{ "data": { "similar": [ { "grade": "B", "json": "https://www.anchorterminal.com/tools/deel.json", "name": "Deel", "score": 69.1, "shared": [ "hr.employees", "hr.time-off", "hr.org", "hr.onboarding", "hr.documents" ], "slug": "deel" }, { "grade": "C", "json": "https://www.anchorterminal.com/tools/bamboohr.json", "name": "BambooHR", "score": 61.7, "shared": [ "hr.employees", "hr.time-off", "hr.org", "hr.onboarding", "hr.documents" ], "slug": "bamboohr" }, { "grade": "C", "json": "https://www.anchorterminal.com/tools/hibob.json", "name": "HiBob", "score": 57, "shared": [ "hr.employees", "hr.time-off", "hr.org", "hr.onboarding", "hr.documents" ], "slug": "hibob" }, { "grade": "C", "json": "https://www.anchorterminal.com/tools/workable.json", "name": "Workable", "score": 61.7, "shared": [ "recruiting.candidates", "hr.employees", "hr.time-off", "hr.org" ], "slug": "workable" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/finch.json", "name": "Finch", "score": 71.6, "shared": [ "hr.employees", "hr.org", "hr.documents" ], "slug": "finch" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/gusto.json", "name": "Gusto", "score": 63.3, "shared": [ "hr.onboarding", "hr.time-off" ], "slug": "gusto" } ], "tool": { "slug": "rippling", "name": "Rippling", "vendor": "People Center, Inc. dba Rippling", "vendorUrl": "https://www.rippling.com", "kind": "http-api", "category": "hr", "summary": "Rippling is a workforce platform for HR, payroll, IT and spend. Its REST Platform API v2 reads and writes worker, time off and organisation data with scoped Bearer tokens. A first-party MCP server runs as the signed-in employee.", "url": "https://www.anchorterminal.com/tools/rippling", "markdownUrl": "https://www.anchorterminal.com/tools/rippling.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/rippling.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/rippling.json", "license": "Proprietary service under Rippling's customer terms and Developer Terms of Use. The JavaScript SDK on npm is Apache-2.0", "transports": [ "http" ], "remoteUrl": "https://rest.ripplingapis.com", "packages": [ { "registry": "npm", "name": "@rippling/rippling-sdk" } ], "auth": "mixed", "authNotes": "A Rippling customer creates API tokens in Tools \u003e Developer \u003e API Tokens and sends them as `Authorization: Bearer` to https://rest.ripplingapis.com. A token's access is the overlap of its chosen scopes (162 listed, most split into read and read-write) and its owner's permission profile. It is shown once, can't change owner, and is revoked when the owner is terminated or after 30 days unused. App Shop partners must use OAuth 2.0 (authorisation code with refresh, one token per customer company) and get a partner account only after applying and being approved. The Rippling MCP signs in as the employee, after an admin assigns tools in MCP Gateway.", "pricing": "paid", "pricingNotes": "No public prices. rippling.com/pricing says most products are billed per employee per month and asks for a quote, with no free tier or trial found. Reference pages name the package an endpoint needs, such as API Tier 1, with no price shown. Partners pay nothing to use the API or list in the App Shop, but must apply, and their customers need the Identity \u0026 Access Management package. Approved partners get a test company, and the API can create sandboxes. Rippling MCP tool calls need a Rippling AI trial or subscription (checked 2026-10-07).", "priceSummary": "Paid", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in llms.txt, the REST API essentials pages or the pricing page (checked 2026-10-07).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 3633, "pypiWeekly": null, "asOf": "2026-10-07" }, "docsUrl": "https://developer.rippling.com/documentation/rest-api", "llmsTxt": "https://developer.rippling.com/llms.txt", "capabilities": [ "hr.employees", "hr.time-off", "hr.org", "hr.onboarding", "hr.documents", "recruiting.candidates" ], "tags": [ "hosted", "enterprise", "api-key", "oauth", "mcp", "llms-txt", "typescript", "webhooks", "sales-led", "status-page", "soc2", "iso27001" ], "lastRelease": "2026-10-07", "graded": true, "anchor": { "graded": true, "score": 60.8, "grade": "C", "agentReady": false, "rank": 341, "ranked": true, "rankOf": 629, "categoryRank": 3, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 75, "maintenance": 74, "payments": 5, "reliability": 62, "schema": 73, "security": 90, "transparency": 51 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 62, "points": 12.4, "reason": "Read with the hosted lines and scored on the REST Platform API v2, the surface an outside agent calls with a token. status.rippling.com on Atlassian Statuspage lists components among them Rippling App and Platform API, with incident history (20). Fourteen incidents between 9 July and 7 October 2026, five marked critical and three major. The app was down on 27 July (twice, about 21 and 14 minutes before access returned), intermittently on 18 September (about an hour) and on 29 September (about 31 minutes, an overloaded authentication database). REST API latency on 10 September lasted about three hours and caused timeouts in Functions. The Rippling MCP was down for 34 minutes on 17 September. None tags the Platform API component, so this is read as short of several API majors (5). Limits with numbers, 300 requests per IP per 10 seconds, page size 100, 64 filter nodes (15). The docs ask for exponential backoff or Retry-After logic on 429 and give a retry column per status. `Idempotency-Key` appears on hires, draft transitions and time entries only (12 of 15). No SLA found, and the customer terms were unreadable (0). The v2 API carries no beta label (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 73, "points": 11.86, "reason": "The reference is generated from an OpenAPI document and shows a JSON Schema tab per operation, but we found no downloadable spec, and the typed SDK on npm is the only public machine-readable contract (12 of 25). llms.txt lists the docs with guidance written for models, though it says Markdown twins aren't published and pages render only with JavaScript (10). Endpoint descriptions are short, with filterable, expandable and sortable fields and the required package listed, and llms.txt says when to use v2, V1, the MCP or Functions (13 of 20). Enums on status and type fields and typed bodies. `filter` is a string expression (12 of 15). Curl examples in every guide and a status table. The documented 401 example differs from the body the API returned to us, `{\"ok\": false, \"error\": ...