[{"data":1,"prerenderedAt":1707},["ShallowReactive",2],{"navigation":3,"\u002Fapi\u002Froles-and-scopes":547,"\u002Fapi\u002Froles-and-scopes-surround":1702},[4,28,62,92,117,146,253,292,325,349,385,421,459,488],{"title":5,"path":6,"stem":7,"children":8,"icon":27},"Getting Started","\u002Fgetting-started","1.getting-started\u002F1.index",[9,12,17,22],{"title":10,"path":6,"stem":7,"icon":11},"Introduction","i-lucide-house",{"title":13,"path":14,"stem":15,"icon":16},"Usage","\u002Fgetting-started\u002Fusage","1.getting-started\u002F3.usage","i-lucide-sliders",{"title":18,"path":19,"stem":20,"icon":21},"Signing in on the mobile app","\u002Fgetting-started\u002Fmobile-app-sign-in","1.getting-started\u002F4.mobile-app-sign-in","i-lucide-smartphone",{"title":23,"path":24,"stem":25,"icon":26},"Running without email","\u002Fgetting-started\u002Frunning-without-email","1.getting-started\u002F5.running-without-email","i-lucide-mail-x",false,{"title":29,"icon":27,"path":30,"stem":31,"children":32,"page":27},"Security & Privacy","\u002Fsecurity","10.security",[33,38,43,47,52,57],{"title":34,"path":35,"stem":36,"icon":37},"Security Overview","\u002Fsecurity\u002Foverview","10.security\u002F1.overview","i-lucide-shield-check",{"title":39,"path":40,"stem":41,"icon":42},"Authentication","\u002Fsecurity\u002Fauthentication","10.security\u002F2.authentication","i-lucide-log-in",{"title":44,"path":45,"stem":46,"icon":21},"Two-Factor & Devices","\u002Fsecurity\u002Ftwo-factor-and-devices","10.security\u002F3.two-factor-and-devices",{"title":48,"path":49,"stem":50,"icon":51},"Audit & Monitoring","\u002Fsecurity\u002Faudit-and-monitoring","10.security\u002F4.audit-and-monitoring","i-lucide-scroll-text",{"title":53,"path":54,"stem":55,"icon":56},"Account Deletion & Privacy","\u002Fsecurity\u002Faccount-deletion-and-privacy","10.security\u002F5.account-deletion-and-privacy","i-lucide-user-x",{"title":58,"path":59,"stem":60,"icon":61},"Roles & Permissions","\u002Fsecurity\u002Froles-and-permissions","10.security\u002F6.roles-and-permissions","i-lucide-key-round",{"title":63,"icon":27,"path":64,"stem":65,"children":66,"page":27},"Billing & Plans","\u002Fbilling","11.billing",[67,72,77,82,87],{"title":68,"path":69,"stem":70,"icon":71},"Plans","\u002Fbilling\u002Fplans","11.billing\u002F1.plans","i-lucide-credit-card",{"title":73,"path":74,"stem":75,"icon":76},"Limits & Usage","\u002Fbilling\u002Flimits-and-usage","11.billing\u002F2.limits-and-usage","i-lucide-gauge",{"title":78,"path":79,"stem":80,"icon":81},"Managing Your Subscription","\u002Fbilling\u002Fmanaging-your-subscription","11.billing\u002F3.managing-your-subscription","i-lucide-receipt",{"title":83,"path":84,"stem":85,"icon":86},"Add-ons","\u002Fbilling\u002Fadd-ons","11.billing\u002F4.add-ons","i-lucide-puzzle",{"title":88,"path":89,"stem":90,"icon":91},"Integrations","\u002Fbilling\u002Fintegrations","11.billing\u002F5.integrations","i-lucide-plug",{"title":93,"icon":27,"path":94,"stem":95,"children":96,"page":27},"Settings","\u002Fsettings","12.settings",[97,101,105,109,113],{"title":98,"path":99,"stem":100},"General","\u002Fsettings\u002Fgeneral","12.settings\u002F1.general",{"title":102,"path":103,"stem":104},"Leave Types","\u002Fsettings\u002Fleavetype","12.settings\u002F2.leaveType",{"title":106,"path":107,"stem":108},"Carry Forward","\u002Fsettings\u002Fcarryforward","12.settings\u002F3.carryForward",{"title":110,"path":111,"stem":112},"Department Management","\u002Fsettings\u002Fdepartments","12.settings\u002F4.departments",{"title":114,"path":115,"stem":116},"Public Holidays","\u002Fsettings\u002Fpublicholiday","12.settings\u002F5.publicholiday",{"title":118,"path":119,"stem":120,"children":121,"page":27},"Mcp","\u002Fmcp","13.mcp",[122,127,131,136,141],{"title":123,"path":124,"stem":125,"icon":126},"Overview","\u002Fmcp\u002Foverview","13.mcp\u002F1.overview","i-lucide-bot",{"title":128,"path":129,"stem":130,"icon":91},"Connecting","\u002Fmcp\u002Fconnecting","13.mcp\u002F2.connecting",{"title":132,"path":133,"stem":134,"icon":135},"Tools Reference","\u002Fmcp\u002Ftools","13.mcp\u002F3.tools","i-lucide-wrench",{"title":137,"path":138,"stem":139,"icon":140},"Security","\u002Fmcp\u002Fsecurity","13.mcp\u002F4.security","i-lucide-shield",{"title":142,"path":143,"stem":144,"icon":145},"Integrating Your Own MCP Client","\u002Fmcp\u002Fcustom-client","13.mcp\u002F5.custom-client","i-lucide-code",{"title":147,"icon":27,"path":148,"stem":149,"children":150,"page":27},"Public