BambooHR

Explore 5 actions and their permissionsExact inputs, sign-in scopes, access limits and approval rules.

With BambooHR connected, a hire can:

• look people up: name, job title, department, location, manager and status,
• see time-off requests in a date range and who's out (with company holidays),
• approve or deny a time-off request that's waiting, always after a person approves,
• be woken when someone asks for time off.

Personal data: the minimum, unless you widen itCopy Anchor Link

HR data is about people, and much of it is sensitive. Roster keeps it to what a hire needs:

• By default a hire sees only names, job titles, departments, locations, managers and status. Roster asks BambooHR for nothing more, so the rest never leaves BambooHR.
• Never by default: pay, social security and other ID numbers, birth dates, home addresses, private emails and phone numbers, gender, ethnicity, family details, why someone is off (the time-off type, like "Sick leave") and notes on requests.
• You widen it on purpose, on the connection: More fields hires may see for ordinary fields (like workEmail), and Sensitive fields hires may see for the rest (like timeOffType, timeOffNotes or payRate). A sensitive field typed in the ordinary list is refused, so it always takes a deliberate second step.
• When notes are shown, phone numbers and email addresses in them are taken out.
• Hires are told that personal data stays inside your team.

The API key also sees only what its BambooHR user sees, so make it for a user whose access matches what hires should see.

1. Make an API key in BambooHRCopy Anchor Link

Straight there: your BambooHR (https://<subdomain>.bamboohr.com) → your name → API Keys. Once you've typed your subdomain in Roster, the form links to your BambooHR.

1. Sign in to BambooHR as the user hires should see as (ideally one whose access you've limited).
2. Click your name at the top right, choose API Keys and Add New Key. Name it Roster and copy it.

2. Connect it in RosterCopy Anchor Link

1. Open Integrations → Tools → Add a tool, search for BambooHR and choose it.
2. API key: paste the key.
3. BambooHR subdomain: the part before .bamboohr.com in your BambooHR address, like bayt.
4. More fields hires may see and Sensitive fields hires may see: leave them empty unless a hire's job needs more (field names as BambooHR's API names them, like workEmail, hireDate, timeOffType).
5. Click Connect.

Roster checks the key when you click Connect. Once it's accepted, the connection shows Connected as your BambooHR address and whose key it is. If it's refused, Roster says what to fix (a mistyped key, a missing permission) and saves nothing.

3. Give hires accessCopy Anchor Link

On the hire's Tools tab, click Give access on BambooHR:

• Read only: it can look people up and see time off and who's out.
• Read and write: it can also approve or deny time-off requests. That always asks a person first: the hire asks in the thread with whose request it is and the note, and when the approver says yes, Roster does exactly that, once.
• Departments: departments whose people it may see, by name. Leave it empty for everyone. Anyone in another department is refused, in every list and lookup.

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "words": {
      "type": "string",
      "maxLength": 200
    },
    "limit": {
      "default": 30,
      "type": "integer",
      "minimum": 1,
      "maximum": 100
    }
  }
}

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "pattern": "^\\d{1,12}$"
    }
  },
  "required": [
    "id"
  ]
}

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "start": {
      "type": "string",
      "pattern": "^\\d{4}-\\d{2}-\\d{2}$"
    },
    "end": {
      "type": "string",
      "pattern": "^\\d{4}-\\d{2}-\\d{2}$"
    },
    "status": {
      "type": "string",
      "enum": [
        "requested",
        "approved",
        "denied",
        "canceled"
      ]
    },
    "employee": {
      "description": "an employee ID",
      "type": "string",
      "pattern": "^\\d{1,12}$"
    }
  }
}

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "start": {
      "type": "string",
      "pattern": "^\\d{4}-\\d{2}-\\d{2}$"
    },
    "end": {
      "type": "string",
      "pattern": "^\\d{4}-\\d{2}-\\d{2}$"
    }
  }
}

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "request": {
      "type": "string",
      "pattern": "^\\d{1,12}$"
    },
    "decision": {
      "type": "string",
      "enum": [
        "approve",
        "deny"
      ]
    },
    "employee": {
      "type": "string",
      "minLength": 1,
      "maxLength": 200,
      "description": "the employee's name as list_time_off shows it; checked"
    },
    "note": {
      "description": "for the employee",
      "type": "string",
      "maxLength": 1000
    }
  },
  "required": [
    "request",
    "decision",
    "employee"
  ]
}