Humaans vs Zoho People

Humaans

API tokens are limited by eight scopes and the creator's role, can expire and can be rotated with a seven-day overlap, and rate limits are published with Retry-After on 429. No OpenAPI file, API changelog, official SDK or idempotency keys were found, and prices are by quote, so an agent needs a paying customer's token.

Zoho People

The REST API covers employee forms, leave, attendance, timesheets, files and learning, with per-endpoint rate limits and Markdown docs listed in an llms.txt. No OpenAPI spec, official SDK or dated API changelog was found, the Free plan has no API access, and several scopes come only as ALL.

Humaans

1. Send Authorization: Bearer <token> to https://app.humaans.io/api. Call GET /api/token-info first to read the token's scopes and expiry
2. Expect a role limit as well as scopes. A token made by a user with the User role reads only public company data and that person's own profile
3. Page with $limit (maximum 250) and $skip, and pass -g to curl because parameters use $ and []
4. On 429 wait the seconds in Retry-After. The bucket holds 40 requests and refills at 7 a second per token
5. Check state before retrying a POST. No idempotency key exists, and DELETE /api/people/:id cannot be undone

Zoho People

1. Use the accounts host and API host of the organisation's data centre. Tokens issued in one region fail in another
2. Stay under each page's threshold, often 30 calls a minute. Exceeding it locks that endpoint for five minutes
3. Page form records with sIndex and limit, at most 200 a call, and use modifiedtime to fetch only changes
4. Look up form and field label names with /api/forms before writing. inputData takes label names, and lookup fields take record IDs
5. Send the refresh token and client secret in the POST body, not the query string, and store the refresh token, which never expires