API and developers
Build on the same record HR works in.
A REST API documented in OpenAPI. Every write calls the same domain logic as the console, so approvals, locks, the self-approval guard and the audit trail apply exactly as they do for a person.
Reads and writes
People, positions, organisation structure, time off and more, with writes for hires, changes and leave going through the same approvals as the console.
Keys or OAuth
Company-scoped API keys, or OAuth client credentials for apps. Keys have an expiry, are shown once, and every call is logged.
Access by field group
A Read and a Write switch per group of fields, so a rostering system can read time off without ever seeing pay.
Signed webhooks
Joiner, mover and leaver events under Standard Webhooks, thin by default, with every delivery logged and retried.
API and developers
Build on the same record.
A REST API documented in OpenAPI, with reads and writes, company-scoped keys or OAuth client credentials, and signed webhooks for joiners, movers and leavers. Every write goes through the same approvals and audit trail as the console.
Read the docs at docs.andteam.com# A hire arrives as a prefilled draft offer. # HR still approves it and sends it. POST /v1/hires Authorization: Bearer atk_live_•••• Content-Type: application/json { "candidate": { "firstName": "Kagiso", "lastName": "Mahlangu", "email": "kagiso@example.com" }, "position": "pos_junior_fleet_planner", "startDate": "2031-05-01" } 201 Created { "offer": { "id": "ofr_8f2k…", "status": "draft" } }
What the API will not do
It never sends letters: after an approved change, HR sees a letter to send. A hire arrives as a prefilled draft offer, never as a starter, and never carries ID, employment equity or bank details. Legal names are not writable; preferred names are.
Special categories of personal information are available only with your Information Officer's approval, and health information is never available. Pay reads need approval from the person who signs off payroll, with a reason.
Limits and testing
Rate limits are 300 requests a minute per key and 1,200 per organisation. Your sandbox tenant accepts test keys, so an integration can be built against sample people before it touches real ones.
Managing integrations is its own permission in andteam. See the documentation for every endpoint, error type and header.