API","\u002Fapi","14.api",[151,156,160,164,169,174,179,183,208,238,243,248],{"title":152,"path":153,"stem":154,"icon":155},"API Overview","\u002Fapi\u002Foverview","14.api\u002F1.overview","i-lucide-code-xml",{"title":5,"path":157,"stem":158,"icon":159},"\u002Fapi\u002Fgetting-started","14.api\u002F2.getting-started","i-lucide-rocket",{"title":161,"path":162,"stem":163,"icon":61},"Authentication & Tokens","\u002Fapi\u002Fauthentication","14.api\u002F3.authentication",{"title":165,"path":166,"stem":167,"icon":168},"API Roles & Scopes","\u002Fapi\u002Froles-and-scopes","14.api\u002F4.roles-and-scopes","i-lucide-layers",{"title":170,"path":171,"stem":172,"icon":173},"Requests & Responses","\u002Fapi\u002Frequests-and-responses","14.api\u002F5.requests-and-responses","i-lucide-arrow-left-right",{"title":175,"path":176,"stem":177,"icon":178},"Errors","\u002Fapi\u002Ferrors","14.api\u002F6.errors","i-lucide-circle-alert",{"title":180,"path":181,"stem":182,"icon":76},"Rate Limits","\u002Fapi\u002Frate-limits","14.api\u002F7.rate-limits",{"title":184,"icon":185,"path":186,"stem":187,"children":188,"page":27},"Guides","i-lucide-book-marked","\u002Fapi\u002Fguides","14.api\u002F8.guides",[189,194,199,204],{"title":190,"path":191,"stem":192,"icon":193},"People","\u002Fapi\u002Fguides\u002Fpeople","14.api\u002F8.guides\u002F1.people","i-lucide-users",{"title":195,"path":196,"stem":197,"icon":198},"Leave","\u002Fapi\u002Fguides\u002Fleave","14.api\u002F8.guides\u002F2.leave","i-lucide-calendar-days",{"title":200,"path":201,"stem":202,"icon":203},"Time","\u002Fapi\u002Fguides\u002Ftime","14.api\u002F8.guides\u002F3.time","i-lucide-clock",{"title":205,"path":206,"stem":207,"icon":81},"Expenses & Documents","\u002Fapi\u002Fguides\u002Fexpenses-and-documents","14.api\u002F8.guides\u002F4.expenses-and-documents",{"title":209,"icon":210,"path":211,"stem":212,"children":213,"page":27},"Webhooks","i-lucide-webhook","\u002Fapi\u002Fwebhooks","14.api\u002F9.webhooks",[214,218,223,228,233],{"title":215,"path":216,"stem":217,"icon":210},"Webhooks Overview","\u002Fapi\u002Fwebhooks\u002Foverview","14.api\u002F9.webhooks\u002F1.overview",{"title":219,"path":220,"stem":221,"icon":222},"Events Reference","\u002Fapi\u002Fwebhooks\u002Fevents","14.api\u002F9.webhooks\u002F2.events","i-lucide-list",{"title":224,"path":225,"stem":226,"icon":227},"Verifying Signatures","\u002Fapi\u002Fwebhooks\u002Fverifying-signatures","14.api\u002F9.webhooks\u002F3.verifying-signatures","i-lucide-badge-check",{"title":229,"path":230,"stem":231,"icon":232},"Retries & Failures","\u002Fapi\u002Fwebhooks\u002Fretries-and-failures","14.api\u002F9.webhooks\u002F4.retries-and-failures","i-lucide-refresh-cw",{"title":234,"path":235,"stem":236,"icon":237},"Best Practices","\u002Fapi\u002Fwebhooks\u002Fbest-practices","14.api\u002F9.webhooks\u002F5.best-practices","i-lucide-list-checks",{"title":239,"path":240,"stem":241,"icon":242},"Postman & OpenAPI","\u002Fapi\u002Fpostman-and-openapi","14.api\u002F91.postman-and-openapi","i-lucide-file-json",{"title":244,"path":245,"stem":246,"icon":247},"Versioning & Changes","\u002Fapi\u002Fversioning","14.api\u002F92.versioning","i-lucide-git-branch",{"title":249,"path":250,"stem":251,"icon":252},"API Reference","\u002Fapi\u002Freference","14.api\u002F93.reference","i-lucide-book-open",{"title":254,"icon":27,"path":255,"stem":256,"children":257,"page":27},"Data Import & Migration","\u002Fdata-import","2.data-import",[258,262,267,272,277,282,287],{"title":123,"path":259,"stem":260,"icon":261},"\u002Fdata-import\u002Foverview","2.data-import\u002F1.overview","i-lucide-database",{"title":263,"path":264,"stem":265,"icon":266},"Importing a File","\u002Fdata-import\u002Fimporting-a-file","2.data-import\u002F2.importing-a-file","i-lucide-file-up",{"title":268,"path":269,"stem":270,"icon":271},"Supported Platforms","\u002Fdata-import\u002Fsupported-platforms","2.data-import\u002F3.supported-platforms","i-lucide-layout-grid",{"title":273,"path":274,"stem":275,"icon":276},"Direct Connections","\u002Fdata-import\u002Fdirect-connections","2.data-import\u002F4.direct-connections","i-lucide-plug-zap",{"title":278,"path":279,"stem":280,"icon":281},"Custom Templates","\u002Fdata-import\u002Fcustom-templates","2.data-import\u002F5.custom-templates","i-lucide-layout-template",{"title":283,"path":284,"stem":285,"icon":286},"Rollback & Import History","\u002Fdata-import\u002Frollback-and-history","2.data-import\u002F6.rollback-and-history","i-lucide-undo-2",{"title":288,"path":289,"stem":290,"icon":291},"Troubleshooting","\u002Fdata-import\u002Ftroubleshooting","2.data-import\u002F7.troubleshooting","i-lucide-life-buoy",{"title":293,"icon":27,"path":294,"stem":295,"children":296,"page":27},"Leave