Application form links

Publish the account’s one stable public application-form link, or mint per-campaign links that each carry their own document checklist.

Two different kinds of link, five endpoints

The account link is ONE per account, published once and dropped into your careers page — POST is an idempotent ensure, never a rotation. A campaign link is minted as many times as you like, each with its own documents checklist, and can be revoked independently.

The account link#

GET/api/v1/application-form/link#

Read the account’s one stable public application-form link, if one has been published.

Headers

X-Api-Keyonb_live_<key_id>_<secret>required: Your issued Partner API key — see Authentication.

Status codes

2002xx: { url: null, slug: null } when nothing has been published yet — a genuine checked answer, never an error. Otherwise the live link.
4014xx: Missing, malformed, unknown or revoked key. Every authentication failure looks the same — see Authentication.
4294xx: Per-key or per-account rate limit exceeded. Retry after the Retry-After header.
Too many requests — please try again shortly.
5035xx: The read itself failed. Never a confident { url: null, slug: null } — retry.
Some of this candidate’s records could not be read right now. Try again shortly.

Account-level, not candidate-level — there is no {id} in this path, and no request body.

cURL

curl \
  "https://rca-onboardly.com/api/v1/application-form/link" \
  -H "X-Api-Key: $ONB_KEY"

200 · Nothing published yet

{
  "url": null,
  "slug": null
}

200 · Published

{
  "url": "https://rca-onboardly.com/application-form/k7m9pqr2",
  "slug": "k7m9pqr2"
}

POST/api/v1/application-form/link#

Mint the account’s one stable public application-form link, or return the one that already exists.

Headers

X-Api-Keyonb_live_<key_id>_<secret>required: Your issued Partner API key — see Authentication.

Status codes

2002xx: Minted, or (this account already published one) the SAME existing link — a repeat call is always safe to make again.
4014xx: Missing, malformed, unknown or revoked key. Every authentication failure looks the same — see Authentication.
4294xx: Per-key or per-account rate limit exceeded. Retry after the Retry-After header.
Too many requests — please try again shortly.
5005xx: No service client, the mint failed, or (the already-published case) the follow-up read of the existing link failed. Every failure on this route returns the same message — retry.
This resource is temporarily unavailable. Try again shortly.

No rotate verb — deliberately

This call only ever ENSURES a link exists; it never replaces one. Rotating would silently break every careers page already carrying the old URL. If you need a fresh URL for a specific campaign instead of the account’s one stable link, mint a campaign link below rather than trying to force this one to change.

No request body — the API key alone identifies which account’s link to ensure.

cURL

curl -X POST \
  "https://rca-onboardly.com/api/v1/application-form/link" \
  -H "X-Api-Key: $ONB_KEY"

200 · Minted for the first time

{
  "url": "https://rca-onboardly.com/application-form/k7m9pqr2",
  "slug": "k7m9pqr2"
}

200 · Already published — the existing link, unchanged

{
  "url": "https://rca-onboardly.com/application-form/k7m9pqr2",
  "slug": "k7m9pqr2"
}

Campaign links#

GET/api/v1/application-form/links#

List every campaign application-form link this account has minted.

Headers

X-Api-Keyonb_live_<key_id>_<secret>required: Your issued Partner API key — see Authentication.

Status codes

2002xx: Every link this account owns, most recent first — see the note below about revoked ones.
4014xx: Missing, malformed, unknown or revoked key. Every authentication failure looks the same — see Authentication.
4294xx: Per-key or per-account rate limit exceeded. Retry after the Retry-After header.
Too many requests — please try again shortly.
5035xx: The read itself failed. Never a confident empty list — retry.
Some of this candidate’s records could not be read right now. Try again shortly.

