Integrations

REST API

Punchify offers a REST API at https://<your domain>/api/v1, e.g. for payroll, reporting or your own programs. The full description (OpenAPI) is at https://<your domain>/api/v1-docs.

Authenticate with the header:

Authorization: Bearer <API key or OAuth token>

Available scopes:

Example:

curl -H "Authorization: Bearer $PUNCHIFY_API_KEY" https://time.yourcompany.com/api/v1/people

API keys

Under Company → Integrations an admin creates keys with selected scopes and an expiry date. The key is shown only once; it can be revoked at any time.

OAuth 2.0 for apps

Third-party programs connect via OAuth 2.0 (authorization code with PKCE). An admin registers the app under Company → Integrations → Apps; the person agrees on a consent page when connecting for the first time. Grants can be revoked under Settings → Connected apps. Endpoints: /oauth/authorize, /oauth/token, /oauth/revoke. Access tokens are valid for one hour, refresh tokens for 60 days.

Webhooks

Punchify reports selected events immediately via HTTPS to other systems:

punch, entry.created, entry.updated, entry.deleted, absence.requested, absence.created, absence.approved, absence.rejected, absence.cancelled, month.closed, month.reopened

Each delivery is signed with HMAC-SHA256 (header X-Punchify-Signature; the secret is shown once when created). Failed deliveries are retried for about a day; after 50 consecutive failures the webhook is switched off. A delivery log and "Send test" help with the setup.

Data import

Under Company → Data import admins import entries from another system – as CSV or Excel (.xlsx), one row per work block:

Punchify recognises the columns by common headings, shows a preview with errors per row and only imports rows without errors. A break is placed in the middle of the block; if a block ends before it starts, it runs past midnight. An import can be undone.