{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "rippling", "name": "Rippling", "vendor": "People Center, Inc. dba Rippling", "vendorUrl": "https://www.rippling.com", "kind": "http-api", "category": "hr", "summary": "Rippling is a workforce platform for HR, payroll, IT and spend. Its REST Platform API v2 reads and writes worker, time off and organisation data with scoped Bearer tokens. A first-party MCP server runs as the signed-in employee.", "url": "https://www.anchorterminal.com/tools/rippling", "markdownUrl": "https://www.anchorterminal.com/tools/rippling.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/rippling.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/rippling.json", "license": "Proprietary service under Rippling's customer terms and Developer Terms of Use. The JavaScript SDK on npm is Apache-2.0", "transports": [ "http" ], "remoteUrl": "https://rest.ripplingapis.com", "packages": [ { "registry": "npm", "name": "@rippling/rippling-sdk" } ], "auth": "mixed", "authNotes": "A Rippling customer creates API tokens in Tools \u003e Developer \u003e API Tokens and sends them as `Authorization: Bearer` to https://rest.ripplingapis.com. A token's access is the overlap of its chosen scopes (162 listed, most split into read and read-write) and its owner's permission profile. It is shown once, can't change owner, and is revoked when the owner is terminated or after 30 days unused. App Shop partners must use OAuth 2.0 (authorisation code with refresh, one token per customer company) and get a partner account only after applying and being approved. The Rippling MCP signs in as the employee, after an admin assigns tools in MCP Gateway.", "pricing": "paid", "pricingNotes": "No public prices. rippling.com/pricing says most products are billed per employee per month and asks for a quote, with no free tier or trial found. Reference pages name the package an endpoint needs, such as API Tier 1, with no price shown. Partners pay nothing to use the API or list in the App Shop, but must apply, and their customers need the Identity \u0026 Access Management package. Approved partners get a test company, and the API can create sandboxes. Rippling MCP tool calls need a Rippling AI trial or subscription (checked 2026-10-07).", "priceSummary": "Paid", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in llms.txt, the REST API essentials pages or the pricing page (checked 2026-10-07).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 3633, "pypiWeekly": null, "asOf": "2026-10-07" }, "docsUrl": "https://developer.rippling.com/documentation/rest-api", "llmsTxt": "https://developer.rippling.com/llms.txt", "capabilities": [ "hr.employees", "hr.time-off", "hr.org", "hr.onboarding", "hr.documents", "recruiting.candidates" ], "tags": [ "hosted", "enterprise", "api-key", "oauth", "mcp", "llms-txt", "typescript", "webhooks", "sales-led", "status-page", "soc2", "iso27001" ], "lastRelease": "2026-10-07", "graded": true, "anchor": { "graded": true, "score": 60.8, "grade": "C", "agentReady": false, "rank": 386, "ranked": true, "rankOf": 722, "categoryRank": 4, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 75, "maintenance": 74, "payments": 5, "reliability": 62, "schema": 73, "security": 90, "transparency": 51 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 62, "points": 12.4, "reason": "Read with the hosted lines and scored on the REST Platform API v2, the surface an outside agent calls with a token. status.rippling.com on Atlassian Statuspage lists components among them Rippling App and Platform API, with incident history (20). Fourteen incidents between 9 July and 7 October 2026, five marked critical and three major. The app was down on 27 July (twice, about 21 and 14 minutes before access returned), intermittently on 18 September (about an hour) and on 29 September (about 31 minutes, an overloaded authentication database). REST API latency on 10 September lasted about three hours and caused timeouts in Functions. The Rippling MCP was down for 34 minutes on 17 September. None tags the Platform API component, so this is read as short of several API majors (5). Limits with numbers, 300 requests per IP per 10 seconds, page size 100, 64 filter nodes (15). The docs ask for exponential backoff or Retry-After logic on 429 and give a retry column per status. `Idempotency-Key` appears on hires, draft transitions and time entries only (12 of 15). No SLA found, and the customer terms were