Management","\u002Fleave-management","3.leave-management",[297,302,307,312,316,321],{"title":298,"path":299,"stem":300,"icon":301},"Leave Management Overview","\u002Fleave-management\u002Foverview","3.leave-management\u002F1.overview","i-lucide-palmtree",{"title":303,"path":304,"stem":305,"icon":306},"Requesting Leave","\u002Fleave-management\u002Frequesting-leave","3.leave-management\u002F2.requesting-leave","i-lucide-calendar-plus",{"title":308,"path":309,"stem":310,"icon":311},"Leave Balances","\u002Fleave-management\u002Fleave-balances","3.leave-management\u002F3.leave-balances","i-lucide-wallet",{"title":313,"path":314,"stem":315,"icon":193},"Group Booking","\u002Fleave-management\u002Fgroup-booking","3.leave-management\u002F4.group-booking",{"title":317,"path":318,"stem":319,"icon":320},"Editing and Cancelling Leave","\u002Fleave-management\u002Fediting-and-cancelling","3.leave-management\u002F5.editing-and-cancelling","i-lucide-pencil",{"title":322,"path":323,"stem":324,"icon":291},"Leave Troubleshooting","\u002Fleave-management\u002Ftroubleshooting","3.leave-management\u002F6.troubleshooting",{"title":326,"icon":27,"path":327,"stem":328,"children":329,"page":27},"Approvals","\u002Fapprovals","4.approvals",[330,335,340,344],{"title":331,"path":332,"stem":333,"icon":334},"Approvals Overview","\u002Fapprovals\u002Foverview","4.approvals\u002F1.overview","i-lucide-check-check",{"title":336,"path":337,"stem":338,"icon":339},"Leave Approvals","\u002Fapprovals\u002Fleave-approvals","4.approvals\u002F2.leave-approvals","i-lucide-calendar-check",{"title":341,"path":342,"stem":343,"icon":81},"Expense Approvals","\u002Fapprovals\u002Fexpense-approvals","4.approvals\u002F3.expense-approvals",{"title":345,"path":346,"stem":347,"icon":348},"Time Approvals","\u002Fapprovals\u002Ftime-approvals","4.approvals\u002F4.time-approvals","i-lucide-clock-9",{"title":350,"icon":27,"path":351,"stem":352,"children":353,"page":27},"Time tracking & monitoring","\u002Ftime-tracking","5.Time Tracking",[354,359,364,369,373,377,381],{"title":355,"path":356,"stem":357,"icon":358},"Clocking In & Location","\u002Ftime-tracking\u002Fclock-in-and-location","5.Time Tracking\u002F5.clock-in-and-location","i-lucide-map-pin",{"title":360,"path":361,"stem":362,"icon":363},"Overtime & Pay-Period Lockdown","\u002Ftime-tracking\u002Fovertime-and-lockdown","5.Time Tracking\u002F6.overtime-and-lockdown","i-lucide-lock",{"title":365,"path":366,"stem":367,"icon":368},"Geofencing","\u002Ftime-tracking\u002Fgeofencing","5.Time Tracking\u002F7.geofencing","i-lucide-map",{"title":370,"path":371,"stem":372},"Time & Projects","\u002Ftime-tracking\u002Ftimeandprojects","5.Time Tracking\u002FTime&Projects",{"title":374,"path":375,"stem":376},"Time Tracking","\u002Ftime-tracking\u002Ftime-tracking","5.Time Tracking\u002FTime-tracking",{"title":378,"path":379,"stem":380},"Timeboard","\u002Ftime-tracking\u002Ftimeboard","5.Time Tracking\u002FTimeBoard",{"title":382,"path":383,"stem":384},"Timesheets","\u002Ftime-tracking\u002Ftimesheets","5.Time Tracking\u002FTimesheets",{"title":386,"icon":27,"path":387,"stem":388,"children":389,"page":27},"Expenses","\u002Fexpenses","6.expenses",[390,394,398,402,406,411,416],{"title":391,"path":392,"stem":393},"Expense Claims","\u002Fexpenses\u002Foverview","6.expenses\u002F1.overview",{"title":395,"path":396,"stem":397},"Add & Manage Purchases","\u002Fexpenses\u002Fpurchases","6.expenses\u002F2.purchases",{"title":399,"path":400,"stem":401},"Travel & Mileage Entry","\u002Fexpenses\u002Ftravelentries","6.expenses\u002F3.travelentries",{"title":403,"path":404,"stem":405,"icon":71},"Company Card Expenses","\u002Fexpenses\u002Fcompany-cards","6.expenses\u002F4.company-cards",{"title":407,"path":408,"stem":409,"icon":410},"Per Diems","\u002Fexpenses\u002Fper-diems","6.expenses\u002F5.per-diems","i-lucide-utensils",{"title":412,"path":413,"stem":414,"icon":415},"Receipt Scanning","\u002Fexpenses\u002Freceipt-scanning","6.expenses\u002F6.receipt-scanning","i-lucide-scan-line",{"title":417,"path":418,"stem":419,"icon":420},"Statuses & Submission","\u002Fexpenses\u002Fstatuses-and-submission","6.expenses\u002F7.statuses-and-submission","i-lucide-git-pull-request-arrow",{"title":422,"icon":27,"path":423,"stem":424,"children":425,"page":27},"Documents & E-Signatures","\u002Fdocuments","7.documents",[426,430,435,440,445,449,454],{"title":123,"path":427,"stem":428,"icon":429},"\u002Fdocuments\u002Foverview","7.documents\u002F1.overview","i-lucide-folder-open",{"title":431,"path":432,"stem":433,"icon":434},"Uploading Documents","\u002Fdocuments\u002Fuploading","7.documents\u002F2.uploading","i-lucide-upload",{"title":436,"path":437,"stem":438,"icon":439},"E-Signatures","\u002Fdocuments\u002Fe-signatures","7.documents\u002F3.e-signatures","i-lucide-pen-tool",{"title":441,"path":442,"stem":443,"icon":444},"Audit Trail & Certificate","\u002Fdocuments\u002Faudit-trail","7.documents\u002F4.audit-trail","i-lucide-file-check",{"title":446,"path":447,"stem":448,"icon":281},"Templates & Bulk Send","\u002Fdocuments\u002Ftemplates-and-bulk-send","7.documents\u002F5.templates-and-bulk-send",{"title":450,"path":451,"stem":452,"icon":453},"Onboarding","\u002Fdocuments\u002Fonboarding","7.documents\u002F6.onboarding","i-lucide-user-plus",{"title":455,"path":456,"stem":457,"icon":458},"Offboarding","\u002Fdocuments\u002Foffboarding","7.documents\u002F7.offboarding","i-lucide-user-minus",{"title":460,"icon":27,"path":461,"stem":462,"children":463,"page":27},"People & HR","\u002Fpeople","8.people",[464,468,473,478,483],{"title":465,"path":466,"stem":467,"icon":193},"Directory & Profiles","\u002Fpeople\u002Fdirectory-and-profiles","8.people\u002F1.directory-and-profiles",{"title":469,"path":470,"stem":471,"icon":472},"Managing Users","\u002Fpeople\u002Fmanaging-users","8.people\u002F2.managing-users","i-lucide-user-cog",{"title":474,"path":475,"stem":476,"icon":477},"HR Records","\u002Fpeople\u002Fhr-records","8.people\u002F3.hr-records","i-lucide-folder-archive",{"title":479,"path":480,"stem":481,"icon":482},"Performance","\u002Fpeople\u002Fperformance","8.people\u002F4.performance","i-lucide-target",{"title":484,"path":485,"stem":486,"icon":487},"Training","\u002Fpeople\u002Ftraining","8.people\u002F5.training","i-lucide-graduation-cap",{"title":489,"icon":27,"path":490,"stem":491,"children":492,"page":27},"Features","\u002Ffeatures","9.features",[493,497,501,505,510,515,519,523,527,531,535,539,543],{"title":494,"path":495,"stem":496,"icon":11},"Home","\u002Ffeatures\u002Fhome","9.features\u002F1.home",{"title":498,"path":499,"stem":500},"Email Configuration (SMTP)","\u002Ffeatures\u002Femail-configuration","9.features\u002F10.email-configuration",{"title":502,"path":503,"stem":504},"SMTP troubleshoot","\u002Ffeatures\u002Fsmtp-troubleshoot","9.features\u002F11.smtp-troubleshoot",{"title":506,"path":507,"stem":508,"icon":509},"Notifications","\u002Ffeatures\u002Fnotifications","9.features\u002F12.notifications","i-lucide-bell",{"title":511,"path":512,"stem":513,"icon":514},"Reports","\u002Ffeatures\u002Freports","9.features\u002F13.reports","i-lucide-bar-chart-3",{"title":516,"path":517,"stem":518},"Dashboard","\u002Ffeatures\u002Fdashboard","9.features\u002F2.dashboard",{"title":520,"path":521,"stem":522},"Calendar & Leave Overview","\u002Ffeatures\u002Fcalendar","9.features\u002F3.calendar",{"title":524,"path":525,"stem":526},"Calendar Integration","\u002Ffeatures\u002Fcalendar-integration","9.features\u002F4.calendar-integration",{"title":528,"path":529,"stem":530},"Schedules","\u002Ffeatures\u002Fschedules","9.features\u002F5.schedules",{"title":532,"path":533,"stem":534},"Project Management","\u002Ffeatures\u002Fprojects","9.features\u002F6.projects",{"title":536,"path":537,"stem":538},"Expense Settings","\u002Ffeatures\u002Fexpense-settings","9.features\u002F7.expense-settings",{"title":540,"path":541,"stem":542},"Auth0 SSO Integration","\u002Ffeatures\u002Fauth0-integration","9.features\u002F8.auth0-integration",{"title":544,"path":545,"stem":546},"Password & Authentication Policy","\u002Ffeatures\u002Fpolicies","9.features\u002F9.policies",{"id":548,"title":165,"body":549,"description":1695,"extension":1696,"links":1697,"meta":1698,"navigation":1699,"path":166,"seo":1700,"stem":167,"__hash__":1701},"docs\u002F14.api\u002F4.roles-and-scopes.md",{"type":550,"value":551,"toc":1680},"minimark",[552,556,579,582,589,594,651,662,666,679,700,707,712,715,842,863,867,870,877,1425,1445,1449,1452,1534,1546,1550,1553,1646,1653,1657],[553,554,555],"p",{},"A token's access is the overlap of three things, worked out again on every request:",[557,558,559,567,573],"ol",{},[560,561,562,566],"li",{},[563,564,565],"strong",{},"The scopes it was granted",", either through an API role or as a custom list.",[560,568,569,572],{},[563,570,571],{},"The ceiling of its owner's current role."," Each scope has a minimum owner role; scopes above the owner's role are