jobtrackingapp/docs/global-jobs/00/PROVIDER_RIGHTS_MATRIX.md

# Provider rights and feasibility — GJ-00

Access date: **2026-10-28**. Official documentation research only; no consumer registration, account creation, credential use, live advertisement search or provider contract test was performed. “Conditional” means suitable for design with stated gates, not enabled or approved for Jobjakt. No provider has live operational acceptance here.

## Feasibility matrix

| Country / immutable proposed provider ID | Documented access / cost / commercial position | Search and in-app content | Lifecycle / attribution / approval | Decision |
|---|---|---|---|---|
| NO / `nav-feed` | Free; JWT. Private token requires consumer registration and written acceptance; rotating public token is experimental. | Change feed, not live keyword search; local index. Detail fetch supplies original description; FINN adverts excluded. | Apply updates/removals immediately; mask stopped content/contact data. Preserve application deep link. [Feed](https://navikt.github.io/pam-stilling-feed/), [terms](https://arbeidsplassen.nav.no/vilkar-api). | CONDITIONAL GO design; consumer token and lifecycle proof required before enablement. |
| NO / `finn-manual` | Advertiser/business relationship, ownership of accessible data and agreement required for API. No general third-party search grant. | URL bookmark/manual fields + external link only. No page fetch, preview extraction, bulk search or full descriptions assumed. | Any broader caching/display/removal/price rights need explicit agreement. [FINN access](https://www.finn.no/api/). | GO manual-only design; NO-GO API/full-content connector without suitable grant. |
| SE / `se-jobsearch` | Public, CC0, no key/registration listed; no paid access prerequisite documented. | Live free-text/structured search and detail endpoint; design for available original descriptions, not guaranteed populated fields. | Recheck active detail before display/alert; reconcile withdrawals. Source labels/links retained. Rate/SLA/cache specifics need current contract qualification. [Service](https://data.arbetsformedlingen.se/dataservice/jobsearch/), [dataset](https://data.arbetsformedlingen.se/dataset/job-ads/). | CONDITIONAL GO; strongest initial live-query candidate, not tested here. |
| SE / `se-jobad-links` | Public, CC0, no key/registration listed. | Search and referenced metadata; descriptions deliberately truncated; original-site link required by service guidance. Never retrieve full third-party page to fill gaps. | Daily source refresh; SSYK classification is provider-generated. [Service](https://data.arbetsformedlingen.se/dataservice/jobad-links/), [OpenAPI 1.4.5](https://links.api.jobtechdev.se/swagger.json). | CONDITIONAL GO preview/link design; no full-content grant. |
| SE / `se-jobstream` | Public, CC0, no registration listed. | Platsbanken feed candidate for later local indexing; not a second inventory to count twice. | Detailed change/delete protocol, snapshots, lag and reconciliation must be qualified in GJ04-A before choosing ingestion. [Service](https://data.arbetsformedlingen.se/dataservice/jobstream/). | CONDITIONAL future adapter; initial SE plan uses JobSearch. |
| GB / `gb-adzuna` | ID/key; free evaluation tier, commercial trial limited to 14 days. Ongoing revenue/lead service needs licence; price/limits negotiated. No trial begun. | Search response contains description snippet, not full advert; retain provider redirect. | Adzuna branding/link rules; termination requires data removal. Contract must settle caching, alert use, expiry, quotas and link handling. [Terms](https://developer.adzuna.com/docs/terms_of_service), [search](https://developer.adzuna.com/docs/search). | NO-GO live commercial connector pending written approval; conditional snippet-only design. |
| GB / `gb-nhs` | NHS documents employer self-serve XML/RSS and ATS integrations; not evidence of unrestricted SaaS aggregation rights. | External NHS search/link fallback; no bulk/full-detail connector approved. | Ask NHSBSA for commercial job-board eligibility, scope, display, caching, quotas and withdrawal rules. [Official integration guidance](https://www.nhsbsa.nhs.uk/about-nhs-jobs/nhs-jobs-integration-and-benefits). | NO-GO direct integration until rights confirmed. |
| GB / `gb-find-a-job` | Documented DWP bulk upload is employer/ATS publishing, not a search-consumer grant. | External search/manual URL only. | Consumer access/display/retention remain unverified. [Official uploader specification](https://static.findajob.dwp.gov.uk/images/find_a_job_bulk_upload_spec_v3.0.pdf). | NO-GO search API; do not repurpose upload credentials. |

Reed, Indeed, Totaljobs, CV-Library, Civil Service and other boards are **unqualified prospects**, with no connector or rights assumed. External links may be offered without server fetching; a new source requires its own reviewed manifest before any integration. Optional DK/DE/FR/NL expansion is deferred, not claimed researched or supported.

