> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Recruitee

> Connect your Recruitee company to Oleria to discover your team members, their hiring roles, the guests and tokens connected to your company, and who changed that access.

Connect Recruitee to Oleria to see who can reach your recruiting data: team members and their hiring roles, the guests and share links that open candidates to people outside your company, and the tokens and apps connected to your account. Oleria reads this data from the Recruitee API with a personal API token, so you can find over-provisioned access and take action directly from Oleria.

Each integration covers one Recruitee company. To bring in several companies, add one integration for each.

## What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your Recruitee company:

* **Accounts:**
  * **Team members** - every team member, with their name, email, hiring role, whether they're an Administrator, whether they're active, whether two-factor authentication is on, when they joined, and their last activity (see [Known limitations](#known-limitations)). Members who are a job's recruiter or hiring manager, or a requisition approver, are marked with that too.
  * **Pending invitations** - every invitation that hasn't been accepted yet, shown as a disabled account with the hiring role it grants.
  * **Guests** - people outside your company who review shared candidates, marked as external users, as a reviewer or an external recruiter.
* **Roles** - every hiring role, built-in and custom, with its abilities and who holds it. For each role, Oleria also shows what it can do on each kind of Recruitee object - jobs, talent pools, requisitions, shared candidates, and candidates - such as read, create, update, delete, or share, worked out from the role's abilities.
* **Teams** - every team and its members.
* **Non-human identities (NHIs):**

  | Non-human identity | NHI type | What Oleria shows |
  | :- | :- | :- |
  | Careers Site API token | `APIToken` | Name, who created it, when, and whether it's revoked. |
  | Share link | `APIToken` | The shared candidates it opens, who created it, recipients, what they can see and do, and when it expires. |
  | Personal API token | `PAT` | The integration user's own tokens. |
  | Guest magic-link token | `PAT` | The guest it signs in, and the shared candidates it opens. |
  | Calendar feed token | `PAT` | The integration user's own feed. |
  | Webhook signing secret | `Secret` | The company's secret for signing webhooks. |
  | OAuth app authorization | `Application` | Marketplace apps the integration user authorized, with their scopes. Each app can act as that user. |
  | Slack integration | `Application` | The Slack workspace or channel, and who connected it. |
  | Shared mailbox | `Application` | The mailbox's email address, provider, and connection status. |

  Tokens, the webhook secret, and shared mailboxes also appear as credentials, with their names, owners, dates, and status. Oleria never reads or stores token, link, or secret values.
* **Activity** - the company audit log: changes to team members, invitations, roles, jobs, talent pools, hiring teams, sharing, API tokens, and company settings, with the team member or guest who made each change, where Recruitee records one, and the IP address.

## Prerequisites

* A Recruitee company. API access is included in every Recruitee plan.
* A dedicated Recruitee team member with the **Administrator** role, to own the personal API token. See [Permissions](#permissions).
* Admin access to the Oleria workspace.

> [!WARNING]
>
> A personal API token belongs to the user who created it, and stops working if that user is removed from Recruitee. Create the token as a dedicated integration user, not a real employee's account, so the integration keeps working when people leave.

## Permissions

Recruitee personal API tokens have no scopes. A token has the same permissions as the hiring role of the user who created it, so the integration user's role decides what Oleria can read and do.

### Required to sync

| Data | Recruitee permission |
| :- | :- |
| Users (team members, invitations, guests) | **Administrator** role |
| Groups (teams) | Any Recruitee team member |
| Roles | `manage_recruiters` ability |

Oleria requires the **Administrator** role when you connect, and that role covers all three. Other roles can't read every administrator or the audit log, so Oleria would show an incomplete inventory.

### Required only for actions

| Action | Recruitee permission |
| :- | :- |
| Create user | **Administrator** role, `manage_recruiters` |
| Add user to role | **Administrator** role, `manage_recruiters` |
| Remove user from role | **Administrator** role, `manage_recruiters` |
| Delete user | **Administrator** role, `manage_recruiters` |
| Disable non-human identity | **Administrator** role, `manage_api_tokens`, `share_candidates`, `manage_integrations`, `manage_email_integrations` |

> [!NOTE]
>
> Recruitee has no read-only token, so you can't leave these permissions out: the Administrator role that syncing needs already includes them. Oleria makes changes in Recruitee only when an action is run from Oleria.

## Create a personal API token

**1. Create a dedicated integration user**

In Recruitee, go to **Settings** -> **General** -> **Team members** and select **New team member**. Enter an email address your team controls - for example, `recruitee-oleria@yourcompany.com` - and a first and last name. Under **Give access to apps**, turn on **Recruitee (ATS)**, choose the **Administrator** role, and select **Add 1 member**. Then accept the invitation and finish signing up as that user.

