Limits & security

Rate limits, roles, filtered fields and punch-clock controls.

Public Integration API v1 is intentionally limited — enough for payroll, reporting, and punch hardware, without exposing Curio’s admin surface.

Rate limiting

Tier	Limit (planned)
Sandbox	60 requests / minute
Production	300 requests / minute per credential
Punch endpoints	Stricter burst limits on `POST …/punch`

On 429 Too Many Requests, retry with exponential backoff.

Roles by endpoint (HR API)

Endpoint group	Minimum role
Time entries (read)	`employee` (own) / `manager+` (others)
Employees (read)	`manager`, `owner`, `accountant`
Departments	`owner`, `manager`, `accountant`
Payroll preview	`owner`, `accountant`
Schedules, time off	`employee+` within company

employee tokens only see their own data where enforced.

Module gates

Company features can be disabled. API may return empty lists or 403:

Flag	Effect
`enableProjects`	Projects unavailable
`enableShifts`	Schedules unavailable
`enableTimeOff`	Time off / absences unavailable

Public employee response (HR API)

{
  "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "email": "employee@company.example",
  "isActive": true,
  "employeeProfile": {
    "displayName": "Jane Doe",
    "jobTitle": "Operator",
    "departments": [{ "id": "…", "name": "Operations" }],
    "employmentStartDate": "2024-01-15",
    "employmentEndDate": null,
    "employmentRatio": 100
  }
}

Excluded from public HR API

Field	Reason
`nationalId`	PII — separate payroll agreement only
`kioskPin`	Security
`phone`, `address`, emergency contacts	PII
`aiCompanionMemory`	Internal
`can*` permission flags	Internal RBAC
`hourlyCost`, `salaryType`	Sensitive compensation
`assignedRuleId` / rule JSON	Use `dynamicPayLines` instead

Public timesheet response

GET …/time-entries includes entries and totals. Not included:

appliedRuleDefinitionJson
Punch photos / signatures (unless separately agreed)
Raw GPS on read API (GPS may be stored on punch; not exposed in v1 read)

Payroll preview is read-only

POST …/payroll/export/preview calculates lines without calling Payday/DK/Regla. v1 does not expose:

POST …/payroll/export/payday
POST …/payroll/export/dkplus
Other export triggers

Customers run export from Curio Time settings after configuring integrations.

Punch clock security

Control	Description
Password punch	Verifies employee web password per punch
Kiosk PIN	4-digit PIN + registered device token
IP rules	Company may restrict punch by IP (enforced server-side)
GPS	Optional recording; profile may require GPS without blocking punch
Rate limit	Abuse protection on punch POST

Partners must not log or display employee passwords or PINs.

Integration and punch actions are logged (timestamp, endpoint, company)
Collect only data you need; delete when integration ends
Contact Curio Time to revoke credentials