First-party app
Rippling

Rippling

Read and manage Rippling workers, users, org structure, time off and custom objects through the Rippling REST API.

stable Human ResourcesProductivity

About

Rippling ships in the w6w first-party pack. It declares 44 actions, 2 health checks, and the host runs its code in a sandbox that never sees the credential.

App id
io.w6w.rippling
Version
0.1.0
Author
w6w
Licence
MIT
Categories
Human Resources · Productivity

Overview

Rippling is an HR, IT and payroll platform, and its REST API exposes the same employee system of record the product runs on. This app lets a workflow read workers and users, walk the org structure (departments, teams, work locations, employment types, levels, titles and legal entities), and work with time off — listing requests and balances, creating a request, approving or rejecting one by changing its status.

It also reaches Rippling’s custom fields and custom objects: list an object’s field definitions, query and page through its records, and create, update or delete a record by id or look one up by external id.

Authentication is a Rippling API token, scoped when it is created. What each action returns is bounded by that token’s scopes and by its owner’s permission profile; fields the token may not see come back as null, and every list action reports exactly which ones in redactedFields. Health checks read the Platform API component of Rippling’s status page rather than the company-wide indicator, so a Payroll incident does not mark the API as down.

Build with Rippling

Three routes to the same 44 actions. The Workflow tab is generated from Rippling's own manifest and carries its real ids, so it is copy-pasteable; the Code and CLI examples are the same call for any action on any app, so every app-specific value in them is a blank you fill in.

List Companies

company-list

The company (or companies) the token can see. Rippling's own quickstart uses this as the first call. Returns one page, forward-paginated. Requires the `companies.read` scope on the API token.

Get Compensation

compensation-get

Retrieve one compensation by id. Requires the `compensations.read` scope on the API token.

List Compensations

compensation-list

Worker compensation records (sensitive: hidden unless the token owner may see it). Returns one page, forward-paginated. Requires the `compensations.read` scope on the API token.

List Custom Fields

custom-field-list

The company's custom field definitions (the fields admins add to worker profiles). Returns one page, forward-paginated. Requires the `custom-fields.read` scope on the API token.

List Custom Object Fields

custom-object-field-list

The field definitions of one custom object. Requires a `custom-objects.read` scope (or a read-write scope) on the API token.

Create Custom Object Record

custom-object-record-create

Create a record on a custom object. Requires `custom-object-records.read-write` on the API token. Not idempotent: Rippling documents no idempotency key, so a retry may create a second record unless you set a unique external_id.

Delete Custom Object Record

custom-object-record-delete

Delete a custom object record (answers 204). Requires `custom-object-records.read-write` on the API token. Destructive; deleting an already-deleted record fails with a 404.

Get Custom Object Record by External ID

custom-object-record-get

Retrieve one custom object record by the external_id you stored on it. Requires `custom-object-records.read` (or a read-write scope). Rippling documents no get-by-record-id endpoint, so the external id is the only direct lookup.

List Custom Object Records

custom-object-record-list

One page of a custom object's records. Requires `custom-object-records.read` (or a read-write scope) on the API token. This endpoint takes only `limit` and `cursor`; to filter, use Query Custom Object Records.

Query Custom Object Records

custom-object-record-query

Search a custom object's records with a query string. Requires `custom-object-records.read` (or a read-write scope). Unlike the other lists, this one returns a bare `cursor` rather than a `next_link`.

Update Custom Object Record

custom-object-record-update

Patch a custom object record. Requires `custom-object-records.read-write` on the API token. Only the fields you send change.

Create Department

department-create

Create a department. Requires the `departments.read-write` scope on the API token. Not idempotent: Rippling documents no idempotency key, so a retry may create a duplicate.

Get Department

department-get

Retrieve one department by id. Requires the `departments.read` scope on the API token.

List Departments

department-list

Departments of the company, optionally nested. Returns one page, forward-paginated. Requires the `departments.read` scope on the API token.

