BambooHR vs Humaans

BambooHR

The REST API publishes an OpenAPI 3.1 spec with 389 operations, llms.txt and OAuth scopes with separate write variants, and every call runs with the authorising user's permissions. No rate limit numbers are published, the MCP server is in beta, and its results can omit records without saying so.

Humaans

API tokens are limited by eight scopes and the creator's role, can expire and can be rotated with a seven-day overlap, and rate limits are published with Retry-After on 429. No OpenAPI file, API changelog, official SDK or idempotency keys were found, and prices are by quote, so an agent needs a paying customer's token.

BambooHR

1. Treat a short or empty result as what this caller may see. list_employees drops employees when a filter or sort field is restricted
2. Honour Retry-After on 429. Rate-limited calls returned 503 before 16 September 2026, so handle both
3. Ask for read scopes only unless the task writes. Write access needs the matching .write scope
4. Request offline_access to receive a refresh token. Access tokens last one hour
5. Use list-employees with fields, filter and cursor paging in place of the unpaginated directory endpoint

Humaans

1. Send Authorization: Bearer <token> to https://app.humaans.io/api. Call GET /api/token-info first to read the token's scopes and expiry
2. Expect a role limit as well as scopes. A token made by a user with the User role reads only public company data and that person's own profile
3. Page with $limit (maximum 250) and $skip, and pass -g to curl because parameters use $ and []
4. On 429 wait the seconds in Retry-After. The bucket holds 40 requests and refills at 7 a second per token
5. Check state before retrying a POST. No idempotency key exists, and DELETE /api/people/:id cannot be undone