Changelog

v1 launch

September 2026

The first public version of the Tabbio developer platform.

Sign in with Tabbio. OAuth 2.0 authorization code with PKCE, a consent screen where the person chooses which CV to share and whether to include private contact details, and an RFC 8414 discovery document at https://server.tabbio.com/.well-known/oauth-authorization-server.

User resources. GET /v1/me for identity, GET /v1/me/cv for the shared CV as the canonical Tabbio CV document with ETag support, GET /v1/me/cv.pdf for the rendered PDF, and a durable signed PDF link that needs no credential, stays current, and answers 404 once the connection ends.

Partner API. API keys with company scopes. Create and update companies with idempotent creates keyed on your own identifier, post jobs through the draft, live, closed and archived lifecycle, and read candidates with the CV they submitted, their screening answers and a resume download. Every list is page based: page, pageSize and a meta carrying total and totalPages.

Token lifecycle. One hour access tokens, 90 day refresh tokens rotated on every use with reuse detection, RFC 7009 revocation and RFC 7662 introspection. The token and introspection endpoints answer the flat bodies their RFCs define; revocation keeps the API envelope, because RFC 7009 specifies no success body of its own.

User control. Settings > Connected apps lists every app a person has connected, what it can read, and which CV it sees. Changing the CV there changes what your app reads on its next call. Disconnecting revokes every token immediately, and durable CV links end with the consent behind them: disconnecting, turning CV sharing off, or revoking your refresh token all kill them. Read pdf.url again for a fresh one.

Developer platform. Apps, client credentials, API keys, connections, usage graphs, a 30 day request log and your limits live at platform.tabbio.com. Sign in with your Tabbio account or create a developer login. See Developer platform.

Account limits. Every /v1 resource route is metered against your developer account: 300 requests per minute and 20,000 per day on the standard plan, across every app and key you own. Responses carry x-ratelimit-* and x-quota-*, and going over answers 429 with RATE_LIMIT_EXCEEDED or QUOTA_EXCEEDED and meta.retryAfter. Every /v1 and /oauth response also carries x-request-id, which the platform's request log is keyed on.

Machine readable. The OpenAPI 3.1 document this reference is generated from is served live at https://server.tabbio.com/v1/openapi.json.

Known gaps in this version: no webhooks, no OpenID Connect id_token, no client credentials grant, no dynamic client registration, and no write access to applications.