First-party app
BambooHR

BambooHR

Read and write BambooHR employees, time off, files, reports and metadata via the BambooHR API v1.

stable Human Resources

About

BambooHR ships in the w6w first-party pack. It declares 18 actions, 2 health checks, and the host runs its code in a sandbox that never sees the credential.

App id
io.w6w.bamboohr
Version
0.1.2
Author
w6w
Licence
MIT
Categories
Human Resources

Overview

BambooHR is the HR system many growing companies use as their single source of truth for employee data, and this app brings that data into your workflows. Look up individual employees or pull the full company directory, create and update employee records, and read the tabular history behind a job title or compensation change rather than just its current value.

Time off is a first-class citizen: submit and query time-off requests, approve or deny them, check whether someone has accrued enough leave for a future date, and see who’s out today. Run whatever custom report has already been built in BambooHR’s own UI instead of reassembling its columns and filters by hand.

Because BambooHR’s field set is different per company, custom-field discovery is built in — list every field and every dropdown’s allowed values before you build the rest of a workflow around them, so you’re always working with fields your account actually has.

Build with BambooHR

Three routes to the same 18 actions. The Workflow tab is generated from BambooHR's own manifest and carries its real ids, so it is copy-pasteable; the Code and CLI examples are the same call for any action on any app, so every app-specific value in them is a blank you fill in.

Create Employee

create-employee

Create a new employee. First and last name are the only required fields; any other writable employee field may be supplied via Additional fields.

Create Time Off Request

create-time-off-request

Create a time off request for an employee. Submit as `requested` to enter the normal approval workflow, or as `approved`/`denied` to record it directly if the key has the permission for that.

Get Employee

get-employee

Fetch one employee by internal employee ID. You must name the fields you want — BambooHR returns only `id` otherwise. Pass `0` to read the record of the user the API key belongs to.

Get Employee Table Data

get-employee-table-data

Read an employee's tabular history — job information, compensation, employment status and custom tables. Pass `all` as the employee ID to fetch the table for every accessible employee.

Get Employee Directory

get-employees-directory

Fetch the company employee directory — the shared view of who works here, with the fields the company publishes. Governed by directory sharing settings, not per-employee permissions.

Get Report

get-report

Run a saved report by ID and return its rows. Often the simplest way to extract a wide, pre-filtered slice of employee data, since the columns are chosen in the BambooHR UI.

Get Time Off Balance

get-time-off-balance

Calculate an employee's time off balances, per policy. Defaults to today, but accepts a future date to project what they will have accrued by then.

List Employee Files

list-employee-files

List the files attached to an employee, grouped by file category. Returns metadata (id, name, size, dates, sharing) — not file contents.

List Employees

list-employees

List employees with optional filtering and sorting, one cursor page at a time. Unlike Get Employee this returns a default set of fields; `fields` adds to it.

List Fields

list-fields

List every employee field available in this company, with its numeric id, standard name and custom alias. Use it to build the `fields` value for the employee read actions.

List List Fields

list-list-fields

List the company's list (dropdown) fields with their allowed values — department, division, location, employment status and any custom lists.

List Reports

list-reports

List the company's saved reports, with their IDs. Use an ID with Get Report to run one.

List Time Off Policies

list-time-off-policies

List the company's time off policies — the accrual rules behind the balances returned by Get Time Off Balance.

List Time Off Requests

list-time-off-requests

List time off requests overlapping a date window, optionally narrowed to one employee, type or status. Use Action = approve to find requests awaiting the key holder's decision.

List Time Off Types

list-time-off-types

List the company's time off types. Use this to find the `timeOffTypeId` required by Create Time Off Request.

List Who's Out

list-whos-out

List time off and holidays in a date range — the Who's Out calendar. Defaults to the next 14 days.

Update Employee

update-employee

Update fields on an existing employee. Only the fields you supply are changed; everything else is left alone.

Update Time Off Request Status

update-time-off-request-status

Approve, deny or cancel an existing time off request, optionally with a note. An owner/admin completes the whole approval workflow at once; another approver completes only their own step.