ignored.",[560,574,575,578],{},[563,576,577],{},"The scopes that have endpoints today."," A scope only takes effect once at least one endpoint uses it.",[553,580,581],{},"Inside a scope, the data returned is always limited to what the owner can see in the app. A scope opens an area of the API; it never widens the owner's own visibility.",[553,583,584,588],{},[585,586,587],"code",{},"GET \u002Ftoken"," returns the resulting effective scopes, so an integration can check what it may do before it starts.",[590,591,593],"h2",{"id":592},"scope-naming","Scope naming",[595,596,597,612,625],"ul",{},[560,598,599,600,603,604,607,608,611],{},"Scopes are written ",[585,601,602],{},"resource:action",", for example ",[585,605,606],{},"leaves:read"," or ",[585,609,610],{},"leaves:approve",".",[560,613,614,615,617,618,621,622,611],{},"A ",[585,616,611],{}," marks a more sensitive tier of a resource's fields, for example ",[585,619,620],{},"users.personal:read"," on top of ",[585,623,624],{},"users:read",[560,626,614,627,630,631,634,635,638,639,641,642,644,645,648,649,611],{},[585,628,629],{},"write"," scope also satisfies the matching ",[585,632,633],{},"read"," scope for the same resource and tier. ",[585,636,637],{},"leaves:write"," lets a token call endpoints that need ",[585,640,606],{},"; it does not satisfy ",[585,643,610],{},", and ",[585,646,647],{},"users:write"," does not satisfy ",[585,650,620],{},[553,652,653,654,657,658,661],{},"When a token calls an endpoint without the scope it needs, the response is ",[585,655,656],{},"403 SCOPE_MISSING",", and the message names the scope that endpoint requires. Each operation in the ",[659,660,249],"a",{"href":250}," lists its required scope.",[590,663,665],{"id":664},"api-roles","API roles",[553,667,668,669,672,673,675,676,611],{},"An ",[563,670,671],{},"API role"," is a named, reusable set of scopes, such as \"Payroll export\" or \"Leave dashboard\". Administrators and Executives manage them on the ",[563,674,665],{}," tab under ",[563,677,678],{},"Settings > API",[595,680,681,688,694,697],{},[560,682,683,684,687],{},"A token created from a role ",[563,685,686],{},"follows"," it. Editing the role changes every token that uses it, from the next request.",[560,689,690,693],{},[563,691,692],{},"Archiving"," a role makes every token that follows it grant nothing until the role is restored. Roles are never deleted.",[560,695,696],{},"A role can only contain scopes the person creating or editing it may hold. An Administrator cannot define a role with Executive-only scopes.",[560,698,699],{},"A token can only follow a role whose scopes are all within its owner's role ceiling.",[553,701,702,703,706],{},"A token can instead have a ",[563,704,705],{},"custom"," scope list, which is fixed to that token.",[708,709,711],"h3",{"id":710},"built-in-templates","Built-in templates",[553,713,714],{},"Templates are starting points for a new API role or a custom token. When applied, a template keeps only the scopes that have endpoints today and that the owner's role may hold.",[716,717,718,731],"table",{},[719,720,721],"thead",{},[722,723,724,728],"tr",{},[725,726,727],"th",{},"Template",[725,729,730],{},"Scopes",[732,733,734,756,780,795,820],"tbody",{},[722,735,736,742],{},[737,738,739],"td",{},[563,740,741],{},"Read-only directory",[737,743,744,747,748,747,750,747,753],{},[585,745,746],{},"organization:read",", ",[585,749,624],{},[585,751,752],{},"departments:read",[585,754,755],{},"teams:read",[722,757,758,763],{},[737,759,760],{},[563,761,762],{},"Leave sync",[737,764,765,747,767,747,769,747,772,747,774,747,777],{},[585,766,746],{},[585,768,624],{},[585,770,771],{},"leave_types:read",[585,773,606],{},[585,775,776],{},"leave_balances:read",[585,778,779],{},"holidays:read",[722,781,782,787],{},[737,783,784],{},[563,785,786],{},"Leave management",[737,788,789,790,792,793],{},"Everything in Leave sync, plus ",[585,791,637],{}," and ",[585,794,610],{},[722,796,797,802],{},[737,798,799],{},[563,800,801],{},"Time and payroll export",[737,803,804,747,806,747,808,747,811,747,814,747,817],{},[585,805,746],{},[585,807,624],{},[585,809,810],{},"users.employment:read",[585,812,813],{},"time_entries:read",[585,815,816],{},"timesheets:read",[585,818,819],{},"projects:read",[722,821,822,827],{},[737,823,824],{},[563,825,826],{},"HRIS sync",[737,828,829,830,832,833,747,836,792,839],{},"Every ",[585,831,633],{}," scope except ",[585,834,835],{},"compensation:read",[585,837,838],{},"users.govid:read",[585,840,841],{},"webhooks:read",[843,844,846],"callout",{"color":845,"icon":140},"amber",[553,847,848,850,851,747,853,747,856,792,859,862],{},[563,849,826],{}," includes