Developer API — v1.0

XS Attendance Integration Hub

Connect any ERP, HR platform, or custom app to XS Attendance. Our REST APIs make employee sync effortless — add, update, list, and remove in seconds.

Quick Start Get Your Token Read the Docs
3
Endpoints
4
Languages
REST
Architecture
JWT
Auth Method
Instant Sync
Push employee records in real-time with a single API call.
Secure Bearer Auth
Token-based auth keeps every request authenticated and safe.
Upsert by Code
Auto-create or auto-update employees matched by emp_code.

Authentication

All endpoints require a Bearer token. Every request must include your access token in the Authorization header.

Your personal access token is available under Profile → API Token after logging in. It grants the same permissions as your account — keep it private.
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9... Required
Required HTTP Headers
Header Value Notes
Authorization Bearer {YOUR_TOKEN} Found in Profile → API Token settings.
Content-Type application/json Required on all POST requests.
Accept application/json Optional but recommended.
Security Warning: Never expose your access-token in client-side JavaScript or public repositories. Always make these calls from your secure backend server.

Base URL & Format

All API responses are JSON. HTTP status codes indicate success or failure.

Base URL https://xs.jisecure.com/api
Success
HTTP 200 OK
Includes status: 200 in body
Error
HTTP 400 / 403 / 404
Includes status: 400 + message
Format
application/json
All requests & responses

Add / Update Employee

Creates a new employee or updates an existing one matched by emp_code. This is an upsert operation — no need to call separate create/update routes.

POST https://xs.jisecure.com/api/employee/add
Request Body Parameters
FieldTypeStatusDescription
emp_code string Required Unique employee ID; used to find existing record for update (upsert key).
full_name string Required Employee's full legal name.
email string Optional Work email address for login and notifications.
contact_no string Optional Phone with country code, e.g. +919876543210.
designation string Optional Job title or role.
gender integer Optional 0 Male  ·  1 Female  ·  2 Other
joining_date date Optional ISO format: YYYY-MM-DD
state_id integer Optional 1 = Active (default)  ·  0 = Inactive
company_id integer Optional Target company ID. Defaults to token owner's company if omitted.
terminal 
# Add or update an employee (upsert by emp_code)
ACCESS_TOKEN="your-access-token-here"

curl -X POST \
  https://xs.jisecure.com/api/employee/add \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "emp_code":    "EMP001",
    "full_name":   "John Doe",
    "email":       "john@company.com",
    "contact_no":  "+919876543210",
    "designation": "Senior Developer",
    "gender":      0,
    "joining_date":"2026-01-15",
    "state_id":    1,
    "company_id":  5
  }'
import requests

# ── Configuration ──────────────────────────
access_token = "your-access-token-here"
url          = "https://xs.jisecure.com/api/employee/add"

# ── Payload ─────────────────────────────────
payload = {
    "emp_code":    "EMP001",
    "full_name":   "John Doe",
    "email":       "john@company.com",
    "contact_no":  "+919876543210",
    "designation": "Senior Developer",
    "gender":      0,
    "joining_date":"2026-01-15",
    "state_id":    1,
    "company_id":  5
}

# ── Send ────────────────────────────────────
headers = {
    "Authorization": f"Bearer {access_token}",
    "Content-Type":  "application/json"
}
try:
    r = requests.post(url, json=payload, headers=headers)
    print(r.status_code, r.json())
except Exception as e:
    print(f"Error: {e}")
<?php

// ── Setup ──────────────────────────────────
$accessToken = "your-access-token-here";
$url         = "https://xs.jisecure.com/api/employee/add";

// ── Payload ─────────────────────────────────
$payload = json_encode([
    "emp_code"    => "EMP001",
    "full_name"   => "John Doe",
    "email"       => "john@company.com",
    "contact_no"  => "+919876543210",
    "designation" => "Senior Developer",
    "gender"      => 0,
    "joining_date"=> "2026-01-15",
    "state_id"    => 1,
    "company_id"  => 5
]);

// ── Execute via cURL ─────────────────────────
$ch = curl_init($url);
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => $payload,
    CURLOPT_HTTPHEADER     => [
        "Authorization: Bearer " . $accessToken,
        "Content-Type: application/json"
    ]
]);