}` (11 of 15). Dated versions through `Rippling-Api-Version` and a changelog of 141 entries (15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 75, "points": 12.19, "reason": "Related objects come back null until asked for with `expand`, and `limit` sizes a page. No field selection (20 of 25). Cursor pagination through `next_link`, `filter` with nine operators, `order_by` (20). A status table with retry advice, `__meta.redacted_fields` naming hidden fields and `x-rippling-request-id` on responses, though the example error bodies are generic (14 of 20). `Idempotency-Key` on hires, draft transitions and time entries, and the SDK retries twice by default. No general idempotency rule for writes, and MCP annotations weren't visible (12 of 20). List calls need no parameters. One official SDK, JavaScript, still alpha (9 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 90, "points": 15.75, "reason": "API tokens with 162 listed scopes, most split into read and read-write, limited to the owner's permission profile, shown once, revocable, and revoked after 30 days unused or when the owner leaves. OAuth 2.0 with scopes for partners. All in the `Authorization` header (30). Read-only scopes, admin-only token oversight, hires and worker changes created as drafts for review, leave requests through the normal approval flow, and MCP deletes that need confirmation (19 of 20). The MCP runs model-written code in a sandbox with no network egress and credentials kept outside it, and withholds SSNs, home addresses and tax IDs. No guidance on untrusted text in records (9 of 15). An activity log endpoint with 90 days of events, an email on token creation and MCP Gateway audit logs. A per-token call log wasn't found (14 of 15). SOC 1 and SOC 2 Type II, SOC 3, ISO 27001, 27018 and 42001, CSA STAR Level 2, and a vulnerability reporting programme with bounties. No security.txt (18 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 5, "points": 0.63, "reason": "Read with the hosted rubric. No x402, MPP or L402 (0). rippling.com/pricing says products are billed per employee per month and asks for a quote, with no figures (0). No free tier or trial found for customers. Approved App Shop partners use the API and a test company at no cost, which needs an application, so partial credit (5 of 20). A person creates each token in the Developer app or completes an OAuth install (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 74, "points": 6.48, "reason": "The changelog's latest entry is 28 September 2026 and the SDK's latest version 7 October 2026 (30). 46 changelog entries on 16 dates since 9 July, and 39 SDK versions (20). Closed service with a dated changelog, a partner support address and a service desk for applications. No public issue tracker (10 of 15). One official SDK, current but alpha, and no entry for Rippling's own MCP server in the official registry (9 of 15). The SDK has no runtime dependencies. Its repository is private, so CI isn't visible (5 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 51, "points": 4.46, "note": "editorial 33, provenance 69", "reason": "Closed service. Customer terms, user terms, AI Services Terms and Developer Terms of Use are published at stable URLs, which returned only a JavaScript application to our reader. The SDK is Apache-2.0 (13 of 30). The privacy and compliance page says Rippling processes customer data only as instructed and links a privacy notice and a DPA, both unread for the same reason. The docs state 90 days of activity log retention and the fields the MCP withholds (12 of 30). Versions are dated and V1 is labelled an archive, but breaking changes are logged on the day with no notice period shown and no removal dates (8 of 20). No sub-processor list or hosting locations found on the security, privacy and compliance or legal index pages (0)." } ], "assessment": { "date": "2026-10-07", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Related objects come back null until asked for with `expand`, and `limit` sizes a page. No field selection (20 of 25). Cursor pagination through `next_link`, `filter` with nine operators, `order_by` (20). A status table with retry advice, `__meta.redacted_fields` naming hidden fields and `x-rippling-request-id` on responses, though the example error bodies are generic (14 of 20). `Idempotency-Key` on hires, draft transitions and time entries, and the SDK retries twice by default. No general idempotency rule for writes, and MCP annotations weren't visible (12 of 20). List calls need no parameters. One official SDK, JavaScript, still alpha (9 of 15).", "maintenance": "The changelog's latest entry is 28 September 2026 and the SDK's latest version 7 October 2026 (30). 46 changelog entries on 16 dates since 9 July, and 39 SDK versions (20). Closed service with a dated changelog, a partner support address and a service desk for applications. No public issue tracker (10 of 15). One official SDK, current but alpha, and no entry for Rippling's own MCP server in the official registry (9 of 15). The SDK has no runtime dependencies. Its repository is private, so CI isn't visible (5 of 10).", "payments": "Read with the hosted rubric. No x402, MPP or L402 (0). rippling.com/pricing says products are billed per employee per month and asks for a quote, with no figures (0). No free tier or trial found for customers. Approved App Shop partners use the API and a test company at no cost, which needs an application, so partial credit (5 of 20). A person creates each token in the Developer app or completes an OAuth install (0).", "reliability": "Read with the hosted lines and scored on the REST Platform API v2, the surface an outside agent calls with a token. status.rippling.com on Atlassian Statuspage lists components among them Rippling App and Platform API, with incident history (20). Fourteen incidents between 9 July and 7 October 2026, five marked critical and three major. The app was down on 27 July (twice, about 21 and 14 minutes before access returned), intermittently on 18 September (about an hour) and on 29 September (about 31 minutes, an overloaded authentication database). REST API latency on 10 September lasted about three hours and caused timeouts in Functions. The Rippling MCP was down for 34 minutes on 17 September. None tags the Platform API component, so this is read as short of several API majors (5). Limits with numbers, 300 requests per IP per 10 seconds, page size 100, 64 filter nodes (15). The docs ask for exponential backoff or Retry-After logic on 429 and give a retry column per status. `Idempotency-Key` appears on hires, draft transitions and time entries only (12 of 15). No SLA found, and the customer terms were unreadable (0). The v2 API carries no beta label (10).", "schema": "The reference is generated from an OpenAPI document and shows a JSON Schema tab per operation, but we found no downloadable spec, and the typed SDK on npm is the only public machine-readable contract (12 of 25). llms.txt lists the docs with guidance written for models, though it says Markdown twins aren't published and pages render only with JavaScript (10). Endpoint descriptions are short, with filterable, expandable and sortable fields and the required package listed, and llms.txt says when to use v2, V1, the MCP or Functions (13 of 20). Enums on status and type fields and typed bodies. `filter` is a string expression (12 of 15). Curl examples in every guide and a status table. The documented 401 example differs from the body the API returned to us, `{\"ok\": false, \"error\": ...