API, webhooks and MCP

Endpoints

Webhooks

Events: job.published, job.expired, job.filled, application.created, application.stage_changed, application.withdrawn, application.identity_revealed, message.received, interview.confirmed, offer.accepted, offer.declined. Payload { id, type, created_at, org_id, data }. Deliveries retry with exponential backoff for about 24 hours; an endpoint is disabled after 50 consecutive failures and you are emailed.

Verify the signature (Node)

import { createHmac, timingSafeEqual } from 'node:crypto'

export function verifyScrubHub(secret, rawBody, header, toleranceSeconds = 300) {
  const parts = Object.fromEntries(header.split(',').map((p) => p.split('=')))
  const t = Number(parts.t)
  if (!t || Math.abs(Date.now() / 1000 - t) > toleranceSeconds) return false
  const expected = createHmac('sha256', secret).update(`${t}.${rawBody}`).digest('hex')
  return expected.length === parts.v1.length && timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1))
}

Verify the signature (Python)

import hmac, hashlib, time

def verify_scrubhub(secret: str, raw_body: bytes, header: str, tolerance=300) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(","))
    t = int(parts["t"])
    if abs(time.time() - t) > tolerance:
        return False
    expected = hmac.new(secret.encode(), f"{t}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, parts["v1"])

MCP server

@scrubhub/mcp exposes the same API as tools over stdio and streamable HTTP: search_jobs, get_job, create_job_draft, publish_job, list_applications, get_application, move_application_stage, reject_application, send_message, schedule_interview, make_offer, search_candidates, invite_candidate, list_pipeline_stages. The resource scrubhub://listing-schema/{schema_key} returns the JSON Schema for each setting block so an agent can draft a compliant listing.

{
  "mcpServers": {
    "scrubhub": { "command": "npx", "args": ["-y", "@scrubhub/mcp"], "env": { "SCRUBHUB_API_KEY": "sh_live_…", "SCRUBHUB_API_URL": "https://scrubhub.ai/api/v1" } }
  }
}