Introspect the token
Returns the authenticated user, workspace (tenant), role, employee id, and the scopes this token carries. Use it to verify a token before wiring anything else.
One API, two doors. Call Kumo directly over REST, or point your agents — Claude, ChatGPT, Cursor, your own — at the Kumo MCP server and let them do HR work. Either way a token acts as its user, never more: role-bound, scope-narrowed, rate-limited, and fully audited.
Tokens are minted per user, per workspace. The API applies the same visibility model as the app — self-service users see themselves, managers their team, HR the workspace. Scopes can only narrow that further.
The REST endpoints, the OpenAPI spec, this reference, and the MCP server's tool list are all generated from the same operation registry the runtime executes. Docs cannot go stale by construction.
Writes run through the platform's own engines — validation, approvals, notifications included. Every MCP tool call lands in the audit log with who, what, and when.
Create a token in Kumo under Settings → API access — pick a name and the scopes it should carry. The secret is shown exactly once. Send it on every request; revoke it any time from the same screen.
leave:readRead leave requests and balancesleave:writeCreate leave requestsreports:readRun read-only reportsBase URL https://kumohr.com. Responses use a { data } / { error: { code, message } } envelope with X-RateLimit-* headers. The machine-readable version of this reference lives at /api/v1/openapi.json.
Returns the authenticated user, workspace (tenant), role, employee id, and the scopes this token carries. Use it to verify a token before wiring anything else.
Lists leave requests you are allowed to see — your own for self-service roles, your team’s for line managers, your department’s for directors, the whole workspace for HR and admins. Filter by status and date range.
statusstringFilter by status. One of: PENDING, APPROVED, REJECTED, CANCELLED, IN_PROGRESS, COMPLETED.fromstringOnly requests ending on or after this date (YYYY-MM-DD).tostringOnly requests starting on or before this date (YYYY-MM-DD).limitnumberMax rows to return (1–200, default 50).Books time off for the token’s user through the platform’s own leave engine — policy validation, balance movement, approval routing, and notifications all run exactly as from the app. Pass start_date plus either end_date or days; the policy defaults to annual leave.
start_daterequiredstringFirst day off (YYYY-MM-DD).end_datestringLast day off, inclusive (YYYY-MM-DD). Use this OR days.daysnumberNumber of consecutive calendar days off. Use this OR end_date.policystringLeave policy name, e.g. "Annual Leave". Defaults to the annual policy.policy_idstringExact policy id (overrides policy).reasonstringOptional short reason.half_daybooleanTrue for a single half-day request.Per-employee untaken leave for a year: allocated, used, and remaining days with department and manager, sorted by most untaken first. Runs through the same permission-gated reporting tool Kumo’s agent uses — your role decides whose rows you see.
yearnumberBalance year (defaults to the current year).min_untaken_daysnumberOnly employees with at least this many untaken days.policystringLeave policy name filter (defaults to annual policies).Point any MCP-capable agent at https://kumohr.com/api/mcp (streamable HTTP) with your token in the Authorization header. Its tool list is your API: the same operations above, filtered to your token's scopes.
Your agent can only do what your role allows. The same RBAC that gates the app gates every tool call — the token cannot escalate.
tools/list only advertises operations the token's scopes permit, so an agent holding a read-only token never even sees the write tools.
Every tool call is recorded in the audit log — which token, which tool, which arguments, and whether it succeeded. You can see everything it did.