Developers & integrations

A biometric attendance API your other systems can actually use

Most attendance products end at their own dashboard, and integration means a monthly Excel export somebody emails to somebody. AionHRMS is built the other way around: the platform is API-first — our own console is a client of the same backend — and organisations get scoped, rate-limited API keys so attendance flows into the systems where it is actually used.

Get started Talk to sales

The AionHRMS partner API is live in production: scoped keys let your software pull attendance by person or organisation-wide over IST date ranges, create and update people, record payments, block or unblock someone's device access, and even push a person's record to the biometric terminals — enrolment driven from your own system. Keys are shown once and stored only as a SHA-256 hash, carry per-minute rate limits and monthly quotas, and every request is logged. An MCP server — so AI agents can query attendance and act with scoped permissions — and outbound webhooks are in development; API access today is provisioned per organisation by our team rather than self-serve, and we say that plainly.

Live

a real partner API in production — not a roadmap slide

Scoped

people, attendance and payments scopes, read and write separated

Logged

per-minute rate limits, monthly quotas, full request log

MCP

AI-agent access via MCP server — in development, early access open

What the API does today

Everything in this list is running in production, verified against the implementation rather than a spec document. If a capability is not on it, it is not live — see the in-development section below for what is coming.

  • Scoped keys — people, attendance and payments scopes, read and write separated
  • Pull attendance by person or organisation-wide, over IST date ranges, paginated
  • Create and update people, assign packages, record payments from your own systems
  • Block or unblock a person's device access from an external system
  • Push a person to the site's terminals via API — enrolment driven from your software
  • Per-minute rate limits, monthly quotas and a full request log on every key
  • Keys shown once and stored only as a SHA-256 hash — never recoverable from us

Attendance into your ERP, CRM and BI stack

The integration pattern is deliberately simple: your systems pull from the API on whatever schedule suits them, and write back the actions they own. No agent software at your site, no database access, no CSV in anyone's inbox.

  • ERP and payroll: pull the month's attendance by date range and feed your wage journal — the same numbers the register shows, without re-keying
  • HR systems: on exit, your HRMS calls the API to block the person's device access the same hour — the leaver workflow closes itself
  • CRM and operations tools: person status, presence and history available wherever your team already works
  • BI and dashboards: organisation-wide attendance, paginated over date ranges, straight into the warehouse
  • Onboarding flows: create the person in your system, and the API pushes them to the site's terminals — one entry, everywhere

AI agents and MCP: where this is going

An attendance register is exactly the kind of operational data AI agents are starting to work with — "who is absent at the Okhla plant today", "flag people whose late marks crossed the threshold", "block the contractor batch whose engagement ended Friday". Because AionHRMS already exposes a scoped REST API, an AI agent can consume it today like any other client. What is in development is the native packaging: an MCP server, so agents connect with the same scoped permissions and audit logging as any API key — no scraping, no shared passwords, no all-or-nothing access.

  • MCP server in development — agents will query attendance and act within the exact scopes you grant
  • Same security model as the API: scoped, rate-limited, logged; an agent can hold read-only access
  • Today, any agent or automation platform that can call a REST API can already integrate
  • Outbound webhooks — events pushed to your systems as they happen — are on the same roadmap
  • Early access is open: tell us the agent or integration you want to build and we will provision it

The security model, specifically

An API into biometric-adjacent data deserves more scrutiny than a dashboard login, so the key design errs on the paranoid side. Note what the API never exposes: biometric templates are not readable through it, by design.

  • Keys are presented once at creation; we store only a SHA-256 hash and can never recover or read your key
  • Scopes separate read from write — an ERP that only reads attendance holds a key that can do nothing else
  • Per-minute rate limits and monthly quotas per key, set when the key is issued
  • Every authenticated request is logged — which key, which endpoint, when
  • Keys are revocable instantly, and expiry dates can be set at issue time
  • Fingerprint and face templates are never available through the API — no scope grants them

Getting access

API access is provisioned per organisation by our team — deliberately, while the self-serve documentation portal is still in development. That costs us some developer-marketing polish and buys every customer a key that was scoped correctly by a human who asked what it is for.

  • Tell us what you are integrating — ERP, CRM, BI, an AI agent, your own product
  • We issue a named key with exactly the scopes, rate limit and quota the integration needs
  • You get the endpoint reference for your use case directly from the engineering team in Noida
  • MCP and webhook early access runs through the same conversation

API integration versus export-file integration

AionHRMS partner APIMonthly export file
FreshnessPull on your schedule — hourly, nightly, on demand.As of whenever somebody last ran the export.
DirectionRead and write — block access, push enrolment, record payments.One way, read only.
SecurityScoped hashed keys, rate limits, request log.A spreadsheet in inboxes and shared drives.
BreakageVersioned endpoints; a failed call is visible in the log.Silently wrong the month someone edits a column.
Effort per monthZero once built.Somebody's afternoon, every month, forever.

Frequently asked questions

Is there an API for biometric attendance data in India?
Yes — AionHRMS exposes a live partner API: scoped keys pull attendance by person or organisation-wide over date ranges (computed in IST), manage people, record payments, and control device access. It works regardless of which supported terminal brand — eSSL, ZKTeco or Realtime — produced the punches, because the platform normalises them into one register first.
How do I integrate biometric attendance with my ERP or payroll software?
Your ERP pulls attendance from the API over the date range it is processing and feeds its own wage or muster logic — no re-keying, no CSV. If you also want AionHRMS's own shift-wise salary computation, that already happens inside the platform; the API is how you take either result into the system your accounts team lives in.
Do you support webhooks?
Not yet — outbound webhooks are in development. Today the integration model is pull: your system calls the API on its own schedule, which for attendance data (a punch log, not a chat stream) covers almost every real use. If your case genuinely needs push, join the early access and tell us — real use cases are what prioritise the roadmap.
What is an MCP server and why would attendance have one?
MCP (Model Context Protocol) is the emerging standard for connecting AI agents to tools and data. An MCP server for AionHRMS — in development — means an AI agent can ask your attendance system questions and take permitted actions using the same scoped, logged security model as an API key, instead of screen-scraping a dashboard or holding a human's password. If you are building with agents, that is the difference between an integration and a liability.
Can the API read fingerprint or face templates?
No, deliberately. No scope exposes biometric templates; they are stored for device synchronisation and never leave the platform through the API. Integrations get attendance facts — who, when, where, verified how — not biometric data.
What does API access cost?
It is provisioned per organisation as part of your subscription conversation — scopes, rate limit and quota sized to the integration. Tell us what you are connecting and we will quote it plainly rather than hide it in a tier table.

Related

Build on your attendance data

ERP, CRM, BI or an AI agent — tell us the integration and we will provision a scoped key for it.

Get started Talk to sales