# Skills verification API for hiring platforms

> Early-access API for hiring and HR software: send candidates adaptive skill assessments, look up verified skills and receive results by signed webhook.

Source: https://getlemma.io/developers

Send a candidate an adaptive assessment, look up the skills on their Lemma record and get the result back into your ATS. Every answer comes from recorded evidence, not from what a CV says.

See the candidate flow

Early access. There are no public docs, SDKs or self-serve keys yet. We set up each integration with the team that will use it.

![Painting of sand dunes and beach grass beside a calm sea](https://cdn.sanity.io/images/islu4peo/production/dff90452f76e9c536c5e144f0078c5cc8670c3cf-1680x1120.jpg?w=1080&fm=webp&q=68&fit=max)

## Three integrations, one evidence record.

Each integration reads from the same skill record people build on Lemma. You choose which part of the hiring flow it plugs into.

### Candidate assessments

Create an invite for any active skill in the Lemma catalogue and send the candidate the link. They take an adaptive assessment in their own Lemma account. You get the score, the pass result, the level reached and an integrity score.

`POST /v1/public/assess/invites`[How assessments work](https://getlemma.io/product/assessments)

### Skill and Passport checks

Look up a person's skills one at a time, or up to 100 people in one batch call. Each skill returns its level, evidence counts by type and when evidence was last added. A shared Passport can be checked against its signature and its revocation status.

`GET /v1/public/verify/:uid/:skillKey`[What a Passport contains](https://getlemma.io/product/passport)

### Results in your ATS

Subscribe an endpoint to assessment events: started, completed and expired. Attach your own metadata to an invite, such as a requisition ID, and it comes back on the completion event so the result lands on the right record.

`assess_completed`[Lemma for technical hiring](https://getlemma.io/solutions/technical-hiring)

## From invite to result.

The candidate flow for an assessment invite, end to end.

1.  ### Create an invite

    Your system sends a skill key and the candidate's email. Invites stay open for 72 hours by default, and you can set your own window or cancel one before it starts.

2.  ### The candidate takes it

    They open the link, sign in or create a Lemma account, and start when ready. Question difficulty adapts to their answers as they go.

3.  ### The result is recorded

    Score, pass result and level are stored against the invite. The integrity score starts at 100 and drops with signals such as tab switching, pasting or leaving full screen.

4.  ### You get it back

    A signed assess\_completed webhook reaches your endpoint, or you can read the invite directly. Invites that run out send assess\_expired instead.

[How evidence is weighed](https://getlemma.io/methodology#how-evidence-is-weighed)

## What a request looks like.

Field names follow the current early-access API and may change before general availability.

Create an invite

```
POST /v1/public/assess/invites
Authorization: Bearer lm_sandbox_••••••••
Content-Type: application/json

{
  "skillKey": "python",
  "candidateEmail": "candidate@example.com",
  "candidateName": "Rina T.",
  "expiresInHours": 72,
  "metadata": { "requisitionId": "REQ-1042" }
}

201 Created
{
  "id": "inv_…",
  "skillKey": "python",
  "skillLabel": "Python",
  "candidateEmail": "candidate@example.com",
  "status": "pending",
  "assessmentUrl": "https://app.getlemma.io/en/assess/inv_…",
  "expiresAt": "2026-10-15T09:00:00.000Z",
  "createdAt": "2026-10-12T09:00:00.000Z"
}
```

Completion webhook, abridged

```
POST https://ats.example.com/hooks/lemma
X-Lemma-Event: assess_completed
X-Lemma-Signature: t=1760270400,v1=9c41…e07b
X-Lemma-Delivery-Id: dlv_…

{
  "event": "assess.completed",
  "inviteId": "inv_…",
  "skillKey": "python",
  "result": {
    "passed": true,
    "score": 7.8,
    "level": "advanced",
    "tier": "T4",
    "integrityScore": 95
  },
  "metadata": { "requisitionId": "REQ-1042" },
  "completedAt": "2026-10-12T14:05:00.000Z"
}
```

## Scoped, signed and logged.

The API handles candidate data, so access is narrow by default and every call leaves a record.

### Scoped keys

Each key carries only the scopes it needs: assess\_write to create invites, assess\_read to read them, verify\_read for skill lookups. A call outside a key's scopes is refused.

### Sandbox and live keys

Sandbox keys (lm\_sandbox\_) return synthetic records only and never reach real people. Live keys (lm\_live\_) are issued by Lemma to an organisation once it has signed the Verification Agreement.

### Keys stored as hashes

The full key is shown once, when it is created. Lemma keeps only a SHA-256 hash and a short prefix, and any key can be revoked at once.

### Signed webhooks with retries

Every delivery carries a timestamp and an HMAC-SHA256 signature in X-Lemma-Signature. Failed deliveries retry with exponential backoff, up to five attempts, and each attempt is logged.

### Rate limits and usage logs

Limits apply per key and return 429 with a Retry-After header. Every call is logged against the key that made it, which is what usage is counted from.

### Consent checked on every lookup

A live lookup returns a person only if they have granted your organisation consent and confirmed they are 18 or older. Consent is checked on every call; each lookup is shown to the candidate, who can revoke it at any time, and you get a consent\_revoked webhook when they do.

[Read how Lemma handles security](https://getlemma.io/security)

## API access, answered.

### Is there public API documentation?

Not yet. While the API is in early access, we share reference material directly with each team we onboard. Public documentation will follow when access opens more widely.

### Can I create an API key myself?

No. Keys are issued during onboarding, starting with a sandbox key, so scopes and rate limits are agreed with your team first.

### What does a skill lookup return?

For each skill: its level, evidence counts by type (sessions as learner and as teacher, assessments passed, peer confirmations, external proofs) and when evidence was last added. It does not return assessment answers or session content.

### What does API access cost?

Pricing is agreed with each early-access team. Write to hello@getlemma.io with the volume of assessments and lookups you expect.

### How can I verify a developer's skills through an API?

Send the candidate an assessment invite for one skill. When they start it, they can also let your organisation look up their other skill records; with that consent, the API returns levels and evidence counts. Signed webhooks report when an invite is started, completed or expired, and when consent is revoked. The API is in early access.

![Painting of lavender fields stretching towards distant mountains](https://cdn.sanity.io/images/islu4peo/production/7e50477b06c4c311359fe477e92c3f2b3d38e848-1680x945.jpg?w=1080&fm=webp&q=68&fit=max)

## Building hiring or HR software?

Tell us what you need to verify and where the results should go. We are onboarding a small number of teams to the API, starting with sandbox keys.

Or write to us at [hello@getlemma.io](mailto:hello@getlemma.io)