Update Department

department-update

Update a department. Requires the `departments.read-write` scope on the API token. A PATCH: only the fields you set are sent, everything else is left as it is.

Get Employment Type

employment-type-get

Retrieve one employment type by id. Requires the `employment-types.read` scope on the API token.

List Employment Types

employment-type-list

Employment types (employee or contractor, hourly or salaried, full- or part-time). Returns one page, forward-paginated. Requires the `employment-types.read` scope on the API token.

Get Leave Balance

leave-balance-get

Retrieve one leave balance by id. Requires the `leave-balances.read` scope on the API token.

List Leave Balances

leave-balance-list

Per-worker time-off balances by leave type. Returns one page, forward-paginated. Requires the `leave-balances.read` scope on the API token.

Create Leave Request

leave-request-create

Create a time-off request for a worker. A leave type or a leave policy must be given. Requires the `leave-requests.read-write` scope on the API token. Not idempotent: Rippling documents no idempotency key, so a retry may create a duplicate.

Get Leave Request

leave-request-get

Retrieve one leave request by id. Requires the `leave-requests.read` scope on the API token.

List Leave Requests

leave-request-list

Time-off requests. Returns one page, forward-paginated. Requires the `leave-requests.read` scope on the API token.

Update Leave Request

leave-request-update

Update a time-off request: approve or reject it by setting the status, or change its dates and notes. Requires the `leave-requests.read-write` scope on the API token. A PATCH: only the fields you set are sent, everything else is left as it is.

Get Leave Type

leave-type-get

Retrieve one leave type by id. Requires the `leave-types.read` scope on the API token.

List Leave Types

leave-type-list

Time-off types (vacation, sick, ...). Returns one page, forward-paginated. Requires the `leave-types.read` scope on the API token.

Get Legal Entity

legal-entity-get

Retrieve one legal entity by id. Requires the `legal-entities.read` scope on the API token.

List Legal Entities

legal-entity-list

Legal entities the company employs through. Returns one page, forward-paginated. Requires the `legal-entities.read` scope on the API token.

Get Level

level-get

Retrieve one level by id. Requires the `levels.read` scope on the API token.

List Levels

level-list

Job levels. Returns one page, forward-paginated. Requires the `levels.read` scope on the API token.

Create Team

team-create

Create a team. Requires the `teams.read-write` scope on the API token. Not idempotent: Rippling documents no idempotency key, so a retry may create a duplicate.

Get Team

team-get

Retrieve one team by id. Requires the `teams.read` scope on the API token.

List Teams

team-list

Teams of the company, optionally nested. Returns one page, forward-paginated. Requires the `teams.read` scope on the API token.

Update Team

team-update

Update a team. Requires the `teams.read-write` scope on the API token. A PATCH: only the fields you set are sent, everything else is left as it is.

Get Title

title-get

Retrieve one title by id. Requires the `titles.read` scope on the API token.

List Titles

title-list

Job titles. Returns one page, forward-paginated. Requires the `titles.read` scope on the API token.

Get User

user-get

Retrieve one user by id. Requires the `users.read` scope on the API token.

List Users

user-list

A user is an account that can sign in and be granted access and roles. Returns one page, forward-paginated. Requires the `users.read` scope on the API token.

Create Work Location

work-location-create

Create a work location. Requires the `work-locations.read-write` scope on the API token. Not idempotent: Rippling documents no idempotency key, so a retry may create a duplicate.

Delete Work Location

work-location-delete

Delete a work location. Requires the `work-locations.read-write` scope on the API token. Destructive; Rippling answers 204, and a repeat delete fails with a 404.

Get Work Location

work-location-get

Retrieve one work location by id. Requires the `work-locations.read` scope on the API token.

List Work Locations

work-location-list

Office and other work locations. Returns one page, forward-paginated. Requires the `work-locations.read` scope on the API token.

Update Work Location

work-location-update

Update a work location. Requires the `work-locations.read-write` scope on the API token. A PATCH: only the fields you set are sent.

Get Worker

worker-get

Retrieve one worker by id. Requires the `workers.read` scope on the API token.

