{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "factorial", "name": "Factorial", "vendor": "Everyday Software, S.L.", "vendorUrl": "https://factorial.com", "kind": "http-api", "category": "hr", "summary": "Factorial is an HR platform from Barcelona for employee records, time off, attendance, payroll data, recruiting and expenses. Agents reach it through a versioned REST API with API keys or OAuth 2.0, webhooks and a hosted MCP server.", "url": "https://www.anchorterminal.com/tools/factorial", "markdownUrl": "https://www.anchorterminal.com/tools/factorial.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/factorial.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/factorial.json", "repo": "https://github.com/factorialco/factorial-api-sdks", "license": "Proprietary service under Factorial's terms and conditions. The TypeScript and Python SDKs are MIT", "transports": [ "http" ], "remoteUrl": "https://api.factorialhr.com", "packages": [ { "registry": "npm", "name": "@factorialco/api-client" }, { "registry": "pypi", "name": "factorial-api-client" } ], "auth": "mixed", "authNotes": "A company administrator creates credentials in Factorial's settings, with no registration or approval queue for a company's own use. An API key goes in `x-api-key`, grants every scope and does not expire. OAuth 2.0 apps use the authorisation code grant through Factorial ID (PKCE for public clients), choose from 33 scopes and receive 1-hour company or user tokens with a refresh token. A user token is limited by that employee's permission group. Integrations for other companies must use OAuth, with scopes agreed with Factorial. The MCP server uses OAuth with dynamic client registration and runs as the signed-in employee.", "pricing": "paid", "pricingNotes": "The pricing page says Factorial starts at $8 per user per month and asks for a tailored quote for everything else. The terms describe a free trial of at most 15 days granted at Factorial's discretion, and the sign-up page is drawn by script, so its conditions were not read. The demo API environment is provisioned by an account manager, so an agent cannot start without a customer account. Factorial One requests through the MCP server consume plan credits (https://factorial.com/pricing, checked 2026-10-08).", "priceSummary": "$8 / seat-mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the developer docs, the OpenAPI definition, the terms or the pricing page (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 7, "npmWeekly": 1367, "pypiWeekly": 1075, "asOf": "2026-10-08" }, "docsUrl": "https://apidoc.factorialhr.com", "llmsTxt": "https://apidoc.factorialhr.com/llms.txt", "openapi": "https://api.factorialhr.com/oas/", "capabilities": [ "hr.employees", "hr.time-off", "hr.org", "hr.documents", "recruiting.applications", "recruiting.jobs", "recruiting.candidates", "spend.expenses", "tasks.create" ], "tags": [ "hosted", "paid", "sales-led", "api-key", "oauth", "mcp", "openapi", "llms-txt", "webhooks", "sandbox", "typescript", "python", "status-page", "sla", "bug-bounty", "soc2", "eu" ], "lastRelease": "2026-10-05", "graded": true, "anchor": { "graded": true, "score": 66.3, "grade": "B", "agentReady": false, "rank": 239, "ranked": true, "rankOf": 722, "categoryRank": 2, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 58, "maintenance": 84, "payments": 10, "reliability": 88, "schema": 77, "security": 65, "transparency": 78 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 88, "points": 17.6, "reason": "Graded on the public REST API with the hosted lines. Statuspage at status.factorialhr.com with 14 components, API \u0026 backend among them (20). The incident feed's newest entry is 1 June 2026 (6 hours of degraded performance), so the 90 days to 8 October are clean (30). The FAQ gives one number, 200 `POST` requests a minute, and nothing for other methods (8). The docs advise exponential backoff on 429 and 5xx and a check before retrying a create, but no `Retry-After` header or idempotency key is documented (10). The trust centre publishes a 99.9 per cent monthly uptime SLA with a 5 per cent service credit, referenced from the terms (10). The API is generally available, with dated stable versions (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 77, "points": 12.51, "reason": "A public OpenAPI 3.1.0 definition at `https://api.factorialhr.com/oas/` covers 615 operations and 137 webhook events (25). `llms.txt` and a Markdown twin of every page (10). Every operation has a description, but most only restate the action, such as Creates a Leave, with few saying when to use an endpoint (9). Inputs are typed with required fields and 359 enum declarations, with IDs passed as strings (11). 