Job Posting API

1.0.0

The Job Posting API allows Vagas for Business customers to post jobs via an HTTP call in JSON format.

Authentication

The authentication for using this API can be done in two ways:

• Client Credencials
  • The job will be created with user identification of admin as responsible
• Autorization Code (3-legged)
  • The job will be created with the given user in the authorization steps as responsible

Client Credencials

This process consists of a direct POST call to the gateway indicating the credentials to obtain the access token.

Considering that the credentials were created in the gateway, just make a call according to the example:

curl -X POST -k -H 'Content-Type: application/x-www-form-urlencoded' -i 'https://apigateway.vagas.com.br/oauth/token' --data 'grant_type=client_credentials' -u 'client_id:client_secret'

The return will be:

{
  "access_token": "asd23sde12e123sd",
  "expires_in": 2591999,
  "token_type": "Bearer"
}

For all other requests below, the access_token must be included in the request as a Authorization HEADER attribute in BEARER token format

Remembering that access_token has a time limit for use, the information returned in the key expires_in indicates the number of seconds that the token will expire from its generation date.

Exemple request using the __access_token:__

# Example token the must be added in the Authorization HEADER:
# Authorization: Bearer asd23sde12e123sd
CURL example:
curl -XGET <URL TBD>
    --header “Authorization: Bearer asd23sde12e123sd”

Autorization Code (3-legged)

This process implements the OAuth 2.0 specification for authentication and authorization.

This authentication follows the "three leg" approach:

• The remote service requests user (Jobs For Business employee) to authenticate to a VAGAS API server

How to get the token

The remote service starts the process by calling the PATH /oauth/authorize from the VAGAS API server, sending as parameters:

• client_id: Application ID (Provided by VAGAS team)
• login_type: Type of login ID (must send the value "empresa")
• response_type: Type of response ID (must send "code")
• redirect_uri: URI that will be redirected when login action succeeds or fails

Exemple:

https://apigateway.vagas.com.br/oauth/authorize?response_type=code&client_id=some_application_id&login_type=empresa&redirect_uri=http%3A%2F%2Flocalhost%2Foauth%2Fcode_callback

The user will authenticate with their credentials and authorize the use of their information by the remote service.

When the user accepts the authorization, the VAGAS API server will redirect back to the remote service using the address indicated by the redirect_uri parameter with an authorization code.

Exemple:

http://localhost/oauth/code_callback?code=AixUbVTop239876

In case of unauthorized request, the call will be to the same URI informed in the redirect_uri parameter with the error parameter.

Exemple:

http://localhost/oauth/code_callback?error=unauthorized-request

Using the code returned above, the remote service must request an access token that will be used for all other requests.

Making a new request via an HTTP POST to the route /oauth/token using the "application/x-www-form-urlencoded" format with the following parameters:

• code: The authorization code (received in the previous request)
• grant_type: Should have the value: "authorization_code"

It must also be included in the request HEADER an attribute with the client_id and client_secret information concatenated by a colon (:) and encoded in Base64

Example:

• Having the client_id equal to "example" and a client_secret equal to "emi40QrBjUiPaVC2eGK5"
• Must be concatenated: example:emi40QrBjUiPaVC2eGK5
• Applied Base64 on above value: ZXhhbXBsZTplbWk0MFFyQmpVaVBhVkMyZUdLNQ==
• Included in the HEADER of the request: Authorization: Basic ZXhhbXBsZTplbWk0MFFyQmpVaVBhVkMyZUdLNQ==

Exemple Curl:

curl -XPOST https://apigateway.vagas.com.br/oauth/token \
    --header “Authorization: Basic ZXhhbXBsZTplbWk0MFFyQmpVaVBhVkMyZUdLNQ==” \
    --data “code=AixUbVTop239876&grant_type=authorization_code”

The return of the request, if successful will be:

 {
   "access_token": "asd23sde12e123sd",
   "expired_in": 2591999
 }

For all other requests below, the access_token must be included in the request as a HEADER attribute in BEARER format

Remembering that access_token has a time limit for use, the information returned in the key expires_in indicates the number of seconds that the token will expire from its generation date.

Example call using __access_token:__

# Example value that must be included in the request HEADER:
# Authorization: Bearer asd23sde12e123sd
CURL example:
curl -XGET <URL TBD>
     --header “Authorization: Bearer asd23sde12e123sd”

This is version 1.0.0 of this API documentation. Last update on Sep 22, 2026.