sensitive read scopes, such as ",[585,852,620],{},[585,854,855],{},"time_entries.location:read",[585,857,858],{},"documents.content:read",[585,860,861],{},"benefits:read",", when its owner's role allows them. Review the list before saving, and remove anything the receiving system does not need.",[590,864,866],{"id":865},"scope-catalogue","Scope catalogue",[553,868,869],{},"The minimum owner role is the lowest role whose tokens may hold the scope. The four roles, from lowest to highest, are Employee, Department Head, Administrator and Executive.",[553,871,872,873,876],{},"Scopes marked ",[563,874,875],{},"Sensitive"," read restricted personal, financial or file data and are flagged in the token console.",[716,878,879,894],{},[719,880,881],{},[722,882,883,886,889,892],{},[725,884,885],{},"Scope",[725,887,888],{},"Minimum owner role",[725,890,891],{},"Grants",[725,893,875],{},[732,895,896,910,923,937,952,966,979,992,1006,1019,1033,1046,1059,1072,1085,1098,1111,1124,1138,1151,1165,1178,1191,1205,1219,1233,1247,1260,1274,1288,1302,1316,1330,1343,1356,1370,1384,1398,1411],{},[722,897,898,902,905,908],{},[737,899,900],{},[585,901,746],{},[737,903,904],{},"Employee",[737,906,907],{},"Read the organization profile",[737,909],{},[722,911,912,916,918,921],{},[737,913,914],{},[585,915,624],{},[737,917,904],{},[737,919,920],{},"Read the employee directory",[737,922],{},[722,924,925,929,932,935],{},[737,926,927],{},[585,928,810],{},[737,930,931],{},"Department Head",[737,933,934],{},"Read employment details (dates, probation, payroll id)",[737,936],{},[722,938,939,943,946,949],{},[737,940,941],{},[585,942,620],{},[737,944,945],{},"Administrator",[737,947,948],{},"Read personal details (date of birth, home address, emergency contact)",[737,950,951],{},"Yes",[722,953,954,958,961,964],{},[737,955,956],{},[585,957,838],{},[737,959,960],{},"Executive",[737,962,963],{},"Read government identifiers",[737,965,951],{},[722,967,968,972,974,977],{},[737,969,970],{},[585,971,647],{},[737,973,945],{},[737,975,976],{},"Create and update employees",[737,978],{},[722,980,981,985,987,990],{},[737,982,983],{},[585,984,752],{},[737,986,904],{},[737,988,989],{},"Read departments",[737,991],{},[722,993,994,999,1001,1004],{},[737,995,996],{},[585,997,998],{},"departments:write",[737,1000,945],{},[737,1002,1003],{},"Create and update departments",[737,1005],{},[722,1007,1008,1012,1014,1017],{},[737,1009,1010],{},[585,1011,755],{},[737,1013,904],{},[737,1015,1016],{},"Read teams",[737,1018],{},[722,1020,1021,1026,1028,1031],{},[737,1022,1023],{},[585,1024,1025],{},"teams:write",[737,1027,945],{},[737,1029,1030],{},"Create and update teams",[737,1032],{},[722,1034,1035,1039,1041,1044],{},[737,1036,1037],{},[585,1038,771],{},[737,1040,904],{},[737,1042,1043],{},"Read leave types",[737,1045],{},[722,1047,1048,1052,1054,1057],{},[737,1049,1050],{},[585,1051,606],{},[737,1053,904],{},[737,1055,1056],{},"Read leave requests",[737,1058],{},[722,1060,1061,1065,1067,1070],{},[737,1062,1063],{},[585,1064,637],{},[737,1066,904],{},[737,1068,1069],{},"Create and cancel leave requests",[737,1071],{},[722,1073,1074,1078,1080,1083],{},[737,1075,1076],{},[585,1077,610],{},[737,1079,931],{},[737,1081,1082],{},"Approve and reject leave requests",[737,1084],{},[722,1086,1087,1091,1093,1096],{},[737,1088,1089],{},[585,1090,776],{},[737,1092,904],{},[737,1094,1095],{},"Read leave balances",[737,1097],{},[722,1099,1100,1104,1106,1109],{},[737,1101,1102],{},[585,1103,779],{},[737,1105,904],{},[737,1107,1108],{},"Read public holidays and locked dates",[737,1110],{},[722,1112,1113,1117,1119,1122],{},[737,1114,1115],{},[585,1116,813],{},[737,1118,904],{},[737,1120,1121],{},"Read time entries",[737,1123],{},[722,1125,1126,1131,1133,1136],{},[737,1127,1128],{},[585,1129,1130],{},"time_entries:write",[737,1132,904],{},[737,1134,1135],{},"Create, update and delete time entries",[737,1137],{},[722,1139,1140,1144,1146,1149],{},[737,1141,1142],{},[585,1143,855],{},[737,1145,945],{},[737,1147,1148],{},"Read clock-in and clock-out locations",[737,1150,951],{},[722,1152,1153,1158,1160,1163],{},[737,1154,1155],{},[585,1156,1157],{},"time_entries:approve",[737,1159,931],{},[737,1161,1162],{},"Approve and reject time entries",[737,1164],{},[722,1166,1167,1171,1173,1176],{},[737,1168,1169],{},[585,1170,816],{},[737,1172,904],{},[737,1174,1175],{},"Read timesheets",[737,1177],{},[722,1179,1180,1184,1186,1189],{},[737,1181,1182],{},[585,1183,819],{},[737,1185,904],{},[737,1187,1188],{},"Read