REST API v1

The AccessTime REST API is the same one our mobile app uses: everything the app does goes through here. You can also use it for small integrations of your own, for example checking the day's time entries from a script or requesting an absence from another tool.

The base URL is https://yourdomain/api/v1, all requests and responses are JSON and protected routes require the Authorization: Bearer {token} header.

1. Get a token

Authentication uses personal tokens (Laravel Sanctum), with no cookies or session. The token is obtained with the employee's email and password, the same ones they use to sign in to the web panel:

curl -X POST https://yourdomain/api/v1/login \
  -H "Content-Type: application/json" \
  -d '{ "email": "empleado@empresademo.com", "password": "********" }'

The response includes the token and the user's basic data:

{
  "token": "1|abcdef...",
  "user": { "id": 1, "name": "...", "email": "...", "role": "empleado", "company_id": 2 }
}

Store the token somewhere safe and don't share it: it grants access to that person's data. If the credentials are invalid you'll receive a 422, and the endpoint is limited to 10 attempts per minute.

To sign out, POST /api/v1/logout (authenticated) revokes the current token.

2. Available endpoints

All endpoints operate on the authenticated user: each person only sees their own entries, absences and balance.

3. Clocking in from the API

POST /fichar automatically alternates between clock-in and clock-out based on the last entry, just like the panel button (how clocking in works). Geolocation is optional:

curl -X POST https://yourdomain/api/v1/fichar \
  -H "Authorization: Bearer 1|abcdef..." \
  -H "Content-Type: application/json" \
  -d '{ "latitude": 40.4168, "longitude": -3.7038, "accuracy": 12 }'

Response 201: { "type": "in", "happened_at": "2026-07-07T09:00:00+00:00" }.

Time entries are stored in UTC and the "today" and "week" queries use your company's time zone. The monthly summary is calculated from the workdays consolidated each night, the same ones that feed the reports.

If the person falls outside the free plan's 10 active seats, POST /fichar responds with 403 (plans and billing).

4. Absences from the API

You can query the available types and the balance, and request an absence:

curl -X POST https://yourdomain/api/v1/ausencias \
  -H "Authorization: Bearer 1|abcdef..." \
  -H "Content-Type: application/json" \
  -d '{ "absence_type_id": 1, "starts_on": "2026-08-03", "ends_on": "2026-08-07", "reason": "Vacaciones" }'

The API applies the same validations as the panel: overlaps with your other absences, available balance for types that deduct days, and that the range contains working days (weekends and public holidays are excluded). If the type requires approval, the request enters the approval flow with pending status; if not, it's approved immediately. More detail in absences and holidays.

Absence types that require supporting documents can't be requested via the API: the request returns an error and must be made from the web panel, where the document can be attached.

What now?

• If you haven't set up your account yet, start with getting started.
• To clock in on a shared tablet you don't need the API: use the QR kiosk.