566 operations carry examples, but the definition documents only 200 and 201 responses and errors are explained in one FAQ table (7). Dated versions in the path and quarterly release notes that mark new and removed items (15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 58, "points": 9.43, "reason": "List responses are capped at 100 records and can be narrowed by ID and date filters. No field selection was found, and the full definition is 1.2 MB (12). Cursor pagination on every list endpoint with `meta.total`, and filters such as `ids[]`, `emails[]` and `updated_at_gteq` (18). Status codes come with recovery advice and some 422 responses carry a `code`, but messages are localised, a credential from the wrong environment yields 200 with an empty body, and an expired version is served in an older schema with no error (9). No idempotency keys, and the docs say the API does not deduplicate requests. The MCP tool annotations were not read (4). Few required parameters, with official SDKs in TypeScript and Python and a Ruby SDK in the repository (15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 65, "points": 11.38, "reason": "OAuth 2.0 with 33 scopes, PKCE for public clients, 1-hour tokens, refresh and a revoke endpoint, and user tokens bound to a permission group. API keys are revocable and sent in a header, but grant every scope and never expire (25). An OAuth app without the `write` scope is read-only and a user token inherits one employee's permissions. No confirmation step was found for terminate or bulk delete calls (13). The API returns text written by employees. The webhook guide says to treat payloads as untrusted input, and no injection guidance was found for API or MCP responses (3). The trust centre says audit logs exist and links a help centre article that our reader could not extract, so API coverage is not established (7). SOC 2 Type 2, SOC 3, ISO/IEC 27001:2022, ENS High, annual third-party penetration tests and a HackerOne bounty per the trust centre. No security.txt (17)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 10, "points": 1.25, "reason": "No x402, MPP or L402 (0). The pricing page gives one figure, from $8 per user per month, and quotes everything else, which we scored between contact sales and public plan pricing (5). The terms describe a trial of at most 15 days at Factorial's discretion. Whether it needs a card could not be read from the script-drawn sign-up page, and the demo API environment comes from an account manager (5). API keys and OAuth apps are created by an administrator in a browser, and the MCP server's dynamic client registration still ends in a human login (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 84, "points": 7.35, "reason": "API version 2026-10-01 was released on 5 October 2026, with SDK 3.0.0 the same day (30). In the 90 days before, the changelog has the MCP server on 14 July and entries on 1 and 5 October, and the SDK repository has five Python releases from 22 July to 5 October (20). A dated changelog with RSS, two support forms, a published first-response target of 4 hours for 90 per cent of tickets, and a public SDK repository whose issues we could not read (11). Current official SDKs in TypeScript and Python (15). The SDK repository has CI, release automation and npm trusted publishing, with daily beta builds for the next API version (8)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 78, "points": 6.83, "note": "editorial 73, provenance 82", "reason": "Closed service with public terms amended 12 December 2025, and MIT SDKs. Clauses 9.6 and 9.8 prohibit benchmarking, competitive evaluation and monitoring of availability (15). The terms and the trust centre agree on retention (30 days to request return of data, one year blocked for authorities, then deletion), the privacy policy of January 2026 covers Factorial's role as processor, and the trust centre says customer data is not used to train models. The DPA was not read (24). Each API version is supported for one year with dated release notes, but an expired version is served silently in an older schema, API keys for marketplace use are being phased out with no date, and the terms reserve the right to change or remove the public API (16). The trust centre lists sub-processors with purpose and location, and states EU storage on AWS Frankfurt and Azure Frankfurt and Sweden (18)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "List responses are capped at 100 records and can be narrowed by ID and date filters. No field selection was found, and the full definition is 1.2 MB (12). Cursor pagination on