}` (11 of 15). Dated versions through `Rippling-Api-Version` and a changelog of 141 entries (15).", "security": "API tokens with 162 listed scopes, most split into read and read-write, limited to the owner's permission profile, shown once, revocable, and revoked after 30 days unused or when the owner leaves. OAuth 2.0 with scopes for partners. All in the `Authorization` header (30). Read-only scopes, admin-only token oversight, hires and worker changes created as drafts for review, leave requests through the normal approval flow, and MCP deletes that need confirmation (19 of 20). The MCP runs model-written code in a sandbox with no network egress and credentials kept outside it, and withholds SSNs, home addresses and tax IDs. No guidance on untrusted text in records (9 of 15). An activity log endpoint with 90 days of events, an email on token creation and MCP Gateway audit logs. A per-token call log wasn't found (14 of 15). SOC 1 and SOC 2 Type II, SOC 3, ISO 27001, 27018 and 42001, CSA STAR Level 2, and a vulnerability reporting programme with bounties. No security.txt (18 of 20).", "transparency": "Closed service. Customer terms, user terms, AI Services Terms and Developer Terms of Use are published at stable URLs, which returned only a JavaScript application to our reader. The SDK is Apache-2.0 (13 of 30). The privacy and compliance page says Rippling processes customer data only as instructed and links a privacy notice and a DPA, both unread for the same reason. The docs state 90 days of activity log retention and the fields the MCP withholds (12 of 30). Versions are dated and V1 is labelled an archive, but breaking changes are logged on the day with no notice period shown and no removal dates (8 of 20). No sub-processor list or hosting locations found on the security, privacy and compliance or legal index pages (0)." }, "sources": [ { "what": "llms.txt, API surfaces and authentication paths", "url": "https://developer.rippling.com/llms.txt", "seen": "2026-10-07" }, { "what": "usage and rate limits", "url": "https://developer.rippling.com/documentation/rest-api/essentials/api-limits", "seen": "2026-10-07" }, { "what": "API tokens and permissions", "url": "https://developer.rippling.com/documentation/rest-api/essentials/api-tokens", "seen": "2026-10-07" }, { "what": "versioning", "url": "https://developer.rippling.com/documentation/rest-api/essentials/versioning", "seen": "2026-10-07" }, { "what": "pagination and query parameters", "url": "https://developer.rippling.com/documentation/rest-api/essentials/pagination", "seen": "2026-10-07" }, { "what": "errors and troubleshooting", "url": "https://developer.rippling.com/documentation/rest-api/essentials/troubleshooting", "seen": "2026-10-07" }, { "what": "changelog (141 entries, read from the site's data)", "url": "https://developer.rippling.com/documentation/rest-api/essentials/changelog", "seen": "2026-10-07" }, { "what": "API reference introduction, version and scopes", "url": "https://developer.rippling.com/documentation/rest-api/reference/rippling-platform-api", "seen": "2026-10-07" }, { "what": "draft transitions guide with Idempotency-Key", "url": "https://developer.rippling.com/documentation/rest-api/guides/schedule-worker-changes", "seen": "2026-10-07" }, { "what": "Rippling MCP overview, limits and sandbox", "url": "https://developer.rippling.com/documentation/rippling-platform/rippling-mcp/overview", "seen": "2026-10-07" }, { "what": "Rippling MCP tools", "url": "https://developer.rippling.com/documentation/rippling-platform/rippling-mcp/tools", "seen": "2026-10-07" }, { "what": "partner requirements, process and pricing", "url": "https://developer.rippling.com/documentation/developer-portal/getting-started/requirements", "seen": "2026-10-07" }, { "what": "App Shop webhooks", "url": "https://developer.rippling.com/documentation/developer-portal/v2-guides/webhooks", "seen": "2026-10-07" }, { "what": "sitemap, count of reference operations", "url": "https://developer.rippling.com/sitemap.xml", "seen": "2026-10-07" }, { "what": "status incidents feed", "url": "https://status.rippling.com/api/v2/incidents.json", "seen": "2026-10-07" }, { "what": "pricing page", "url": "https://www.rippling.com/pricing", "seen": "2026-10-07" }, { "what": "security page", "url": "https://www.rippling.com/security", "seen": "2026-10-07" }, { "what": "vulnerability reporting terms", "url": "https://www.rippling.com/vulnerability-reporting/terms", "seen": "2026-10-07" }, { "what": "privacy and compliance page", "url": "https://www.rippling.com/privacy-compliance", "seen": "2026-10-07" }, { "what": "SDK on npm", "url": "https://registry.npmjs.org/@rippling/rippling-sdk", "seen": "2026-10-07" }, { "what": "official MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0.1/servers?search=rippling", "seen": "2026-10-07" }, { "what": "unauthenticated call to the API (401 body and headers)", "url": "https://rest.ripplingapis.com/companies/", "seen": "2026-10-07" } ], "openQuestions": [ "unchecked: customer terms, privacy notice, DPA, AI Services Terms and Developer Terms of Use on app.rippling.com (JavaScript-only pages), so retention periods, any SLA, sub-processors and hosting locations are unconfirmed", "unchecked: whether the 14 changes labelled breaking were announced to customers before their changelog date, or applied only to tokens on a newer version than 2024-08-01", "unchecked: what API Tier 1 and the other named packages cost, and whether every customer plan includes API tokens", "unchecked: whether 429 responses carry a Retry-After header. The docs mention retry-after logic without naming the header", "Whether `Idempotency-Key` is accepted on writes beyond hires, draft transitions and time entries", "The docs give `npx @rippling/rippling-sdk-mcp` and `@rippling/ripdev`, but both names returned 404 from the npm registry on 7 October 2026", "The remote URL of the Rippling MCP isn't in the public docs. It is copied from the product, so tool annotations and schemas couldn't be read", "Whether rest.ripplingapis.com is registered to People Center, Inc. wasn't checked beyond the vendor's own docs naming it" ] }, "negative": -3, "negativeNotes": [ "2026-05-21 and 2026-06-17. The changelog labels 14 changes breaking since October 2025, among them `draft_hire_id` removed from POST /draft-hires/ responses on 21 May 2026 and `candidate_id` made required on GET /candidate-applications/ on 17 June 2026, while the reference still shows a single version, 2024-08-01. The versioning page says a breaking change requires a version update. Each change is documented on the day, so the smallest deduction applies (https://developer.rippling.com/documentation/rest-api/essentials/changelog)." ], "verdict": "API tokens carry any of 162 scopes and can never see more than their owner, and hires and worker changes land as drafts for a person to review. There is no public price, trial or self-serve signup, and status.rippling.com shows five incidents marked critical between 16 July and 29 September 2026.", "bestFor": "An agent working for a company already on Rippling that needs scoped reads of people, organisation and time off data, and writes that wait for human review.", "strengths": [ "API tokens are limited to chosen scopes (162 listed) and to the owner's permission profile, and are revoked after 30 days unused", "Hires and worker changes are created as drafts for review in Rippling, and leave requests follow the normal approval flow", "Dated changelog with 141 entries since 6 August 2025, 46 of them between 9 July and 28 September 2026, each labelled breaking or not", "llms.txt with integration guidance for agents, cursor pagination, filter, expand and order_by on list endpoints", "SOC 1 and SOC 2 Type II, ISO 27001, ISO 27018, ISO 42001 and CSA STAR Level 2 listed, with a paid vulnerability reporting programme" ], "weaknesses": [ "No public price, free tier or trial. rippling.com/pricing is a quote form, and endpoints name a paid package such as API Tier 1", "Five incidents marked critical and three marked major on status.rippling.com between 16 July and 