Changelog

The CV ETag now follows every part of the CV

October 2026

The ETag on GET /v1/me/cv used to change only when the CV row or the profile row did. Adding, editing or deleting an education, certification, project or highlight, or changing which skills and languages show, could leave it unchanged, so a conditional read answered 304 while the CV had changed. The tag now covers every record the CV is built from, whether the CV is the person's main CV or one they picked, plus the main-CV flag, the title and the durable pdf.url: after you revoke a refresh token, the next read returns the new link instead of a 304. Error responses carry no ETag.

Every ETag value changed once with this release, so each stored tag misses one time and your next conditional read returns the full CV with a new tag. Nothing else about the response changed. updatedAt still reports when the CV row (or, for the main CV built from the profile, the profile) last changed, so compare the ETag, not updatedAt, to detect changes.

A deleted chosen CV is refused, not replaced

October 2026

When a person chose one specific CV for your app and later deleted it, the shared CV endpoints used to fall back to their main CV, a document they never chose to share with you. They now answer 409 CV_SELECTION_UNAVAILABLE instead: GET /v1/me/cv (with no ETag) and GET /v1/me/cv.pdf. connection.cv on GET /v1/me is null in that state, and the durable PDF link answers its usual 404. Ask the person to choose a CV again; Settings > Connected apps flags the app for them. Connections that follow the main CV are unchanged. See When the chosen CV was deleted.

v1 launch

September 2026

The first public version of the Tabbio developer platform.

Sign in with Tabbio. OAuth 2.0 authorization code with PKCE, a consent screen where the person chooses which CV to share and whether to include private contact details, and an RFC 8414 discovery document at https://server.tabbio.com/.well-known/oauth-authorization-server.

User resources. GET /v1/me for identity, GET /v1/me/cv for the shared CV as the canonical Tabbio CV document with ETag support, GET /v1/me/cv.pdf for the rendered PDF, and a durable signed PDF link that needs no credential, stays current, and answers 404 once the connection ends.

Partner API. API keys with company scopes. Create and update companies with idempotent creates keyed on your own identifier, post jobs through the draft, live, closed and archived lifecycle, and read candidates with the CV they submitted, their screening answers and a resume download. Every list is page based: page, pageSize and a meta carrying total and totalPages.

Token lifecycle. One hour access tokens, 90 day refresh tokens rotated on every use with reuse detection, RFC 7009 revocation and RFC 7662 introspection. The token and introspection endpoints answer the flat bodies their RFCs define; revocation keeps the API envelope, because RFC 7009 specifies no success body of its own.

User control. Settings > Connected apps lists every app a person has connected, what it can read, and which CV it sees. Changing the CV there changes what your app reads on its next call. Disconnecting revokes every token immediately, and durable CV links end with the consent behind them: disconnecting, turning CV sharing off, or revoking your refresh token all kill them. Read pdf.url again for a fresh one.

Developer platform. Apps, client credentials, API keys, connections, usage graphs, a 30 day request log and your limits live at platform.tabbio.com. Sign in with your Tabbio account or create a developer login. See Developer platform.

Account limits. Every /v1 resource route is metered against your developer account: 300 requests per minute and 20,000 per day on the standard plan, across every app and key you own. Responses carry x-ratelimit-* and x-quota-*, and going over answers 429 with RATE_LIMIT_EXCEEDED or QUOTA_EXCEEDED and meta.retryAfter. Every /v1 and /oauth response also carries x-request-id, which the platform's request log is keyed on.

Machine readable. The OpenAPI 3.1 document this reference is generated from is served live at https://server.tabbio.com/v1/openapi.json.

Known gaps in this version: no webhooks, no OpenID Connect id_token, no client credentials grant, no dynamic client registration, and no write access to applications.