How to use DevConnext

One guide per topic, step by step, as the system works today.

What DevConnext API is, who can use it

It's the website dev.bizconnext.com (open it from the service picker at account.bizconnext.com) — available once your company pays for an HRConnext package (not during a free trial; no extra charge) · Lets your other systems — ERP, accounting, time clocks — read data from HRConnext themselves. Read-only for now: branches, departments, positions, employees (work data), check-ins, leave and balances, shifts, holidays and HR report totals. Confidential or unneeded data is never sent (salary, national ID, bank, religion, birth date, address, phone, GPS, photos, leave reasons). the API connections menu is for the account owner and HR director, and appears once HRConnext has turned DevConnext API on for your company.

Read →

Ask Next · API specialist

Press "API specialist" in the dev.bizconnext.com menu. Ask in Thai or English — "which endpoint files leave for an employee?" gives the endpoint with cURL / JavaScript / Python · "what is 428?" gives the meaning and the fix · "our ERP gets errors — check it" makes Next read your company's last 24 hours of calls and say which key failed on which endpoint and why (e.g. the plan has no writing, or the key lacks a scope) · "our webhook isn't arriving" checks delivery · "how do I connect Claude?" · Next sees only your company's connections, read-only, never shows keys and doesn't keep your questions; it runs on HRConnext's own servers · don't paste API keys in the chat — if you do, Next tells you to revoke that key · the public API reference (api.bizconnext.com/v1/docs) has an "Ask Next" button too, for IT staff or developers without an account — general questions only, no company data.

Read →

Make an API key

Press "+ Create API key", name it after the system that will use it, choose "Test (sandbox)" for sample data or "Live" for real data, tick only the scopes that system needs, pick an expiry and (optional, recommended) the IP of the machine that will call. Before the first live key, someone reads and ticks the DevConnext API terms once on behalf of the company (name, time and IP are recorded; "Read the terms" shows them again later) — test keys need no acceptance. The key is shown once — copy it somewhere safe; we only keep a one-way hash. If it is lost, make a new one and revoke the old one. Up to 2 live keys at once (one in use + one to rotate to) and 2 test keys.

Read →

Try it in the Playground first

Playground tab: choose "Sample data" and press "Get a test token" (15 minutes), or "Company's own key" and paste a live key to see real data read-only. Pick an endpoint, fill in values and press "Send request" to see the response, status, time and headers. You can try writes too (endpoints starting POST / PATCH) — on sample data only; the body is pre-filled with sample ids, edit the JSON, and set dry_run = true to see the result without saving. "Code" gives curl / JavaScript / Python to copy — without the key (keep it in an environment variable). The full API reference opens from "API documentation" at the top.

Read →

Sample data (sandbox)

A pretend company is made for you with the first test key or token: 12 people, two weeks of check-ins, leave, shifts and holidays. Test keys read only it — never real data — and nobody is notified about it. Press "Reset sample data" any time (every sandbox id changes; test keys keep working).

Read →

Safety, limits and errors

The API lives at https://api.bizconnext.com/v1 · send the key in the Authorization: Bearer header only — never in a URL (it is blocked at once) or a web page others can open · if you think a key leaked, press "Revoke"; it stops at once · limits follow your package, per key per minute and per company per day (Thai time); over the limit you get 429 with when to retry · more than 30 wrong, expired or revoked keys in a minute from one IP pauses that IP for a minute (429) · every error has a code — insufficient_scope, not_found (missing, or another company's id), key_revoked, key_expired, ip_not_allowed — and a request_id to give our team · each call is logged with time, path and result (never employee data).

Read →

Sending data into HRConnext (writing)

Pick scopes marked "write" when making a key: add departments (org:write) · add employees and change work data such as name, e-mail, position, branch, hire date (employees:write) · file leave for employees (leave:write) — it goes to their approver in LINE as usual and balances change only once approved (approving through the API isn't possible — the approver decides in LINE) · send punches from time clocks and ask for punch fixes for employees (attendance:write) — punches follow the same rules as checking in on LINE (late / early and the company's deduction for unworked time, if switched on), show a "Time clock" label on the attendance page, and re-sending never doubles them; fixes go to the approver · submit expense claims for employees with jpg / png / pdf receipts (expense:write) — to the approver as usual; photos lose their hidden data (such as where they were taken) before they're stored · a key that writes acts for the person who made it and can only do what they may do in the app; if that person is closed or loses the permission, the key stops writing at once (reading still works) · employee status (leaving), salary, national ID, bank account and religion can't be changed through the API — do it in the app · every write is in the activity log as "DevConnext API · key name (for the maker)" · the company's package must include writing (otherwise write_not_in_plan) · connected systems should send an Idempotency-Key every time (safe retries), If-Match when changing, and try ?dry_run=true first to see what would change without saving.

Read →

Webhooks — HRConnext notifies your system

The "Webhooks" tab: press "+ Add a webhook address", enter your system's https address (a public one — internal addresses are refused), pick events such as leave or expense approved, people joining or leaving, payroll closed, then copy the signing secret (whsec_…), shown once, into your system to verify HRC-Signature · only ids and changed field names are sent, never confidential data — your system fetches details with an API key · "Send a test" tries a sample; "Delivery log" shows what got through (kept 30 days); "Send again" once your system is back · failed sends are retried 8 times over 24 hours; 3 days of failures switch it off — press "Turn on" after fixing · "New secret" keeps the old one working for 24 hours · needs a plan that includes it; how to verify signatures is in the API reference.

Read →

Connect an AI app (DevConnext MCP)

Once HRConnext has turned DevConnext MCP on for your company, the "AI apps (MCP)" tab gives you the MCP address to paste into an AI app that supports MCP (e.g. Claude — tested with Claude) as a custom connector. The app opens HRConnext: sign in, see the app name, the domain it returns to and the permissions it asks for, tick only what it may read and press "Allow" (account owner or HR director only; the company must have accepted the DevConnext API terms) · the app reads only, on behalf of the person who allowed it, never confidential data, at most 50 rows at a time · what it reads goes to that app's AI provider, which may process it outside Thailand; before connecting, check the AI provider's terms (e.g. how data is kept and whether it trains models) and inform employees as the law requires (DevConnext API terms section 9) · AI answers can be wrong or incomplete — check against HRConnext before deciding anything that affects employees · see who connected which app and press "Withdraw" any time — it stops at once; it also stops if that person is deactivated or loses the permission · an "Unverified" app registered itself — check its name and domain before allowing it.

Read →

Get the whole company started today

Start your 14-day free trial

Talk to us @bizconnext →