unreadable (0). The v2 API carries no beta label (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 73, "points": 11.86, "reason": "The reference is generated from an OpenAPI document and shows a JSON Schema tab per operation, but we found no downloadable spec, and the typed SDK on npm is the only public machine-readable contract (12 of 25). llms.txt lists the docs with guidance written for models, though it says Markdown twins aren't published and pages render only with JavaScript (10). Endpoint descriptions are short, with filterable, expandable and sortable fields and the required package listed, and llms.txt says when to use v2, V1, the MCP or Functions (13 of 20). Enums on status and type fields and typed bodies. `filter` is a string expression (12 of 15). Curl examples in every guide and a status table. The documented 401 example differs from the body the API returned to us, `{\"ok\": false, \"error\": ...}` (11 of 15). Dated versions through `Rippling-Api-Version` and a changelog of 141 entries (15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 75, "points": 12.19, "reason": "Related objects come back null until asked for with `expand`, and `limit` sizes a page. No field selection (20 of 25). Cursor pagination through `next_link`, `filter` with nine operators, `order_by` (20). A status table with retry advice, `__meta.redacted_fields` naming hidden fields and `x-rippling-request-id` on responses, though the example error bodies are generic (14 of 20). `Idempotency-Key` on hires, draft transitions and time entries, and the SDK retries twice by default. No general idempotency rule for writes, and MCP annotations weren't visible (12 of 20). List calls need no parameters. One official SDK, JavaScript, still alpha (9 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 90, "points": 15.75, "reason": "API tokens with 162 listed scopes, most split into read and read-write, limited to the owner's permission profile, shown once, revocable, and revoked after 30 days unused or when the owner leaves. OAuth 2.0 with scopes for partners. All in the `Authorization` header (30). Read-only scopes, admin-only token oversight, hires and worker changes created as drafts for review, leave requests through the normal approval flow, and MCP deletes that need confirmation (19 of 20). The MCP runs model-written code in a sandbox with no network egress and credentials kept outside it, and withholds SSNs, home addresses and tax IDs. No guidance on untrusted text in records (9 of 15). An activity log endpoint with 90 days of events, an email on token creation and MCP Gateway audit logs. A per-token call log wasn't found (14 of 15). SOC 1 and SOC 2 Type II, SOC 3, ISO 27001, 27018 and 42001, CSA STAR Level 2, and a vulnerability reporting programme with bounties. No security.txt (18 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 5, "points": 0.63, "reason": "Read with the hosted rubric. No x402, MPP or L402 (0). rippling.com/pricing says products are billed per employee per month and asks for a quote, with no figures (0). No free tier or trial found for customers. Approved App Shop partners use the API and a test company at no cost, which needs an application, so partial credit (5 of 20). A person creates each token in the Developer app or completes an OAuth install (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 74, "points": 6.48, "reason": "The changelog's latest entry is 28 September 2026 and the SDK's latest version 7 October 2026 (30). 46 changelog entries on 16 dates since 9 July, and 39 SDK versions (20). Closed service with a dated changelog, a partner support address and a service desk for applications. No public issue tracker (10 of 15). One official SDK, current but alpha, and no entry for Rippling's own MCP server in the official registry (9 of 15). The SDK has no runtime dependencies. Its repository is private, so CI isn't visible (5 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 51, "points": 4.46, "note": "editorial 33, provenance 69", "reason": "Closed service. Customer terms, user terms, AI Services Terms and Developer Terms of Use are published at stable URLs, which returned only a JavaScript application to our reader. The SDK is Apache-2.0 (13 of 30). The privacy and compliance page says Rippling processes customer data only as instructed and links a privacy notice and a DPA, both unread for the same reason. The docs state 90 days of activity log