This list INCLUDES revoked links

A revoked link is not filtered out server-side — it is returned with revokedAt set, the same way the dashboard’s own manage list shows it. Filter for revokedAt === null yourself if you only want links that currently resolve.

cURL

curl \
  "https://rca-onboardly.com/api/v1/application-form/links" \
  -H "X-Api-Key: $ONB_KEY"

200 · Response

[
  {
    "id": "5b7e2b4b-6f8b-4a9e-9c3a-8e1c9d0a6f52",
    "slug": "k7m9pqr2",
    "url": "https://rca-onboardly.com/application-form/k7m9pqr2",
    "documents": [
      "DBS",
      "Right to Work"
    ],
    "label": "Support Workers — autumn intake",
    "createdAt": "2026-09-10T09:02:14Z",
    "expiresAt": null,
    "revokedAt": null
  }
]

POST/api/v1/application-form/links#

Mint a fresh campaign application-form link with its own document checklist.

Headers

X-Api-Keyonb_live_<key_id>_<secret>required: Your issued Partner API key — see Authentication.

Request fields

documentsstring[]required: Each entry must be one of this deployment's CLOSED document-type names — unlike Create a candidate and Add documents (see Document names), an unrecognised name here is refused with invalid_documents, not accepted freely. Up to 50 entries. May be [] to mint a link with no checklist yet.
labelstring or nulloptional: Up to 80 characters. Your own name for the campaign — never shown to the candidate.

Status codes

2002xx: Minted. Always a fresh id and slug — there is no idempotent-ensure behaviour here, unlike the single account link above.
4004xx: Malformed body, an unrecognised document name, too many documents, an over-length label, or a document set with nothing collectible in it.
invalid_jsoninvalid_documentsinvalid_labellabel_too_longtoo_many_documentsno_collectible_documents
4014xx: Missing, malformed, unknown or revoked key. Every authentication failure looks the same — see Authentication.
4294xx: Per-key or per-account rate limit exceeded. Retry after the Retry-After header.
Too many requests — please try again shortly.
5005xx: No service client, or the mint could not be committed after retrying.
This resource is temporarily unavailable. Try again shortly.exhaustedwrite_failed

`documents` is a CLOSED list here — not the same rule as Create a candidate / Add documents

Recognised names today: Passport, DBS, Social Work England, NMC Registration, HCPC Registration, Right to Work, Proof of Address 1, Proof of Address 2, Driving Licence, Training Certificate. Any other string is refused with invalid_documents — this endpoint does NOT accept an arbitrary role-specific name the way Create a candidate and Add documents do. no_collectible_documents guards a non-empty set that is entirely reference/CV-shaped names; no name in the list above is one, so it is not reachable through this vocabulary as the config stands today — it exists in case that config ever changes.

organisationId and createdBy are always null on a link minted through this API — an integration key identifies a recruiter, not a human user.

cURL

curl -X POST \
  "https://rca-onboardly.com/api/v1/application-form/links" \
  -H "X-Api-Key: $ONB_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "documents": [
    "DBS",
    "Right to Work"
  ],
  "label": "Support Workers — autumn intake"
}'

Request body

{
  "documents": [
    "DBS",
    "Right to Work"
  ],
  "label": "Support Workers — autumn intake"
}

200 · Response

{
  "id": "5b7e2b4b-6f8b-4a9e-9c3a-8e1c9d0a6f52",
  "slug": "k7m9pqr2",
  "url": "https://rca-onboardly.com/application-form/k7m9pqr2",
  "documents": [
    "DBS",
    "Right to Work"
  ],
  "label": "Support Workers — autumn intake"
}

DELETE/api/v1/application-form/links#

Revoke one campaign application-form link.

Headers

X-Api-Keyonb_live_<key_id>_<secret>required: Your issued Partner API key — see Authentication.

Request fields

linkIdstring (UUID)required: The id from a List application-form links row or a Mint a campaign link response.