$response = curl_exec($ch);
curl_close($ch);
echo $response;
?>
// ── Employee Upsert (Node.js / Browser) ────
const accessToken = "your-access-token-here";

const response = await fetch("https://xs.jisecure.com/api/employee/add", {
  method:  "POST",
  headers: {
    "Authorization": `Bearer ${accessToken}`,
    "Content-Type":  "application/json"
  },
  body: JSON.stringify({
    emp_code:    "EMP001",
    full_name:   "John Doe",
    email:       "john@company.com",
    contact_no:  "+919876543210",
    designation: "Senior Developer",
    gender:      0,
    joining_date:"2026-01-15",
    state_id:    1
  })
});

const data = await response.json();
console.log(data);
Sample Response 200 OK
response.json 
{
  "status":  200,
  "message": "Employee added successfully.",
  "detail": {
    "id":            42,
    "full_name":     "John Doe",
    "designation":   "Senior Developer",
    "joining_date":  "2026-01-15",
    "emp_code":      "EMP001",
    "profile_image": "https://example.com/uploads/profile.jpg",
    "state":         "Active",
    "created_on":    "2026-01-15 10:30:00",
    "company":       "Acme Corp",
    "created_by":    "Admin User"
  }
}

List Employees

Returns all active employee profiles linked to your company. Optionally filter by company_id.

GET https://xs.jisecure.com/api/employee/list
Query Parameters
ParameterTypeStatusDescription
company_id integer Optional Filter by company. Defaults to the token owner's company.
list_employees 
ACCESS_TOKEN="your-access-token-here"

curl -X GET \
  "https://xs.jisecure.com/api/employee/list" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Accept: application/json"
import requests

r = requests.get(
    "https://xs.jisecure.com/api/employee/list",
    headers={"Authorization": f"Bearer your-access-token-here"}
)
print(r.json())
<?php
$ch = curl_init("https://xs.jisecure.com/api/employee/list");
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer your-access-token-here",
        "Accept: application/json"
    ]
]);
echo curl_exec($ch);
curl_close($ch);
?>
const r = await fetch("https://xs.jisecure.com/api/employee/list", {
  headers: { "Authorization": "Bearer your-access-token-here" }
});
console.log(await r.json());
Sample Response 200 OK
response.json 
{
  "status": 200,
  "list": [
    {
      "id":            42,
      "full_name":     "John Doe",
      "designation":   "Senior Developer",
      "joining_date":  "2026-01-15",
      "emp_code":      "EMP001",
      "profile_image": "https://example.com/uploads/profile.jpg",
      "state":         "Active",
      "created_on":    "2026-01-15 10:30:00",
      "company":       "Acme Corp",
      "created_by":    "Admin User"
    },
    // ... more employees
  ]
}

Delete Employee

Permanently removes an employee profile. Provide either id or emp_code — at least one is required.

POST https://xs.jisecure.com/api/employee/delete
Irreversible: Deletion is permanent. Consider setting state_id = 0 (inactive) if you need to preserve the record.
Parameters (pass as query string or JSON body)
ParameterTypeStatusDescription
emp_code string Optional* Preferred. Employee code used as the primary lookup key.
id integer Optional* Internal database ID. One of id or emp_code is mandatory.
company_id integer Optional Target company ID. Defaults to current user's company if omitted.
delete_employee 
# Delete by emp_code (recommended)
ACCESS_TOKEN="your-access-token-here"

curl -X POST \
  "https://xs.jisecure.com/api/employee/delete?emp_code=EMP001" \
  -H "Authorization: Bearer $ACCESS_TOKEN"
import requests

r = requests.post(
    "https://xs.jisecure.com/api/employee/delete",
    params={"emp_code": "EMP001"},
    headers={"Authorization": f"Bearer your-access-token-here"}
)
print(r.json())
<?php
$empCode = "EMP001";
$url     = "https://xs.jisecure.com/api/employee/delete?emp_code="
           . urlencode($empCode);

$ch = curl_init($url);
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST           => true,
    CURLOPT_HTTPHEADER     => [
        "Authorization: Bearer your-access-token-here"
    ]
]);
echo curl_exec($ch);
curl_close($ch);
?>
const r = await fetch(
  "https://xs.jisecure.com/api/employee/delete?emp_code=EMP001",
  {
    method:  "POST",
    headers: { "Authorization": "Bearer your-access-token-here" }
  }
);
console.log(await r.json());
Sample Response 200 OK
response.json 
{
  "status":  200,
  "message": "Employee profile deleted successfully."
}
Start Integrating Today

Ready to connect your platform?

Sign in to get your Bearer token and start syncing employees with XS Attendance in minutes.

Sign In & Get Token Contact Support

We use cookies, check our Privacy Policies.