29 September 2026", "The changelog labels 14 changes breaking since October 2025 while the reference still shows one version, 2024-08-01", "No downloadable OpenAPI file found, and the documentation site renders only with JavaScript", "One official SDK, JavaScript at 0.2.0-alpha.106, and the documented @rippling/rippling-sdk-mcp package returned 404 on npm" ], "agentNotes": [ "Call https://rest.ripplingapis.com with a Bearer token and pin `Rippling-Api-Version`. Use V1 at api.rippling.com only for resources that exist nowhere else", "Treat a null field as possibly hidden. Check `__meta.redacted_fields`, the token's scopes and whether `expand` was sent", "Follow `next_link` until it is null. The default page is 50 records and a `limit` above 100 returns 400", "Stay under 300 requests per IP in any 10 seconds. Going over rejects every request for the next 10 seconds", "Send an `Idempotency-Key` on POST /hires/ and POST /draft-transitions/, then poll the request until it reaches a final status" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 60.8 } ], "editorialScores": { "ergonomics": 75, "maintenance": 74, "payments": 5, "reliability": 62, "schema": 73, "security": 90, "transparency": 33 }, "provenanceScore": 69 }, "connect": { "install": "npm install @rippling/rippling-sdk", "http": "curl -X GET 'https://rest.ripplingapis.com/companies/' \\\n -H 'Accept: application/json' \\\n -H 'Authorization: Bearer YOUR_API_TOKEN'" }, "letme": { "capability": "https://letme.dev/hr.employees", "tool": "https://letme.dev/rippling" }, "notable": [ "The current public API is the REST Platform API v2 at https://rest.ripplingapis.com, versioned by date through the `Rippling-Api-Version` header. The V1 APIs at api.rippling.com are labelled an archive (https://developer.rippling.com/llms.txt)", "The sitemap lists about 350 v2 reference operations, among them workers, users, departments, teams, leave requests, leave balances, draft hires, hires, employee documents, custom objects and an activity log (https://developer.rippling.com/sitemap.xml)", "The Rippling MCP exposes one tool named code. The model writes JavaScript against 31 documented functions (ask_ai, people and org lookups, time off, create_draft_hire, custom objects) that runs in an isolated sandbox with no network egress (https://developer.rippling.com/documentation/rippling-platform/rippling-mcp/tools)", "The MCP never returns Social Security numbers, home addresses, personal email addresses or tax IDs, and each employee gets only the tools an admin assigns in MCP Gateway (https://developer.rippling.com/documentation/rippling-platform/rippling-mcp/overview)", "Partner requirements prohibit integrating through third-party integration services other than Merge and Finch, and forbid using a customer's API key on behalf of another organisation (https://developer.rippling.com/documentation/developer-portal/getting-started/requirements)", "App Shop webhooks are for partners only, arrive about five minutes after the event as form-encoded POSTs and cover employee, group, company and leave request events (https://developer.rippling.com/documentation/developer-portal/v2-guides/webhooks)" ], "area": "business", "details": [ { "label": "APIs", "value": "REST Platform API v2 at https://rest.ripplingapis.com (reference version 2024-08-01, about 350 operations). V1 Base, Employee, Company, Payroll, Reports, Time and Attendance and Recruiting APIs at api.rippling.com are legacy" }, { "label": "HR coverage", "value": "Read workers, users, compensations, departments, teams, titles, levels, work locations, legal entities, leave types, balances and requests. Write leave requests, departments, teams, work locations, employee documents, custom objects, draft hires, hires and draft transitions (proposed worker changes)" }, { "label": "Credentials", "value": "API tokens with 162 listed scopes for a customer's own use, limited to the owner's permission profile and revoked after 30 days unused. OAuth 2.0 authorisation code for App Shop partners. Employee sign-in for the Rippling MCP" }, { "label": "MCP server", "value": "First-party and remote, enabled per company and governed in MCP Gateway. One code tool over 31 functions, 10 of them writes. The server URL is copied from IT \u003e My IT \u003e MCP connectors. Needs a Rippling AI trial or subscription" }, { "label": "Rate limits", "value": "REST API 300 requests per IP per sliding 10 seconds, then every request is rejected for 10 seconds. MCP 50 calls per function per 60 seconds per user, 5 ask_ai starts a minute and 10 concurrent runs" }, { "label": "Pagination and queries", "value": "Cursor pagination through `next_link`, 50 records by default and 100 at most. `filter` with eq, ne, gt, gte, lt, lte, in, and, or (64 nodes at most), `expand` to two levels and ten fields, `order_by`" }, { "label": "Errors", "value": "Status table with a retry column for 400, 401, 403, 404, 409, 422, 429, 500 and 504. Responses carry `x-rippling-request-id`. Fields the token can't see are null and named in `__meta.redacted_fields`" }, { "label": "Idempotency", "value": "`Idempotency-Key` is required on POST /hires/ and shown on POST /draft-transitions/ and time entries. Not found as a general rule for writes" }, { "label": "SDK", "value": "@rippling/rippling-sdk 0.2.0-alpha.106 (7 October 2026), TypeScript, Apache-2.0, no runtime dependencies, two retries by default. The source repository is private" }, { "label": "Webhooks", "value": "App Shop partner webhooks only, with about five minutes' lag and an optional Bearer token. In-product webhooks trigger Rippling workflows" }, { "label": "Audit", "value": "Activity log endpoint with 90 days of events, filterable by time, event type, worker and source app. An email goes to the owner and admins when a token is created. MCP Gateway keeps audit logs" }, { "label": "Certifications", "value": "SOC 1 Type II, SOC 2 Type II, SOC 3, ISO 27001, ISO 27018, ISO 42001 and CSA STAR Level 2 per rippling.com/security. Vulnerability reporting programme with bounties at Rippling's discretion" }, { "label": "Status", "value": "status.rippling.com on Atlassian Statuspage, with components among them Rippling App, Platform API, Third-party integrations and Rippling AI" } ], "provenance": { "legalEntity": "People Center, Inc. dba Rippling", "domain": "rippling.com", "domainRegistered": "2002-02-25", "endpointOnVendorDomain": false, "terms": "https://app.rippling.com/legal", "privacy": "https://app.rippling.com/legal/privacy", "statusPage": "https://status.rippling.com", "changelog": "https://developer.rippling.com/documentation/rest-api/essentials/changelog", "securityTxt": "none", "checked": "2026-10-07", "notes": [ "The Vulnerability Reporting Terms and Conditions, last updated 21 August 2024, name People Center, Inc. dba Rippling and its affiliates.", "The v2 API answers at rest.ripplingapis.com, a separate domain from rippling.com that the vendor's llms.txt and quickstart name. V1 and the OAuth token exchange use api.rippling.com and app.rippling.com.", "www.rippling.com/.well-known/security.txt returns 404. Reports go through the form at rippling.com/vulnerability-reporting or to security@rippling.com.", "The terms, privacy notice, DPA and Developer Terms of Use sit on app.rippling.com, which returned only a JavaScript application to our reader, so their text is unread.", "RDAP for rippling.com gives a registration date of 2002-02-25." ], "score": 69, "checks": [ { "check": "Legal entity named", "value": "People Center, Inc. dba Rippling", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "rippling.com, registered 2002-02-25 (24 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "rest.ripplingapis.com is not on rippling.com", "points": 0, "max": 15, "state": "no" }, { "check": "Terms of service", "value": "published, but our reader couldn't read it", "points": 7, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "published, but our reader couldn't read it", "points": 7, "max": 10, "state": "part" }, { "check": "Status page", "value": "status.rippling.