{
 "categories": [
  "hr",
  "hcm",
  "saas-platform"
 ],
 "deployment": "saas",
 "evidence": [
  {
   "date": "2026-09-09",
   "fact": "homepage",
   "note": "BambooHR presents a hosted HR platform covering hiring, HR data, payroll, time, benefits, employee experience, performance, and compensation. The page states 30,000 businesses and service in 150-plus countries as vendor-declared figures.",
   "source": "https://www.bamboohr.com/",
   "tier": "declared"
  },
  {
   "date": "2026-09-09",
   "fact": "license",
   "note": "BambooHR sells Core, Pro, and Elite as paid per-employee monthly plans starting at $10, $17, and $25 USD, with a $250 USD monthly floor at 25 employees or fewer. Payroll, benefits, and time are add-ons.",
   "source": "https://www.bamboohr.com/pricing",
   "tier": "declared"
  },
  {
   "date": "2026-09-09",
   "fact": "deployment",
   "note": "The FAQ states customer data is hosted in the United States, Canada, or Ireland depending on the customer. This is SaaS, not a self-managed install.",
   "source": "https://www.bamboohr.com/",
   "tier": "declared"
  },
  {
   "date": "2026-09-09",
   "fact": "modalities.api.exists",
   "note": "BambooHR documents a RESTful HTTPS API that accesses and modifies employee resources and generates reports in several formats.",
   "source": "https://documentation.bamboohr.com/docs/getting-started",
   "tier": "declared"
  },
  {
   "date": "2026-09-09",
   "fact": "modalities.api.kinds[0]",
   "note": "API requests go to https://{companyDomain}.bamboohr.com/api/. The current major version is V1. Responses use standard HTTP status codes including 201 when creating an employee or time-off request.",
   "source": "https://documentation.bamboohr.com/docs/api-details",
   "tier": "declared"
  },
  {
   "date": "2026-09-09",
   "fact": "modalities.api.auth[0]",
   "note": "OAuth uses the developer portal client ID and secret. Users authorize at https://{companyDomain}.bamboohr.com/authorize.php?request=authorize and exchange the code at token.php with grant_type=authorization_code. Tokens are Bearer, expires_in 3600, with refresh_token when offline_access is requested.",
   "source": "https://documentation.bamboohr.com/docs/getting-started",
   "tier": "declared"
  },
  {
   "date": "2026-09-09",
   "fact": "modalities.api.auth[1]",
   "note": "Single-customer integrations authenticate with HTTP Basic: the API key is the username and any string is the password. Example: curl -u \"{API Key}:x\" https://{companyDomain}.bamboohr.com/api/v1/employees/directory. Repeated unknown keys return HTTP 403.",
   "source": "https://documentation.bamboohr.com/docs/getting-started",
   "tier": "declared"
  },
  {
   "date": "2026-09-09",
   "fact": "modalities.api.coverage",
   "note": "GET employee returns JSON or XML for named fields, with silent field-level permission omission and a 400-field cap. Related documented surfaces include list-employees, datasets, reports, time off, hiring, and benefits. Coverage is permission-scoped rather than a full unrestricted dump.",
   "source": "https://documentation.bamboohr.com/reference/get-employee",
   "tier": "declared"
  },
  {
   "date": "2026-09-09",
   "fact": "modalities.api.coverage",
   "note": "POST/update employee accepts JSON or XML field maps for writable employee fields discovered via List Fields. Photo upload is a separate endpoint and is documented as unreliable for AI connectors.",
   "source": "https://documentation.bamboohr.com/reference/update-employee",
   "tier": "declared"
  },
  {
   "date": "2026-09-09",
   "fact": "modalities.api.docs",
   "note": "Opened BambooHR's current API getting-started guide covering OAuth, API-key Basic, companyDomain substitution, and the pointer to language bindings and Postman.",
   "source": "https://documentation.bamboohr.com/docs/getting-started",
   "tier": "declared"
  },
  {
   "date": "2026-09-09",
   "fact": "modalities.sdk.exists",
   "note": "BambooHR documents official MIT-licensed SDKs. The opened page lists PHP (composer require bamboohr/api, PHP 8.1+, OAuth 2.0) as current. .NET and Java wrappers are unmaintained. Community Python, Ruby, and Perl wrappers are unsupported on that page.",
   "source": "https://documentation.bamboohr.com/docs/sdks",
   "tier": "declared"
  },
  {
   "date": "2026-09-09",
   "fact": "modalities.sdk.languages[0]",
   "note": "The official SDKs page presents the PHP package bamboohr/api with a fluent ApiClient that can authenticate with an API key and load employees.",