every list endpoint with `meta.total`, and filters such as `ids[]`, `emails[]` and `updated_at_gteq` (18). Status codes come with recovery advice and some 422 responses carry a `code`, but messages are localised, a credential from the wrong environment yields 200 with an empty body, and an expired version is served in an older schema with no error (9). No idempotency keys, and the docs say the API does not deduplicate requests. The MCP tool annotations were not read (4). Few required parameters, with official SDKs in TypeScript and Python and a Ruby SDK in the repository (15).", "maintenance": "API version 2026-10-01 was released on 5 October 2026, with SDK 3.0.0 the same day (30). In the 90 days before, the changelog has the MCP server on 14 July and entries on 1 and 5 October, and the SDK repository has five Python releases from 22 July to 5 October (20). A dated changelog with RSS, two support forms, a published first-response target of 4 hours for 90 per cent of tickets, and a public SDK repository whose issues we could not read (11). Current official SDKs in TypeScript and Python (15). The SDK repository has CI, release automation and npm trusted publishing, with daily beta builds for the next API version (8).", "payments": "No x402, MPP or L402 (0). The pricing page gives one figure, from $8 per user per month, and quotes everything else, which we scored between contact sales and public plan pricing (5). The terms describe a trial of at most 15 days at Factorial's discretion. Whether it needs a card could not be read from the script-drawn sign-up page, and the demo API environment comes from an account manager (5). API keys and OAuth apps are created by an administrator in a browser, and the MCP server's dynamic client registration still ends in a human login (0).", "reliability": "Graded on the public REST API with the hosted lines. Statuspage at status.factorialhr.com with 14 components, API \u0026 backend among them (20). The incident feed's newest entry is 1 June 2026 (6 hours of degraded performance), so the 90 days to 8 October are clean (30). The FAQ gives one number, 200 `POST` requests a minute, and nothing for other methods (8). The docs advise exponential backoff on 429 and 5xx and a check before retrying a create, but no `Retry-After` header or idempotency key is documented (10). The trust centre publishes a 99.9 per cent monthly uptime SLA with a 5 per cent service credit, referenced from the terms (10). The API is generally available, with dated stable versions (10).", "schema": "A public OpenAPI 3.1.0 definition at `https://api.factorialhr.com/oas/` covers 615 operations and 137 webhook events (25). `llms.txt` and a Markdown twin of every page (10). Every operation has a description, but most only restate the action, such as Creates a Leave, with few saying when to use an endpoint (9). Inputs are typed with required fields and 359 enum declarations, with IDs passed as strings (11). 566 operations carry examples, but the definition documents only 200 and 201 responses and errors are explained in one FAQ table (7). Dated versions in the path and quarterly release notes that mark new and removed items (15).", "security": "OAuth 2.0 with 33 scopes, PKCE for public clients, 1-hour tokens, refresh and a revoke endpoint, and user tokens bound to a permission group. API keys are revocable and sent in a header, but grant every scope and never expire (25). An OAuth app without the `write` scope is read-only and a user token inherits one employee's permissions. No confirmation step was found for terminate or bulk delete calls (13). The API returns text written by employees. The webhook guide says to treat payloads as untrusted input, and no injection guidance was found for API or MCP responses (3). The trust centre says audit logs exist and links a help centre article that our reader could not extract, so API coverage is not established (7). SOC 2 Type 2, SOC 3, ISO/IEC 27001:2022, ENS High, annual third-party penetration tests and a HackerOne bounty per the trust centre. No security.txt (17).", "transparency": "Closed service with public terms amended 12 December 2025, and MIT SDKs. Clauses 9.6 and 9.8 prohibit benchmarking, competitive evaluation and monitoring of availability (15). The terms and the trust centre agree on retention (30 days to request return of data, one year blocked for authorities, then deletion), the privacy policy of January 2026 covers Factorial's role as processor, and the trust centre says customer data is not used to train models. The DPA was not read (24). Each API version is supported for one year with dated release notes, but an expired version