---
title: Use the Illizeo REST API
description: "Illizeo exposes a REST API documented in OpenAPI. Authentication uses a scoped token / secret pair, sent in two HTTP headers. - **Reading time**5 min - **Level**Advanced - **Last updated**May 2026 - **Module**Integrations & API ## Main endpoints | Domain | Abilities…"
url: "https://illizeo.com/en/centre-aide/use-the-illizeo-rest-api/"
updated: "2026-09-21"
category: "Platform / Integrations & API"
---

# Use the Illizeo REST API

Illizeo exposes a REST API documented in OpenAPI. Authentication uses a scoped token / secret pair, sent in two HTTP headers.

- **Reading time**5 min
- **Level**Advanced
- **Last updated**May 2026
- **Module**Integrations & API

## Main endpoints

| Domain | Abilities available |
| --- | --- |
| Employees | read, write |
| Absences | read, write |
| Attendance | read, write |
| Documents | read, write |
| Signatures | read, write |
| Offices | read, write |
| Departments | read, write |
| Teams, positions, countries | read |

Organisation, salaries and two per-employee GDPR endpoints — export and erasure — round it out. The full contract is published as OpenAPI 3.0 at `/api/api-docs`, some forty paths.

## Step-by-step

1. ### Create a token

   From the settings, create an access token: a name, the list of abilities, and an expiry date if you want one. You get a **token** and a **secret**. The secret is shown once.
2. ### Authenticate your calls

   Two HTTP headers, `Token` and `Secret`. No OAuth, no bearer token: two fixed values, to keep in a vault.
3. ### Tick only what you need

   Each ability is named and checked route by route. A token holding only employee read gets an explicit refusal on a write, naming the missing ability.
4. ### Read the error codes for what they say

   Every error response carries an `error_code` and a request id. 401: the token is no longer valid. 403: missing right. 404: outside your scope. 409: state conflict. 422: invalid data. 500: a failure on our side. A 202 is not an error: the request is accepted but its effect is deferred, typically pending approval.
5. ### Manage the token lifecycle

   A token can be deactivated, regenerated — a new token/secret pair — or deleted. Regenerating invalidates the old pair immediately.

## Data format

All responses in JSON. Cursor-based pagination (RFC 5988). RFC 7807 errors (Problem Details). Standard URL filters: `?filter[status]=active&sort=-created_at&page[size]=50`.

## FAQ

   Is the API versioned?

There is no version prefix in the URLs. Contract changes are recorded in a changelog, with no contractual deprecation notice period.

   Are there call quotas?

No quota is published or enforced per route. That does not excuse an unreasonable frequency: an HR synchronisation does not need to be to the second.

   Are there SDKs?

No. There is no official library and no ready-made collection: the OpenAPI specification lets you generate one in your language.

   Is there a sandbox?

No separate test environment with fictitious data. Test on your own workspace, starting with a read-only token.

   How do I receive events?

You do not: there is no outbound webhook. A synchronisation is built by polling.

## What does not exist

No OAuth 2.0 for the API (Illizeo’s OAuth is for employee sign-in, not integration tokens). No webhooks. No official or community SDKs. No Postman collection provided. No API usage dashboard. No cursor pagination and no RFC 7807 error format. No sandbox. No hourly quotas per resource.

### See Webhooks and events

Receive Illizeo events in real time.

[See all Platform articles](/en/centre-aide/?cat=platform)

### *Related*