> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# HiBob

> Connect HiBob to Iru Compliance using HTTP Basic Auth with a service user ID and token to collect employee roster, lifecycle events, and organizational structure evidence.

### About HiBob

Iru reads the **employee roster** (including status, start date, and termination date), **lifecycle events**, **departments and reporting lines**, and **metadata fields** from HiBob's public API. Authentication uses an **API service user** created under **Settings** → **Integrations** → **Service Users**. A service user is not an employee and cannot sign in to Bob. It exists only to authenticate API requests.

### How It Works

```http theme={null}
Authorization: Basic BASE64("SERVICE-USER-ID:TOKEN")
```

HiBob uses **HTTP Basic** over HTTPS, where the **username** is the service user's **ID** and the **password** is its **token**. Iru handles the encoding. You paste the two values separately. Requests target `https://api.hibob.com/v1`; there is no subdomain to configure.

Service user permissions are **granular and additive**: each data category is granted separately through a permission group, and an endpoint returns nothing until its category is granted. HiBob **discontinued API Access Tokens on October 31, 2024**. Service users are the only supported method for customer-built integrations.

| Detail             | Value                           |
| ------------------ | ------------------------------- |
| **Category**       | HRIS                            |
| **Authentication** | Basic (service user ID + token) |

Official references: [API service users](https://apidocs.hibob.com/docs/api-service-users), [Building the authorization header](https://apidocs.hibob.com/reference/authorization), [Permissions](https://apidocs.hibob.com/reference/permissions).

### Prerequisites

* A **Bob admin** account, or an admin who can generate the credentials for you. Only admins can create service users.
* Ability to create a **permission group** and assign the service user to it. Creating the service user alone is not enough. Without a permission group, authentication succeeds and returns no data.

### Connect HiBob to Iru

<Tabs>
  <Tab title="HiBob">
    <Note>
      Complete this tab before you connect the source in Compliance.
    </Note>

    <Steps>
      <Step title="Sign in to Bob">
        Sign in to Bob as an **admin**.
      </Step>

      <Step title="Open Service Users">
        Go to **Settings** → **Integrations** → **Service Users**.
      </Step>

      <Step title="Create a service user">
        Create a **new service user**, and name it something like **Iru Compliance** so you can identify it later.
      </Step>

      <Step title="Copy the ID and token">
        Copy the **service user ID** and **token** immediately. The token is shown **only once**. If you lose it, refresh the service user's token and reconnect.
      </Step>

      <Step title="Assign a permission group">
        Create a **permission group** (or edit an existing one) and add the new service user to it.
      </Step>

      <Step title="Grant read permissions">
        Grant the group **read** permissions for the categories your compliance program needs. **People - Read** is the minimum for roster and offboarding evidence. Do not grant write or delete permissions. Grant **Payroll - Read** only if a control requires compensation data.
      </Step>
    </Steps>

    <Note>
      Continue on the [**Iru Compliance**](#iru-compliance) tab.
    </Note>
  </Tab>

  <Tab title="Iru Compliance">
    <Note>
      Finish the [**HiBob**](#hibob) tab first.
    </Note>

    <Steps>
      <Step title="Open Sources">
        In Iru Compliance, on the left navigation bar, expand **Compliance** and select **Sources**.

        <Frame>
          <img src="https://mintcdn.com/iru/tI0HDLDwHj8r9Ile/assets/media/images/iru-navigation-compliance-sources.png?fit=max&auto=format&n=tI0HDLDwHj8r9Ile&q=85&s=87dcef15fc17d2fb9a6e53f454e41710" alt="Left navigation: Compliance expanded, Sources selected" width="410" height="1024" data-path="assets/media/images/iru-navigation-compliance-sources.png" />
        </Frame>
      </Step>

      <Step title="Turn on HiBob">
        Find **HiBob** (use **Category** or **Search by name or description**). On that card, turn on the **toggle**. A browser tab or window may open for the connector wizard.
      </Step>

      <Step title="Enter Basic authentication">
        Enter **Username** = the **service user ID** and **Password** = the **service user token**.
      </Step>

      <Step title="Finish the connection">
        Click **Submit Credentials**. When the connection succeeds, the wizard shows **Connection Configured**.
      </Step>

      <Step title="Confirm the source is Active">
        Close the **Iru is requesting access to external services** browser tab, then return to **Compliance** → **Sources** and confirm the **HiBob** card is **Active**.
      </Step>
    </Steps>
  </Tab>
</Tabs>

### Troubleshooting

<AccordionGroup>
  <Accordion title="Nothing opens when you turn the source on">
    Check **pop-up blocker** settings for the Iru site and try again.
  </Accordion>

  <Accordion title="Authentication fails with tokenNotMatch">
    The ID and token are mismatched or the token has been refreshed. Generate a new token in HiBob and reconnect. Confirm you have not swapped the two fields. The **ID** is the username.
  </Accordion>

  <Accordion title="Connection succeeds but no employees are returned">
    The service user is not in a **permission group**, or the group lacks **People - Read**. This is the most common HiBob setup issue, because authentication passes cleanly either way.
  </Accordion>

  <Accordion title="You are using an old API Access Token">
    These stopped working on **October 31, 2024**. Migrate to a service user.
  </Accordion>

  <Accordion title="Terminated employees are missing">
    Confirm the collection includes inactive records; HiBob excludes them by default on some endpoints.
  </Accordion>
</AccordionGroup>

### Considerations

<CardGroup cols={2}>
  <Card title="Permission groups are required" icon="circle-info">
    Creating the service user alone is not enough. Without a **permission group** that includes **People - Read**, authentication succeeds and returns no employees.
  </Card>
</CardGroup>

### Related Articles

<CardGroup cols={2}>
  <Card title="Sources Management" icon="plug" href="/en/compliance/sources-management">
    Browse and manage every Compliance source.
  </Card>

  <Card title="Getting Started With Compliance" icon="rocket" href="/en/compliance/getting-started-with-compliance">
    Frameworks, actions, and **Artifacts**.
  </Card>

  <Card title="Iru Overview" icon="layer-group" href="/en/iru/platform-overview/iru-overview">
    How Endpoint, Compliance, and Identity fit together.
  </Card>

  <Card title="Artifacts Management" icon="folder-open" href="/en/compliance/artifacts-management">
    Upload, review, and organize evidence from sources and actions.
  </Card>
</CardGroup>