Skip to content
Mihnaro
Help center

API reference by section

The main endpoints of each section with the permission they need, how to read the full generated reference, and the OpenAPI file for Postman.

Mihnaro has more than 900 endpoints. This page gives the ones most integrations start with, section by section. The full API reference lists every endpoint, generated from the code so it always matches the server.

In the paths below {company} is your company's ID, and the other {…} are record IDs. "None" in the permission column means any active user of the company may call it, and sees only their own records or what they may see. Read Getting started for the headers.

How to use the full reference

  • Search in the box at the top of the sidebar: a word from the path, a permission (leaves.view) or a description ("payslip").
  • Sections are the first part of the path after the company: employees, leaves, payroll-runs and so on. Each one has a link you can share, for example the employees section.
  • Open an endpoint to see its description, who can call it (sign-in, permission, module, rate limit), its path parameters, the query parameters or body fields the code checks with their rules, and a copy-ready curl call.
  • Body fields are read from the code's validation. Some sections check more fields further in; the description then names them, and the section's own help articles explain the forms.

OpenAPI and Postman

The whole API is also available as an OpenAPI 3.0 file, generated from the same code: download openapi.json.

  • Postman: Import → Upload files → choose mihnaro-openapi.json. Set the collection's authorization to Bearer Token with your key, and replace {company} with your company's ID.
  • Insomnia, Bruno, Hoppscotch and client generators (OpenAPI Generator, openapi-typescript) read the same file.
  • Every operation carries x-permissions, x-modules and x-rate-limit-per-minute.

Account and company

Method Path Permission What
POST /api/v1/app/token None (no token) Sign in and get a token
DELETE /api/v1/app/token None Sign out this token
GET /api/v1/app/me None (token only, not API keys) Your account and your companies
GET /api/v1/app/companies/{company} None The license, modules and branches the company gives you
GET /api/v1/app/companies/{company}/branch None The branch you are working in
PUT /api/v1/app/companies/{company}/branch None Switch branch: {"branch": 77} or {"branch": "all"}

Employees

Method Path Permission What
GET /api/v1/app/companies/{company}/employees employees.view The list: search, status, employee_number, branch_id, salary_status, per_page
GET /api/v1/app/companies/{company}/employees/{employee} employees.view One employee
GET /api/v1/app/companies/{company}/employees/by-number/{number} employees.view One employee by their employee number
POST /api/v1/app/companies/{company}/employees employees.create Add an employee (within the license's headcount)
PATCH /api/v1/app/companies/{company}/employees/{employee} employees.edit Change the fields you send
GET /api/v1/app/companies/{company}/directory employees.view or self.directory.view The company directory

All employee endpoints: the file, professional data, termination, rehire, salary packages and more.

Attendance and clocking

Method Path Permission What
GET /api/v1/app/companies/{company}/me/attendance self.attendance.view My month of attendance and today's records
POST /api/v1/app/companies/{company}/attendance/clock-in self.clock Clock in (the clocking security checks apply)
POST /api/v1/app/companies/{company}/attendance/clock-out self.clock Clock out
GET /api/v1/app/companies/{company}/attendance/records attendance.view Records: from, to, employee, shift, state
POST /api/v1/app/companies/{company}/attendance/records attendance.records.manage Add a record, or correct a day with "replace": true
GET /api/v1/app/companies/{company}/attendance/team attendance.view The team's month, totals per employee
GET /api/v1/app/companies/{company}/attendance/today attendance.view One day of the team: counts and each person's status
GET /api/v1/app/companies/{company}/attendance/punch-log attendance.security.review Every punch with its security checks

All attendance endpoints, and shifts, timesheets and overtime.

Leaves

Method Path Permission What
GET /api/v1/app/companies/{company}/me/leaves self.leaves.view My balances this year (or ?year=) and my requests
POST /api/v1/app/companies/{company}/leaves self.leaves.request Ask for time off: leave_type_id, start_date, end_date, reason (multipart with attachment when the type needs one)
GET /api/v1/app/companies/{company}/leaves/{leave} leaves.manage or leaves.view or self.approvals.decide or self.leaves.view (own, or leaves.view) One leave with its balance
POST /api/v1/app/companies/{company}/leaves/{leave}/withdraw leaves.manage or self.leaves.cancel Withdraw my leave
POST /api/v1/app/companies/{company}/leaves/{leave}/decide leaves.manage or requests.manage or self.approvals.decide (the approver of the step) decision: approved or rejected, decision_note
GET /api/v1/app/companies/{company}/team-leaves leaves.view The team's leaves: status, type, employee, from, to
POST /api/v1/app/companies/{company}/team-leaves leaves.record HR records an approved leave for an employee
GET /api/v1/app/companies/{company}/leave-types leave_setup.manage The leave types

All leave endpoints, and balances and adjustments.

