API Quick Start

To start using the PeopleFlow API, you'll need an API key: 1. Log in to your PeopleFlow dashboard 2. Navigate to Settings → API Settings 3. Click "Generate API Key" 4. Copy and securely store your API key ⚠️ Keep your API key secret. Never expose it in client-side code or public repositories.

Test your API key with a simple GET request: curl -X GET "https://peopleflowhr.net/api/v1/employees" \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" A successful response returns a JSON array of employees: { "data": [...], "meta": { "total": 42, "page": 1, "per_page": 25 } }

The PeopleFlow API uses Bearer token authentication: • Include your API key in the Authorization header • All requests must use HTTPS • Tokens can be scoped to specific permissions (read, write, admin) • Rotate your keys periodically for security Example header: Authorization: Bearer pf_live_abc123...

API requests are rate-limited to ensure fair usage: • Standard Plan: 100 requests per minute • Professional Plan: 500 requests per minute • Enterprise Plan: Custom limits Rate limit headers are included in every response: X-RateLimit-Limit: 100 X-RateLimit-Remaining: 95 X-RateLimit-Reset: 1640000000 When rate-limited, you'll receive a 429 Too Many Requests response.

Here are the most commonly used API endpoints: GET /api/v1/employees — List all employees POST /api/v1/employees — Create a new employee GET /api/v1/employees/:id — Get employee details PUT /api/v1/employees/:id — Update an employee DELETE /api/v1/employees/:id — Remove an employee GET /api/v1/time/entries — List time entries POST /api/v1/time/clock-in — Clock in an employee POST /api/v1/time/clock-out — Clock out an employee GET /api/v1/leave/requests — List leave requests POST /api/v1/leave/requests — Submit a leave request GET /api/v1/payroll/runs — List payroll runs See the full API Reference for all available endpoints.

The API uses standard HTTP status codes: 200 — Success 201 — Created 400 — Bad Request (check your parameters) 401 — Unauthorized (invalid or missing API key) 403 — Forbidden (insufficient permissions) 404 — Not Found 422 — Validation Error 429 — Rate Limited 500 — Internal Server Error Error responses include a message and error code: { "error": { "code": "VALIDATION_ERROR", "message": "Email is required", "details": [...] } }