Can AI agents automate HiBob?

HiBob (Bob) is automatable today through a public REST API. This record is HiBob, not BambooHR, Personio, 4human HRM, or Workday. Customer-built integrations authenticate as API service users with HTTP Basic: Base64-encoded service-user ID and token in the Authorization header. Service users cannot log in to Bob; access is set by permission groups on features, people's fields, and whose data they may see. Approved Marketplace partners use OAuth 2.0 authorization code instead, exchanging codes at https://auth.app.hibob.com/oauth2/v1/apps/token. Access tokens expire in five minutes and are refreshed. The People Search API and related employee, time-off, attendance, tasks, reports, docs, goals, skills, job-catalog, employer, workforce-planning, hiring, and learning resources live under https://api.hibob.com/v1. Coverage is partial because field access is permission-gated, People Search has no pagination and documents large-company batching limits, and OAuth is partner-only. Webhooks v2 POST JSON events for employee, time off, task, docs, and workforce-planning changes, signed with HMAC SHA512. Zapier lists a Hibob app with employee lifecycle triggers. First-party MCP ownership is not established. Computer-use viability is unassessed. API scores 8 and is the best path. The opened Zapier listing is trigger-heavy, so integrations scores 5.

Best path today: api · Overall automatability: 8/10