Skip to content
Yareta

Partner GraphQL

Human users of the app do not need GraphQL. This page is for approved technical partners embedding Yareta in another product.

Endpoint: POST https://platform.yareta.ai/api
Content-Type: application/json
Body: { "query": "...", "variables": { }, "operationName": "OptionalName" }
Auth: Authorization: Bearer <OAuth access token> (or a partner credential Yareta issued)

GET /api returns a short health string and is not an API.

What you can expect to call

After OAuth, typical partner operations (names can be confirmed on your contract) include:

  • Current user / organisation (getUserDataQuery and related)
  • List and create submissions (companies / candidates) for the user’s org
  • Read scores, founders, and reports the user can already see in the UI
  • Integration helpers the user has connected

Yareta will give you an allowlisted operation list. Do not enumerate or call admin, billing-admin, prompt, or other tenants’ data operations.

Example

{
  "query": "query Me { getUserDataQuery { email } }"
}
Terminal window
curl -sS https://platform.yareta.ai/api \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"query":"query Me { getUserDataQuery { email } }"}'

Errors

  • Transport auth failure: HTTP 401 { "error": "Unauthorized" } (or invalid token message).
  • GraphQL field errors: HTTP 200 with errors[]. Check both.

CORS

Browser calls to GraphQL from arbitrary origins are not the supported partner pattern. Use a backend (your server or a BFF) with the OAuth client secret.

Schema

A public introspectable schema is not guaranteed. Use the operations Yareta shares with you. If introspection is disabled in your environment, that is intentional.