is served silently in an older schema, API keys for marketplace use are being phased out with no date, and the terms reserve the right to change or remove the public API (16). The trust centre lists sub-processors with purpose and location, and states EU storage on AWS Frankfurt and Azure Frankfurt and Sweden (18)." }, "sources": [ { "what": "developer docs index (llms.txt)", "url": "https://apidoc.factorialhr.com/llms.txt", "seen": "2026-10-08" }, { "what": "getting started, environments and first call", "url": "https://apidoc.factorialhr.com/docs/getting-started.md", "seen": "2026-10-08" }, { "what": "authentication methods", "url": "https://apidoc.factorialhr.com/docs/authentication.md", "seen": "2026-10-08" }, { "what": "API keys", "url": "https://apidoc.factorialhr.com/docs/api-keys.md", "seen": "2026-10-08" }, { "what": "OAuth 2 token types and endpoints", "url": "https://apidoc.factorialhr.com/docs/oauth-2.md", "seen": "2026-10-08" }, { "what": "OAuth scopes", "url": "https://apidoc.factorialhr.com/docs/oauth-scopes.md", "seen": "2026-10-08" }, { "what": "FAQ, rate limits, errors and retries", "url": "https://apidoc.factorialhr.com/docs/faqs.md", "seen": "2026-10-08" }, { "what": "pagination", "url": "https://apidoc.factorialhr.com/docs/pagination.md", "seen": "2026-10-08" }, { "what": "API versioning", "url": "https://apidoc.factorialhr.com/docs/api-versioning.md", "seen": "2026-10-08" }, { "what": "production and demo environments", "url": "https://apidoc.factorialhr.com/docs/production-and-demo.md", "seen": "2026-10-08" }, { "what": "webhook policies", "url": "https://apidoc.factorialhr.com/docs/webhooks-policies.md", "seen": "2026-10-08" }, { "what": "webhook best practices", "url": "https://apidoc.factorialhr.com/docs/best-practices-troubleshooting.md", "seen": "2026-10-08" }, { "what": "MCP server guide", "url": "https://apidoc.factorialhr.com/docs/mcp-server.md", "seen": "2026-10-08" }, { "what": "MCP OAuth metadata", "url": "https://mcp.factorialhr.com/.well-known/oauth-authorization-server", "seen": "2026-10-08" }, { "what": "SDKs guide", "url": "https://apidoc.factorialhr.com/docs/sdks.md", "seen": "2026-10-08" }, { "what": "OpenAPI definition, version 2026-10-01", "url": "https://api.factorialhr.com/oas/", "seen": "2026-10-08" }, { "what": "changelog feed", "url": "https://apidoc.factorialhr.com/changelog.rss", "seen": "2026-10-08" }, { "what": "2026-10-01 release notes", "url": "https://apidoc.factorialhr.com/changelog/changelog_2026-10-01.md", "seen": "2026-10-08" }, { "what": "SDK repository (clone)", "url": "https://github.com/factorialco/factorial-api-sdks", "seen": "2026-10-08" }, { "what": "npm package", "url": "https://registry.npmjs.org/@factorialco/api-client", "seen": "2026-10-08" }, { "what": "PyPI package", "url": "https://pypi.org/pypi/factorial-api-client/json", "seen": "2026-10-08" }, { "what": "status incidents", "url": "https://status.factorialhr.com/api/v2/incidents.json", "seen": "2026-10-08" }, { "what": "status components", "url": "https://status.factorialhr.com/api/v2/components.json", "seen": "2026-10-08" }, { "what": "pricing", "url": "https://factorial.com/pricing", "seen": "2026-10-08" }, { "what": "terms and conditions", "url": "https://factorial.com/terms-of-use", "seen": "2026-10-08" }, { "what": "privacy policy", "url": "https://factorial.com/privacy", "seen": "2026-10-08" }, { "what": "trust centre (SLA, certifications, sub-processors, AI, retention)", "url": "https://trust.factorial.co", "seen": "2026-10-08" }, { "what": "legal notice", "url": "https://factorial.com/legal", "seen": "2026-10-08" }, { "what": "domain registration (RDAP)", "url": "https://rdap.org/domain/factorialhr.com", "seen": "2026-10-08" } ], "openQuestions": [ "unchecked: the MCP server's tool list, input schemas and annotations, which need an OAuth login", "unchecked: the sign-up page at app.factorialhr.com/users/sign_up, which is drawn by script, so the trial's length and whether it needs a card are not established", "unchecked: the help centre article on audit logs, whose text our reader could not extract, so whether API calls are logged is not established", "unchecked: the Data Processing Agreement and the full SLA exclusions", "unchecked: the official MCP registry, which did not answer from our shell", "unchecked: the HackerOne programme page named in the trust centre, and open issues on the SDK repository", "Whether rate limits apply to GET, PUT and DELETE requests, and whether 429 responses carry `Retry-After`", "Whether API access or the MCP server depends on the plan. The pricing page does not say", "The lead gave factorialhr.com as the site, which