Implement, Test and Deploy APIs

Fetching an access token

You must use an access token in order to access protected APIs.

For more information about the token API, see Obtain an access token via an OAuth client credentials grant. This is a standard OAuth2.0 Client Credentials token API.

The following is an example of a cURL request for the token API. The content of the basic authentication header must be "yourClientID:yourClientSecret" encoded in Base64.

curl --location 'https://gwg.cloud.utmost.co/api/gwg/supplier/oauth/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'Authorization: Basic **************' \
--data-urlencode 'grant_type=client_credentials'

If you are testing in Postman, refer to Authentication Instructions for Postman.

Calling an authenticated API

All API calls are secured using Bearer Authentication. The client must fetch a token from the token API and send it in the Authorization header when making requests to protected resources:

Authorization: Bearer <token>

If the token is missing, invalid, or expired, the API in question will respond with a 401 error code (unauthorized).

Fetch Requests

To interact with the Request API (used to retrieve requests, also called job postings), you must use a valid access token. For more information, see Security and authentication.

Listing all of your requests

Use the List Requests API to list all requests/job postings available from your connected Beeline clients in one API call. To improve response times, this API returns a limited set of request information.

Fetching the full details of a request

When you’ve identified a new request, or when you want to review an existing request, use the Get Request by ID endpoint to get the full set of fields for one particular request, including rates and client-specific custom fields.

Receiving a notification for new requests

To react to new requests faster, suppliers might like to receive alerts when a job posting is released. Webhook subscriptions are available to support this.

Use the Webhook Management APIs to specify an API on your system that Supplier Network can call when a new posting is released from one of your clients. This way, you can use that API to drive further internal processes in your ATS.

Supplier Network will cryptographically sign all notifications sent to your API using the HMAC secret you provide when setting up the webhook subscription. To prevent unauthorized parties from calling your API, it is critical that you validate that this signature is correct on all the requests you receive.

Submit a Candidate

When you identify a request you are interested in, use the API to submit candidates to that posting.

To interact with the candidate APIs, you must use a valid access token. For more information, see Security and authentication.

Client-specific custom fields

Each client will have different configuration and required fields as requirements for submitting a candidate. Use the Candidate Metadata API to fetch information about the custom fields that are available for this particular posting, and whether they are required or not.

Adding a resume

To add a resume to the candidate submission, use the Add Media API.

Submitting the candidate

When your submission is ready, use the Submit Candidate API to submit your candidate. A successful submission will return a HTTP 202 response indicating Accepted, and the candidate submission will be sent to the client VMS for client-specific validation.

Fetch Timesheets

To interact with the timesheets API, you must use a valid access token. For more information, see Security and authentication.

Listing all of your timesheets

Use the List Timesheets API to list all timesheets available from your connected Beeline clients in one API call. You can specify the status, date range (start date and end date), limit and offset in the GET call.

Fetching the full details of a timesheet

Once you have used the List Timesheets API to list all available timesheets and their uids, you can fetch the full details of a timesheet by using the timesheet’s uid when calling the Get Timesheet API. The timesheet has both timesheet-level data and an array of child lineItem objects which each represent one line item in the timesheet.

Limitations

Please note the following limitations of the Timesheets API:

If you had live client connections at the time the Timesheets API was released, the API will return timesheets for those clients back to February 2026.
If you connected a client to BSN after the Timesheets API was released, the API will return timesheets for that client back to the date that the connection was established.
The Timesheets API currently only supports retrieving timesheets, not writing them. We anticipate releasing a Submit Timesheets API in the future based on user need. If this functionality would be useful to you, we recommend visiting our product roadmap and idea portal and voting for them!

Future enhancements

We’re constantly making improvements to our APIs and welcome your feedback. Please take a moment to view our product roadmap and ideas portal and vote for features that are most important to you. We value your thoughts and experience and are committed to continuously improving our offerings to better serve your needs.