## Capability manifest and enforcement proposal

Each manifest records `providerId`, countries, API/document version, terms URL, evidence/reviewer/date, rights validity/review date, commercial eligibility, credential reference/status, allowed modes, filters, geographic precision, content level, stored fields, cache/PII retention limits, deletion mechanism, attribution, original/apply-link policy, quota/concurrency/backoff and enabled state. Numeric rights limits are nullable **unknown**, never unlimited. Unknown rights deny that capability. Quota absence means bounded conservative traffic plus provider confirmation before load, not permission to stress the service.

Effective permission = reviewed grant AND operational enablement AND valid credentials where required AND supported API capability. Store no tokens in the manifest, query strings in logs, or repository. Capability-specific interfaces avoid fake `Search` implementations for feeds/manual sources. Display permission is enforced server-side for search, details, exports, saved-job views and notifications; UI badges alone are insufficient.

Current JobAd Links schema permits `q`, region/municipality/country concept IDs and occupation fields/groups, with limit <=100 and offset <=2000. This is a bounded search window, not exhaustive pagination or exact town/radius support. API metadata was read; responses were not exercised. The old 1,000-request/day wording seen in a 2023 report is not a verified current quota. Contact provider before higher volume.

No full description is promised for snippet sources. For Adzuna, use approved redirect/attribution rather than bypassing to extracted third-party URLs. Verify usable HTTPS destinations during qualification; never forward provider credentials to redirects. Estimated salaries must remain visibly estimated.

## Lifecycle decisions

NAV: normalize ACTIVE/INACTIVE changes into internal `SourceLifecycleEvent`; “tombstone” is Jobjakt's internal deletion marker, not an invented NAV endpoint/status. Ingest removals even if geography/occupation changed or the ad now fails a filter. Apply record/masking/cache invalidation and cursor advancement transactionally. Do not leave a persistent cache backed by request-time partial feed scans. Detail rechecks and source-health fail-closed policy are required when freshness cannot be maintained. No claim of instantaneous detection beyond the provider feed is possible.

For all sources, distinguish official requirement from proposed operational bound. Proposed: active query caches <=5 minutes, no alert if the source is stale, provider-specific health/freshness threshold reviewed in GJ04-A, and immediate local suppression when a withdrawal is observed. These numbers do not substitute for provider terms. For NAV, outage handling should hide searchable cached content once freshness cannot be assured, and disclose availability loss; owner/provider must approve polling and stale thresholds.

SE live query: short rights-permitted cache, current detail/404 handling, expiry checks, and periodic reconciliation of retained saved references. Daily JobAd Links refresh cannot prove minute-level freshness. Withdrawal checks and uncertainty must remain visible. Historical API presence does not make a job active or justify retaining contact PII.

On expiry/withdrawal/revocation: suppress search/detail, cancel queued alerts and clear source-derived restricted text/contacts across cache/index/exports. Keep minimal provider ID/status event without content where lawful. A dedupe cluster may still show independently authorised active sources; never inherit a wider grant from another source. User-authored notes/status remain separately retained under approved account policy; copied source text does not become user-owned merely by saving it. Backup/restore purge and policy replay must prevent republication.

## Required qualification before GJ04 source GO

Review exact terms/version and written agreement where applicable; record price/quota/retention/display/application-link obligations; obtain operator-managed credentials without printing them; freeze permitted redacted fixtures and schema hash; prove update/delete/404/429/auth failure and rights-revocation behavior; run authorised bounded smoke separately. No fixture pass upgrades commercial approval or provider health.