projects, tasks and clients",[737,1190],{},[722,1192,1193,1198,1200,1203],{},[737,1194,1195],{},[585,1196,1197],{},"schedules:read",[737,1199,904],{},[737,1201,1202],{},"Read shift schedules",[737,1204],{},[722,1206,1207,1212,1214,1217],{},[737,1208,1209],{},[585,1210,1211],{},"expenses:read",[737,1213,904],{},[737,1215,1216],{},"Read expense reports",[737,1218],{},[722,1220,1221,1226,1228,1231],{},[737,1222,1223],{},[585,1224,1225],{},"expenses:approve",[737,1227,931],{},[737,1229,1230],{},"Approve and reject expense reports",[737,1232],{},[722,1234,1235,1240,1242,1245],{},[737,1236,1237],{},[585,1238,1239],{},"documents:read",[737,1241,904],{},[737,1243,1244],{},"Read document metadata",[737,1246],{},[722,1248,1249,1253,1255,1258],{},[737,1250,1251],{},[585,1252,858],{},[737,1254,945],{},[737,1256,1257],{},"Download document files",[737,1259,951],{},[722,1261,1262,1267,1269,1272],{},[737,1263,1264],{},[585,1265,1266],{},"training:read",[737,1268,904],{},[737,1270,1271],{},"Read training assignments",[737,1273],{},[722,1275,1276,1281,1283,1286],{},[737,1277,1278],{},[585,1279,1280],{},"training:write",[737,1282,931],{},[737,1284,1285],{},"Assign training",[737,1287],{},[722,1289,1290,1295,1297,1300],{},[737,1291,1292],{},[585,1293,1294],{},"certifications:read",[737,1296,904],{},[737,1298,1299],{},"Read certifications",[737,1301],{},[722,1303,1304,1309,1311,1314],{},[737,1305,1306],{},[585,1307,1308],{},"assets:read",[737,1310,904],{},[737,1312,1313],{},"Read assigned assets",[737,1315],{},[722,1317,1318,1323,1325,1328],{},[737,1319,1320],{},[585,1321,1322],{},"assets:write",[737,1324,931],{},[737,1326,1327],{},"Assign and update assets",[737,1329],{},[722,1331,1332,1336,1338,1341],{},[737,1333,1334],{},[585,1335,861],{},[737,1337,945],{},[737,1339,1340],{},"Read benefit enrollments",[737,1342,951],{},[722,1344,1345,1349,1351,1354],{},[737,1346,1347],{},[585,1348,835],{},[737,1350,945],{},[737,1352,1353],{},"Read compensation records",[737,1355,951],{},[722,1357,1358,1363,1365,1368],{},[737,1359,1360],{},[585,1361,1362],{},"onboarding:read",[737,1364,904],{},[737,1366,1367],{},"Read onboarding progress",[737,1369],{},[722,1371,1372,1377,1379,1382],{},[737,1373,1374],{},[585,1375,1376],{},"custom_fields:read",[737,1378,904],{},[737,1380,1381],{},"Read custom profile fields",[737,1383],{},[722,1385,1386,1391,1393,1396],{},[737,1387,1388],{},[585,1389,1390],{},"goals:read",[737,1392,904],{},[737,1394,1395],{},"Read goals",[737,1397],{},[722,1399,1400,1404,1406,1409],{},[737,1401,1402],{},[585,1403,841],{},[737,1405,945],{},[737,1407,1408],{},"Read webhook endpoints, deliveries and the event catalogue",[737,1410],{},[722,1412,1413,1418,1420,1423],{},[737,1414,1415],{},[585,1416,1417],{},"webhooks:write",[737,1419,945],{},[737,1421,1422],{},"Create, update, test and delete webhook endpoints",[737,1424],{},[553,1426,1427,1428,1430,1431,1434,1435,1437,1438,1441,1442,611],{},"Every scope in the catalogue has at least one endpoint. Each operation in the ",[659,1429,249],{"href":250}," names the scope it requires, and the OpenAPI document carries it as ",[585,1432,1433],{},"x-required-scope",". Operations that return more fields with a field-tier scope, such as ",[585,1436,620],{}," on ",[585,1439,1440],{},"GET \u002Fusers",", list those scopes in ",[585,1443,1444],{},"x-field-scopes",[708,1446,1448],{"id":1447},"field-tiers","Field tiers",[553,1450,1451],{},"A field-tier scope adds fields to responses the base scope already opens; it never opens an endpoint on its own.",[716,1453,1454,1467],{},[719,1455,1456],{},[722,1457,1458,1461,1464],{},[725,1459,1460],{},"Base scope",[725,1462,1463],{},"Field-tier scope",[725,1465,1466],{},"Adds",[732,1468,1469,1482,1495,1508,1521],{},[722,1470,1471,1475,1479],{},[737,1472,1473],{},[585,1474,624],{},[737,1476,1477],{},[585,1478,810],{},[737,1480,1481],{},"Employee and payroll ids, employment type, employment start and end dates, probation, offboarding date",[722,1483,1484,1488,1492],{},[737,1485,1486],{},[585,1487,624],{},[737,1489,1490],{},[585,1491,620],{},[737,1493,1494],{},"Date of birth, gender, marital status, nationality, personal phone numbers and email, home address, emergency contact",[722,1496,1497,1501,1505],{},[737,1498,1499],{},[585,1500,624],{},[737,1502,1503],{},[585,1504,838],{},[737,1506,1507],{},"Tax id, citizenship certificate number, benefit id number",[722,1509,1510,1514,1518],{},[737,1511,1512],{},[585,1513,813],{},[737,1515,1516],{},[585,1517,855],{},[737,1519,1520],{},"Clock-in