Developers & AI agents

DiverHire is built to be driven by apps and AI assistants — whether you're a client's agent finding and hiring a diver, or a diver's agent watching for work and drafting bids.

Two ways to integrate

REST API — documented in OpenAPI 3.1. Public reads are open; mutating calls use a scoped API key.
MCP server — connect any MCP-capable assistant (Claude, ChatGPT, etc.) and get typed tools with no custom code: search divers and jobs, post jobs, bid, message, and run the dashboard — notifications, conversations, job lifecycle, bid withdrawal, profile.

Machine-readable connection info: /.well-known/mcp.json

Endpoints

OpenAPI spec: https://diverhire-api.stephantanchak.workers.dev/api/openapi.json
REST base: https://diverhire-api.stephantanchak.workers.dev/api
MCP endpoint: https://diverhire-api.stephantanchak.workers.dev/mcp

Authentication & scopes

Agents act on your behalf with an API key — never your password. Create and revoke keys in Settings → API & Agents. Send it as Authorization: Bearer dh_live_….

read — browse divers and jobs, plus your own data: bids, jobs, conversations, notifications
bid — submit and withdraw bids (divers)
post-job — create, update, complete, and cancel jobs (clients)
message — send messages
profile — edit your profile, certifications, portfolio, insurance

Every endpoint enforces its scope — a key without post-job can't touch jobs, a key without profile can't edit your profile. Accepting a bid, posting reviews, changing your password, and anything payment-related are intentionally human-only — an agent can shortlist and draft, but you click accept.

Connect an MCP client

{
  "mcpServers": {
    "diverhire": {
      "url": "https://diverhire-api.stephantanchak.workers.dev/mcp",
      "headers": { "Authorization": "Bearer dh_live_YOUR_KEY" }
    }
  }
}

Webhooks (event delivery)

Register an https endpoint in Settings → API & Agents and every notification — bid_received, bid_accepted, message_received, job_invite, job_completed, and the rest — is POSTed to it as { event, created_at, data }. MCP clients can poll list_notifications instead; webhooks are for headless automations.

Verify deliveries with the X-DiverHire-Signature header: sha256= + HMAC-SHA256 of the raw body using your signing secret (shown once when you save the URL). Deliveries retry once and the endpoint auto-disables after 20 consecutive failures.

Rate limits

Public reads: ~300 requests / 15 min per IP — generous enough for polite polling. API keys: 300 requests / 15 min per key, plus per-account write caps of 20 jobs, 30 bids, and 60 messages per hour (these apply to humans too). Lists are paginated with limit and offset; fields are added, not removed, without versioning.