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "https://app.rippling.com/legal", "state": "unreadable", "reason": "the page has 15 words of text without a browser, so the document is drawn by script or sits elsewhere", "readAt": "2026-10-08", "points": 7, "max": 10 }, { "kind": "privacy", "url": "https://app.rippling.com/legal/privacy", "state": "unreadable", "reason": "the page has 15 words of text without a browser, so the document is drawn by script or sits elsewhere", "readAt": "2026-10-08", "points": 7, "max": 10 } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/rippling.json", "live": { "slug": "rippling", "probe": { "target": "https://rest.ripplingapis.com", "method": "get", "lastAt": "2026-10-08T18:20:39.176388921Z", "lastOk": true, "lastStatus": 404, "lastMs": 260, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 301, "p95ms24h": 2545, "samples24h": 33, "samples30d": 33, "days": [ { "date": "2026-10-08", "probes": 33, "ok": 33 } ] }, "vendorStatus": { "page": "https://status.rippling.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-08T18:22:18.3293084Z" }, "versions": [ { "registry": "npm", "name": "@rippling/rippling-sdk", "version": "0.2.0-alpha.106", "seenAt": "2026-10-08T16:27:45.404049579Z" } ], "npmWeekly": 3633, "securityTxt": { "url": "https://rippling.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-10-08T15:38:49.166690021Z" }, "pages": [ { "url": "https://developer.rippling.com/documentation/rest-api/essentials/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-10-08T18:17:17.596835563Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "e3b0c44298fc" }, { "url": "https://app.rippling.com/legal/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-10-08T18:15:21.558708711Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "8a3694d85aaa" }, { "url": "https://app.rippling.com/legal", "kind": "terms", "status": 200, "checkedAt": "2026-10-08T18:15:19.356857643Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "8a3694d85aaa" } ], "updatedAt": "2026-10-08T18:22:18.3293084Z" } }, "verify": { "accepts": "a page on rippling.com or one of its subdomains", "badgeUrl": "https://www.anchorterminal.com/badges/rippling.svg", "body": { "slug": "rippling", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/rippling", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/rippling\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/rippling.svg\" alt=\"Rippling on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![Rippling on Anchor Terminal](https://www.anchorterminal.com/badges/rippling.svg)](https://www.anchorterminal.com/tools/rippling)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/rippling\"\u003eRippling on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/rippling", "json": "https://www.anchorterminal.com/tools/rippling.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/rippling.md", "slim": "https://www.anchorterminal.com/tools/rippling.min.md" }, "markdown": "## Overview\n\n**Grade C · 60.8/100 · rank #341 of 629 · #3 in HR \u0026 employee operations · not agent-ready · confidence medium**\n\n\n## Assessment\n\nAPI tokens carry any of 162 scopes and can never see more than their owner, and hires and worker changes land as drafts for a person to review. There is no public price, trial or self-serve signup, and status.rippling.com shows five incidents marked critical between 16 July and 29 September 2026.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | People Center, Inc. dba Rippling (https://www.rippling.com) |\n| Kind | HTTP API |\n| Category | HR \u0026 employee operations (https://www.anchorterminal.com/categories/hr) |\n| Transport | HTTP |\n| Endpoint | `https://rest.ripplingapis.com` |\n| Auth | OAuth or key · A Rippling customer creates API tokens in Tools \u003e Developer \u003e API Tokens and sends them as `Authorization: Bearer` to https://rest.ripplingapis.com. A token's access is the overlap of its chosen scopes (162 listed, most split into read and read-write) and its owner's permission profile. It is shown once, can't change owner, and is revoked when the owner is terminated or after 30 days unused. App Shop partners must use OAuth 2.0 (authorisation code with refresh, one token per customer company) and get a partner account only after applying and being approved. The Rippling MCP signs in as the employee, after an admin assigns tools in MCP Gateway. |\n| Pricing | Paid (Paid) · No public prices. rippling.com/pricing says most products are billed per employee per month and asks for a quote, with no free tier or trial found. Reference pages name the package an endpoint needs, such as API Tier 1, with no price shown. Partners pay nothing to use the API or list in the App Shop, but must apply, and their customers need the Identity \u0026 Access Management package. Approved partners get a test company, and the API can create sandboxes. Rippling MCP tool calls need a Rippling AI trial or subscription (checked 2026-10-07). |\n| x402 | No · No x402, MPP or L402 in llms.txt, the REST API essentials pages or the pricing page (checked 2026-10-07). |\n| Licence | Proprietary service under Rippling's customer terms and Developer Terms of Use. The JavaScript SDK on npm is Apache-2.0 |\n| Packages | npm: `@rippling/rippling-sdk` |\n| Docs | https://developer.rippling.com/documentation/rest-api |\n| llms.txt | https://developer.rippling.com/llms.txt |\n| Last release | 2026-10-07 |\n| npm downloads / week | 3,633 |\n| APIs | REST Platform API v2 at https://rest.ripplingapis.com (reference version 2024-08-01, about 350 operations). V1 Base, Employee, Company, Payroll, Reports, Time and Attendance and Recruiting APIs at api.rippling.com are legacy |\n| HR coverage | Read workers, users, compensations, departments, teams, titles, levels, work locations, legal entities, leave types, balances and requests. Write leave requests, departments, teams, work locations, employee documents, custom objects, draft hires, hires and draft transitions (proposed worker changes) |\n| Credentials | API tokens with 162 listed scopes for a customer's own use, limited to the owner's permission profile and revoked after 30 days unused. OAuth 2.0 authorisation code for App Shop partners. Employee sign-in for the Rippling MCP |\n| MCP server | First-party and remote, enabled per company and governed in MCP Gateway. One code tool over 31 functions, 10 of them writes. The server URL is copied from IT \u003e My IT \u003e MCP connectors. Needs a Rippling AI trial or subscription |\n| Rate limits | REST API 300 requests per IP per sliding 10 seconds, then every request is rejected for 10 seconds. MCP 50 calls per function per 60 seconds per user, 5 ask_ai starts a minute and 10 concurrent runs |\n| Pagination and queries | Cursor pagination through `next_link`, 50 records by default and 100 at most. `filter` with eq, ne, gt, gte, lt, lte, in, and, or (64 nodes at most), `expand` to two levels and ten fields, `order_by` |\n| Errors | Status table with a retry column for 400, 401, 403, 404, 409, 422, 429, 500 and 504. Responses carry `x-rippling-request-id`. Fields the token can't see are null and named in `__meta.redacted_fields` |\n| Idempotency | `Idempotency-Key` is required on POST /hires/ and shown on POST /draft-transitions/ and time entries. Not found as a general rule for writes |\n| SDK | @rippling/rippling-sdk 0.2.0-alpha.106 (7 October 2026), TypeScript, Apache-2.0, no runtime dependencies, two retries by default. The source repository is private |\n| Webhooks | App Shop partner webhooks only, with about five minutes' lag and an optional Bearer token. In-product webhooks trigger Rippling workflows |\n| Audit | Activity log endpoint with 90 days of events, filterable by time, event type, worker and source app. An email goes to the owner and admins when a token is created. MCP Gateway keeps audit logs |\n| Certifications | SOC 1 Type II, SOC 2 Type II, SOC 3, ISO 27001, ISO 27018, ISO 42001 and CSA STAR Level 2 per rippling.com/security. Vulnerability reporting programme with bounties at Rippling's discretion |\n| Status | status.rippling.com on Atlassian Statuspage, with components among them Rippling App, Platform API, Third-party integrations and Rippling AI |\n| Capabilities | hr.employees, hr.time-off, hr.org, hr.onboarding, hr.documents, recruiting.candidates |\n| Tags | hosted, enterprise, api-key, oauth, mcp, llms-txt, typescript, webhooks, sales-led, status-page, soc2, iso27001 |\n| JSON | https://www.anchorterminal.com/api/v1/tools/rippling.json |\n\n## Score breakdown (methodology v0.4, October 2026 research run)\n\nAssessed 2026-10-07 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 62 | 12.4 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 73 | 11.9 |\n| Agent ergonomics | 13% | 16.2 | 75 | 12.2 |\n| Security \u0026 auth | 14% | 17.5 | 90 | 15.8 |\n| Payments \u0026 pricing | 10% | 12.5 | 5 | 0.6 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 74 | 6.5 |\n| Transparency \u0026 trust (editorial 33, provenance 69) | 7% | 8.8 | 51 | 4.5 |\n| Negative events | up to −15 | up to −15 | 2026-05-21 and 2026-06-17. The changelog labels 14 changes breaking since October 2025, among them `draft_hire_id` removed from POST /draft-hires/ responses on 21 May 2026 and `candidate_id` made required on GET /candidate-applications/ on 17 June 2026, while the reference still shows a single version, 2024-08-01. The versioning page says a breaking change requires a version update. Each change is documented on the day, so the smallest deduction applies (https://developer.rippling.com/documentation/rest-api/essentials/changelog). | -3 |\n| **Total** | | | | **60.8 → C** |\n\n### Why each score\n\n- Reliability 62: Read with the hosted lines and scored on the REST Platform API v2, the surface an outside agent calls with a token. status.rippling.com on Atlassian Statuspage lists components among them Rippling App and Platform API, with incident history (20). Fourteen incidents between 9 July and 7 October 2026, five marked critical and three major. The app was down on 27 July (twice, about 21 and 14 minutes before access returned), intermittently on 18 September (about an hour) and on 29 September (about 31 minutes, an overloaded authentication database). REST API latency on 10 September lasted about three hours and caused timeouts in Functions. The Rippling MCP was down for 34 minutes on 17 September. None tags the Platform API component, so this is read as short of several API majors (5). Limits with numbers, 300 requests per IP per 10 seconds, page size 100, 64 filter nodes (15). The docs ask for exponential backoff or Retry-After logic on 429 and give a retry column per status. `Idempotency-Key` appears on hires, draft transitions and time entries only (12 of 15). No SLA found, and the customer terms were unreadable (0). The v2 API carries no beta label (10).\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 73: The reference is generated from an OpenAPI document and shows a JSON Schema tab per operation, but we found no downloadable spec, and the typed SDK on npm is the only public machine-readable contract (12 of 25). llms.txt lists the docs with guidance written for models, though it says Markdown twins aren't published and pages render only with JavaScript (10). Endpoint descriptions are short, with filterable, expandable and sortable fields and the required package listed, and llms.txt says when to use v2, V1, the MCP or Functions (13 of 20). Enums on status and type fields and typed bodies. `filter` is a string expression (12 of 15). Curl examples in every guide and a status table. The documented 401 example differs from the body the API returned to us, `{\"ok\": false, \"error\": ...}` (11 of 15). Dated versions through `Rippling-Api-Version` and a changelog of 141 entries (15).\n- Agent ergonomics 75: Related objects come back null until asked for with `expand`, and `limit` sizes a page. No field selection (20 of 25). Cursor pagination through `next_link`, `filter` with nine operators, `order_by` (20). A status table with retry advice, `__meta.redacted_fields` naming hidden fields and `x-rippling-request-id` on responses, though the example error bodies are generic (14 of 20). `Idempotency-Key` on hires, draft transitions and time entries, and the SDK retries twice by default. No general idempotency rule for writes, and MCP annotations weren't visible (12 of 20). List calls need no parameters. One official SDK, JavaScript, still alpha (9 of 15).\n- Security \u0026 auth 90: API tokens with 162 listed scopes, most split into read and read-write, limited to the owner's permission profile, shown once, revocable, and revoked after 30 days unused or when the owner leaves. OAuth 2.0 with scopes for partners. All in the `Authorization` header (30). Read-only scopes, admin-only token oversight, hires and worker changes created as drafts for review, leave requests through the normal approval flow, and MCP deletes that need confirmation (19 of 20). The MCP runs model-written code in a sandbox with no network egress and credentials kept outside it, and withholds SSNs, home addresses and tax IDs. No guidance on untrusted text in records (9 of 15). An activity log endpoint with 90 days of events, an email on token creation and MCP Gateway audit logs. A per-token call log wasn't found (14 of 15). SOC 1 and SOC 2 Type II, SOC 3, ISO 27001, 27018 and 42001, CSA STAR Level 2, and a vulnerability reporting programme with bounties. No security.txt (18 of 20).\n- Payments \u0026 pricing 5: Read with the hosted rubric. No x402, MPP or L402 (0). rippling.com/pricing says products are billed per employee per month and asks for a quote, with no figures (0). No free tier or trial found for customers. Approved App Shop partners use the API and a test company at no cost, which needs an application, so partial credit (5 of 20). A person creates each token in the Developer app or completes an OAuth install (0).\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 74: The changelog's latest entry is 28 September 2026 and the SDK's latest version 7 October 2026 (30). 