now redirects to factorial.com, and did not mention the MCP server or the SDKs" ] }, "negative": 0, "verdict": "A public OpenAPI 3.1 definition covers 615 operations, including leave approval and employee termination, and OAuth apps can be limited to 33 scopes. API keys always grant every scope and never expire. No idempotency keys exist, and a request to an expired API version is answered in an older schema with no error.", "bestFor": "An agent working for a company that already runs Factorial and needs employee records, leave requests with approval, attendance clock-ins, recruiting or expenses through one API.", "strengths": [ "OpenAPI 3.1.0 definition at `https://api.factorialhr.com/oas/` with 615 operations and 137 webhook events, plus `llms.txt` and a Markdown twin of every docs page", "OAuth 2.0 with 33 scopes, PKCE for public clients, 1-hour access tokens and a revoke endpoint. User tokens are bound to an employee's permission group", "Time off can be requested, approved and rejected through the API (`/timeoff/leaves/approve` and `/timeoff/leaves/reject`)", "Dated API versions ship each quarter and are supported for one year, with release notes that mark removed endpoints and fields", "A 99.9 per cent monthly uptime commitment with a 5 per cent service credit is published in the trust centre, and the status page shows no incident since 1 June 2026" ], "weaknesses": [ "An API key grants every scope, cannot be narrowed and does not expire", "No idempotency keys. The docs say the API does not deduplicate requests, so a blind retry can create a duplicate record", "A request to an unsupported API version is served in the oldest supported schema with no error", "The only published rate limit is 200 `POST` requests a minute, and no `Retry-After` header is documented", "The terms prohibit benchmarking, competitive evaluation and monitoring of availability, and pricing beyond a $8 starting figure is by quote" ], "agentNotes": [ "Send an API key in `x-api-key` and an OAuth token in `Authorization: Bearer`. The key is JWT-formatted but is rejected as a bearer token", "Pin the version in the path, such as `/api/2026-10-01/resources/...`, and migrate within a year. Expired versions answer in an older schema without an error", "Treat a 200 with an empty body as a credential from the other environment. Production is `api.factorialhr.com` and demo is `api.eu2.demo.factorial.dev`", "Page with `limit=100` and pass `meta.end_cursor` as `after_id`. A larger limit is capped at 100", "Check whether a record exists before retrying a create. Retry only 429 and 5xx with backoff, and branch on `code` for 422 because messages are localised" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 66.3 } ], "editorialScores": { "ergonomics": 58, "maintenance": 84, "payments": 10, "reliability": 88, "schema": 77, "security": 65, "transparency": 73 }, "provenanceScore": 82 }, "connect": { "install": "npm install @factorialco/api-client", "http": "curl --request GET \\\n --url 'https://api.factorialhr.com/api/2026-10-01/resources/api_public/credentials' \\\n --header 'accept: application/json' \\\n --header 'x-api-key: \u003capi_key\u003e'" }, "letme": { "capability": "https://letme.dev/hr.employees", "tool": "https://letme.dev/factorial" }, "notable": [ "The OpenAPI 3.1.0 definition for version 2026-10-01 lists 431 paths, 615 operations (316 GET, 188 POST, 63 PUT, 48 DELETE) and 137 webhook events, and accepts a `?version=` parameter (https://api.factorialhr.com/oas/)", "API keys grant every scope and do not expire. OAuth 2.0 tokens last 1 hour and are limited to the app's scopes, and API keys are deprecated for marketplace integrations (https://apidoc.factorialhr.com/docs/authentication)", "A hosted MCP server at `https://mcp.factorialhr.com` (Streamable HTTP, OAuth 2.0 with dynamic client registration) was announced on 14 July 2026. It runs as the signed-in employee and covers attendance, tasks, time off, employee lookup and a bridge to the Factorial One assistant (https://apidoc.factorialhr.com/docs/mcp-server)", "A new API version ships each quarter and is supported for one year. Requests to an unsupported version are served with the oldest supported version's schema, with no error (https://apidoc.factorialhr.com/docs/api-versioning)", "The FAQ states one rate limit, 200 `POST` requests a minute, and says the API does not deduplicate requests (https://apidoc.factorialhr.com/docs/faqs)", "Official TypeScript and Python SDKs were announced on 9 July 2026, generated from the OpenAPI definition, with an installable skill for coding agents. The repository also holds a Ruby SDK (https://github.com/factorialco/factorial-api-sdks)", "The