Agents and API

JobOfferMaster agent guide

Public product documentation, a selected API contract, and examples for user-authorized workflows.

What JobOfferMaster does

JobOfferMaster combines a job-search workspace with a Chrome extension. It helps new graduates and other active job seekers save roles, reuse a reviewed profile on supported application forms, prepare role-specific resume and cover-letter drafts, practice interview questions, and track interviews and follow-ups.

Those product capabilities are not all available through a public API. The specification below documents an existing public trust manifest and signed-in, read-only job search. It does not expose resume generation, autofill, application submission, or access to personal vault contents.

Start with public discovery

  • llms.txt: a concise product and documentation index.
  • OpenAPI description: request parameters, response schemas, and authentication requirements.
  • API catalog: an RFC 9727 Linkset linking the API to its specification and this guide.

These resources and public documentation can be read without an account. They do not grant permission to access a user's information.

curl https://joboffermaster.com/llms.txt
curl https://joboffermaster.com/openapi.json
curl https://joboffermaster.com/.well-known/api-catalog
curl https://joboffermaster.com/trust.json

Authentication and private data

The job-search API requires a first-party browser session. Let the user sign in through JobOfferMaster's sign-in page and complete Privacy Mode setup. Requests use the browser-managed Auth.js session cookie; there is no public API key, bearer-token flow, or third-party OAuth integration in this release. The public trust manifest does not require authentication.

Use same-origin requests from the user-authorized JobOfferMaster browser tab. Do not ask the user to paste or export a cookie, password, recovery code, or vault key. A generic server-side OpenAPI client cannot use this endpoint without a supported authenticated browser context.

Protected vault contents are encrypted in the browser before storage. Signing in and unlocking the vault are separate operations. The job-search API returns indexed public postings and does not require decrypting the user's vault; private product workflows may require an unlocked vault on the current device. User-requested AI features process the relevant supplied content, so encryption at rest does not imply end-to-end encryption to the AI provider. See the trust guide for the boundaries.

Read the public trust manifest

GET /trust.json returns published implementation evidence: product identity, the last review date, cryptography, privacy claims and their limitations, data boundaries, the threat model, and verification scope. It contains no user records and requires no credentials.

Check review.last_reviewed, read each claim's limitations, and preserve the distinction between implementation evidence and an independent security audit. The complete field contract is in the OpenAPI description.

GET /api/who-is-hiring searches indexed open jobs. It does not save an application, upload a resume, generate an AI answer, or submit anything to an employer.

title and location
Required text, each 1-80 characters after trimming. Location supports Remote, Bay Area, or other location text.
source
Optional, case-sensitive; defaults to All. Supported values: Greenhouse, Lever, Ashby, Workable, Workday, Recruitee, Personio, Rippling.
offset
Optional decimal integer from 0 to 10000, default 0. Each page contains at most 30 jobs.
// In a user-authorized, signed-in JobOfferMaster browser tab.
const query = new URLSearchParams({
  title: "AI Engineer",
  location: "Bay Area",
  source: "All",
  offset: "0",
});
const response = await fetch("/api/who-is-hiring?" + query, {
  credentials: "same-origin",
});
if (!response.ok) {
  throw new Error("Search failed: " + response.status);
}
const page = await response.json();
// Request page.nextOffset only if page.hasMore is true.

An empty successful search returns:

{
  "jobs": [],
  "totalMatches": 0,
  "pageSize": 30,
  "totalPages": 0,
  "nextOffset": 0,
  "hasMore": false
}

For matching jobs, each item includes id, company, source, title, location, workplaceType, url, postedAt, and indexedAt. Workplace type and source posting date may be null. The indexed date is when JobOfferMaster first saw a posting, not necessarily when the employer published it.

Continue with nextOffset only while hasMore is true. Results may change between requests; job availability is not guaranteed by a search result or an older archive.

  • 400: correct the missing or invalid parameters.
  • 401: let the user sign in; do not repeatedly retry.
  • 403: let the user finish Privacy Mode setup.
  • 503: search is temporarily unavailable; use bounded backoff and stop after a small number of attempts.

Capabilities and limitations

  • Autofill needs the Chrome extension, a supported form, and the user's reviewed profile. Missing profile details cannot be filled reliably; consult the support matrix.
  • Resume, cover-letter, and interview-preparation drafts need user review. Practice questions are suggestions, not an employer's actual interview questions.
  • Do not invent experience, qualifications, work authorization, consent, or demographic answers.
  • JobOfferMaster does not automatically submit applications. The user reviews answers and submits to the employer.
  • No remote MCP server or unattended application API is provided by these discovery files. Experimental browser tools, where available, are separate from this HTTP API contract.

Product documentation

  • How it works: Profile setup, extension installation, saving jobs, and reviewing applications.
  • Supported application platforms: Named ATS workflows, support levels, and autofill boundaries.
  • Chrome extension: Installation and supported browser workflow.
  • Open jobs: Public indexed job listings and dated archives; availability can change.
  • Trust and encryption: Browser-side encryption, key handling, and AI-processing boundaries.
  • Public trust manifest: Machine-readable implementation evidence and privacy limitations; not an independent audit.
  • Privacy policy: Personal information handling and service policies.
  • Help: Setup, account access, and troubleshooting.
  • Release notes: Published product and extension updates.
  • Contact: Product questions and support.