retention and the fields the MCP withholds (12 of 30). Versions are dated and V1 is labelled an archive, but breaking changes are logged on the day with no notice period shown and no removal dates (8 of 20). No sub-processor list or hosting locations found on the security, privacy and compliance or legal index pages (0)." } ], "assessment": { "date": "2026-10-07", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Related objects come back null until asked for with `expand`, and `limit` sizes a page. No field selection (20 of 25). Cursor pagination through `next_link`, `filter` with nine operators, `order_by` (20). A status table with retry advice, `__meta.redacted_fields` naming hidden fields and `x-rippling-request-id` on responses, though the example error bodies are generic (14 of 20). `Idempotency-Key` on hires, draft transitions and time entries, and the SDK retries twice by default. No general idempotency rule for writes, and MCP annotations weren't visible (12 of 20). List calls need no parameters. One official SDK, JavaScript, still alpha (9 of 15).", "maintenance": "The changelog's latest entry is 28 September 2026 and the SDK's latest version 7 October 2026 (30). 46 changelog entries on 16 dates since 9 July, and 39 SDK versions (20). Closed service with a dated changelog, a partner support address and a service desk for applications. No public issue tracker (10 of 15). One official SDK, current but alpha, and no entry for Rippling's own MCP server in the official registry (9 of 15). The SDK has no runtime dependencies. Its repository is private, so CI isn't visible (5 of 10).", "payments": "Read with the hosted rubric. No x402, MPP or L402 (0). rippling.com/pricing says products are billed per employee per month and asks for a quote, with no figures (0). No free tier or trial found for customers. Approved App Shop partners use the API and a test company at no cost, which needs an application, so partial credit (5 of 20). A person creates each token in the Developer app or completes an OAuth install (0).", "reliability": "Read with the hosted lines and scored on the REST Platform API v2, the surface an outside agent calls with a token. status.rippling.com on Atlassian Statuspage lists components among them Rippling App and Platform API, with incident history (20). Fourteen incidents between 9 July and 7 October 2026, five marked critical and three major. The app was down on 27 July (twice, about 21 and 14 minutes before access returned), intermittently on 18 September (about an hour) and on 29 September (about 31 minutes, an overloaded authentication database). REST API latency on 10 September lasted about three hours and caused timeouts in Functions. The Rippling MCP was down for 34 minutes on 17 September. None tags the Platform API component, so this is read as short of several API majors (5). Limits with numbers, 300 requests per IP per 10 seconds, page size 100, 64 filter nodes (15). The docs ask for exponential backoff or Retry-After logic on 429 and give a retry column per status. `Idempotency-Key` appears on hires, draft transitions and time entries only (12 of 15). No SLA found, and the customer terms were unreadable (0). The v2 API carries no beta label (10).", "schema": "The reference is generated from an OpenAPI document and shows a JSON Schema tab per operation, but we found no downloadable spec, and the typed SDK on npm is the only public machine-readable contract (12 of 25). llms.txt lists the docs with guidance written for models, though it says Markdown twins aren't published and pages render only with JavaScript (10). Endpoint descriptions are short, with filterable, expandable and sortable fields and the required package listed, and llms.txt says when to use v2, V1, the MCP or Functions (13 of 20). Enums on status and type fields and typed bodies. `filter` is a string expression (12 of 15). Curl examples in every guide and a status table. The documented 401 example differs from the body the API returned to us, `{\"ok\": false, \"error\": ...