firstNameandroot.surnameare required. - Bob returns
201 Createdwith an empty body, and the record appears in ATS Pending Hires. Bob alerts the notification recipients that the customer configured. - HR approves it and completes the existing New Hire flow, the Bob flow that creates the employee record.
Field mapping
Tell customers that any field they map must also be included in their Bob New Hire flow, or it will not be populated. Workforce Planning scopes are optional if you also sync open positions into your ATS.
Notifications in Bob
Customers set up notifications for new pending hires in Bob, in your app's tile in the Bob Marketplace, not in your product. Bob alerts the configured recipients when a record arrives. Add this step to your customer-facing user guide, so customers know to set up notifications after they install your app. See Set up ATS new hire notifications ↗.
If you have a Hire API integration today
Existing Hire API connections keep working, and there is no automated migration. New Marketplace partner integrations must use the Applicant API. Customers re-complete mapping in your product when they move to your Marketplace app. The guide describes the plan to block creation of new token-based Hire API connections six months after the Applicant API launch.
Before you build: the full guide lists the required scopes and rate limits for this API. Review it first. See Submit new hires to Bob with the Applicant API.
Background check providers (Background Checks API)
Recruiters in Bob Hiring order a check for a candidate, choose one of your packages, and track status and results in the hiring workflow. The model is notify, pull, then push back.
- After a customer installs your app, you register your package catalog.
- When a recruiter orders a check, Bob sends
backgroundCheck.triggered. The payload contains IDs only. - You retrieve the check details: candidate, requester, job opening, and selected package.
- You run the check in your system and patch the status and results back to Bob as it progresses.
- If the recruiter cancels, Bob sends
backgroundCheck.cancelled. Stop processing and do not send further updates.
Bob signs webhooks with the Bob-Signature header and delivers them at least once, so handle duplicates using backgroundCheckRequestId.
Listing details
Complete your listing details before you test. Bob shows your app as a tile when a recruiter chooses a provider, so it needs your listing details before it can display the app in a test company.
Add the provider name and description, your logo, and the Marketplace category Background screening, together with your OAuth configuration and webhook listener URL.
Before you build: the full guide lists the required scopes and rate limits for this API. Review it first. See Integrate with Bob Hiring Background Checks API.
Assessment providers (Assessments API)
Assessment providers, for example coding challenges or personality questionnaires, use the same notify, pull, then push back model as background checks.
- After a customer installs your app, you register your package catalog.
- When a recruiter orders an assessment, Bob sends
assessment.triggeredwith theassessmentRequestIdand the selectedpackageId. - You retrieve the assessment details and start the assessment at your provider.
- You patch the status and results back to Bob. Optional result fields include a score, a verdict, a results URL, and a per-section summary.
- If the recruiter cancels, Bob sends
assessment.cancelled. Stop processing and do not send further updates.
Listing details
Complete your listing details before you test. Bob shows your app as a tile when a recruiter chooses a provider, so it needs your listing details before it can display the app in a test company.
Add the provider name and description, your logo, and the Marketplace category Candidate assessments, together with your OAuth configuration and webhook listener URL.
Before you build: the full guide lists the required scopes and rate limits for this API. Review it first. See Integrate with Bob Hiring Assessments API.
Other Marketplace apps
Solutions without a dedicated flow use Bob's public APIs to build their own integration flow. You decide which data to read or write and when, and you build the app on the shared partner journey above.
- Create and submit the app using the Quick start guide.
- Choose the endpoints you need from the Explore by Module guides, such as Employee data, Time off, or Attendance.
- Request only the scopes your app needs, listed in Scopes mapping to endpoints.
- Use partner webhooks to receive events from Bob, and Managing customer installations to handle each customer's install.
Solution-specific contracts, such as package catalogs or sync requests, are not available for these apps. If you are unsure whether your product fits a dedicated flow, ask your HiBob partnerships contact before you start building.
Partner community
Approved Marketplace partners can ask questions and share integration patterns with other builders in Bob for Builders.
Updated 9 days ago

