Skip to content

BambooHR API Key

Service Name: BambooHR

Service Description: BambooHR is a cloud-based human resources software service that provides tools for managing employee data, time-off tracking, performance management, onboarding, and other HR-related functions for small to medium-sized businesses.

Service Address: https://www.bamboohr.com/

Validation Type: API Auth

IP Allow list: IP restrictions can be configured at the account level through BambooHR's security settings.

Secret Access Scope: Grants programmatic access to BambooHR's API, allowing applications to read and write employee data, manage time-off requests, access reports, and perform other HR-related operations.

Secret Revokement URL: https://help.bamboohr.com/hc/en-us/articles/229926868-API-Keys

Secret Example: 7ed5d9032d968a2e9d3e86b6b7e2c35f69bdf817

Suspicious Activity Investigation Instructions:

  • Review API access logs in your BambooHR account for unusual activity.
  • Check for unauthorized data exports or changes to employee information.
  • Monitor for unexpected API calls, especially those accessing sensitive employee data.
  • Look for API requests from unusual IP addresses or outside normal business hours.
  • Verify if any integrations or third-party applications have been added without authorization.

Mitigation Instructions:

  • Log in to your BambooHR account as an administrator.
  • Navigate to Account > API Keys.
  • Locate the compromised API key and click "Revoke" to immediately invalidate it.
  • Generate a new API key if needed for legitimate applications.
  • Review and update access permissions for all remaining API keys.
  • Consider implementing IP restrictions for API access if not already in place.
  • Audit all third-party integrations and remove any unauthorized connections.
  • Notify your security team and consider whether any data breach reporting is required.