How to find any company's job board from just its domain, without a list

Most tech companies run their careers page on an ATS: Greenhouse, Ashby, Workable, Workday, BambooHR and a handful of others. Nearly all of those expose a public JSON endpoint for their postings, no key and no login. The endpoint needs a board token, though, which is the company's slug inside that ATS.

And that is the actual problem. You have stripe.com. You need to know that Stripe is on Greenhouse under the token stripe, and every tutorial starts one step after that, with the token already in hand. Here is what actually works, and the measurement that says so.

The obvious approach is the worse one

Fetch the company's careers page, look for a link to boards.greenhouse.io or jobs.ashbyhq.com, pull the token out of the URL. Measured across 30 companies: that finds the board 50% of the time. It fails on exactly the companies you most want.

Stripe's careers page is a JavaScript application that names no board anywhere in the delivered HTML. Render it in a headless browser and you have turned a 200ms JSON fetch into a multi-second browser run, for a token that is five characters long.

Guess the token, then verify it

The better approach inverts it. Derive candidate tokens from the domain, then ask each ATS whether that board exists. On these platforms a bogus token returns 404 and a real one returns 200 with the postings, so a 200 is proof. You never need the careers page at all.

import httpx

BOARDS = {
    "greenhouse": "https://boards-api.greenhouse.io/v1/boards/{t}/jobs",
    "ashby": "https://api.ashbyhq.com/posting-api/job-board/{t}",
    "workable": "https://apply.workable.com/api/v1/widget/accounts/{t}?details=true",
    "bamboohr": "https://{t}.bamboohr.com/careers/list",
}

def resolve(domain: str):
    token = domain.split("//")[-1].split("/")[0].split(".")[-2]
    hits = []
    for ats, url in BOARDS.items():
        r = httpx.get(url.format(t=token), timeout=15)
        if r.status_code == 200:
            # a 200 here is proof
            hits.append((ats, token, r.json()))
    return hits

Measured on the same 30 companies: 90%, including Stripe, whose Greenhouse board answers with more than 500 open roles the careers page never mentioned. (Check it yourself: boards-api.greenhouse.io/v1/boards/stripe/jobs. The count moves daily, which is rather the point.)

One attempt per guess, not a retry ladder. A guessed token either exists or it does not, and retrying every wrong guess three times is what turns a sweep of 90 domains into 25 seconds each.

The part that will bite you

Two failure modes look identical to a naive script, and both produce a confident wrong answer.

A company can run more than one ATS. Take the board with the most postings, not the first one that answers 200. Otherwise a company with a stale Lever board from 2023 and a live Greenhouse board resolves to the dead one.

An empty board is a real answer, and it is not the answer you want. nvidia.com resolves to a genuine Workable account with zero open roles. NVIDIA has about 2,000 postings. They are on Workday. So "Workable, 0 roles" is true and completely misleading. If you return that bare, your caller reads "NVIDIA is not hiring", which is the same lie a 404 tells when you read it as "nothing found". Return the emptiness as a fact of its own:

best = max(hits, key=lambda h: len(h[2]))
result = {
    "ats": best[0],
    "token": best[1],
    "isEmpty": len(best[2]) == 0,
    "alternatives": [h[:2] for h in hits if h is not best]
}

And Workday cannot be guessed at all. Its URLs look like https://nvidia.wd5.myworkdayjobs.com/NVIDIAExternalCareerSite: a tenant, a numbered data centre and a site name, none of which follow from the domain. For Workday you need the careers URL itself. There is no trick here, and any library that claims to find Workday from a domain is guessing.

If you would rather not run it yourself I maintain an index built this way: 24,280 company boards across 10 ATS platforms, 688,711 open roles, rebuilt nightly, no login and no company list needed. It is on Apify as ATS Jobs Search API, and the single-platform ones are Greenhouse, Workday, Ashby, Workable and BambooHR. The 30-company and 90-domain numbers above are from building it.

If you hit a case where guess-and-verify fails and the careers page would have worked, I would genuinely like to know which company.