Organization
API access
Read your workspace's people, organization and leave data from other tools with scoped API keys. In beta.
- Plans
- ProEnterprise
- Who
- Owner, Admin
- Where
- Settings → Organization → API keys
- How to enable
- Create an API key and choose what it can read.
Beta
The API is in beta. We're still adding endpoints and fields, but changes stay additive: nothing an integration relies on is removed or renamed.
The API lets your other tools read openbranchhq data: payroll can pick up approved leave, an IT system can follow who joins and leaves, and a dashboard can show who's out this week. It is read-only for now. The API reference lists every endpoint, with a playground to try them.
How it works
- What it reads. Your organization's locations, departments and public holidays; people's records with their work details, employee number and date of birth; and leave types, requests, balances and the team calendar.
- API keys. Owners and admins create keys for the workspace. A key is shown once, when it's created, and only a fingerprint of it is stored, so a lost key is replaced rather than recovered.
- Scopes. Each key reads only what it was created for: a whole area (organization, people or leave) or single parts of one, such as locations or leave balances. A whole area also covers data the API adds to it later; a single part covers just that part. A request outside a key's scopes is refused.
- Keys act as their creator. A key never sees more than the person who created it could see in the app, and it follows that person's current role. If the creator is removed from the workspace or archived, their keys stop working for good, even if they're rehired later.
- Revoking. Any owner or admin can revoke a key at any time, and it stops working immediately. Keys can also expire after 30 days, 90 days or a year.
- Fair use. Requests are rate-limited per key, and every response says how many remain.
Good to know
- Plans. API access is part of Pro and Enterprise. If the workspace moves to Free, its keys are kept but every request is refused until you upgrade again.
- Personal data. Leave notes stay out of the API, and the team calendar shows approved leave only, as in the app. People's records include each person's date of birth, so a key reads everyone's only while its creator is an owner, admin or HR; otherwise it reads just its creator's own.