Status codes

2002xx: Revoked. Re-revoking an already-revoked link is a harmless no-op, not an error.
4004xx: Malformed body, or linkId missing/blank.
invalid_jsonlink_id_required
4014xx: Missing, malformed, unknown or revoked key. Every authentication failure looks the same — see Authentication.
4044xx: A linkId that is not even UUID-shaped, one this account does not own, or one that does not exist — one outcome, never distinguishable, and checked before the rate limit is spent.
not_found
4294xx: Per-key or per-account rate limit exceeded. Retry after the Retry-After header.
Too many requests — please try again shortly.
5005xx: No service client, or the write itself failed.
This resource is temporarily unavailable. Try again shortly.write_failed

A non-UUID-shaped linkId 404s here rather than 400ing — a ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$ shape check runs before any query, so a malformed id gets the SAME 404 a genuine foreign or missing id does.

cURL

curl -X DELETE \
  "https://rca-onboardly.com/api/v1/application-form/links" \
  -H "X-Api-Key: $ONB_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "linkId": "5b7e2b4b-6f8b-4a9e-9c3a-8e1c9d0a6f52"
}'

Request body

{
  "linkId": "5b7e2b4b-6f8b-4a9e-9c3a-8e1c9d0a6f52"
}

200 · Response

{
  "revoked": true
}

PreviousRestart a candidate’s journey NextApproved templates

GET /api/v1/application-form/link

cURL

curl \
  "https://rca-onboardly.com/api/v1/application-form/link" \
  -H "X-Api-Key: $ONB_KEY"

200 · Nothing published yet

{
  "url": null,
  "slug": null
}

200 · Published

{
  "url": "https://rca-onboardly.com/application-form/k7m9pqr2",
  "slug": "k7m9pqr2"
}

POST /api/v1/application-form/link

cURL

curl -X POST \
  "https://rca-onboardly.com/api/v1/application-form/link" \
  -H "X-Api-Key: $ONB_KEY"

200 · Minted for the first time

{
  "url": "https://rca-onboardly.com/application-form/k7m9pqr2",
  "slug": "k7m9pqr2"
}

200 · Already published — the existing link, unchanged

{
  "url": "https://rca-onboardly.com/application-form/k7m9pqr2",
  "slug": "k7m9pqr2"
}

GET /api/v1/application-form/links

cURL

curl \
  "https://rca-onboardly.com/api/v1/application-form/links" \
  -H "X-Api-Key: $ONB_KEY"

200 · Response

[
  {
    "id": "5b7e2b4b-6f8b-4a9e-9c3a-8e1c9d0a6f52",
    "slug": "k7m9pqr2",
    "url": "https://rca-onboardly.com/application-form/k7m9pqr2",
    "documents": [
      "DBS",
      "Right to Work"
    ],
    "label": "Support Workers — autumn intake",
    "createdAt": "2026-09-10T09:02:14Z",
    "expiresAt": null,
    "revokedAt": null
  }
]

POST /api/v1/application-form/links

cURL

curl -X POST \
  "https://rca-onboardly.com/api/v1/application-form/links" \
  -H "X-Api-Key: $ONB_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "documents": [
    "DBS",
    "Right to Work"
  ],
  "label": "Support Workers — autumn intake"
}'

Request body

{
  "documents": [
    "DBS",
    "Right to Work"
  ],
  "label": "Support Workers — autumn intake"
}

200 · Response

{
  "id": "5b7e2b4b-6f8b-4a9e-9c3a-8e1c9d0a6f52",
  "slug": "k7m9pqr2",
  "url": "https://rca-onboardly.com/application-form/k7m9pqr2",
  "documents": [
    "DBS",
    "Right to Work"
  ],
  "label": "Support Workers — autumn intake"
}

DELETE /api/v1/application-form/links

cURL

curl -X DELETE \
  "https://rca-onboardly.com/api/v1/application-form/links" \
  -H "X-Api-Key: $ONB_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "linkId": "5b7e2b4b-6f8b-4a9e-9c3a-8e1c9d0a6f52"
}'

Request body

{
  "linkId": "5b7e2b4b-6f8b-4a9e-9c3a-8e1c9d0a6f52"
}

200 · Response

{
  "revoked": true
}