}` (11 of 15). Dated versions through `Rippling-Api-Version` and a changelog of 141 entries (15).", "security": "API tokens with 162 listed scopes, most split into read and read-write, limited to the owner's permission profile, shown once, revocable, and revoked after 30 days unused or when the owner leaves. OAuth 2.0 with scopes for partners. All in the `Authorization` header (30). Read-only scopes, admin-only token oversight, hires and worker changes created as drafts for review, leave requests through the normal approval flow, and MCP deletes that need confirmation (19 of 20). The MCP runs model-written code in a sandbox with no network egress and credentials kept outside it, and withholds SSNs, home addresses and tax IDs. No guidance on untrusted text in records (9 of 15). An activity log endpoint with 90 days of events, an email on token creation and MCP Gateway audit logs. A per-token call log wasn't found (14 of 15). SOC 1 and SOC 2 Type II, SOC 3, ISO 27001, 27018 and 42001, CSA STAR Level 2, and a vulnerability reporting programme with bounties. No security.txt (18 of 20).", "transparency": "Closed service. Customer terms, user terms, AI Services Terms and Developer Terms of Use are published at stable URLs, which returned only a JavaScript application to our reader. The SDK is Apache-2.0 (13 of 30). The privacy and compliance page says Rippling processes customer data only as instructed and links a privacy notice and a DPA, both unread for the same reason. The docs state 90 days of activity log retention and the fields the MCP withholds (12 of 30). Versions are dated and V1 is labelled an archive, but breaking changes are logged on the day with no notice period shown and no removal dates (8 of 20). No sub-processor list or hosting locations found on the security, privacy and compliance or legal index pages (0)." }, "sources": [ { "what": "llms.txt, API surfaces and authentication paths", "url": "https://developer.rippling.com/llms.txt", "seen": "2026-10-07" }, { "what": "usage and rate limits", "url": "https://developer.rippling.com/documentation/rest-api/essentials/api-limits", "seen": "2026-10-07" }, { "what": "API tokens and permissions", "url": "https://developer.rippling.com/documentation/rest-api/essentials/api-tokens", "seen": "2026-10-07" }, { "what": "versioning", "url": "https://developer.rippling.com/documentation/rest-api/essentials/versioning", "seen": "2026-10-07" }, { "what": "pagination and query parameters", "url": "https://developer.rippling.com/documentation/rest-api/essentials/pagination", "seen": "2026-10-07" }, { "what": "errors and troubleshooting", "url": "https://developer.rippling.com/documentation/rest-api/essentials/troubleshooting", "seen": "2026-10-07" }, { "what": "changelog (141 entries, read from the site's data)", "url": "https://developer.rippling.com/documentation/rest-api/essentials/changelog", "seen": "2026-10-07" }, { "what": "API reference introduction, version and scopes", "url": "https://developer.rippling.com/documentation/rest-api/reference/rippling-platform-api", "seen": "2026-10-07" }, { "what": "draft transitions guide with Idempotency-Key", "url": "https://developer.rippling.com/documentation/rest-api/guides/schedule-worker-changes", "seen": "2026-10-07" }, { "what": "Rippling MCP overview, limits and sandbox", "url": "https://developer.rippling.com/documentation/rippling-platform/rippling-mcp/overview", "seen": "2026-10-07" }, { "what": "Rippling MCP tools", "url": "https://developer.rippling.com/documentation/rippling-platform/rippling-mcp/tools", "seen": "2026-10-07" }, { "what": "partner requirements, process and pricing", "url": "https://developer.rippling.com/documentation/developer-portal/getting-started/requirements", "seen": "2026-10-07" }, { "what": "App Shop webhooks", "url": "https://developer.rippling.com/documentation/developer-portal/v2-guides/webhooks", "seen": "2026-10-07" }, { "what": "sitemap, count of reference operations", "url": "https://developer.rippling.com/sitemap.xml", "seen": "2026-10-07" }, { "what": "status incidents feed", "url": "https://status.rippling.com/api/v2/incidents.json", "seen": "2026-10-07" }, { "what": "pricing page", "url": "https://www.rippling.com/pricing", "seen": "2026-10-07" }, { "what": "security page", "url": "https://www.rippling.com/security", "seen": "2026-10-07" }, { "what": "vulnerability reporting terms", "url": "https://www.rippling.com/vulnerability-reporting/terms", "seen": "2026-10-07" }, { "what": "privacy and compliance page", "url": "https://www.rippling.com/privacy-compliance", "seen": "2026-10-07" }, { "what": "SDK on npm", "url": "https://registry.npmjs.org/@rippling/rippling-sdk", "seen": "2026-10-07" }, { "what": "official MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0.1/servers?search=rippling", "seen": "2026-10-07" }, { "what": "unauthenticated call to the API (401 body and headers)", "url": "https://rest.ripplingapis.com/companies/", "seen": "2026-10-07" } ], "openQuestions": [ "unchecked: customer terms, privacy notice, DPA, AI Services Terms and Developer Terms of Use on app.rippling.com (JavaScript-only pages), so retention periods, any SLA, sub-processors and hosting locations are unconfirmed", "unchecked: whether the 14 changes labelled breaking were announced to customers before their changelog date, or applied only to tokens on a newer version than 2024-08-01", "unchecked: what API Tier 1 and the other named packages cost, and whether every customer plan includes API tokens", "unchecked: whether 429 responses carry a Retry-After header. The docs mention retry-after logic without naming the header", "Whether `Idempotency-Key` is accepted on writes beyond hires, draft transitions and time entries", "The docs give `npx @rippling/rippling-sdk-mcp` and `@rippling/ripdev`, but both names returned 404 from the npm registry on 7 October 2026", "The remote URL of the Rippling MCP isn't in the public docs. It is copied from the product, so tool annotations and schemas couldn't be read", "Whether rest.ripplingapis.com is registered to People Center, Inc. wasn't checked beyond the vendor's own docs naming it" ] }, "negative": -3, "negativeNotes": [ "2026-05-21 and 2026-06-17. The changelog labels 14 changes breaking since October 2025, among them `draft_hire_id` removed from POST /draft-hires/ responses on 21 May 2026 and `candidate_id` made required on GET /candidate-applications/ on 17 June 2026, while the reference still shows a single version, 2024-08-01. The versioning page says a breaking change requires a version update. Each change is documented on the day, so the smallest deduction applies (https://developer.rippling.com/documentation/rest-api/essentials/changelog)." ], "verdict": "API tokens carry any of 162 scopes and can never see more than their owner, and hires and worker changes land as drafts for a person to review. There is no public price, trial or self-serve signup, and status.rippling.com shows five incidents marked critical between 16 July and 29 September 2026.", "bestFor": "An agent working for a company already on Rippling that needs scoped reads of people, organisation and time off data, and writes that wait for human review.", "strengths": [ "API tokens are limited to chosen scopes (162 listed) and to the owner's permission profile, and are revoked after 30 days unused", "Hires and worker changes are created as drafts for review in Rippling, and leave requests follow the normal approval flow", "Dated changelog with 141 entries since 6 August 2025, 46 of them between 9 July and 28 September 2026, each labelled breaking or not", "llms.txt with integration guidance for agents, cursor pagination, filter, expand and order_by on list endpoints", "SOC 1 and SOC 2 Type II, ISO 27001, ISO 27018, ISO 42001 and CSA STAR Level 2 listed, with a paid vulnerability reporting programme" ], "weaknesses": [ "No public price, free tier or trial. rippling.com/pricing is a quote form, and endpoints name a paid package such as API Tier 1", "Five incidents marked critical and three marked major on status.rippling.com between 16 July and 29 September 2026", "The changelog labels 14 changes breaking since October 2025 while the reference still shows one version, 2024-08-01", "No downloadable OpenAPI file found, and the documentation site renders only with JavaScript", "One official SDK, JavaScript at 0.2.0-alpha.106, and the documented @rippling/rippling-sdk-mcp package returned 404 on npm" ], "agentNotes": [ "Call https://rest.ripplingapis.com with a Bearer token and pin `Rippling-Api-Version`. Use V1 at api.rippling.com only for resources that exist nowhere else", "Treat a null field as possibly hidden. Check `__meta.redacted_fields`, the token's scopes and whether `expand` was sent", "Follow `next_link` until it is null. The default page is 50 records and a `limit` above 100 returns 400", "Stay under 300 requests per IP in any 10 seconds. Going over rejects every request for the next 10 seconds", "Send an `Idempotency-Key` on POST /hires/ and POST /draft-transitions/, then poll the request until it reaches a final status" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 60.8 } ], "editorialScores": { "ergonomics": 75, "maintenance": 74, "payments": 5, "reliability": 62, "schema": 73, "security": 90, "transparency": 33 }, "provenanceScore": 