Skip to main content

​
About HiBob

Iru reads the employee roster (including status, start date, and termination date), lifecycle events, departments and reporting lines, and metadata fields from HiBob’s public API. Authentication uses an API service user created under Settings → Integrations → Service Users. A service user is not an employee and cannot sign in to Bob. It exists only to authenticate API requests.

​
How It Works

HiBob uses HTTP Basic over HTTPS, where the username is the service user’s ID and the password is its token. Iru handles the encoding. You paste the two values separately. Requests target https://api.hibob.com/v1; there is no subdomain to configure. Service user permissions are granular and additive: each data category is granted separately through a permission group, and an endpoint returns nothing until its category is granted. HiBob discontinued API Access Tokens on October 31, 2024. Service users are the only supported method for customer-built integrations. Official references: API service users, Building the authorization header, Permissions.

​
Prerequisites

  • A Bob admin account, or an admin who can generate the credentials for you. Only admins can create service users.
  • Ability to create a permission group and assign the service user to it. Creating the service user alone is not enough. Without a permission group, authentication succeeds and returns no data.

​
Connect HiBob to Iru

Complete this tab before you connect the source in Compliance.
1

Sign in to Bob

Sign in to Bob as an admin.
2

Open Service Users

Go to Settings → Integrations → Service Users.
3

Create a service user

Create a new service user, and name it something like Iru Compliance so you can identify it later.
4

Copy the ID and token

Copy the service user ID and token immediately. The token is shown only once. If you lose it, refresh the service user’s token and reconnect.
5

Assign a permission group

Create a permission group (or edit an existing one) and add the new service user to it.
6

Grant read permissions

Grant the group read permissions for the categories your compliance program needs. People - Read is the minimum for roster and offboarding evidence. Do not grant write or delete permissions. Grant Payroll - Read only if a control requires compensation data.
Continue on the Iru Compliance tab.

​
Troubleshooting

Check pop-up blocker settings for the Iru site and try again.
The ID and token are mismatched or the token has been refreshed. Generate a new token in HiBob and reconnect. Confirm you have not swapped the two fields. The ID is the username.
The service user is not in a permission group, or the group lacks People - Read. This is the most common HiBob setup issue, because authentication passes cleanly either way.
These stopped working on October 31, 2024. Migrate to a service user.
Confirm the collection includes inactive records; HiBob excludes them by default on some endpoints.

​
Considerations

Permission groups are required

Creating the service user alone is not enough. Without a permission group that includes People - Read, authentication succeeds and returns no employees.

Sources Management

Browse and manage every Compliance source.

Getting Started With Compliance

Frameworks, actions, and Artifacts.

Iru Overview

How Endpoint, Compliance, and Identity fit together.

Artifacts Management

Upload, review, and organize evidence from sources and actions.