A workflow step names the app and the action, and the editor fills in the connection when you pick one. This is the Step shape from the workflow spec, carrying BambooHR's real ids.

{
  "manifestVersion": "2",
  "name": "bamboohr-example",
  "steps": [
    {
      "id": "create-employee",
      "uses": {
        "app": "io.w6w.bamboohr",
        "action": "create-employee",
        "connection": "conn_YOUR_CONNECTION_ID"
      },
      "with": {
        "firstName": "<firstName>",
        "lastName": "<lastName>"
      }
    }
  ]
}

Here are some of the things you can do

  • Create Employee

    perform
    create-employee
  • Create Time Off Request

    perform
    create-time-off-request
  • Get Employee

    read
    get-employee
  • Get Employee Table Data

    read
    get-employee-table-data
  • Get Employee Directory

    search
    get-employees-directory

+13 more actions available

Every app-specific value here is a blank you have to fill in. An app action is reached through the connection that authenticates it, so the address is a connection id, not the app id — and connections belong to your account, so a public page cannot know yours. Create one for BambooHR, then fill in the three blanks: conn_YOUR_CONNECTION_ID, the action key, and the parameters that action declares. The call itself is real — the shape is transcribed from the studio's own snippet builder, which prints the same kind of blanks — but nothing in it is specific to BambooHR. The Workflow tab is where this app's real ids are.

Install
npm install @w6w/sdk
yarn add @w6w/sdk
pnpm add @w6w/sdk
deno add npm:@w6w/sdk
Code
import { W6wClient, isActionRun } from "@w6w/sdk";

// Reads W6W_BASE_URL and W6W_TOKEN from the environment when omitted.
const client = new W6wClient();

const envelope = await client.run({
  urn: "conn_YOUR_CONNECTION_ID",
  action: "create-employee",
  payload: {
    firstName: "<value>",
    lastName: "<value>",
    // workEmail: "<value>",
    // jobTitle: "<value>",
    // department: "<value>",
    // hireDate: "<value>",
    // fields: "<value>",
  },
});

if (isActionRun(envelope)) console.log(envelope.value);
Install the CLI
npm install -g @w6w/cli
CLI
w6w run conn_YOUR_CONNECTION_ID --action create-employee --payload '{"firstName":"<value>","lastName":"<value>"}'

Give an AI agent BambooHR — without giving it BambooHR's credentials. One MCP endpoint exposes every app, function and workflow the caller is entitled to, as tools it can discover and run. Access is granted per team while we onboard.

One tool call
{
  "name": "w6w_invoke",
  "arguments": {
    "ref": "app:io.w6w.bamboohr#create-employee",
    "input": {
      "firstName": "<firstName>",
      "lastName": "<lastName>"
    }
  }
}

Every tool names its target with a single ref. The app: form above doesn't name a connection at all — the host resolves which of the caller's BambooHR connections to sign with, and refuses rather than guesses when the answer is ambiguous.

What the agent gets

Credentials it can't read

The token is attached host-side, at the moment of the call. It is never a tool argument, never in the model's context, and never in a transcript — so a prompt injection has nothing to exfiltrate.

A tool surface scoped to the caller

Tools are derived per end user from what that person has actually connected and is entitled to — not one shared bot identity carrying the union of everyone's access.

A durable workflow in one call

Multi-step work runs on the workflow engine and returns a run handle the agent can poll — retries, branching and state survive the conversation that started them.

Health-aware discovery

BambooHR's declared health checks are on the surface too, so an agent can tell "the vendor is down" from "your credential expired" before it burns a retry on either.

The MCP surface is part of the hosted platform. BambooHR itself is MIT, and the runtime that executes it is source-available (FSL).

Request MCP access

Health checks

BambooHR declares its own checks, so its health is a property of the app rather than something the host guesses at.

service

BambooHR platform status

Open incidents on BambooHR's status feed (status.bamboohr.com, hosted on status.io). Unauthenticated and unsigned; fetched and parsed by the host.

quota

API rate-limit headroom