BambooHR vs Zoho People

BambooHR

The REST API publishes an OpenAPI 3.1 spec with 389 operations, llms.txt and OAuth scopes with separate write variants, and every call runs with the authorising user's permissions. No rate limit numbers are published, the MCP server is in beta, and its results can omit records without saying so.

Zoho People

The REST API covers employee forms, leave, attendance, timesheets, files and learning, with per-endpoint rate limits and Markdown docs listed in an llms.txt. No OpenAPI spec, official SDK or dated API changelog was found, the Free plan has no API access, and several scopes come only as ALL.

BambooHR

1. Treat a short or empty result as what this caller may see. list_employees drops employees when a filter or sort field is restricted
2. Honour Retry-After on 429. Rate-limited calls returned 503 before 16 September 2026, so handle both
3. Ask for read scopes only unless the task writes. Write access needs the matching .write scope
4. Request offline_access to receive a refresh token. Access tokens last one hour
5. Use list-employees with fields, filter and cursor paging in place of the unpaginated directory endpoint

Zoho People

1. Use the accounts host and API host of the organisation's data centre. Tokens issued in one region fail in another
2. Stay under each page's threshold, often 30 calls a minute. Exceeding it locks that endpoint for five minutes
3. Page form records with sIndex and limit, at most 200 a call, and use modifiedtime to fetch only changes
4. Look up form and field label names with /api/forms before writing. inputData takes label names, and lookup fields take record IDs
5. Send the refresh token and client secret in the POST body, not the query string, and store the refresh token, which never expires