Most assessment programmes in the Gulf never need an ATS integration. Here is how to tell whether yours does.

Not with a connector AssessAll ships — there is none, for those or for any other ATS or HRIS. What exists is a public REST API with signed webhooks and a public OpenAPI 3.1 description, so those systems are reached either directly or through the integration platform your organisation already licenses. If a supported, vendor-maintained connector for one of those systems is a hard requirement, a vendor that publishes one is the right choice: on 5 September 2026 SHL's own ATS integrations page states over 80 integrations and names Workday, Oracle and SAP.

Usually not. Share-link and QR delivery opens a proctored sitting with no participant account, no seat licence and no connection to your ATS, so a cohort can run the same day. An integration earns its cost when the score has to drive an automated stage change or feed other systems, and when annual volume is high enough that the build and its maintenance cost less than the manual step it removes.

Assessment API v1 lets you list the assessments available to your organisation, create a sitting for a named candidate, read that sitting back, fetch the scored result, and issue and read badges. There is a parallel lifecycle for assessing AI agents. Authentication is a bearer token from a key issued in your workspace, and the machine-readable description is public at /api/v1/openapi.json.

There are four events: sitting.started, sitting.scored, credential.issued and agent_sitting.scored. Each delivery carries an X-AssessAll-Signature header holding sha256= followed by an HMAC-SHA256 of the exact raw body, keyed with your endpoint's secret, so you verify by recomputing over the raw bytes before parsing. Deliveries time out at five seconds, retry once on a network error or 5xx, and every attempt is logged. Payloads never contain an API key or the webhook secret.

No. There is no enterprise SAML SSO and no SCIM provisioning. Cross-platform sign-on exists only between AssessAll and a small number of partner platforms it operates with. This matters less than it usually would because candidates never create accounts — the people who need workspace logins are your own staff, and they are managed in the console.

Transfer outside the Kingdom is permitted under the PDPL for defined purposes, provided it does not prejudice national security or the Kingdom's vital interests and the data-minimisation principle is respected. Because SDAIA has not published a list of jurisdictions offering an adequate level of protection, most transfers rely on a safeguard — Saudi standard contractual clauses, binding common rules or a certificate of accreditation — together with a documented transfer risk assessment. Establish that basis before an integration starts moving results, and note that a share-link cohort with export usually crosses fewer systems and fewer borders than a pushed integration. This is a dated summary as at 5 September 2026, not legal advice.

Yes. Federal Decree-Law No. 45 of 2021 came into force on 2 January 2022 and binds today. Its Executive Regulations, which are intended to set out procedural detail, had not been issued as at 10 March 2026 according to the Chambers 2026 UAE practice guide. Both common errors are worth avoiding: treating the law as dormant because the regulations are pending, and citing procedural requirements that have not in fact been issued. Entities in the DIFC and ADGM free zones sit under those zones' own regimes.

Ask four questions that a connector list does not answer. Which direction does the integration run, and does it write back the report and the proctoring evidence or only a number? Who maintains the connector when the ATS releases a new version, the assessment vendor or the ATS vendor? What happens when a candidate sits the same assessment twice? And where is the data hosted, and under which transfer basis does it get there? A vendor that answers those four plainly is telling you more than a list of eighty logos.