and clock-out coordinates, addresses and accuracy, location confidence, whether the clock-in was outside the geofence",[722,1522,1523,1527,1531],{},[737,1524,1525],{},[585,1526,816],{},[737,1528,1529],{},[585,1530,810],{},[737,1532,1533],{},"Pay figures, for Administrator and Executive owners only",[553,1535,1536,1537,747,1539,747,1541,607,1543,1545],{},"Reads that return ",[585,1538,620],{},[585,1540,838],{},[585,1542,835],{},[585,1544,858],{}," data are written to the organization's sensitive-data access log, one entry per record, with the token that read them.",[590,1547,1549],{"id":1548},"rules-beyond-the-scope","Rules beyond the scope",[553,1551,1552],{},"A scope is necessary but not always enough: the owner must also be allowed to do the same thing in the app. The cases that most often surprise integrators:",[716,1554,1555,1565],{},[719,1556,1557],{},[722,1558,1559,1562],{},[725,1560,1561],{},"Endpoint",[725,1563,1564],{},"Rule",[732,1566,1567,1583,1596,1613,1624,1634],{},[722,1568,1569,1574],{},[737,1570,1571],{},[585,1572,1573],{},"GET \u002Fclients",[737,1575,1576,1577,1580,1581,611],{},"Department Heads and above. An Employee's token gets ",[585,1578,1579],{},"403 FORBIDDEN"," even with ",[585,1582,819],{},[722,1584,1585,1590],{},[737,1586,1587],{},[585,1588,1589],{},"GET \u002Fusers\u002F{id}\u002Fcustom-fields",[737,1591,1592,1593,611],{},"The owner's own values, or anyone's for an Administrator or Executive. Other people answer ",[585,1594,1595],{},"404",[722,1597,1598,1601],{},[737,1599,1600],{},"Approving or rejecting leave, time entries and expense reports",[737,1602,1603,1604,1606,1607,1609,1610,1612],{},"Nobody decides their own request through the API, whatever their role (",[585,1605,1579],{},"). A Department Head decides only inside their own and managed departments. A record the owner cannot see answers ",[585,1608,1595],{},"; a leave request they can see but may not decide answers ",[585,1611,1579],{}," before anything is revealed about its state.",[722,1614,1615,1621],{},[737,1616,1617,1620],{},[585,1618,1619],{},"POST \u002Fleaves"," for someone else",[737,1622,1623],{},"Administrators and Executives, or the person's Department Head.",[722,1625,1626,1631],{},[737,1627,1628],{},[585,1629,1630],{},"PATCH \u002Fusers\u002F{id}",[737,1632,1633],{},"Only an Executive edits or promotes to Executive, and nobody changes their own role.",[722,1635,1636,1639],{},[737,1637,1638],{},"Webhook endpoints",[737,1640,1641,1642,1645],{},"Owners must be Administrators or Executives, whatever ",[563,1643,1644],{},"Who may create tokens"," allows.",[553,1647,1648,1649,1652],{},"The ",[659,1650,1651],{"href":191},"guides"," describe the visibility rules for each area.",[590,1654,1656],{"id":1655},"choosing-scopes","Choosing scopes",[595,1658,1659,1662,1665,1677],{},[560,1660,1661],{},"Start from the narrowest template that fits, then remove anything unused.",[560,1663,1664],{},"Use separate tokens for separate integrations rather than one token with every scope.",[560,1666,1667,1668,1670,1671,607,1673,1676],{},"Prefer ",[585,1669,633],{}," scopes for reporting and sync jobs. Grant ",[585,1672,629],{},[585,1674,1675],{},"approve"," only to integrations that genuinely act on behalf of their owner.",[560,1678,1679],{},"Give sensitive scopes only to tokens owned by someone whose job already involves that data, and pair them with an IP allowlist.",{"title":1681,"searchDepth":1682,"depth":1683,"links":1684},"",1,2,[1685,1686,1690,1693,1694],{"id":592,"depth":1683,"text":593},{"id":664,"depth":1683,"text":665,"children":1687},[1688],{"id":710,"depth":1689,"text":711},3,{"id":865,"depth":1683,"text":866,"children":1691},[1692],{"id":1447,"depth":1689,"text":1448},{"id":1548,"depth":1683,"text":1549},{"id":1655,"depth":1683,"text":1656},"How scopes limit what a token can reach, how reusable API roles and the built-in templates work, and the full scope catalogue with the minimum owner role for each scope.","md",null,{},{"icon":168},{"title":165,"description":1695},"IrK9jhljqIGE8MY2fEnYkCpP8RZruUq6DVTOqViWtcw",[1703,1705],{"title":161,"path":162,"stem":163,"description":1704,"icon":61,"children":-1},"How API tokens are formatted and sent, how expiry, rotation and revocation work, IP allowlists, what stops a token, and how to store one safely.",{"title":170,"path":171,"stem":172,"description":1706,"icon":173,"children":-1},"The response envelope, field naming, calendar dates and timestamps, cursor pagination, request bodies, idempotency keys and request ids.",1791906528365]