VidecootAPI

Introduction

What the Integration API does, environments, and how to get an API key.

This guide is for developers connecting an HR system to Videcoot. With the Integration API you can:

  • create and update positions (the job and its interview questions);
  • invite candidates to a one-way video interview;
  • poll for interview progress and download answer videos;
  • request and read the AI analysis of a completed interview.

Every endpoint is described in the API reference, which is generated from the OpenAPI 3.1 spec.

Environment Base URL
Production https://api.videcoot.com/api/integration/v1
SIT (testing) https://sit-api.videcoot.com/api/integration/v1

The examples below use SIT. For production, replace https://sit-api.videcoot.com with https://api.videcoot.com. Keys only work in the environment where they were created.

Get a key

  1. Videcoot enables API access for your organization. Contact us to have it turned on. Until then, every request returns 403 API access is not enabled for this organization.
  2. An owner or admin of your organization signs in to Videcoot and opens Organization → API keys.
  3. They create a key and give it a name, for example HR system. The key looks like vdc_live_ followed by 32 letters and digits.
  4. The key is shown once. Copy it straight into your secret store. If it's lost, create a new key and revoke the old one.

An organization can have up to 10 active keys. Revoking a key stops it working immediately.

Keep the key server-side. It gives full access to your organization's positions, candidates and interview videos. Never put it in a browser, mobile app or public repository. The API sends no CORS headers on purpose, so browser calls fail.

Calls made with a key act on behalf of the user who created it. For example, positions created through the API show that user as their creator, and that user gets the AI analysis emails.

Keeping keys safe

  • A key grants full read/write access to your organization's positions, candidates and interview results. Store it in a secrets manager, never in client-side code, and send it only over HTTPS in the Authorization header.
  • Keys never expire on their own. Rotate them without downtime: create a second key, switch your integration to it, then revoke the first key. Revocation takes effect immediately.
  • If a key leaks, revoke it in the dashboard at once. Every request is logged with the key id, so ask support for the request history if you need to assess the impact.