Send a candidate an adaptive assessment, look up the skills on their Lemma record and get the result back into your ATS. Every answer comes from recorded evidence, not from what a CV says.
Early access. There are no public docs, SDKs or self-serve keys yet. We set up each integration with the team that will use it.
Each integration reads from the same skill record people build on Lemma. You choose which part of the hiring flow it plugs into.
Create an invite for any active skill in the Lemma catalogue and send the candidate the link. They take an adaptive assessment in their own Lemma account. You get the score, the pass result, the level reached and an integrity score.
POST /v1/public/assess/invitesHow assessments workLook up a person's skills one at a time, or up to 100 people in one batch call. Each skill returns its level, evidence counts by type and when evidence was last added. A shared Passport can be checked against its signature and its revocation status.
GET /v1/public/verify/:uid/:skillKeyWhat a Passport contains
1{2 "uid": "u_7Kf2q9",3 "displayName": "Dana R.",4 "skillKey": "typescript",5 "level": 3,6 "verificationTier": "T3",7 "confidence": 82,8 "evidence": {9 "total": 15,10 "sessionsAsLearner": 6,11 "sessionsAsTeacher": 4,12 "assessmentsPassed": 1,13 "peerConfirms": 3,14 "externalProofs": 115 },16 "lastEvidenceAt": "2026-10-02T16:20:00.000Z",17 "verifiedAt": "2026-10-13T14:22:07.000Z"18}Subscribe an endpoint to assessment events: started, completed and expired. Attach your own metadata to an invite, such as a requisition ID, and it comes back on the completion event so the result lands on the right record.
assess_completedLemma for technical hiringThe candidate flow for an assessment invite, end to end.
Your system sends a skill key and the candidate's email. Invites stay open for 72 hours by default, and you can set your own window or cancel one before it starts.
They open the link, sign in or create a Lemma account, and start when ready. Question difficulty adapts to their answers as they go.
Score, pass result and level are stored against the invite. The integrity score starts at 100 and drops with signals such as tab switching, pasting or leaving full screen.
A signed assess_completed webhook reaches your endpoint, or you can read the invite directly. Invites that run out send assess_expired instead.
1Invite email
To maya.r@example.com
Halden Labs invited you to a React assessment
Sign in to Lemma and start when you are ready.
Open for 72 hours
2Candidate signs in
Uma K.
Signed in to Lemma
3Assessment in progress
Which hook keeps a value between renders without re-rendering?
Answers can't be changed
4Result in your ATS
Uma K. · REQ-2148
Passassess_completed · 14:32
X-Lemma-Signature verified
Field names follow the current early-access API and may change before general availability.
POST /v1/public/assess/invites
Authorization: Bearer lm_sandbox_••••••••
Content-Type: application/json
{
"skillKey": "python",
"candidateEmail": "candidate@example.com",
"candidateName": "Rina T.",
"expiresInHours": 72,
"metadata": { "requisitionId": "REQ-1042" }
}
201 Created
{
"id": "inv_…",
"skillKey": "python",
"skillLabel": "Python",
"candidateEmail": "candidate@example.com",
"status": "pending",
"assessmentUrl": "https://app.getlemma.io/en/assess/inv_…",
"expiresAt": "2026-10-15T09:00:00.000Z",
"createdAt": "2026-10-12T09:00:00.000Z"
}POST https://ats.example.com/hooks/lemma
X-Lemma-Event: assess_completed
X-Lemma-Signature: t=1760270400,v1=9c41…e07b
X-Lemma-Delivery-Id: dlv_…
{
"event": "assess.completed",
"inviteId": "inv_…",
"skillKey": "python",
"result": {
"passed": true,
"score": 7.8,
"level": "advanced",
"tier": "T4",
"integrityScore": 95
},
"metadata": { "requisitionId": "REQ-1042" },
"completedAt": "2026-10-12T14:05:00.000Z"
}The API handles candidate data, so access is narrow by default and every call leaves a record.
Each key carries only the scopes it needs: assess_write to create invites, assess_read to read them, verify_read for skill lookups. A call outside a key's scopes is refused.
Sandbox keys (lm_sandbox_) return synthetic records only and never reach real people. Live keys (lm_live_) are issued by Lemma to an organisation once it has signed the Verification Agreement.
The full key is shown once, when it is created. Lemma keeps only a SHA-256 hash and a short prefix, and any key can be revoked at once.
Every delivery carries a timestamp and an HMAC-SHA256 signature in X-Lemma-Signature. Failed deliveries retry with exponential backoff, up to five attempts, and each attempt is logged.
Limits apply per key and return 429 with a Retry-After header. Every call is logged against the key that made it, which is what usage is counted from.
A live lookup returns a person only if they have granted your organisation consent and confirmed they are 18 or older. Consent is checked on every call; each lookup is shown to the candidate, who can revoke it at any time, and you get a consent_revoked webhook when they do.
Tell us what you need to verify and where the results should go. We are onboarding a small number of teams to the API, starting with sandbox keys.
Or write to us at hello@getlemma.io
