Ashby candidate profiles, search, notes, tags, files, fraud review, talent projects, and candidate actions. Generated from Ashby's complete current outbound API surface in the official machine-readable reference index: every focus page is reconciled to an emitted operation or a concrete directional/deprecation exclusion, with raw Markdown and embedded OpenAPI hashes retained in the audit fixture. A single openapi_source is intentionally omitted because Ashby publishes Markdown-wrapped per-reference contracts rather than one directly fetchable OpenAPI document. Reads are uncached and permission-scoped; reads over sensitive recruiting data are marked sensitive-read. Every mutation is grant-off and approval-gated. Ashby can report application errors as HTTP 200 with success:false, so operations preserve the full response envelope and workflows disclose provider success/error state. No work-entity Source is declared because Ashby's actual Project contract does not prove a mandatory version field.