69 }, "connect": { "install": "npm install @rippling/rippling-sdk", "http": "curl -X GET 'https://rest.ripplingapis.com/companies/' \\\n -H 'Accept: application/json' \\\n -H 'Authorization: Bearer YOUR_API_TOKEN'" }, "letme": { "capability": "https://letme.dev/hr.employees", "tool": "https://letme.dev/rippling" }, "notable": [ "The current public API is the REST Platform API v2 at https://rest.ripplingapis.com, versioned by date through the `Rippling-Api-Version` header. The V1 APIs at api.rippling.com are labelled an archive (https://developer.rippling.com/llms.txt)", "The sitemap lists about 350 v2 reference operations, among them workers, users, departments, teams, leave requests, leave balances, draft hires, hires, employee documents, custom objects and an activity log (https://developer.rippling.com/sitemap.xml)", "The Rippling MCP exposes one tool named code. The model writes JavaScript against 31 documented functions (ask_ai, people and org lookups, time off, create_draft_hire, custom objects) that runs in an isolated sandbox with no network egress (https://developer.rippling.com/documentation/rippling-platform/rippling-mcp/tools)", "The MCP never returns Social Security numbers, home addresses, personal email addresses or tax IDs, and each employee gets only the tools an admin assigns in MCP Gateway (https://developer.rippling.com/documentation/rippling-platform/rippling-mcp/overview)", "Partner requirements prohibit integrating through third-party integration services other than Merge and Finch, and forbid using a customer's API key on behalf of another organisation (https://developer.rippling.com/documentation/developer-portal/getting-started/requirements)", "App Shop webhooks are for partners only, arrive about five minutes after the event as form-encoded POSTs and cover employee, group, company and leave request events (https://developer.rippling.com/documentation/developer-portal/v2-guides/webhooks)" ], "area": "business", "details": [ { "label": "APIs", "value": "REST Platform API v2 at https://rest.ripplingapis.com (reference version 2024-08-01, about 350 operations). V1 Base, Employee, Company, Payroll, Reports, Time and Attendance and Recruiting APIs at api.rippling.com are legacy" }, { "label": "HR coverage", "value": "Read workers, users, compensations, departments, teams, titles, levels, work locations, legal entities, leave types, balances and requests. Write leave requests, departments, teams, work locations, employee documents, custom objects, draft hires, hires and draft transitions (proposed worker changes)" }, { "label": "Credentials", "value": "API tokens with 162 listed scopes for a customer's own use, limited to the owner's permission profile and revoked after 30 days unused. OAuth 2.0 authorisation code for App Shop partners. Employee sign-in for the Rippling MCP" }, { "label": "MCP server", "value": "First-party and remote, enabled per company and governed in MCP Gateway. One code tool over 31 functions, 10 of them writes. The server URL is copied from IT \u003e My IT \u003e MCP connectors. Needs a Rippling AI trial or subscription" }, { "label": "Rate limits", "value": "REST API 300 requests per IP per sliding 10 seconds, then every request is rejected for 10 seconds. MCP 50 calls per function per 60 seconds per user, 5 ask_ai starts a minute and 10 concurrent runs" }, { "label": "Pagination and queries", "value": "Cursor pagination through `next_link`, 50 records by default and 100 at most. `filter` with eq, ne, gt, gte, lt, lte, in, and, or (64 nodes at most), `expand` to two levels and ten fields, `order_by`" }, { "label": "Errors", "value": "Status table with a retry column for 400, 401, 403, 404, 409, 422, 429, 500 and 504. Responses carry `x-rippling-request-id`. Fields the token can't see are null and named in `__meta.redacted_fields`" }, { "label": "Idempotency", "value": "`Idempotency-Key` is required on POST /hires/ and shown on POST /draft-transitions/ and time entries. Not found as a general rule for writes" }, { "label": "SDK", "value": "@rippling/rippling-sdk 0.2.0-alpha.106 (7 October 2026), TypeScript, Apache-2.0, no runtime dependencies, two retries by default. The source repository is private" }, { "label": "Webhooks", "value": "App Shop partner webhooks only, with about five minutes' lag and an optional Bearer token. In-product webhooks trigger Rippling workflows" }, { "label": "Audit", "value": "Activity log endpoint with 