← Developers

API and MCP reference

Generated from the code, so it always matches the live API. New here? Start with the guide: your first call in five minutes.

Base address:: https://api.mihnaro.com/api/v1
Endpoints:: 1249
MCP tools:: 461

Getting started Download OpenAPI (JSON) Connect an AI assistant (MCP)

Public and sign-in

No token: signing in and password recovery.

brand 1 endpoint

GET /api/v1/app/brand GET /api/v1/app/brand (docs/mobile-app.md, "أيقونة التطبيق"): the main brand from the admi...
GET /api/v1/app/brand (docs/mobile-app.md, "أيقونة التطبيق"): the main brand from the admin panel, for the app's build script (icon, splash) and its screens. Public and cacheable. The icon sources fall back to the mark; `version` changes whenever any of it does. data: name, colors {brand, accent}, logo_url, logo_white_url, mark_url, mark_white_url, icon_url, icon_white_url, icon_source (app_icon|mark), version.

Sign-in
None

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/app/brand" \
  -H "Accept: application/json"
```

branding 1 endpoint

GET /api/v1/app/branding What the mobile app is painted with before anyone signs in: the system palette and logos f...
What the mobile app is painted with before anyone signs in: the system palette and logos from the admin panel.

Sign-in
None

Permission
Any signed-in user of the company

Rate limit
60 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/app/branding" \
  -H "Accept: application/json"
```

help 3 endpoints

GET /api/v1/help/categories
Sign-in
None

Permission
Any signed-in user of the company

Rate limit
60 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/help/categories" \
  -H "Accept: application/json"
```

GET /api/v1/help/articles

Sign-in: None
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

`q`	`nullable\|string\|'max:' . \App\Support\Limits::chars(100)`
`category`	`nullable\|string\|in:getting-started,employees,payroll,leaves,attendance,documents,performance,recruitment,reports,settings,api`

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/help/articles?q=...&category=getting-started" \
  -H "Accept: application/json"

GET /api/v1/help/articles/{category}/{article}

Sign-in: None
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

`category`	string · [a-z0-9-]+	The record's ID.
`article`	string · [a-z0-9-]+	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/help/articles/{category}/{article}" \
  -H "Accept: application/json"

meta 1 endpoint

GET /api/v1/app/meta
Sign-in
None

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/app/meta" \
  -H "Accept: application/json"
```

password 3 endpoints

GET /api/v1/app/password/options
Sign-in
None

Permission
Any signed-in user of the company

Rate limit
60 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/app/password/options" \
  -H "Accept: application/json"
```

POST /api/v1/app/password/forgot

Sign-in: None
Permission: Any signed-in user of the company
Rate limit: 10 requests a minute

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`email`required	`required\|email`
`channel`required	`required\|Rule::in(self::availableChannels())`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/password/forgot" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"email":"[email protected]","channel":"..."}'

POST /api/v1/app/password/reset

Sign-in: None
Permission: Any signed-in user of the company
Rate limit: 10 requests a minute

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`token`required	`required\|string`
`password`required	`required\|string\|confirmed\|\App\Support\PasswordPolicy::rule($link->user)\|new \App\Rules\NotRecentlyUsedPassword($link->user)`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/password/reset" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"token":"...","password":"..."}'

server-switch 1 endpoint

GET /api/v1/app/server-switch GET /api/v1/app/server-switch (docs/mobile-server-switch.md): only whether the app's live/...
GET /api/v1/app/server-switch (docs/mobile-server-switch.md): only whether the app's live/dev switch works now, nothing else. Public, never cached: the app asks at the moment of the 15th tap, and on dev at every open.

Sign-in
None

Permission
Any signed-in user of the company

Rate limit
60 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/app/server-switch" \
  -H "Accept: application/json"
```

