Remote vs Zoho People

Remote

The REST API has 303 operations in a public OpenAPI document, 78 OAuth scopes split into read and write, a sandbox issued by email with no card, and a hosted MCP server using OAuth with PKCE. The REST changelog link redirects to a login page, and writes have no idempotency key.

Zoho People

The REST API covers employee forms, leave, attendance, timesheets, files and learning, with per-endpoint rate limits and Markdown docs listed in an llms.txt. No OpenAPI spec, official SDK or dated API changelog was found, the Free plan has no API access, and several scopes come only as ALL.

Remote

1. Match the token prefix to the host. ra_test_ works only on https://gateway.remote-sandbox.com and ra_live_ only on https://gateway.remote.com
2. Stay under 300 requests a minute per company for customer tokens, shared by every token, and read x-ratelimit-remaining and x-ratelimit-reset (milliseconds)
3. Check for an existing record before retrying a create, or set external_id on employments and treat a 422 for a duplicate as success
4. Fetch the country form schema (GET /v1/countries/{country_code}/{form}) before writing employment data. Country codes are three-letter ISO
5. Use the REST API for unattended work. The MCP server needs a browser sign-in and its write tools cover employee self-service only

Zoho People

1. Use the accounts host and API host of the organisation's data centre. Tokens issued in one region fail in another
2. Stay under each page's threshold, often 30 calls a minute. Exceeding it locks that endpoint for five minutes
3. Page form records with sIndex and limit, at most 200 a call, and use modifiedtime to fetch only changes
4. Look up form and field label names with /api/forms before writing. inputData takes label names, and lookup fields take record IDs
5. Send the refresh token and client secret in the POST body, not the query string, and store the refresh token, which never expires