HiBob vs Humaans

HiBob

Service users start with no permissions and gain view or edit rights per field, and the docs are served as Markdown with an OpenAPI definition on each endpoint page. There is no public price, trial or free sandbox, so an agent needs a paying customer's admin to issue credentials. No idempotency keys or official SDKs were found.

Humaans

API tokens are limited by eight scopes and the creator's role, can expire and can be rotated with a seven-day overlap, and rate limits are published with Retry-After on 429. No OpenAPI file, API changelog, official SDK or idempotency keys were found, and prices are by quote, so an agent needs a paying customer's token.

HiBob

1. Send Authorization: Basic base64(SERVICE-USER-ID:TOKEN) to https://api.hibob.com/v1. Ask the Bob admin to put the service user in a permission group first, because it starts with none
2. Request only the fields needed in fields on POST /people/search (maximum 400). The call returns all matching employees at once, so batch by root.id in large companies
3. Compare returned fields with requested ones. Missing permission or a wrong field ID yields 200 with the field omitted
4. Stop on 401 or 403. More than 50 in 10 seconds blocks the IP for 5 minutes
5. Back off on 429 using Retry-After. Writes such as update, create and terminate employee allow 10 calls a minute, and no idempotency key exists, so check state before retrying a write

Humaans

1. Send Authorization: Bearer <token> to https://app.humaans.io/api. Call GET /api/token-info first to read the token's scopes and expiry
2. Expect a role limit as well as scopes. A token made by a user with the User role reads only public company data and that person's own profile
3. Page with $limit (maximum 250) and $skip, and pass -g to curl because parameters use $ and []
4. On 429 wait the seconds in Retry-After. The bucket holds 40 requests and refills at 7 a second per token
5. Check state before retrying a POST. No idempotency key exists, and DELETE /api/people/:id cannot be undone