Connect your HR system with the Employee API

The Employee API lets your HR or payroll system add, update and deactivate employees in HIPAA Certify automatically. New hires show up, name and email changes carry over, and people who leave are deactivated. Their training records are always kept.

Note

The Employee API is available on the Medium and Large plans and on invoiced accounts. Your HIPAA Certify contact enables it for your organization first. Contact support to request access.

1. Turn the API on (account owner)#

1. Click Employee API in the sidebar.
2. Check the three status boxes: Plan, Enabled by HIPAA Certify and Turned on by you.
3. Click Turn API on.

Only the account owner can turn the API on or off and manage keys. Managers can see the status and the activity log.

2. Create a key#

1. Under API keys, click Create a key.
2. Give it a name, such as "Workday nightly sync".
3. Choose permissions:
   • read: look up employees
   • write: add and update employees
   • deactivate: deactivate people who left. Give this only to the key that runs a full sync.
4. Optional: enter Allowed IP addresses, your HR vendor's outbound IPs. The key won't work from anywhere else.
5. Choose when it Expires, then click Create key.
6. Copy the key now. It's shown only once.

You'll get an email whenever a key is created, revoked, or used from a new IP address.

3. Connect your HR system#

Give the key and the base URL https://hipaacertify.com/api/v1 to your HR system administrator or vendor, along with the Employee API reference.

We recommend:

• a full sync once a day, at night
• matching on your HR employee ID (external_id), so email changes update the right person
• running the first sync with "dry_run": true and checking the results before you go live

How people who leave are handled#

• A full sync deactivates employees who are no longer in your HR list. It doesn't delete them, and their training history stays in Reports.
• By default, only people the API has already seen are deactivated. Employees you added by hand aren't touched unless your developer chooses "deactivate_missing": "all".
• Safety limit: a sync that would deactivate more than 10% of your synced employees, or 25 people (whichever is larger, but never more than half of them), is refused unless the request confirms it. You can change the limit under Sync safety limit.
• The owner gets an email whenever a sync deactivates anyone.

Turning it off#

• Owner: click Turn API off. Every key stops working immediately. Keys come back when you turn the API on again.
• Revoke a single key: click Revoke next to it.
• Downgrading to the Small plan, cancelling, or a failed payment pauses the API automatically until it's resolved.

Tip

The API never changes the account owner or managers. To change an administrator's email, see Change the account owner's or a manager's email.