certo.bio
Register
For developers

Connect certo to your own systems

Invite candidates from your ATS, issue a class's degrees from your student records, hear the moment a checklist is ready, or let an AI assistant do it for you. What your team does in the console, under the same rules.

Read the developer docsSet up a webhook
A first call
curl https://api.certo.bio/v1/candidates?ready=true \
  -H "Authorization: Bearer $CERTO_API_KEY"
{ "data": [ { "name": "Sam Taylor",
    "checklist": { "ready": 6, "total": 6, "complete": true } } ],
  "next_cursor": null }
Or add certo to your assistanthttps://mcp.certo.bio/mcp

Three ways in

Pick the one that fits the job. Each reads and does only what your organisation may, and nothing a candidate did not share.

  • Webhooks

    certo posts a signed event to your endpoint the moment a candidate sends you their checklist.

    • Signed with HMAC-SHA256, checked in a few lines of code
    • Retried for about two hours
    • Ids, states and counts only, never a record
    Webhooks →

  • The API

    Positions, invitations, asks to read, candidates and their checklists, issuing and your webhook, over HTTPS with an API key.

    • Keys made by an owner or an admin, with scopes, expiring within a year
    • Every call described in OpenAPI 3.1
    • Any write can be tried first as a dry run
    The API reference →

  • The MCP server

    Connect Claude, ChatGPT or another assistant and ask in plain words: who is ready for the warehouse role?

    • Sign in with your certo account and choose what it may do
    • Nothing is sent before you confirm a dry run
    • It keeps no conversation and no passport
    Connecting an assistant →

What it never does

The API is the console through another door. It cannot do more than your team can, and it cannot see more than a candidate shared.

  1. Reads only what a candidate approvedNo search over passports and no bulk read. Every read is logged, and the candidate sees it.
  2. Contact details stay their own permissionContact details and the date of birth are in an answer only when the candidate shared them with you.
  3. Never signs a claimIt issues what your organisation confirms. The person still claims it, and a Claimed line stays Claimed.
  4. Never changes who you areMembers, roles, your company details, buying verifications and making keys stay in the console.

Built for

Each kind of organisation uses it for its own work.