Your first request

Updated September 6, 2026

One request, one response, and what each field is for. Everything below is curl; any HTTP client works the same way.

Send the key

Present the key as a bearer token:

curl https://api.wipperoz.com/v1/jobs \
  -H "Authorization: Bearer $ORBIT_API_KEY"

The x-api-key header is accepted too, for clients that cannot set Authorization:

curl https://api.wipperoz.com/v1/jobs \
  -H "x-api-key: $ORBIT_API_KEY"

Read the response

{
  "jobs": [
    {
      "id": "job_01J8Z3K9Q0EXAMPLE",
      "status": "published",
      "title": "Senior Backend Engineer",
      "description": "Own the services behind our hiring pipeline, from the API surface to the queues that move applications through it.",
      "responsibilities": ["Design and ship services on AWS Lambda and DynamoDB"],
      "skills": [{"name": "TypeScript", "level": "required"}],
      "benefits": ["Remote-first"],
      "seniority": "senior",
      "employmentType": "full_time",
      "contractType": "permanent",
      "salary": {"min": 150000, "max": 180000, "currency": "AUD", "period": "year"},
      "location": {"country": "AU", "state": "NSW", "city": "Sydney", "remotePolicy": "hybrid"},
      "company": {"name": "Acme Robotics"},
      "postedAt": "2026-09-01T02:15:00.000Z",
      "updatedAt": "2026-09-03T10:40:00.000Z",
      "expiresAt": "2026-10-01T02:15:00.000Z",
      "url": "https://www.wipperoz.com/en/jobs/acme-robotics/senior-backend-engineer",
      "applyLink": "https://www.wipperoz.com/en/apply/job_01J8Z3K9Q0EXAMPLE?src=careers&account=acc_01J8Z3EXAMPLE"
    }
  ],
  "nextCursor": null
}

Three fields carry the weight:

status is published, closed or expired. Only published accepts applications. The other two are returned rather than omitted so your page can say “this role has closed” instead of showing a broken link.
applyLink is where a candidate applies. Link to it; do not copy the form. The src=careers&account=… on the end is how the apply page records that the candidate came from your site, which is what makes your careers-page applications separable from the ones Wipperoz sends.
nextCursor is null when this is the last page. When it is not, pass it back as ?cursor= for the next one.

One job

curl https://api.wipperoz.com/v1/jobs/job_01J8Z3K9Q0EXAMPLE \
  -H "Authorization: Bearer $ORBIT_API_KEY"

Another account’s job, a draft and an unknown id all answer 404. A draft has no public existence yet.

Headers on every response

X-RateLimit-Limit: 120
X-RateLimit-Remaining: 119
X-RateLimit-Reset: 1788700860

Each key may make 120 requests a minute. Over that, the answer is 429 with a Retry-After in seconds. A careers page that syncs on a schedule will never see it.

When something goes wrong

Every error has the same shape:

{
  "error": {
    "code": "forbidden",
    "message": "This key does not carry the `jobs:read` scope. Mint a key with it in Orbit → Settings → API keys.",
    "requestId": "5f7a9c1e-2b3d-4e5f-8a9b-0c1d2e3f4a5b"
  }
}

Quote the requestId when you write to support. The full list of codes and every parameter is in the reference:

List the account's jobsGET /v1/jobs