   "source": "https://documentation.bamboohr.com/docs/sdks",
   "tier": "declared"
  },
  {
   "date": "2026-09-09",
   "fact": "modalities.sdk.languages[1]",
   "note": "BambooHR's GitHub repository bhr-api-python describes an official Python SDK (pip install bamboohr-sdk) with OAuth and API-key builders, retries, and generated clients. The vendor README was last pushed 2026-08-31.",
   "source": "https://github.com/BambooHR/bhr-api-python",
   "tier": "declared"
  },
  {
   "date": "2026-09-09",
   "fact": "modalities.mcp.first_party",
   "note": "BambooHR documents a vendor-hosted MCP server at https://{subdomain}.bamboohr.com/api/mcp using streamable HTTP. It is in closed beta and powers the Claude and ChatGPT connectors.",
   "source": "https://documentation.bamboohr.com/docs/mcp-server",
   "tier": "declared"
  },
  {
   "date": "2026-09-09",
   "fact": "modalities.mcp.verdict",
   "note": "The server is hosted by BambooHR, uses OAuth 2.0 protected-resource metadata, and exposes 56 tools (41 read, 14 write/delete, 1 utility) across employees, datasets, reports, time off, goals, hiring, global employment, and files. Admin enablement of AI Connectors and manual client registration apply.",
   "source": "https://documentation.bamboohr.com/docs/mcp-server",
   "tier": "declared"
  },
  {
   "date": "2026-09-09",
   "fact": "modalities.mcp.third_party[0]",
   "note": "pipeworx-io/mcp-bamboohr is a third-party pack wrapping BambooHR API v1 (directory, employee, time-off, files) via https://gateway.pipeworx.io/bamboohr/mcp. README last refreshed 2026-08-26. It is not BambooHR-owned.",
   "source": "https://github.com/pipeworx-io/mcp-bamboohr",
   "tier": "scraped"
  },
  {
   "date": "2026-09-09",
   "fact": "modalities.extensibility.webhooks",
   "note": "BambooHR documents HTTPS-only webhooks (global admin and permissioned API). Payloads are JSON or form-encoded, signed with SHA-256 HMAC via X-BambooHR-Signature and X-BambooHR-Timestamp, and retried up to five times.",
   "source": "https://documentation.bamboohr.com/docs/webhooks",
   "tier": "declared"
  },
  {
   "date": "2026-09-09",
   "fact": "modalities.extensibility.webhooks",
   "note": "Event-based webhooks (recommended) fire employee.created, employee.updated, and employee.deleted with a lightweight JSON payload. Field-based/global webhooks remain available.",
   "source": "https://documentation.bamboohr.com/docs/event-based-webhooks",
   "tier": "declared"
  },
  {
   "date": "2026-09-09",
   "fact": "modalities.data_access.export",
   "note": "POST /api/v1/reports/custom returns employee report rows as JSON, XML, CSV, XLS, or PDF. The page marks the endpoint deprecated in favour of Datasets > Get Data from Dataset.",
   "source": "https://documentation.bamboohr.com/reference/request-custom-report",
   "tier": "declared"
  },
  {
   "date": "2026-09-09",
   "fact": "modalities.data_access.import",
   "note": "Employee field updates accept application/json or XML bodies with writable field names from List Fields.",
   "source": "https://documentation.bamboohr.com/reference/update-employee",
   "tier": "declared"
  },
  {
   "date": "2026-09-09",
   "fact": "modalities.agent_docs.llms_txt",
   "note": "BambooHR publishes a genuine documentation llms.txt that indexes getting-started, webhooks, official SDKs, MCP server, Claude and ChatGPT connectors, and the API reference.",
   "source": "https://documentation.bamboohr.com/llms.txt",
   "tier": "declared"
  },
  {
   "date": "2026-09-09",
   "fact": "verdict.scores.api",
   "note": "Documented REST with OAuth and Basic, official PHP and Python SDKs, HMAC webhooks, and read/write employee, time-off, report, and hiring surfaces is a broad production path. Permission filters, deprecated custom reports, and edition add-ons keep it below 9.",
   "source": "https://documentation.bamboohr.com/docs/getting-started",
   "tier": "declared"
  },
  {
   "date": "2026-09-09",
   "fact": "verdict.scores.mcp",
   "note": "The official server has useful coverage (56 tools) but is closed beta, admin-gated, and lacks dynamic client registration. That is a limited vendor preview, not production-grade official coverage.",
   "source": "https://documentation.bamboohr.com/docs/mcp-server",
   "tier": "declared"
  },
  {
   "date": "2026-09-09",
   "fact": "freshness.watch[0].url",
   "note": "Opened and verified as the current BambooHR API getting-started page for OAuth and API-key Basic.",
   "source": "https://documentation.bamboohr.com/docs/getting-started",
   "tier": "declared"
  },
  {