Payroll

Method Path Permission What
GET /api/v1/app/companies/{company}/me/payslips self.payslips.view My payslips (approved runs only)
GET /api/v1/app/companies/{company}/payslips/{payslip} payroll.runs.view or self.payslips.view One payslip
GET /api/v1/app/companies/{company}/payslips/{payslip}/pdf payroll.runs.view or self.payslips.download The payslip as a PDF file
GET /api/v1/app/companies/{company}/payroll-runs payroll.runs.view Payroll runs, newest first
GET /api/v1/app/companies/{company}/payroll-runs/{run} payroll.runs.view A run with its payslips
POST /api/v1/app/companies/{company}/payroll-runs/{run}/approve payroll.runs.approve Approve a run (or send it through its approval chain)
GET /api/v1/app/companies/{company}/payroll/{month} payroll.runs.view The approved regular run of a month (2026-10); 404 before it is approved

All payroll endpoints, and financial transactions, loans and salaries.

Requests and approvals

Method Path Permission What
GET /api/v1/app/companies/{company}/me/requests self.requests.view My requests
POST /api/v1/app/companies/{company}/requests/{type} requests.manage or self.requests.file File a request of a type, with its fields (and an attachment)
POST /api/v1/app/companies/{company}/requests/{employeeRequest}/withdraw requests.manage or self.requests.cancel Withdraw my pending request
POST /api/v1/app/companies/{company}/requests/{employeeRequest}/decide leaves.manage or requests.manage or self.approvals.decide (the approver of the step) decision: approved or rejected, decision_note
GET /api/v1/app/companies/{company}/approvals requests.manage or requests.view or self.approvals.decide The approvals page: tab, status, type
POST /api/v1/app/companies/{company}/approvals/bulk requests.manage or requests.view or self.approvals.decide Approve or reject several items at once

All request endpoints, request types and approvals.

Announcements

Method Path Permission What
GET /api/v1/app/companies/{company}/announcements announcements.manage or self.announcements The announcements this person may read: q, per_page
GET /api/v1/app/companies/{company}/announcements/{announcement} announcements.manage or self.announcements One announcement
POST /api/v1/app/companies/{company}/announcements announcements.create Publish: title and body as {"en", "ar"}, pinned, starts_on, expires_on
DELETE /api/v1/app/companies/{company}/announcements/{announcement} announcements.delete Delete

All announcement endpoints, and events and tasks.

Documents

Method Path Permission What
GET /api/v1/app/companies/{company}/documents employees.view_sensitive or self.documents.view (filtered by what you may see) Employee and company documents
POST /api/v1/app/companies/{company}/documents employees.view_sensitive or self.documents.upload (filtered by what you may manage) Upload a document (multipart)
GET /api/v1/app/companies/{company}/documents/{document}/download None Download the file

All document endpoints, and HR letters.

Devices

Method Path Permission What
GET /api/v1/app/companies/{company}/devices devices.manage Fingerprint and access devices
GET /api/v1/app/companies/{company}/devices/{device} devices.manage One device
POST /api/v1/app/companies/{company}/devices/{device}/actions/{action} devices.manage Send a command to the device
GET /api/v1/app/companies/{company}/devices/{device}/users devices.manage The people on the device

All device endpoints, and door events.

Webhooks and reports

Method Path Permission What
GET /api/v1/app/companies/{company}/webhooks integrations.api_keys.manage Your webhooks (token only, not API keys)
GET /api/v1/app/companies/{company}/webhook-deliveries integrations.api_keys.manage The delivery log
GET /api/v1/app/companies/{company}/reports None (the reports your role allows) The reports you can run

See Webhooks for events and signatures, and the reports section for running and exporting reports.

Last updated:

Still need help?

Our support team answers in English and Arabic.

Email support

We use cookies to understand how the site is used. You can accept or decline.