WorkRight HR API — REST API for HR, Payroll & Accounting

Two paths through WorkRight's docs: Guides & Help for plain-English how-tos (run payroll, onboard a person, set up leave or POSH), and Developers for the REST API, OpenAPI reference and MCP tools.

Jump straight into the developer docs:

• Quickstart — create a token, capability scopes, curl examples, and MCP client setup.
• API Reference — every endpoint with request/response schemas, rendered from the OpenAPI 3.1 spec.
• MCP Tool Catalog — all the capability-gated AI tools the MCP server exposes.

The WorkRight HR API is a REST API for HR, payroll, leave, expense and accounting data, built for Indian companies. It is the same data that powers the WorkRight dashboard, exposed over HTTPS for integrators and automation. Production lives at api.workright.in; every endpoint sits under /api/v1/public/.

It is authenticated with a per-tenant bearer token, scoped by capability, rate-limited, and documented with an OpenAPI 3.1 specification.

Create a token at Settings → API Tokens in the dashboard. The raw token (wr_<32hex>) is shown once at creation and never stored in readable form. Send it on every request:

curl https://api.workright.in/api/v1/public/employees \
  -H "Authorization: Bearer wr_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

Each token is bound to a single (tenant, user) pair, so it can never reach another company's data. The token's capability decides what it may do:

• read — allows GET requests.
• write — allows GET, POST, PATCH and DELETE.
• admin — reserved for the most sensitive operations.

Sensitive reads add a second check: the employee roster (which includes PII) is only returned for tokens owned by a company_admin or hr_manager. Anything else gets a 403.

The public API is read-first, with writes available where they are safe. These groups ship today:

• People — list the employee roster (HR-admin-scoped).
• Leave — list leave requests, role-filtered (employees see their own; managers see their reports; HR sees all).
• Expenses — list expense submissions, with the same role filtering and status filters.
• Accounting — list and fetch invoices, bills, payments and receipts. Amounts are in paise (1 INR = 100 paise) to avoid floating point errors.
• Webhooks — create, list, update and delete outbound webhook subscriptions (Slack / Teams) and inspect delivery logs. This group accepts writes with a write token.

Read coverage is expanding across more modules over time. The authoritative list of endpoints and request/response shapes is always the OpenAPI spec.

Subscribe a Slack or Teams incoming webhook to domain events so your team is notified the moment something happens. Supported events include:

• People: employee.created, employee.updated
• Leave: leave.requested, leave.approved, leave.rejected
• Expenses: expense.submitted, expense.approved, expense.rejected
• Accounting: invoice.created, invoice.sent, invoice.paid, bill.created, bill.paid
• Payroll & books: payroll.run.locked, period.locked

• Sync employees — keep your directory, ID provider or analytics warehouse in step with the WorkRight roster.
• Pull payroll & accounting — fetch locked payroll totals, invoices, bills, payments and receipts into your books or finance dashboard.
• Automate leave & expenses — export approvals for reporting, or route webhook events into Slack/Teams.
• Connect to AI assistants — query the same data conversationally through the WorkRight MCP server.

WorkRight is multi-tenant with strict per-tenant isolation, role-based access, an immutable audit log and INR pricing. The API inherits all of it — a token can only ever see its own tenant, every call is rate-limited to 60 requests/minute, and statutory write-once data (locked payroll runs, locked accounting periods, per Companies Act 2013 §128) stays immutable. See the plans or the broader HR platform.