Developers

Build on i-Swipe HR Suite

Connect your accounting system, time clocks, intranet or identity provider. A simple JSON API over HTTPS, signed webhooks, and SCIM for user provisioning.

Base URLhttps://api.iswipehr.com/v1

OpenAPI 3 spec Browse 24 endpoints Webhooks

Getting started

Create a key

An HR admin opens Settings → API keys, creates a key and ticks only the permissions it needs.

Send it each time

Add Authorization: Bearer ISW_… to every request.

Read the JSON

Lists come back as {"data", "meta"}; errors as {"error": {"code", "message"}}.

curl "https://api.iswipehr.com/v1/employees?per_page=20" \
  -H "Authorization: Bearer ISW_your_key"

const res = await fetch("https://api.iswipehr.com/v1/employees?per_page=20", {
  headers: { Authorization: "Bearer " + process.env.ISWIPE_KEY },
});
const { data, meta } = await res.json();   // meta: { page, per_page, total }

$ch = curl_init("https://api.iswipehr.com/v1/employees?per_page=20");
curl_setopt_array($ch, [
    CURLOPT_HTTPHEADER     => ['Authorization: Bearer ' . getenv('ISWIPE_KEY')],
    CURLOPT_RETURNTRANSFER => true,
]);
$body = json_decode(curl_exec($ch), true);   // $body['data'], $body['meta']

Rate limitsEach key has an hourly limit. Check X-RateLimit-Remaining on every response.

ErrorsNormal HTTP status codes: 401 bad key, 403 missing permission, 404 not found, 422 invalid input, 429 too many requests.

PlansAPI access is part of the Business and Enterprise plans, or the API add-on.

Endpoints

Account 1

GET /v1/me The key and company in use

People 5

GET /v1/employees List employees employees:read

GET /v1/employees/{id} One employee employees:read

PATCH /v1/employees/{id} Update an employee employees:write

GET /v1/departments Departments employees:read

GET /v1/job-titles Job titles employees:read

Leave 4

GET /v1/leave/types Leave types leave:read

GET /v1/leave/requests Leave requests leave:read

POST /v1/leave/requests Send a leave request (same rules and approval chain as the app) leave:write

GET /v1/leave/balances Leave balances leave:read

Attendance 3

GET /v1/attendance Attendance records attendance:read

POST /v1/attendance/clock-in Clock in (time clocks, fingerprint terminals) attendance:write

POST /v1/attendance/clock-out Clock out attendance:write

Payroll 2

GET /v1/payroll/runs Payroll runs payroll:read

GET /v1/payroll/runs/{id}/records Payslips in a run payroll:read

Webhooks 3

GET /v1/webhooks Your webhooks webhooks:manage

POST /v1/webhooks Add a webhook (signed with HMAC-SHA256) webhooks:manage

DELETE /v1/webhooks/{id} Remove a webhook webhooks:manage

SCIM 2.0 provisioning 6

For Okta, Microsoft Entra ID, JumpCloud and OneLogin. Base URL https://api.iswipehr.com/v1/scim/v2, token from Settings → Single sign-on. Deactivating a user in your directory blocks their sign-in at once; HR still handles the exit and final pay.

GET /v1/scim/v2/Users SCIM: list users (filter userName eq "…") scim

POST /v1/scim/v2/Users SCIM: create user scim

GET /v1/scim/v2/Users/{id} SCIM: one user scim

PUT /v1/scim/v2/Users/{id} SCIM: replace user scim

PATCH /v1/scim/v2/Users/{id} SCIM: update (e.g. active=false) scim

DELETE /v1/scim/v2/Users/{id} SCIM: deactivate scim

Webhooks

Get a signed POST to your URL the moment something happens. Add them in Integrations or with POST /v1/webhooks. Failed deliveries are retried for about 15 hours.

employee.createdA new employee is addedemployee.updatedAn employee record changesemployee.exitedSomeone leaves the companyleave.requestedSomeone asks for leaveleave.approvedLeave is approvedleave.declinedLeave is declinedleave.cancelledLeave is cancelledattendance.clock_inSomeone clocks inattendance.clock_outSomeone clocks outpayroll.approvedA payroll run is approvedpayroll.releasedPayslips are releaseddocument.signedSomeone signs a document

Check every delivery is really from us

Each request carries X-iSwipe-Signature: t=<unix time>,v1=<hex>. v1 is an HMAC-SHA256 of <t>.<raw body> using your webhook secret. Reject timestamps older than 5 minutes to stop replays.

const crypto = require("crypto");
const [t, v1] = req.headers["x-iswipe-signature"].split(",").map(p => p.split("=")[1]);
const want = crypto.createHmac("sha256", SECRET).update(t + "." + rawBody).digest("hex");
const ok = Math.abs(Date.now() / 1000 - t) < 300 &&
  crypto.timingSafeEqual(Buffer.from(v1), Buffer.from(want));

parse_str(str_replace(',', '&', $_SERVER['HTTP_X_ISWIPE_SIGNATURE'] ?? ''), $sig);
$raw  = file_get_contents('php://input');
$want = hash_hmac('sha256', $sig['t'] . '.' . $raw, getenv('ISWIPE_WEBHOOK_SECRET'));
$ok   = abs(time() - (int)$sig['t']) < 300 && hash_equals($want, $sig['v1'] ?? '');

Accounting and banks — no code needed

Payroll journals

Each payroll run has a Journal page with one-click imports for QuickBooks Online, Xero, Sage Accounting and Zoho Books.

Bank and tax files

Upload-ready payment files (standard, NIBSS and Remita) under Bank & tax files on every run.