![Recruitee Add new team members dialog with Recruitee (ATS) turned on and the Administrator role selected](https://mintcdn.com/oleria/j8CJXAeJSw0L3OWn/images/integrations/recruitee/step-1.png?fit=max\&auto=format\&n=j8CJXAeJSw0L3OWn\&q=85\&s=d85e156dff9ae9007d8a04291650699b)

**2. Open Personal API tokens**

Sign in to Recruitee as the integration user, go to **Settings** -> **Apps and plugins** -> **API tokens**, and open the **Personal API tokens** tab. Note the **ID** under **Current company details** - this is your Company ID, and you need it to connect.

![Recruitee API Tokens page on the Personal API tokens tab, showing the company ID under Current company details and the Add token button](https://mintcdn.com/oleria/j8CJXAeJSw0L3OWn/images/integrations/recruitee/step-2.png?fit=max\&auto=format\&n=j8CJXAeJSw0L3OWn\&q=85\&s=07c43b3d55467c918a1e9c7d91e0a67c)

**3. Add a token**

Select **Add token** (if a menu opens, choose **Personal API token**), enter a label such as `Oleria`, and select **Save**. Recruitee may ask for the user's password first.

![Recruitee Personal API tokens tab with a new token label entered and the Save button](https://mintcdn.com/oleria/j8CJXAeJSw0L3OWn/images/integrations/recruitee/step-3.png?fit=max\&auto=format\&n=j8CJXAeJSw0L3OWn\&q=85\&s=a4e55a75c2d3a84fb1a5a9c13901431a)

**4. Copy the token**

The new token appears under **Active tokens** with its value shown. Select the copy icon and keep the token somewhere safe until you enter it in Oleria. The token has the integration user's full Administrator permissions. Later, select **Show token** to see it again.

![Recruitee personal API token created under Active tokens, with its value hidden and the copy icon](https://mintcdn.com/oleria/j8CJXAeJSw0L3OWn/images/integrations/recruitee/step-4.png?fit=max\&auto=format\&n=j8CJXAeJSw0L3OWn\&q=85\&s=c5af8d9260de73ecb16673ce21fa7ddf)

## Connect Recruitee to Oleria

**1. Open the integration**

Go to your Oleria workspace, select **Integrations**, select the **Available** tab, and search for **Recruitee**.

**2. Complete the connection form**

Fill in the connection form:

| Field | Notes |
| :- | :- |
| Company ID | Required. The numeric **ID** under **Current company details** on the **API tokens** page. You can't change it after you connect, and you can't connect the same company twice. |
| Personal API token | Required. The token you created. Oleria stores it encrypted. |

Recruitee has one global API, so there's no region to choose.

**3. Confirm the connection**

Select **Authenticate**. Before it saves anything, Oleria checks that:

* Recruitee accepts the token.
* The token's user is a member of the company with that Company ID.
* The token's user has the **Administrator** role. Oleria refuses tokens from any other role, because they would sync an incomplete inventory.
* The token can list your team members.

If a check fails, Oleria shows which one and how to fix it.

## Verify the integration

Confirm the Recruitee company appears on the **Connected** tab of your Oleria **Integrations** page. After the first sync completes, check that team members, invitations, guests, roles, teams, and non-human identities appear in your Oleria workspace.

> [!NOTE]
>
> When you edit the integration, you can replace the **Personal API token**. The **Company ID** can't change. Oleria runs the same checks on the new token, so it must belong to an Administrator of the same company.

## Remediation actions

Oleria can take these actions in Recruitee. Each one runs with the permissions of the integration user, and Oleria checks that the user is still an Administrator before it offers or runs an action.

| Action | What it does | Revert |
| :- | :- | :- |
| Create user | Invites the email address to your company with the company's default hiring role. The person appears as a pending invitation until they accept. A request that includes teams is refused, because the Recruitee API can't change team membership. If the email already belongs to a team member or a pending invitation, the action succeeds without changing anything. | Supported - deletes the invitation Oleria created. If the person has already accepted it, reverting changes nothing; remove them in Recruitee. |
| Add user to role | Gives a team member a hiring role. Every Recruitee team member holds exactly one hiring role, so this replaces their current role. Their job assignments are kept. | Supported - restores the previous role. |
| Remove user from role | Moves a team member to the company's default hiring role. | Supported - restores the previous role. |
| Delete user | Removes a team member from your Recruitee company, or deletes a pending invitation or a guest. | Supported for team members and invitations - invites the person again with their previous hiring role and job hiring teams; they must accept the new invitation. Talent pool and requisition hiring teams aren't restored - add them back in Recruitee. Not supported for guests. |
| Disable non-human identity | Depends on the kind of non-human identity. See [Disable non-human identity](#disable-non-human-identity). | Depends on the kind. |

Keep these limits in mind when you use these actions:

* **Only team members who have accepted their invitation.** The role actions don't work on a pending invitation, because the Recruitee API can't change an invitation's role. Delete the invitation and invite the person again in Recruitee.
* **The default role can't be removed.** Every team member must hold a hiring role, so **Remove user from role** is refused for the company's default role. Assign another role with **Add user to role** instead.
* **Oleria won't lock itself out.** Oleria refuses to change the hiring role of the integration user or remove it. It also refuses to remove the company's last active Administrator, or to move them to a role that isn't an Administrator role.
* **Reverting doesn't undo later changes.** A role revert runs only while the member still holds the role Oleria set. If someone changed the role since, the revert leaves it as it is and reports a conflict. If there's nothing to undo - for example, the member already holds the previous role, or no longer exists - the revert succeeds without changing anything.
* **Changes are checked.** After each change, Oleria reads the record again. If the read shows Recruitee didn't apply the change, the action fails. Recruitee applies some removals in the background, so when a read can't confirm a change yet, the action succeeds but is marked as not confirmed, and it keeps what it needs to undo the change.
* **No deactivation.** Oleria can remove team members (Delete user), but it can't deactivate or reactivate them, change their login method, or change team membership. Do these in Recruitee.
* **Invitations sent from Tellent's team page.** Recruitee's API can't cancel an invitation that was sent from **Settings** -> **Team members** (under **Organization**) in the newer Tellent screens, so Delete user refuses it. Deactivate it in Recruitee instead. Invitations sent by Oleria's Create user action can be deleted.

### Disable non-human identity

| Non-human identity | What disabling does | Revert |
| :- | :- | :- |
| Careers Site API token | Revokes the token. Anything that uses it stops working. | Not supported - a revoked token can't be restored. Create a new token in Recruitee. |
| Share link | Ends the link by setting its expiry to now. | Supported - restores the link's previous expiry, as long as nobody has changed it since. |
| OAuth app authorization | Deauthorizes the Marketplace app. | Not supported - authorize the app again in Recruitee. |
| Slack integration | Removes the Slack integration. | Not supported - connect Slack again in Recruitee. |
| Shared mailbox | Archives the mailbox, which disconnects it from email. | Not supported - reconnecting needs the mailbox password. Connect it again in Recruitee. |

If the non-human identity is already revoked, expired, or disconnected, the action succeeds without changing anything. If it no longer exists, the action fails.

These non-human identities can't be disabled from Oleria:

* **Personal API tokens** - Recruitee shows only the integration user's own tokens, and Oleria can't tell them apart from the token the integration uses without reading token values. Revoke them in Recruitee on the integration user's **Personal API tokens** tab (**Settings** -> **Apps and plugins** -> **API tokens**).
* **Guest magic-link tokens and the calendar feed token** - Recruitee has no API to revoke them. Remove the guest, or the team member, in Recruitee.
* **The webhook signing secret** - Recruitee has no API to rotate or revoke it.

## Known limitations

* **No sign-in data.** Recruitee doesn't record when team members sign in, and its audit log doesn't log sign-ins. A team member's last activity is the newest change they made in the audit log in the last 30 days, so a member who only views data has no last activity.
* **No password data.** Recruitee doesn't expose when a team member last changed their password.
* **Activity covers changes, not access.** The audit log doesn't include sign-ins, sign-outs, failed sign-ins, password changes, or who viewed which candidate. Candidate exports are logged.
* **30 days of activity.** Recruitee keeps audit-log entries for 30 days, so the first sync brings in at most the last 30 days.
* **Changes made with a token are attributed to its owner.** The audit log doesn't record whether a change came from the Recruitee app or an API token. Changes Oleria makes appear under the integration user.
* **Some member changes are only in Recruitee.** The Recruitee API can't deactivate or reactivate a team member, or change their login method, with a personal API token.
* **Teams are read-only.** The Recruitee API can't create teams or change their members with a personal API token.
* **Limited SSO and 2FA data.** Oleria shows whether SSO is on for the company and, when your plan includes SSO, your identity provider's entity ID and default role. It can't see which team members sign in with SSO. It shows whether each member has two-factor authentication on, but not which method they use. Recruitee has no setting that enforces two-factor authentication.
* **Only the integration user's own tokens and apps.** Recruitee shows personal API tokens, calendar feed tokens, and OAuth app authorizations only to the user who owns them, so Oleria sees the integration user's and no one else's.
* **No token expiry or last-used dates.** Recruitee doesn't record when personal API tokens or Careers Site API tokens expire or were last used.
* **No employee records.** Recruitee is a recruiting app, not an HR system. It doesn't store a job title, employee number, hire or end date, manager, or country for team members, so Oleria shows them as accounts and doesn't import employees or departments from Recruitee.
* **Tellent and support access aren't shown.** Users of the Tellent Admin Center, and Recruitee support staff signing in with an administrator's consent, aren't visible through the Recruitee API.
* **Not imported.** Jobs, talent pools, requisitions, shared candidates, candidates, webhook configurations, job-board credentials, and Marketplace partner integrations aren't imported.

## Contact us

For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.