site 2 endpoints

GET /api/v1/site/contact/options
Sign-in
None

Permission
Any signed-in user of the company

Rate limit
60 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/site/contact/options" \
  -H "Accept: application/json"
```
POST /api/v1/site/contact
Sign-in
None

Permission
Any signed-in user of the company
Example request
Link to this endpoint
```
curl -X POST "https://api.mihnaro.com/api/v1/site/contact" \
  -H "Accept: application/json"
```

sso 1 endpoint

POST /api/v1/app/sso/token The mobile app after single sign-on (MobileSso): the one-time code and its PKCE code_verif...

The mobile app after single sign-on (MobileSso): the one-time code and its PKCE code_verifier. No 2FA code: the provider checked.

Sign-in: None
Permission: Any signed-in user of the company
Rate limit: 10 requests a minute

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`code`required	`required\|string\|max:100`
`code_verifier`required	`required\|string\|min:43\|max:128`
`device_name`required	`required\|string\|max:80`
`device_id`	`nullable\|string\|max:100`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/sso/token" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"code":"...","code_verifier":"...","device_name":"...","device_id":"..."}'

token 1 endpoint

POST /api/v1/app/token

Sign-in: None
Permission: Any signed-in user of the company
Rate limit: 10 requests a minute

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`email`required	`required\|string\|max:190`
`password`required	`required\|string`
`device_name`required	`required\|string\|max:80`
`code`	`nullable\|string\|max:20`
`device_id`	`nullable\|string\|max:100`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/token" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"email":"...","password":"...","device_name":"...","code":"...","device_id":"..."}'

tools 4 endpoints

GET /api/v1/tools/calculators
Sign-in
None

Permission
Any signed-in user of the company

Rate limit
60 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/tools/calculators" \
  -H "Accept: application/json"
```

GET POST /api/v1/tools/calculators/{tool}

Sign-in: None
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/tools/calculators/{tool}" \
  -H "Accept: application/json"

GET /api/v1/tools/countries Every country with rules: the tools each can run, its variants and how many of its rules a...
Every country with rules: the tools each can run, its variants and how many of its rules are verified.

