Illizeo exposes a REST API documented in OpenAPI. Authentication uses a scoped token / secret pair, sent in two HTTP headers.
Main endpoints #
| Domain | Abilities available |
|---|---|
| Employees | read, write |
| Absences | read, write |
| Attendance | read, write |
| Documents | read, write |
| Signatures | read, write |
| Offices | read, write |
| Departments | read, write |
| Teams, positions, countries | read |
Organisation, salaries and two per-employee GDPR endpoints — export and erasure — round it out. The full contract is published as OpenAPI 3.0 at /api/api-docs, some forty paths.
Step-by-step #
-
Create a token #
From the settings, create an access token: a name, the list of abilities, and an expiry date if you want one. You get a token and a secret. The secret is shown once.
-
Authenticate your calls #
Two HTTP headers,
TokenandSecret. No OAuth, no bearer token: two fixed values, to keep in a vault. -
Tick only what you need #
Each ability is named and checked route by route. A token holding only employee read gets an explicit refusal on a write, naming the missing ability.
-
Read the error codes for what they say #
Every error response carries an
error_codeand a request id. 401: the token is no longer valid. 403: missing right. 404: outside your scope. 409: state conflict. 422: invalid data. 500: a failure on our side. A 202 is not an error: the request is accepted but its effect is deferred, typically pending approval. -
Manage the token lifecycle #
A token can be deactivated, regenerated — a new token/secret pair — or deleted. Regenerating invalidates the old pair immediately.
Data format #
All responses in JSON. Cursor-based pagination (RFC 5988). RFC 7807 errors (Problem Details). Standard URL filters: ?filter[status]=active&sort=-created_at&page[size]=50.
FAQ #
Is the API versioned?
There is no version prefix in the URLs. Contract changes are recorded in a changelog, with no contractual deprecation notice period.
Are there call quotas?
No quota is published or enforced per route. That does not excuse an unreasonable frequency: an HR synchronisation does not need to be to the second.
Are there SDKs?
No. There is no official library and no ready-made collection: the OpenAPI specification lets you generate one in your language.
Is there a sandbox?
No separate test environment with fictitious data. Test on your own workspace, starting with a read-only token.
How do I receive events?
You do not: there is no outbound webhook. A synchronisation is built by polling.
What does not exist #
No OAuth 2.0 for the API (Illizeo’s OAuth is for employee sign-in, not integration tokens). No webhooks. No official or community SDKs. No Postman collection provided. No API usage dashboard. No cursor pagination and no RFC 7807 error format. No sandbox. No hourly quotas per resource.
