Reference · built on requestConnectorHR, scheduling & workforce

Personio

Persons, employments, absence and attendance periods, and signed webhooks from Personio through its v2 API at api.personio.de.

Request accessPricing ↗

About

Personio is an HR platform for small and mid-sized companies in Europe. Its v2 API at https://api.personio.de/v2 covers persons and employments, compensations, org units, legal entities, cost centers, workplaces, absence periods and types, attendance periods and projects, documents, reports, and recruiting. A Webhooks Management API lets you subscribe to events, and each delivery is signed with HMAC-SHA256.

An operator on Fibric reads persons, absences, and attendance periods, and proposes an absence period, an attendance correction, or a document update for your approval. Each action is recorded once, with its reason and its undo.

This is a reference listing. It documents what Fibric would read from Personio and what it could propose, based on the vendor's published interfaces. Fibric builds it under a managed deployment when you request it; selecting it here installs nothing.

Inputs

  • Persons through GET /v2/persons, filterable by email, name, created_at, updated_at, and status ACTIVE or INACTIVE
  • Employments of a person, plus org units, legal entities, cost centers, and workplaces
  • Absence periods with daily breakdowns, and the absence types behind them
  • Attendance periods, projects, and project members
  • Compensations and compensation types through the Payroll Integrations API
  • Webhook events such as absence-period.created, absence-period.updated.timerange, absence-period.deleted, and attendance-period.created, updated, and deleted
  • Reports and report attributes through the Reporting Engine endpoints

Proposed actions

  • Target capability: propose a new absence period through POST /v2/absence-periods, or an update or deletion of one
  • Target capability: propose an attendance period, created, updated, or deleted
  • Target capability: propose a change to a person or an employment through PATCH
  • Target capability: propose a compensation entry through POST /v2/compensations
  • Target capability: propose a webhook subscription, with its signing secret rotated through POST /v2/webhooks/{id}/signing-secret

Proposed actions are target capabilities. Every action runs propose-first and needs a validated deployment and the appropriate permissions.

What you can build

  • Keep the shift plan honest about who is absent

    Subscribe to absence-period events, compare each new or changed absence with the roster, and propose the coverage change before the shift starts.

    With Leave Conflict, Shift Coverage

  • Reconcile attendance with the schedule

    Read attendance periods against planned hours and propose a correction or a sign-off for the manager to confirm.

    With Punch Match, Timesheet Signoff

  • Run the first week from the employment record

    Watch new persons and employments, then propose the onboarding steps and the document requests each start date implies.

    With Onboarding Checklist, Training Due

Requirements

  • A Personio account whose user has API access rights to create credentials under Marketplace > Connected integrations
  • A client_id and client_secret, and the scopes each endpoint requires, for example personio:persons:read
  • Server-side calls only; Personio uses CORS to block browser requests to its API
  • An HTTPS endpoint that acknowledges webhook posts with a 2xx status within 3 seconds
Authentication
OAuth 2.0 client credentials: POST client_id and client_secret to https://api.personio.de/v2/auth/token for a Bearer token that lasts one day, with space-delimited scopes such as personio:persons:read.

Limits

  • The token endpoint allows 150 requests per minute; above that, one request per second for 60 seconds before the limit resets
  • List endpoints return 1 to 50 resources per call, 10 by default, and page with a cursor
  • Absence updates fire a webhook on time range changes only, not on approvals or certificate uploads
  • A webhook delivery is retried for up to 3 days across at most 6 attempts, then dropped

Access and pricing

Reference listing. Fibric builds the connector under a managed deployment when you request it. Your quote covers the build, capabilities, usage, and support.

Request Personio ↗

Questions and answers

How long does a Personio access token last?
One day. The token is stable for 24 hours, carries a papi- prefix, and can be used for any number of calls in that window, including parallel calls. It works for all Personnel Data endpoints; Auth and Recruiting are handled separately.
How do you check a Personio webhook signature?
Compute HMAC-SHA256 over the string timestamp.body with the signing secret and compare it in constant time with X-Personio-Webhook-Signature. The timestamp comes from X-Personio-Webhook-Timestamp; a five-minute tolerance is recommended. During rotation two signatures are sent for a seven-day grace window.
Which absence changes trigger a webhook?
Creation, deletion, and time range updates: absence-period.created, absence-period.deleted, and absence-period.updated.timerange. Personio notifies on time range only to avoid high-volume events from approvals and certificate uploads. Attendance periods send created, updated, and deleted events.
Ask about Personio

Ask about the capabilities and requirements in this listing.

For project-specific requirements, contact Fibric.

This connector listing is developed, published, and supported by Fibric. It describes integration with Personio through published interfaces. Third-party names and logos identify the systems an integration connects to; they are the property of their respective owners, who are not affiliated with Fibric and do not sponsor or endorse this listing. Trademark policy