trust centre publishes a platform SLA of 99.9 per cent monthly uptime with a 5 per cent service credit, and lists SOC 2 Type 2, SOC 3, ISO/IEC 27001:2022 and ENS High (https://trust.factorial.co)", "Clauses 9.6 and 9.8 of the terms (amended 12 December 2025) prohibit publishing unauthorised benchmark results and using the service for benchmarking, competitive evaluation or monitoring its availability (https://factorial.com/terms-of-use)", "factorialhr.com now redirects to factorial.com, while the API, docs and status page remain on factorialhr.com subdomains (https://factorial.com/pricing)" ], "area": "business", "details": [ { "label": "Surface graded", "value": "The public REST API at `https://api.factorialhr.com/api/2026-10-01/resources/...`. The hosted MCP server is described but its tool definitions sit behind an OAuth login and were not read" }, { "label": "API coverage", "value": "615 operations in 38 groups. The largest are performance (56), project management (52), ATS (45), time off (43), finance (42), contracts (41), attendance (34) and trainings (34). Employees has 8, including create with contract, invite, terminate and unterminate" }, { "label": "Credentials", "value": "API key in `x-api-key`, company-wide, all scopes, no expiry, revocable in settings. OAuth 2.0 authorisation code (PKCE for public clients) through Factorial ID at `id.factorialhr.com`, with company tokens and user tokens that last 1 hour and renew by refresh token" }, { "label": "Scopes", "value": "33 OAuth scopes in the definition, with `read` and `write` plus areas such as `employees`, `time_off`, `time_tracking`, `documents`, `payroll`, `recruitment` and `tasks`. A user token is further limited by the employee's permission group, and fields outside it come back as null" }, { "label": "MCP server", "value": "`https://mcp.factorialhr.com`, Streamable HTTP, OAuth 2.0 with dynamic client registration. Its metadata lists 10 scopes (`one:read`, `one:write`, `employees`, `tasks`, `time_off`, `time_tracking` and four more). Factorial One requests consume plan credits, direct tools currently do not" }, { "label": "Rate limits", "value": "200 `POST` requests a minute per the FAQ. No limit for other methods and no `Retry-After` header found in the reviewed documentation. Suggested backoff is 2, 4, 8 then 16 seconds" }, { "label": "Errors", "value": "400, 401, 403, 404, 422, 429 and 5xx explained in the FAQ. Some 422 responses carry a machine-readable `code`, and messages may be in Spanish, French or German. The OpenAPI definition documents only 200 and 201 responses. An unauthenticated call returned 401 with `{\"errors\":null}`" }, { "label": "Pagination", "value": "Cursor-based on every list endpoint, 100 records by default and at most, with `after_id` and `before_id` and a `meta` block holding `has_next_page`, `end_cursor` and `total`" }, { "label": "Webhooks", "value": "137 event types, managed through `/api_public/webhook_subscriptions`. The payload is the resource itself with no envelope or delivery ID. A `challenge` secret is echoed in `x-factorial-wh-challenge`. Up to 20 attempts over 48 hours, then the subscription is disabled" }, { "label": "Time off", "value": "Create, update and delete leaves, approve, approve all and reject, plus leave types, allowances, policies and blocked periods" }, { "label": "Versioning", "value": "Dated versions in the path (2026-10-01 current, released 5 October 2026, with 2027-01-01 as release candidate). One version a quarter, each supported for one year. Webhook subscriptions carry their own `api_version`" }, { "label": "SDKs", "value": "`@factorialco/api-client` 3.0.0 on npm and `factorial-api-client` 3.0.0 on PyPI (both 5 October 2026, MIT, Python 3.11 or later), a Ruby SDK in the same repository, and a `factorial-api-sdks` skill installed with `npx skills add`. The SDK major version tracks the API version" }, { "label": "Sandbox", "value": "A demo environment at `api.eu2.demo.factorial.dev` with separate credentials, requested through an account manager or account executive. Its data can be deleted at any time" }, { "label": "SLA", "value": "99.9 per cent monthly uptime, with a service credit of 5 per cent of the period's charges when missed, per the trust centre. Support target of 90 per cent of tickets answered within 4 hours" }, { "label": "Certifications", "value": "SOC 2 Type 2, SOC 3, ISO/IEC 27001:2022 and ENS RD311/2022 High per trust.factorial.co. The trust centre names a HackerOne bug bounty and annual third-party penetration tests" }, { "label": "Status", "value": "status.factorialhr.com on Statuspage, 14 components including API \u0026 backend and Authentication system. The newest incident in the feed is dated 1 June 2026" }, { "label": "Data location", "value": "Customer data stored in the EU on AWS (Frankfurt) and Azure (Frankfurt and Sweden). AI functions use Azure OpenAI, Gemini and Cloudflare AI under contracts that bar training on customer data, per the trust centre" } ], "unitPrices": [ { "item": "Starting price", "unit": "seat-month", "usd": 8, "note": "Headline figure on the pricing page. Plans are quoted by modules and company size" } ], "provenance": { "legalEntity": "Everyday Software, S.L.", "domain": "factorialhr.com", "domainRegistered": "2016-11-10", "endpointOnVendorDomain": true, "terms": "https://factorial.com/terms-of-use", "privacy": "https://factorial.com/privacy", "statusPage": "https://status.factorialhr.com", "changelog": "https://apidoc.factorialhr.com/changelog", "securityTxt": "none", "checked": "2026-10-08", "notes": [ "The terms and conditions of contract of the Factorial platform (last amended 12 December 2025) name EVERYDAY SOFTWARE, S.L., Carrer de Llacuna 56, Building C, 08005 Barcelona, tax number B-66854530, and its subsidiaries. They govern the platform and mention the public API in clause 13.8. No separate API terms were found.", "The privacy policy (last update January 2026) names the same company as controller and describes its role as processor for data that customers' employees enter on the platform. It refers to a Data Processing Agreement that we did not read.", "The API answers at api.factorialhr.com, OAuth at id.factorialhr.com and the MCP server at mcp.factorialhr.com. The marketing site factorialhr.com redirects to factorial.com.", "RDAP gives 2016-11-10 as the registration date of factorialhr.com and 1998-04-24 for factorial.com.", "factorialhr.com/.well-known/security.txt and factorial.com/.well-known/security.txt both returned 404. The trust centre has a vulnerability report form and names a HackerOne programme.", "The SLA linked from clause 11.2 of the terms resolves to the trust centre at trust.factorial.co." ], "score": 82, "checks": [ { "check": "Legal entity named", "value": "Everyday Software, S.L.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "factorialhr.com, registered 2016-11-10 (9 years)", "points": 11, "max": 15, "state": "part" }, { "check": "Endpoint on the vendor's domain", "value": "api.factorialhr.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 5 of the 7 things a reader expects, and has 1 clause that costs points", "points": 6.3, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 7 of the 8 things a reader expects", "points": 9.3, "max": 10, "state": "part" }, { "check": "Status page", "value": "status.factorialhr.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "https://factorial.com/terms-of-use", "state": "read", "readAt": "2026-10-08", "words": 12638, "points": 6.3, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": false }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "FACTORIAL GmbH (Germany), registered with the commercial register of the local court of Munich with registered office at Ganghoferstr.", "says": "Disputes go to the courts of Munich" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "…SERVICES, FACTORIAL’S MAXIMUM AGGREGATE LIABILITY, ALSO AS A RESULT OF MULTIPLE HARMFUL EVENTS, SHALL NOT EXCEED AN AMOUNT EQUAL TO THE TOTAL AMOUNT PAID BY THE CUSTOMER TO FACTORIAL IN THE TWELVE (12) MONTHS PRIOR TO THE HARMFUL EVENT (OR IF LESS THAN TWELVE (12) MONTHS HAVE PASSED SINCE THE EFFECTIVENESS OF THESE TE…", "says": "Capped at the fees paid in the 12 months before the claim" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "…if the Customer does not pay the owed invoices within a period of thirty (30) calendar days, Factorial may also, at its sole discretion, suspend and/or block the Customer’s access to the Services and the Platform and/or terminate the relationship entirely or partially, without any liability and without prejudice to it…" }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": false }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "5.4 You may not access the Services if you are (or intend to be) a competitor (direct or indirect) of Factorial, except with Factorial prior written consent after disclosing your competing position." }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": true, "quote": "This time frame is not attributable to the Service Level Agreement." } ], "toKnow": [ { "key": "terms.benchmark", "label": "Restricts benchmarking or competitive use", "found": true, "quote": "…or any other means to obtain the source code, transformation or publication of