46 changelog entries on 16 dates since 9 July, and 39 SDK versions (20). Closed service with a dated changelog, a partner support address and a service desk for applications. No public issue tracker (10 of 15). One official SDK, current but alpha, and no entry for Rippling's own MCP server in the official registry (9 of 15). The SDK has no runtime dependencies. Its repository is private, so CI isn't visible (5 of 10).\n- Transparency \u0026 trust 51: Closed service. Customer terms, user terms, AI Services Terms and Developer Terms of Use are published at stable URLs, which returned only a JavaScript application to our reader. The SDK is Apache-2.0 (13 of 30). The privacy and compliance page says Rippling processes customer data only as instructed and links a privacy notice and a DPA, both unread for the same reason. The docs state 90 days of activity log retention and the fields the MCP withholds (12 of 30). Versions are dated and V1 is labelled an archive, but breaking changes are logged on the day with no notice period shown and no removal dates (8 of 20). No sub-processor list or hosting locations found on the security, privacy and compliance or legal index pages (0).\n\nFix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (20 items): https://www.anchorterminal.com/fixes/rippling.md (JSON https://www.anchorterminal.com/fixes/rippling.json)\n\n### What we couldn't check\n\n- unchecked: customer terms, privacy notice, DPA, AI Services Terms and Developer Terms of Use on app.rippling.com (JavaScript-only pages), so retention periods, any SLA, sub-processors and hosting locations are unconfirmed\n- unchecked: whether the 14 changes labelled breaking were announced to customers before their changelog date, or applied only to tokens on a newer version than 2024-08-01\n- unchecked: what API Tier 1 and the other named packages cost, and whether every customer plan includes API tokens\n- unchecked: whether 429 responses carry a Retry-After header. The docs mention retry-after logic without naming the header\n- Whether `Idempotency-Key` is accepted on writes beyond hires, draft transitions and time entries\n- The docs give `npx @rippling/rippling-sdk-mcp` and `@rippling/ripdev`, but both names returned 404 from the npm registry on 7 October 2026\n- The remote URL of the Rippling MCP isn't in the public docs. It is copied from the product, so tool annotations and schemas couldn't be read\n- Whether rest.ripplingapis.com is registered to People Center, Inc. wasn't checked beyond the vendor's own docs naming it\n\n### Sources\n\n- llms.txt, API surfaces and authentication paths: \u003chttps://developer.rippling.com/llms.txt\u003e (seen 2026-10-07)\n- usage and rate limits: \u003chttps://developer.rippling.com/documentation/rest-api/essentials/api-limits\u003e (seen 2026-10-07)\n- API tokens and permissions: \u003chttps://developer.rippling.com/documentation/rest-api/essentials/api-tokens\u003e (seen 2026-10-07)\n- versioning: \u003chttps://developer.rippling.com/documentation/rest-api/essentials/versioning\u003e (seen 2026-10-07)\n- pagination and query parameters: \u003chttps://developer.rippling.com/documentation/rest-api/essentials/pagination\u003e (seen 2026-10-07)\n- errors and troubleshooting: \u003chttps://developer.rippling.com/documentation/rest-api/essentials/troubleshooting\u003e (seen 2026-10-07)\n- changelog (141 entries, read from the site's data): \u003chttps://developer.rippling.com/documentation/rest-api/essentials/changelog\u003e (seen 2026-10-07)\n- API reference introduction, version and scopes: \u003chttps://developer.rippling.com/documentation/rest-api/reference/rippling-platform-api\u003e (seen 2026-10-07)\n- draft transitions guide with Idempotency-Key: \u003chttps://developer.rippling.com/documentation/rest-api/guides/schedule-worker-changes\u003e (seen 2026-10-07)\n- Rippling MCP overview, limits and sandbox: \u003chttps://developer.rippling.com/documentation/rippling-platform/rippling-mcp/overview\u003e (seen 2026-10-07)\n- Rippling MCP tools: \u003chttps://developer.rippling.com/documentation/rippling-platform/rippling-mcp/tools\u003e (seen 2026-10-07)\n- partner requirements, process and pricing: \u003chttps://developer.rippling.com/documentation/developer-portal/getting-started/requirements\u003e (seen 2026-10-07)\n- App Shop webhooks: \u003chttps://developer.rippling.com/documentation/developer-portal/v2-guides/webhooks\u003e (seen 2026-10-07)\n- sitemap, count of reference operations: \u003chttps://developer.rippling.com/sitemap.xml\u003e (seen 2026-10-07)\n- status incidents feed: \u003chttps://status.rippling.com/api/v2/incidents.json\u003e (seen 2026-10-07)\n- pricing page: \u003chttps://www.rippling.com/pricing\u003e (seen 2026-10-07)\n- security page: \u003chttps://www.rippling.com/security\u003e (seen 2026-10-07)\n- vulnerability reporting terms: \u003chttps://www.rippling.com/vulnerability-reporting/terms\u003e (seen 2026-10-07)\n- privacy and compliance page: \u003chttps://www.rippling.com/privacy-compliance\u003e (seen 2026-10-07)\n- SDK on npm: \u003chttps://registry.npmjs.org/@rippling/rippling-sdk\u003e (seen 2026-10-07)\n- official MCP registry search: \u003chttps://registry.modelcontextprotocol.io/v0.1/servers?search=rippling\u003e (seen 2026-10-07)\n- unauthenticated call to the API (401 body and headers): \u003chttps://rest.ripplingapis.com/companies/\u003e (seen 2026-10-07)\n\n## Who's behind it (provenance 69/100, checked 2026-10-07)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | People Center, Inc. dba Rippling | 20/20 |\n| Domain age | rippling.com, registered 2002-02-25 (24 years) | 15/15 |\n| Endpoint on the vendor's domain | rest.ripplingapis.com is not on rippling.com | 0/15 |\n| Terms of service | published, but our reader couldn't read it | 7/10 |\n| Privacy policy | published, but our reader couldn't read it | 7/10 |\n| Status page | status.rippling.com | 10/10 |\n| Changelog | published | 10/10 |\n| security.txt | not found | 0/10 |\n\nThe Vulnerability Reporting Terms and Conditions, last updated 21 August 2024, name People Center, Inc. dba Rippling and its affiliates.\n\nThe v2 API answers at rest.ripplingapis.com, a separate domain from rippling.com that the vendor's llms.txt and quickstart name. V1 and the OAuth token exchange use api.rippling.com and app.rippling.com.\n\nwww.rippling.com/.well-known/security.txt returns 404. Reports go through the form at rippling.com/vulnerability-reporting or to security@rippling.com.\n\nThe terms, privacy notice, DPA and Developer Terms of Use sit on app.rippling.com, which returned only a JavaScript application to our reader, so their text is unread.\n\nRDAP for rippling.com gives a registration date of 2002-02-25.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service** (https://app.rippling.com/legal), read 2026-10-08. Our reader couldn't read it (the page has 15 words of text without a browser, so the document is drawn by script or sits elsewhere).\n\n\n**Privacy policy** (https://app.rippling.com/legal/privacy), read 2026-10-08. Our reader couldn't read it (the page has 15 words of text without a browser, so the document is drawn by script or sits elsewhere).