HiBob vs Rippling

HiBob

Service users start with no permissions and gain view or edit rights per field, and the docs are served as Markdown with an OpenAPI definition on each endpoint page. There is no public price, trial or free sandbox, so an agent needs a paying customer's admin to issue credentials. No idempotency keys or official SDKs were found.

Rippling

API tokens carry any of 162 scopes and can never see more than their owner, and hires and worker changes land as drafts for a person to review. There is no public price, trial or self-serve signup, and status.rippling.com shows five incidents marked critical between 16 July and 29 September 2026.

HiBob

1. Send Authorization: Basic base64(SERVICE-USER-ID:TOKEN) to https://api.hibob.com/v1. Ask the Bob admin to put the service user in a permission group first, because it starts with none
2. Request only the fields needed in fields on POST /people/search (maximum 400). The call returns all matching employees at once, so batch by root.id in large companies
3. Compare returned fields with requested ones. Missing permission or a wrong field ID yields 200 with the field omitted
4. Stop on 401 or 403. More than 50 in 10 seconds blocks the IP for 5 minutes
5. Back off on 429 using Retry-After. Writes such as update, create and terminate employee allow 10 calls a minute, and no idempotency key exists, so check state before retrying a write

Rippling

1. Call https://rest.ripplingapis.com with a Bearer token and pin Rippling-Api-Version. Use V1 at api.rippling.com only for resources that exist nowhere else
2. Treat a null field as possibly hidden. Check __meta.redacted_fields, the token's scopes and whether expand was sent
3. Follow next_link until it is null. The default page is 50 records and a limit above 100 returns 400
4. Stay under 300 requests per IP in any 10 seconds. Going over rejects every request for the next 10 seconds
5. Send an Idempotency-Key on POST /hires/ and POST /draft-transitions/, then poll the request until it reaches a final status