any unauthorised benchmark test results of any of the elements and utilities integrated within the Platform are prohibited and constitute an infringement of Factorial’s Industrial and Intellectual Property rights and, consequently, agrees n…", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "may result in the immediate adoption by Factorial of any other actions that might correspond to them, possibly leading to the termination of the Licence or any other right granted to the Customer or User, without prior notice" } ], "notes": [ { "date": "2026-10-08", "text": "Factorial accepts no liability for decisions, approvals, payments or actions taken on the basis of AI outputs, including incorrect or incomplete outputs.", "quote": "Factorial is not responsible or liable for any decisions, approvals, payments, or actions you (or your Users) take (or fail to take) based on Outputs, including any incorrect, incomplete, or inappropriate Output." }, { "date": "2026-10-08", "text": "Subscriptions renew automatically for periods identical to the plan contracted.", "quote": "The duration of the subscription is determined by the type of Plan contracted (or conditions agreed upon), and is automatically renewed for identical periods." }, { "date": "2026-10-08", "text": "Factorial is not liable for a detrimental event unless the customer notifies the claim in writing within 20 calendar days of becoming aware of it.", "quote": "In addition, Factorial will not be liable to the Customer for any detrimental event unless the Customer has notified their claim in writing to Factorial, within a period of twenty (20) calendar days from the date on which the Customer became aware of it." } ] }, { "kind": "privacy", "url": "https://factorial.com/privacy", "state": "read", "readAt": "2026-10-08", "statedDate": "2026-01-01", "words": 10557, "points": 9.3, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last update: January 2026.", "says": "Last updated 2026-01-01" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "In general, in order to provide our various services we collect the following personal data:" }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "If you have given us your consent, we will retain your data until you revoke your consent." }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "When third-party integrations, service providers, or external applications are used through the Marketplace operated by Factorial, these integration providers act as independent data controllers and/or independent data processors, depending on the type of application and their relationship with you or your employer." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": false }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "We want to emphasize that in relation to these purposes you will have the right to withdraw your consent at any time." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "What is the information of the Data Controller and the Data Protection Officer?", "says": "Names a data protection officer" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "W In this case, will transfer your data on the basis of the standard contractual clauses in force.", "says": "Relies on standard contractual clauses" } ], "toKnow": [ { "key": "privacy.sells", "label": "Says it sells personal data or shares it for advertising", "found": true, "quote": "In addition to email, Factorial will communicate with you for advertising purposes through various online channels, in particular social media or third-party platforms (e.g. social networks such as Instagram, Linkedin, WhatsApp, etc. and through methods as custom and/or lookalike audiences)." } ], "notes": [ { "date": "2026-10-08", "text": "Factorial uses data about client organisations and their contacts to train and improve the predictive models behind its customer scoring.", "quote": "In order to improve the predictive models or patterns mentioned above, we incorporate the aforementioned data for the purpose of training and improving them." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/factorial.json", "live": { "slug": "factorial", "probe": { "target": "https://api.factorialhr.com", "method": "get", "lastAt": "2026-10-08T21:12:10.156668384Z", "lastOk": true, "lastStatus": 404, "lastMs": 93, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 83, "p95ms24h": 165, "samples24h": 21, "samples30d": 21, "days": [ { "date": "2026-10-08", "probes": 21, "ok": 21 } ] }, "vendorStatus": { "page": "https://status.factorialhr.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-08T21:06:04.681965883Z" }, "updatedAt": "2026-10-08T21:12:10.156668384Z" } } }