\n\n\n## Live (updated 2026-10-08 18:22 UTC)\n\n- Right now: up, HTTP 404, 260 ms, checked 2026-10-08 18:20 UTC (get on `https://rest.ripplingapis.com`)\n- Uptime 24h 100.0% (33 probes) · 30 days 100.0% (33 probes) · p50 301 ms · p95 2.5 s\n- Vendor status page: none, All Systems Operational\n- npm `@rippling/rippling-sdk` 0.2.0-alpha.106\n- security.txt: none\n- Watching changelog \u003chttps://developer.rippling.com/documentation/rest-api/essentials/changelog\u003e\n- Watching privacy \u003chttps://app.rippling.com/legal/privacy\u003e\n- Watching terms \u003chttps://app.rippling.com/legal\u003e\n- Always current: https://www.anchorterminal.com/api/v1/live/rippling.json\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Strengths\n\n- API tokens are limited to chosen scopes (162 listed) and to the owner's permission profile, and are revoked after 30 days unused\n- Hires and worker changes are created as drafts for review in Rippling, and leave requests follow the normal approval flow\n- Dated changelog with 141 entries since 6 August 2025, 46 of them between 9 July and 28 September 2026, each labelled breaking or not\n- llms.txt with integration guidance for agents, cursor pagination, filter, expand and order_by on list endpoints\n- SOC 1 and SOC 2 Type II, ISO 27001, ISO 27018, ISO 42001 and CSA STAR Level 2 listed, with a paid vulnerability reporting programme\n\n## Weaknesses\n\n- No public price, free tier or trial. rippling.com/pricing is a quote form, and endpoints name a paid package such as API Tier 1\n- Five incidents marked critical and three marked major on status.rippling.com between 16 July and 29 September 2026\n- The changelog labels 14 changes breaking since October 2025 while the reference still shows one version, 2024-08-01\n- No downloadable OpenAPI file found, and the documentation site renders only with JavaScript\n- One official SDK, JavaScript at 0.2.0-alpha.106, and the documented @rippling/rippling-sdk-mcp package returned 404 on npm\n\n## Before you call it (notes for agents)\n\n1. Call https://rest.ripplingapis.com with a Bearer token and pin `Rippling-Api-Version`. Use V1 at api.rippling.com only for resources that exist nowhere else\n2. Treat a null field as possibly hidden. Check `__meta.redacted_fields`, the token's scopes and whether `expand` was sent\n3. Follow `next_link` until it is null. The default page is 50 records and a `limit` above 100 returns 400\n4. Stay under 300 requests per IP in any 10 seconds. Going over rejects every request for the next 10 seconds\n5. Send an `Idempotency-Key` on POST /hires/ and POST /draft-transitions/, then poll the request until it reaches a final status\n\n## Connect\n\nInstall:\n\n```bash\nnpm install @rippling/rippling-sdk\n```\n\nFirst request:\n\n```bash\ncurl -X GET 'https://rest.ripplingapis.com/companies/' \\\n -H 'Accept: application/json' \\\n -H 'Authorization: Bearer YOUR_API_TOKEN'\n```\n\nThrough letme (picks today, calling later): https://letme.dev/rippling. letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| Deel | B | 69.1 | 158 | hr.employees, hr.time-off, hr.org, hr.onboarding, hr.documents | no | https://www.anchorterminal.com/tools/deel.md |\n| BambooHR | C | 61.7 | 319 | hr.employees, hr.time-off, hr.org, hr.onboarding, hr.documents | no | https://www.anchorterminal.com/tools/bamboohr.md |\n| HiBob | C | 57 | 429 | hr.employees, hr.time-off, hr.org, hr.onboarding, hr.documents | no | https://www.anchorterminal.com/tools/hibob.md |\n| Workable | C | 61.7 | 320 | recruiting.candidates, hr.employees, hr.time-off, hr.org | no | https://www.anchorterminal.com/tools/workable.md |\n| Finch | BB | 71.6 | 99 | hr.employees, hr.org, hr.documents | no | https://www.anchorterminal.com/tools/finch.md |\n| Gusto | B | 63.3 | 283 | hr.onboarding, hr.time-off | no | https://www.anchorterminal.com/tools/gusto.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- The current public API is the REST Platform API v2 at https://rest.ripplingapis.com, versioned by date through the `Rippling-Api-Version` header. The V1 APIs at api.rippling.com are labelled an archive (source: \u003chttps://developer.rippling.com/llms.txt\u003e)\n- The sitemap lists about 350 v2 reference operations, among them workers, users, departments, teams, leave requests, leave balances, draft hires, hires, employee documents, custom objects and an activity log (source: \u003chttps://developer.rippling.com/sitemap.xml\u003e)\n- The Rippling MCP exposes one tool named code. The model writes JavaScript against 31 documented functions (ask_ai, people and org lookups, time off, create_draft_hire, custom objects) that runs in an isolated sandbox with no network egress (source: \u003chttps://developer.rippling.com/documentation/rippling-platform/rippling-mcp/tools\u003e)\n- The MCP never returns Social Security numbers, home addresses, personal email addresses or tax IDs, and each employee gets only the tools an admin assigns in MCP Gateway (source: \u003chttps://developer.rippling.com/documentation/rippling-platform/rippling-mcp/overview\u003e)\n- Partner requirements prohibit integrating through third-party integration services other than Merge and Finch, and forbid using a customer's API key on behalf of another organisation (source: \u003chttps://developer.rippling.com/documentation/developer-portal/getting-started/requirements\u003e)\n- App Shop webhooks are for partners only, arrive about five minutes after the event as form-encoded POSTs and cover employee, group, company and leave request events (source: \u003chttps://developer.rippling.com/documentation/developer-portal/v2-guides/webhooks\u003e)\n\n## Compare\n\n- [BambooHR vs Rippling](https://www.anchorterminal.com/compare/bamboohr-vs-rippling.md): C 61.7 vs C 60.8\n- [Deel vs Rippling](https://www.anchorterminal.com/compare/deel-vs-rippling.md): B 69.1 vs C 60.8\n- [HiBob vs Rippling](https://www.anchorterminal.com/compare/hibob-vs-rippling.md): C 57 vs C 60.8\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on rippling.com or one of its subdomains. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"rippling\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/rippling\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/rippling.svg\" alt=\"Rippling on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![Rippling on Anchor Terminal](https://www.anchorterminal.com/badges/rippling.svg)](https://www.anchorterminal.com/tools/rippling)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/rippling\"\u003eRippling on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say Rippling is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/rippling-dark.png\n- Light: https://www.anchorterminal.com/assets/share/rippling-light.png\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "HR \u0026 employee operations", "url": "https://www.anchorterminal.com/categories/hr" }, { "name": "Rippling", "url": "" } ], "description": "Rippling is a workforce platform for HR, payroll, IT and spend. Its REST Platform API v2 reads and writes worker, time off and organisation data with scoped Bearer tokens. A first-party MCP server runs as the signed-in employee.", "facts": [ "rank #341 of 629", "OAuth or key auth", "0 desk reviews" ], "h1": "Rippling", "image": "https://www.anchorterminal.com/assets/og/tools-rippling.png", "path": "/tools/rippling", "published": "2026-10-01", "section": "tools", "title": "Rippling review for AI agents, grade C (60.8/100) | Anchor Terminal", "toc": null, "updated": "2026-10-08", "url": "https://www.anchorterminal.com/tools/rippling" }, "tokens": { "markdown": 7050, "slim": 1880 }, "version": 1 }