90 days of events, filterable by time, event type, worker and source app. An email goes to the owner and admins when a token is created. MCP Gateway keeps audit logs" }, { "label": "Certifications", "value": "SOC 1 Type II, SOC 2 Type II, SOC 3, ISO 27001, ISO 27018, ISO 42001 and CSA STAR Level 2 per rippling.com/security. Vulnerability reporting programme with bounties at Rippling's discretion" }, { "label": "Status", "value": "status.rippling.com on Atlassian Statuspage, with components among them Rippling App, Platform API, Third-party integrations and Rippling AI" } ], "provenance": { "legalEntity": "People Center, Inc. dba Rippling", "domain": "rippling.com", "domainRegistered": "2002-02-25", "endpointOnVendorDomain": false, "terms": "https://app.rippling.com/legal", "privacy": "https://app.rippling.com/legal/privacy", "statusPage": "https://status.rippling.com", "changelog": "https://developer.rippling.com/documentation/rest-api/essentials/changelog", "securityTxt": "none", "checked": "2026-10-07", "notes": [ "The Vulnerability Reporting Terms and Conditions, last updated 21 August 2024, name People Center, Inc. dba Rippling and its affiliates.", "The v2 API answers at rest.ripplingapis.com, a separate domain from rippling.com that the vendor's llms.txt and quickstart name. V1 and the OAuth token exchange use api.rippling.com and app.rippling.com.", "www.rippling.com/.well-known/security.txt returns 404. Reports go through the form at rippling.com/vulnerability-reporting or to security@rippling.com.", "The terms, privacy notice, DPA and Developer Terms of Use sit on app.rippling.com, which returned only a JavaScript application to our reader, so their text is unread.", "RDAP for rippling.com gives a registration date of 2002-02-25." ], "score": 69, "checks": [ { "check": "Legal entity named", "value": "People Center, Inc. dba Rippling", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "rippling.com, registered 2002-02-25 (24 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "rest.ripplingapis.com is not on rippling.com", "points": 0, "max": 15, "state": "no" }, { "check": "Terms of service", "value": "published, but our reader couldn't read it", "points": 7, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "published, but our reader couldn't read it", "points": 7, "max": 10, "state": "part" }, { "check": "Status page", "value": "status.rippling.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "https://app.rippling.com/legal", "state": "unreadable", "reason": "the page has 15 words of text without a browser, so the document is drawn by script or sits elsewhere", "readAt": "2026-10-08", "points": 7, "max": 10 }, { "kind": "privacy", "url": "https://app.rippling.com/legal/privacy", "state": "unreadable", "reason": "the page has 15 words of text without a browser, so the document is drawn by script or sits elsewhere", "readAt": "2026-10-08", "points": 7, "max": 10 } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/rippling.json", "live": { "slug": "rippling", "probe": { "target": "https://rest.ripplingapis.com", "method": "get", "lastAt": "2026-10-08T19:53:00.79843741Z", "lastOk": true, "lastStatus": 404, "lastMs": 251, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 289, "p95ms24h": 718, "samples24h": 50, "samples30d": 50, "days": [ { "date": "2026-10-08", "probes": 50, "ok": 50 } ] }, "vendorStatus": { "page": "https://status.rippling.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-08T19:51:01.287637679Z" }, "versions": [ { "registry": "npm", "name": "@rippling/rippling-sdk", "version": "0.2.0-alpha.106", "seenAt": "2026-10-08T16:27:45.404049579Z" } ], "npmWeekly": 3633, "securityTxt": { "url": "https://rippling.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-10-08T15:38:49.166690021Z" }, "pages": [ { "url": "https://developer.rippling.com/documentation/rest-api/essentials/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-10-08T18:17:17.596835563Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "e3b0c44298fc" }, { "url": "https://app.rippling.com/legal/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-10-08T18:15:21.558708711Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "8a3694d85aaa" }, { "url": "https://app.rippling.com/legal", "kind": "terms", "status": 200, "checkedAt": "2026-10-08T18:15:19.356857643Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "8a3694d85aaa" } ], "updatedAt": "2026-10-08T19:53:00.79843741Z" } } }