API release history.

Public launch #

The Hiring Index API is generally available. The version jump from 0.9.x to 1.0.0 marks the contract freeze: every endpoint documented at this date is covered by our six-month deprecation policy.

• Read-only API tier ($2,995/mo, 10,000 calls per month) is open for self-serve signup.
• Webhook tier ($5,995/mo, unlimited reads, push delivery) is open via sales contact.
• Sandbox environment with sk_test_ keys, free of charge, capped at 1,000 calls per day.
• /v1/lateral-moves ships as a stub endpoint. Schema is final, signal coverage backfills through Q3 2026.
• Status page at status.placement.solutions.
• This changelog page, with RSS at /changelog.rss.

• All v1 endpoints are now covered by the six-month deprecation policy. Pre-1.0 endpoints could change without notice; from this date forward they cannot.

Rate-limit bucket replacement #

The rate-limit backend was rewritten to an atomic token-bucket algorithm. Behavior is identical from the caller's side; the difference is reduced tail latency under burst load.

• Rate-limit decisions now complete in under 1 ms at p99, down from ~7 ms under the previous fixed-window counter.
• RateLimit-Reset header is now reported in seconds-from-epoch (previously reported in seconds-until-reset). Both formats are valid per RFC 9239; any client that parses the header as an integer is unaffected.

• Edge case where two requests sharing the same millisecond timestamp could both decrement the bucket twice. Caused intermittent over-counting against monthly quotas; affected accounts received a credit.

Cursor pagination promoted from beta #

Cursor-based pagination is now the only supported pagination model on every list endpoint. Offset pagination, which was available in early-access form on /v1/jobs and /v1/firms, has been removed.

• Every list endpoint accepts cursor and limit (max 500). Responses include next_cursor until the page set is exhausted.
• Cursors are opaque tokens. Do not parse them; they are only valid when echoed back unchanged.

• page and per_page query parameters on /v1/jobs and /v1/firms. Callers still passing them receive a query_param_invalid error with a migration link.

Error envelope v1 finalized #

The error envelope shape is locked. Every non-2xx response now returns the same JSON structure with code, message, request_id, and doc_url fields.

• Six new named error codes after design-partner integration testing: cursor_invalid, page_size_invalid, sort_invalid, filter_invalid, idempotency_key_conflict, scope_insufficient. The full set is now 24 codes.
• doc_url field on every error pointing to the deep-link description on the API reference page.

• The previously-undocumented error_code field was renamed to code. The old field is still emitted alongside code until 2026-09-15 and removed thereafter.

• error_code field. Use error.code. Removal date: 2026-09-15.

Webhooks general availability #

Push delivery exits beta. Five event types are live with the full retry curve and the 24-hour dual-active secret rotation contract.

• Event types job.created, job.updated, firm.headcount_changed, lateral_move.detected, partner_departure.detected.
• HMAC-SHA256 signatures on the Placement-Signature header. Signed payload is {ts}.{raw_body}.
• 16-attempt retry curve over three days (immediate, 5 min, 30 min, 2 h, 5 h, 10 h, then 12 h intervals).
• Secret rotation endpoint with a 24-hour dual-active window. Both old and new secrets verify cleanly during rotation.
• Manual replay endpoint POST /v1/webhooks/{id}/deliveries/{id}/replay.
• 30-day delivery log per endpoint.

• Webhook endpoints are auto-disabled after three consecutive days of failed deliveries. Disabled endpoints can be re-enabled via PATCH /v1/webhooks/{id}.

API key prefix scheme #

Keys now self-identify by prefix. The prefix is human-readable, scannable in logs, and lets clients refuse to accept the wrong key class at the call site.

• pk_live_ for read-only production keys.
• sk_live_ for admin keys (key management, account changes).
• rk_live_ for rotation keys (used in dual-active rotation flows).
• sk_test_ for sandbox keys.
• Per-key IP allowlist. Allowlist entries accept IPv4, IPv6, and CIDR blocks.

• Pre-prefix keys (random 40-char tokens issued before this date). They continue to work until 2026-08-01; on that date they hard-stop returning invalid_api_key. Affected accounts have been emailed.

Reference data endpoints #

Two new lookup endpoints. Both are public, zero-cost (do not consume monthly quota), and cacheable.

• GET /v1/practice-areas returns the 47-node practice taxonomy with parent slugs and a taxonomy_version string.
• GET /v1/markets returns the geographic market list (US metros, EMEA, APAC, LatAm).
• Slug stability guarantee: leaf slugs in the taxonomy are never reused or repurposed. Deprecated slugs continue to resolve via redirect for 18 months after deprecation.

Programmatic SEO surface #

Marketing-side change, mentioned here for completeness. The public job board at /jobs exposes 9,538 server-rendered URLs with structured data, indexed by major search engines. The API itself is unchanged.

• Public job-board pages: list, detail, firm hubs, state hubs, practice hubs.
• JobPosting, BreadcrumbList, and ItemList structured data on every page.
• Sitemap split: sitemap.xml is now an index pointing to sitemap-pages.xml and sitemap-jobs.xml.