Register packages and report background check status for Bob Hiring partners
Partner OAuth integrations only
The Background Checks API is for approved HiBob Marketplace partners with Developer Portal access and OAuth credentials. Service users are not supported for this integration.
Bob customers building integrations for their own company should use Service users and the general Hiring API, not this partner contract.
The Background Checks API is the partner-facing Public API for marketplace background check providers. Use it to register your package catalog, fetch check context after a webhook, and report status and results back to Bob Hiring.
Before you begin
- Read Integrate with Bob Hiring Background Checks API to learn how the integration works end to end.
- Confirm you are an approved Marketplace partner with Developer Portal access and an OAuth app configured for background screening.
Background Checks API endpoints
| Resource | Endpoint |
|---|---|
| Packages | Register background check packages |
| Packages | Delete background check packages |
| Check details | Get background check details |
| Check status | Update background check status |
Background Checks API webhooks
Bob delivers outbound events to your registered HTTPS webhook URL. Requests are signed — verify authenticity using the Bob-Signature header. Delivery is at-least-once; handle duplicates idempotently with backgroundCheckRequestId.
| Event | Webhook |
|---|---|
| Check ordered | Background check triggered |
| Check cancelled | Background check cancelled |
To learn more about partner webhook delivery and retries, see Getting started with partner webhooks.
Required permissions and scopes
This API supports OAuth only. Service users are not supported.
To use the Background Checks API, your OAuth app requires the following scope:
| Name | Scope | Description |
|---|---|---|
| Integrations > Manage hiring integrations | hiring.integrations:write | Register packages, fetch check details, and report status or results |
If the calling app does not have the required scope, the API returns an authorization error (for example, 403 Forbidden).
Rate limiting
Rate limits are restrictions that our API imposes on the number of times a user can access our endpoints within a specified period of time. To learn more about rate limiting best practices, see Rate limiting.