Public API, scoped keys and signed webhooks
A key-authed read surface for employees and attendance, with HMAC-signed webhooks on nine events.
You can now read ontime from your own systems, and have ontime tell you when something happens.
A read API. GET /api/public/v1/employees and
GET /api/public/v1/attendance return org-scoped data for a key you issue
yourself. Keys are hashed at rest and shown exactly once, at creation. Each key
carries its own scope and a limit of 600 requests per minute.
Signed webhooks. Nine events post to your endpoint with an HMAC-SHA256 signature header so you can verify origin: leave approved and rejected, regularization approved and rejected, overtime approved and rejected, payslip published, Form 16 available, and message received. Failed deliveries retry with backoff, and each hook shows its own health.
What is not here yet. There is no public write route — this surface reads. Delivery is in-process and best-effort rather than a durable queue, so treat a webhook as a prompt to fetch rather than a guaranteed record.
Issue a key in Settings → API.