ApplylineBack to home

API documentation

Personal API tokens

A personal token lets a trusted server-side script or assistant call Applyline as you, without sharing your password or browser cookie. It can work with your application, event and checklist data through the routes below.

01 / Set up

Create and copy a token

Open Account settings and choose Personal API tokens. Select Create token, give it a name that identifies the script or assistant, and choose an expiry. You can choose Never expires, though a shorter expiry is safer for temporary work.

Copy the secret immediately and store it securely. Applyline shows it only once, when you create it. You can see a short prefix in your token list later, but you cannot retrieve the full secret again. If it is lost, revoke that token and create another.

02 / Make a request

Call the API with a bearer token

Send the token in the Authorization header. This example lists your applications. Replace the placeholder with your own secret in a trusted environment.

curl https://applyline.app/api/applications \
  -H 'Authorization: Bearer YOUR_PERSONAL_API_TOKEN'

Responses and request bodies use the same JSON contracts as the Applyline web app, including string-named enum values. The token acts as your account, so requests can access only data your account owns.

03 / Scope

Allowed endpoints

Personal tokens work only on these 20 routes. In a path, {id} and {applicationId} stand for the relevant record ID.

Routes available to personal API tokens
MethodPath
GET/api/auth/me
GET/api/applications
GET/api/applications/paged
GET/api/applications/{id}
POST/api/applications
PUT/api/applications/{id}
DELETE/api/applications/{id}
PATCH/api/applications/{id}/status
GET/api/applications/{id}/timeline
POST/api/applications/{id}/timeline/undo
GET/api/applications/{applicationId}/events
POST/api/applications/{applicationId}/events
GET/api/events
GET/api/events/{id}
PUT/api/events/{id}
DELETE/api/events/{id}
GET/api/applications/{applicationId}/checklist
POST/api/applications/{applicationId}/checklist
PUT/api/checklist/{id}
DELETE/api/checklist/{id}
Other routes are refusedTokens cannot manage tokens, change account or password settings, use admin endpoints, or call interview-preparation or development AI endpoints. Any route not listed above is unavailable to personal tokens. Managing tokens requires signing in to the website.
04 / Protect access

Limits and safety

By default, an account can have up to 10 active tokens. Each token can make up to 120 requests per minute; requests over that limit receive HTTP 429.

Treat the secret like a password. Keep it in a secure server-side environment, not in public source code or browser code. Do not paste it into chat messages or logs. If a third-party assistant needs access, understand how it stores the secret and what it can do with your data. Create a separate token for each integration so you can revoke one without interrupting the others.

05 / End access

When a token stops working

Revoke a token from Account settings when you finish using it, or if you think its secret has been exposed. A token with an expiry stops working when that time arrives. Changing or resetting your account password revokes all your tokens. If your account is disabled, its tokens are rejected until the account is re-enabled.