Onboardly
Get started

Partner API Create candidates, collect documents and references, retrieve the compliance pack.

Get an API key

List unmatched attachments

List the files a candidate sent that the bot kept but could not match to a document.

GET/api/v1/candidates/{id}/attachments#

List the files a candidate sent that the bot kept but could not match to a document, newest first.

Headers

X-Api-Keyonb_live_<key_id>_<secret>required
Your issued Partner API key — see Authentication.

Request fields

limitintegeroptional
1–100, default 50. Out of range or non-integer is rejected outright, never clamped.
cursorstringoptional
Opaque — pass back the exact next_cursor value from a previous page.

Status codes

2002xx
A page of attachments, newest first. An empty attachments array means none are held.
4004xx
?limit failed validation, or ?cursor is malformed/tampered/calendar-invalid.
Invalid query parameter: limitInvalid or expired cursor
4014xx
Missing, malformed, unknown, revoked or expired key. Every authentication failure looks the same — see Authentication.
4044xx
Unknown, cross-tenant, sandbox-hidden, or a malformed {id} — one outcome, never a 403.
Not found
4294xx
Per-key or per-account rate limit exceeded. Retry after the Retry-After header.
Too many requests — please try again shortly.
5005xx
The service is not configured to read candidate records.
This resource is temporarily unavailable. Try again shortly.
5035xx
The attachment list, or the lookup of each one’s message_id, could not be read. Never a confident empty list — retry.
Some of this candidate’s records could not be read right now. Try again shortly.
  • Lists only files the bot stored but could not match to any document on the candidate’s checklist, so each one has status: needs_review. A file matched to a document is served by Retrieve document content instead.
  • Also lists files the candidate sent while the bot was paused (a recruiter took over the chat, or the chat is on hold for a name check), after consent. These were never read by the bot.
  • message_id is the id Retrieve messages lists the WhatsApp message under. It is null when that message has no copy in the history.
  • received_at is when the bot stored the file, which is after the message itself arrived.
  • Iterate by passing each page’s next_cursor back as ?cursor until it comes back null.
cURL
curl \
  "https://rca-onboardly.com/api/v1/candidates/<candidate id>/attachments" \
  -H "X-Api-Key: $ONB_KEY"
200 · Response
{
  "attachments": [
    {
      "id": "7c2e9b41-5d3a-4f8e-b6a1-0e4d2c9f8a13",
      "message_id": "b2f4c1a0-7e3d-4a9c-8b1f-2d6e5a9c3f70",
      "content_type": "application/pdf",
      "size_bytes": 184320,
      "received_at": "2026-09-24T13:26:41.118+00:00",
      "status": "needs_review",
      "content_url": "https://rca-onboardly.com/api/v1/candidates/3f9c1a2e-8b7d-4c1f-9a3e-2d5f8c1b4e70/attachments/7c2e9b41-5d3a-4f8e-b6a1-0e4d2c9f8a13/content"
    }
  ],
  "next_cursor": null
}
PreviousRetrieve the CVNextRetrieve attachment content