API access: schedule, hours and absences

What it is for

The “API access” option lets your accounting, payroll or CRM software automatically read your company's published schedule, everyone's hours and approved absences. Access is read-only: nothing can be changed through the API.

Add the option in the app: Management → Manage subscription. It is available during the free trial.

1. Create a key

In the app, the company owner opens Management → API access → New key and gives it a name (for example “Payroll software”). The full key is shown only once: copy it into your software. You can revoke it at any time; 10 keys at most per company.

2. Call the API

Send the key in the “Authorization: Bearer …” header (or “X-Api-Key”). All addresses start with https://app.staff-flow.cloud/api/v1/ext/.

curl -H "Authorization: Bearer sfk_xxxxxxxx_yyyyyyyy…" \
  "https://app.staff-flow.cloud/api/v1/ext/shifts?from=2026-10-01&to=2026-10-31"

3. Endpoints

GET /api/v1/ext/company     company, sites, positions
GET /api/v1/ext/members     people (current and former), role, dates
GET /api/v1/ext/shifts      published shifts         ?from=&to=&format=csv
GET /api/v1/ext/totals      published hours/person   ?from=&to=&format=csv
GET /api/v1/ext/absences    approved leave and unavailability  ?from=&to=

Period: “from” and “to” as YYYY-MM-DD. Without “from”, since the company was created; without “to”, up to today; 5 years at most per call.

Format: JSON by default ({"data": […]}); add “format=csv” for a CSV file (“;” separator, opens in Excel).

Only the published schedule is returned (what employees see), never drafts.

4. Sample response

{
  "data": [
    {
      "id": "6c1f…", "day": "2026-10-06", "start": "08:00", "end": "16:00",
      "minutes": 480, "userId": "a41e…", "userName": "Olena",
      "siteId": "…", "site": "Centre", "positionId": "…", "position": "Barista",
      "note": null
    }
  ]
}

5. Errors

401: missing, wrong or revoked key. 402: the “API access” option is not active (subscription without the option). 400: invalid dates.

Personal data

The company remains responsible for how it uses the data it retrieves (names, hours, absences) and must protect it in its own software. Keep keys secret; revoke a key as soon as it is no longer used.