Pinpoint

Credentials: Pinpoint needs two values.

1. PINPOINT_SUBDOMAIN: the part before .pinpointhq.com in the address you sign in at (for acme.pinpointhq.com it is acme). Each company has its own API host, https://<subdomain>.pinpointhq.com/api/v1.
2. PINPOINT_API_KEY: in Pinpoint open Settings > API & Webhooks, make sure the Pinpoint API toggle is on, then create a key on the API Keys tab. Pinpoint recommends a separate read-only key for AI tools; the two write tools here (pinpoint_add_comment, pinpoint_move_application_stage) need a key with write access. The key is sent in the X-API-KEY header.

A missing or wrong key answers 401; 403 means the API integration is switched off for the account.

Data model: a job has job postings (adverts) and a hiring workflow of stages. A candidate (a person) has one application per job; the application sits in a stage. Comments are internal notes on applications, candidates or jobs; interviews belong to applications. Start with pinpoint_list_jobs (status open), then pinpoint_list_applications with job_id, and pinpoint_get_application with include=candidate,stage for the details.

JSON:API: answers follow the JSON:API format: records are in data[] with id, type and attributes; related records requested with include are in included[], linked through relationships. Ids are strings.

Paging: page starts at 1, page_size defaults to 100 (max 1000). Every list asks for meta.stats.total.count so you know the total; follow links.next or raise page until a page has fewer rows than page_size.

Filters: dates are ISO 8601 (2026-09-01T00:00:00Z). Multiple values in one filter are comma-separated (status=open,hold). Confidential jobs are hidden from pinpoint_list_jobs unless visibility names confidential.

Rate limits: 120 requests per IP per minute and 240 per 8 minutes; above that Pinpoint answers 429 with Retry-After. Prefer one list call with filters and include over many single fetches.