List Workers

worker-list

A worker is a person's HR profile (employment or engagement) in the company. Returns one page, forward-paginated. Requires the `workers.read` scope on the API token.

A workflow step names the app and the action, and the editor fills in the connection when you pick one. This is the Step shape from the workflow spec, carrying Rippling's real ids.

{
  "manifestVersion": "2",
  "name": "rippling-example",
  "steps": [
    {
      "id": "compensation-get",
      "uses": {
        "app": "io.w6w.rippling",
        "action": "compensation-get",
        "connection": "conn_YOUR_CONNECTION_ID"
      },
      "with": {
        "id": "<id>"
      }
    }
  ]
}

Here are some of the things you can do

  • Get Compensation

    read
    compensation-get
  • List Companies

    read
    company-list
  • List Compensations

    read
    compensation-list
  • List Custom Fields

    read
    custom-field-list
  • List Custom Object Fields

    read
    custom-object-field-list

+39 more actions available

Every app-specific value here is a blank you have to fill in. An app action is reached through the connection that authenticates it, so the address is a connection id, not the app id — and connections belong to your account, so a public page cannot know yours. Create one for Rippling, then fill in the three blanks: conn_YOUR_CONNECTION_ID, the action key, and the parameters that action declares. The call itself is real — the shape is transcribed from the studio's own snippet builder, which prints the same kind of blanks — but nothing in it is specific to Rippling. The Workflow tab is where this app's real ids are.

Install
npm install @w6w/sdk
yarn add @w6w/sdk
pnpm add @w6w/sdk
deno add npm:@w6w/sdk
Code
import { W6wClient, isActionRun } from "@w6w/sdk";

// Reads W6W_BASE_URL and W6W_TOKEN from the environment when omitted.
const client = new W6wClient();

const envelope = await client.run({
  urn: "conn_YOUR_CONNECTION_ID",
  action: "compensation-get",
  payload: {
    id: "<value>",
    // expand: "<value>",
  },
});

if (isActionRun(envelope)) console.log(envelope.value);
Install the CLI
npm install -g @w6w/cli
CLI
w6w run conn_YOUR_CONNECTION_ID --action compensation-get --payload '{"id":"<value>"}'

Give an AI agent Rippling — without giving it Rippling's credentials. One MCP endpoint exposes every app, function and workflow the caller is entitled to, as tools it can discover and run. Access is granted per team while we onboard.

One tool call
{
  "name": "w6w_invoke",
  "arguments": {
    "ref": "app:io.w6w.rippling#compensation-get",
    "input": {
      "id": "<id>"
    }
  }
}

Every tool names its target with a single ref. The app: form above doesn't name a connection at all — the host resolves which of the caller's Rippling connections to sign with, and refuses rather than guesses when the answer is ambiguous.

What the agent gets

Credentials it can't read

The token is attached host-side, at the moment of the call. It is never a tool argument, never in the model's context, and never in a transcript — so a prompt injection has nothing to exfiltrate.

A tool surface scoped to the caller

Tools are derived per end user from what that person has actually connected and is entitled to — not one shared bot identity carrying the union of everyone's access.

A durable workflow in one call

Multi-step work runs on the workflow engine and returns a run handle the agent can poll — retries, branching and state survive the conversation that started them.

Health-aware discovery

Rippling's declared health checks are on the surface too, so an agent can tell "the vendor is down" from "your credential expired" before it burns a retry on either.

The MCP surface is part of the hosted platform. Rippling itself is MIT, and the runtime that executes it is source-available (FSL).

Request MCP access

Health checks

Rippling declares its own checks, so its health is a property of the app rather than something the host guesses at.

service

Rippling platform status

status.rippling.com: the Platform API component (weighted fully) plus Rippling App and Authentication (capped at degraded). Payroll, Benefits and the other company-wide components are ignored.

quota

Request headroom

Not exposed: Rippling documents a 300-requests-per-10-seconds burst threshold but no remaining-quota header or usage endpoint.