   "date": "2026-09-09",
   "fact": "freshness.watch[1].url",
   "note": "Opened and verified as BambooHR's current first-party MCP server page, still labelled closed beta at /api/mcp.",
   "source": "https://documentation.bamboohr.com/docs/mcp-server",
   "tier": "declared"
  },
  {
   "date": "2026-09-09",
   "fact": "freshness.watch[2].url",
   "note": "Opened and verified as the current official SDKs page listing PHP as current and .NET/Java as unmaintained.",
   "source": "https://documentation.bamboohr.com/docs/sdks",
   "tier": "declared"
  },
  {
   "date": "2026-09-09",
   "fact": "freshness.watch[3].url",
   "note": "Opened and verified as the current webhook overview for global and permissioned HTTPS callbacks and HMAC signatures.",
   "source": "https://documentation.bamboohr.com/docs/webhooks",
   "tier": "declared"
  }
 ],
 "freshness": {
  "last_verified": "2026-09-09",
  "volatility": "high",
  "watch": [
   {
    "type": "docs",
    "url": "https://documentation.bamboohr.com/docs/getting-started"
   },
   {
    "type": "mcp",
    "url": "https://documentation.bamboohr.com/docs/mcp-server"
   },
   {
    "type": "docs",
    "url": "https://documentation.bamboohr.com/docs/sdks"
   },
   {
    "type": "docs",
    "url": "https://documentation.bamboohr.com/docs/webhooks"
   }
  ]
 },
 "homepage": "https://www.bamboohr.com/",
 "id": "bamboohr",
 "license": "commercial",
 "modalities": {
  "agent_docs": {
   "llms_txt": true
  },
  "api": {
   "auth": [
    "oauth2",
    "basic"
   ],
   "coverage": "partial",
   "docs": "https://documentation.bamboohr.com/docs/getting-started",
   "exists": true,
   "kinds": [
    "rest"
   ]
  },
  "cli": {
   "exists": "unknown"
  },
  "computer_use": {
   "issues": [],
   "viability": "unknown"
  },
  "data_access": {
   "export": [
    "json",
    "xml",
    "csv",
    "xls",
    "pdf"
   ],
   "import": [
    "json",
    "xml"
   ]
  },
  "extensibility": {
   "scripting": [],
   "webhooks": true
  },
  "integrations": {
   "make": "unknown",
   "n8n": "unknown",
   "power_automate": "unknown",
   "zapier": "unknown"
  },
  "mcp": {
   "first_party": true,
   "third_party": [
    {
     "maintained": true,
     "registries": [
      "official-mcp-registry",
      "github"
     ],
     "repo": "https://github.com/pipeworx-io/mcp-bamboohr"
    }
   ],
   "verdict": "official"
  },
  "rpa": {
   "drivability": "unknown",
   "notes": "No repeatable UI probe was run. The BambooHR REST API, official SDKs, HTTPS webhooks, and the vendor-hosted MCP server cover HR automation without browser control. Personio, Workday, SAP SuccessFactors, and Simployer are outside this identity.\n",
   "ui_stack": [
    "web-dom"
   ],
   "vendor_support": []
  },
  "sdk": {
   "exists": true,
   "languages": [
    "php",
    "python"
   ],
   "official": true
  }
 },
 "name": "BambooHR",
 "platforms": [
  "web"
 ],
 "related": {
  "alternatives": [
   "personio",
   "workday",
   "sap-successfactors",
   "simployer"
  ],
  "our_products": []
 },
 "schema_version": 1,
 "score_version": 1,
 "status": "active",
 "vendor": "BambooHR",
 "verdict": {
  "best_path": "api",
  "scores": {
   "api": 8,
   "cli": null,
   "computer_use": null,
   "integrations": null,
   "mcp": 6,
   "overall": 8,
   "rpa": null
  },
  "summary": "BambooHR is automatable today through its public REST API on https://{companyDomain}.bamboohr.com/api/. This record is BambooHR, not Personio, Workday, SAP SuccessFactors, or Simployer. Partners authenticate with OAuth 2 authorization code plus refresh at authorize.php and token.php. Single-customer integrations may send an API key as the HTTP Basic username (any password). The API reads and updates employee fields, time off, reports, datasets, hiring, benefits, and related objects, subject to the caller's permissions and OAuth scopes. Custom reports can return JSON, XML, CSV, XLS, or PDF; that report endpoint is documented as deprecated in favour of Datasets. Official PHP and Python SDKs exist. HTTPS webhooks support event-based and field-based payloads with SHA-256 HMAC signatures. BambooHR also hosts a first-party MCP server in closed beta at https://{subdomain}.bamboohr.com/api/mcp with 56 tools. An admin must enable the AI Connectors app; client registration is manual; access tokens last one hour. A third-party Pipeworx pack wraps API v1 and is not vendor-owned. Connector catalogues were not opened. Computer-use viability is unassessed. API scores 8 and is the best path. MCP scores 6 as a limited official preview.\n"
 }
}