Requested permissions for the Chrome Extension, Slack and other Integrations

in this guide, we'll walk through the permissions requested for other integrations in ashby, including the chrome extension, slack, marketplace integrations and out developer api ashby’s chrome extension privileges see chrome extension docid\ je bij1sj2ro6wt9vttfp for more details about this feature the ashby chrome extension requests the following permissions for candidate sourcing read and change data on specific sites (host permissions) github displays matching candidates or pulls potential matches but does not modify data gmail reads email addresses in threads to cross reference candidates but does not modify emails ashby app ensures the extension works seamlessly with ashby (e g , adding candidates, enrolling sequences) read your browsing history (tabs) the code uses this to notice when you switch pages so the right panel state shows up; it does not store or send your history anywhere active tab access (activetab) gives the extension temporary access to the current tab's url and content only when you click it (revoked when you navigate away) used to toggle the side panel, detect pdf resume and csv downloads on linkedin, and show a badge on the ashby toolbar icon when the linkedin or github profile you are viewing is already a candidate in ashby modify the data you copy and paste (clipboardwrite) lets you copy candidate details from the extension to your clipboard it can only write to the clipboard, never read it manage downloads (downloads) adds candidates to ashby when you download a resume pdf or candidate list csv from linkedin the extension only reads and transmits a file if it comes from linkedin and the ashby side panel is open downloads from any other site are never read or transmitted access cookies (cookies) used exclusively to read a single ashby login cookie on app ashbyhq com, so the extension knows when you sign in or out of ashby the extension does not read cookies on github, gmail, or any other site local storage (storage) stores extension state locally on your machine (e g your preferences) no data is transmitted externally side panel ( sidepanel ) powers the ashby side panel in chrome, allowing you to view and manage candidates without navigating away from your current page inject content into pages ( scripting ) uses the scripting permission (and web accessible resources in our manifest) to inject content scripts in two cases side panel fallback for chromium browsers that don't support chrome's native side panel (e g , some enterprise browsers), we render the ashby interface alongside the active tab's content, mimicking the side panel without overlaying or interrupting the page site integrations injects scripts on github and gmail so the extension can display within those pages ashby's integration for slack for more on setting up the integration for slack, check out slack docid\ w4wjftj8j0vkkxykl2vqo ashby's integration for slack allows your talent team to receive recruiting alerts, automate interview workflows, and manage hiring conversations inside slack ashby requests broad permissions at install time, even if only a subset is used this is because of how slack scopes work this section outlines the permissions requested and why we ask for them why ashby requests elevated slack scopes slack groups multiple actions (e g , posting and joining channels) under single permission categories, which means even if ashby only posts alerts, it must also request scopes that allow managing channels or uploading files slack apps cannot selectively request parts of a scope, all bundled capabilities must be accepted together scopes ashby needs to work correctly the ashby integration accesses the following scopes scope description channels\ read view basic information about public channels in a workspace channels\ manage manage public channels that your slack app has been added to and create new ones enables ashby to automatically create candidate specific channels, add interviewers, and archive channels post hire this is only triggered if auto channel workflows are enabled chat\ write post messages in approved channels & conversations chat\ write public send messages to channels ashby bot isn't a member of allows ashby to deliver alerts (e g , new applicants, interview updates) to channels without requiring admins to manually invite the bot files\ write upload attachments used to deliver resumes, prep docs, or scorecards via slack, along with scheduled dashboards ashby does not delete files unless explicitly instructed; this capability is included because slack groups file actions under one scope groups\ read view basic information about private channels that ashby bot has been added to groups\ write manage private channels that ashby bot has been added to and create new ones enables ashby to automatically create candidate specific channels, add interviewers, and archive channels post hire this is only triggered if auto channel workflows are enabled im\ read view basic information about direct messages ashby bot has been added to im\ write start direct messages with people users\ read view people in a workspace users\ read email view email addresses of people in a workspace how permissions are used ashby only uses these permissions in line with the workflows your team enables in ashby if you're not using slack alerts or auto channel creation, those actions will not be performed however, slack requires all permissions to be accepted up front during installation, regardless of whether they’re actively used ashby post hire integrations ashby integrates with hris systems (e g , hi bob docid\ vnuucxqmztc0bbxh fnqj , workday docid\ lser77ihgverwt8ovu5gx ) to mark hired candidates as employees create employee records in the hris support post hire workflows like tracking requisitions (e g , in workday) ashby uses hris api keys to submit and query relevant records the specific access needed depends on your hris refer to ashby’s knowledge base for detailed integration requirements marketplace integrations ashby offers first party integrations developed by ashby (e g , zoom docid\ s9xgv03nq8kcar0 ifd9l ) third party integrations developed by partners (e g levels fyi docid\ eihxqfxzocwhg090i50f7 ) for third party integrations, please contact the vendor directly for security, access, or privacy related questions ashby developer api ashby provides a developer api for customers, accessed via api keys access control keys are generated by users with the "organization admin" role and shown only at creation management keys can be individually deactivated permissions keys can be scoped to specific endpoints to limit access for integrations or partners for full details, visit ashby developer api documentation https //developers ashbyhq com/reference/introduction