Sign-in
None

Permission
Any signed-in user of the company

Rate limit
60 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/tools/countries" \
  -H "Accept: application/json"
```

GET /api/v1/tools/countries/{country} A country's rules in force, with each rule's source and verified mark; a country with none...

A country's rules in force, with each rule's source and verified mark; a country with none says so.

Sign-in: None
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

country string · [A-Za-z0-9-]+ The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/tools/countries/{country}" \
  -H "Accept: application/json"

App API

An app token or a company API key. Paths with {company} take the company's ID.

access 10 endpoints

GET /api/v1/app/companies/{company}/access/time-zones

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/access/time-zones" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/access/time-zones

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`required	`required\|array`
`name.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(100)`
`name.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(100)`
`device_tz_id`required	`required\|integer\|between:2,50\|unique:access_time_zones`
`schedule`	`array`
`schedule.*`	`array\|max:3`
`schedule..`	`array\|size:2`
`schedule...*`	`date_format:H:i`
`holidays_closed`	`sometimes\|boolean`
`branch_id`	`sometimes\|nullable\|integer\|exists:branches,id`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/access/time-zones" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":{"en":"...","ar":"..."},"device_tz_id":1,"schedule":[],"holidays_closed":true,"branch_id":1}'

PUT /api/v1/app/companies/{company}/access/time-zones/{zone}

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`zone`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`required	`required\|array`
`name.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(100)`
`name.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(100)`
`device_tz_id`required	`required\|integer\|between:2,50\|unique:access_time_zones`
`schedule`	`array`
`schedule.*`	`array\|max:3`
`schedule..`	`array\|size:2`
`schedule...*`	`date_format:H:i`
`holidays_closed`	`sometimes\|boolean`
`branch_id`	`sometimes\|nullable\|integer\|exists:branches,id`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/access/time-zones/{zone}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":{"en":"...","ar":"..."},"device_tz_id":1,"schedule":[],"holidays_closed":true,"branch_id":1}'

GET /api/v1/app/companies/{company}/access/levels

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/access/levels" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/access/levels

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`required	`required\|array`
`name.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(100)`
`name.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(100)`
`access_time_zone_id`	`nullable\|integer\|exists:access_time_zones,id`
`doors`required	`required\|array\|min:1\|max:200`
`doors.*.device_id`required	`required\|integer\|exists:biometric_devices,id`
`doors.*.door`	`nullable\|integer\|between:0,8`
`branch_id`	`sometimes\|nullable\|integer\|exists:branches,id`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/access/levels" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":{"en":"...","ar":"..."},"access_time_zone_id":1,"doors":[],"branch_id":1}'

PUT /api/v1/app/companies/{company}/access/levels/{level}

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`level`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`required	`required\|array`
`name.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(100)`
`name.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(100)`
`access_time_zone_id`	`nullable\|integer\|exists:access_time_zones,id`
`doors`required	`required\|array\|min:1\|max:200`
`doors.*.device_id`required	`required\|integer\|exists:biometric_devices,id`
`doors.*.door`	`nullable\|integer\|between:0,8`
`branch_id`	`sometimes\|nullable\|integer\|exists:branches,id`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/access/levels/{level}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":{"en":"...","ar":"..."},"access_time_zone_id":1,"doors":[],"branch_id":1}'

GET /api/v1/app/companies/{company}/access/assignments

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/access/assignments" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/access/assignments

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`access_level_id`	`nullable\|required_unless:effect,deny\|integer\|exists:access_levels,id`
`target_type`required	`required\|in:employee,group,department,branch,position,all,visitor`
`effect`required	`required\|in:allow,deny`
`target_id`	`nullable\|Rule::requiredIf(fn() => in_array($input['target_type'] ?? '', ['employee', 'gro...\|integer`
`biometric_device_id`	`nullable\|integer\|exists:biometric_devices,id`
`visitor_name`	`nullable\|required_if:target_type,visitor\|string\|max:100`
`visitor_pin`	`nullable\|required_if:target_type,visitor\|string\|max:32\|regex:/^[0-9]+$/`
`visitor_card`	`nullable\|string\|max:32`
`starts_at`	`nullable\|date`
`ends_at`	`nullable\|date\|after:starts_at\|required_if:target_type,visitor`
`note`	`nullable\|string\|'max:' . \App\Support\Limits::chars(255)`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/access/assignments" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"access_level_id":1,"target_type":"employee","effect":"allow","target_id":1,"biometric_device_id":1,"visitor_name":"...","visitor_pin":"...","visitor_card":"...","starts_at":"2026-11-01","ends_at":"2026-11-01","note":"..."}'

PUT /api/v1/app/companies/{company}/access/assignments/{assignment}

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`assignment`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`access_level_id`	`nullable\|required_unless:effect,deny\|integer\|exists:access_levels,id`
`target_type`required	`required\|in:employee,group,department,branch,position,all,visitor`
`effect`required	`required\|in:allow,deny`
`target_id`	`nullable\|Rule::requiredIf(fn() => in_array($input['target_type'] ?? '', ['employee', 'gro...\|integer`
`biometric_device_id`	`nullable\|integer\|exists:biometric_devices,id`
`visitor_name`	`nullable\|required_if:target_type,visitor\|string\|max:100`
`visitor_pin`	`nullable\|required_if:target_type,visitor\|string\|max:32\|regex:/^[0-9]+$/`
`visitor_card`	`nullable\|string\|max:32`
`starts_at`	`nullable\|date`
`ends_at`	`nullable\|date\|after:starts_at\|required_if:target_type,visitor`
`note`	`nullable\|string\|'max:' . \App\Support\Limits::chars(255)`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/access/assignments/{assignment}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"access_level_id":1,"target_type":"employee","effect":"allow","target_id":1,"biometric_device_id":1,"visitor_name":"...","visitor_pin":"...","visitor_card":"...","starts_at":"2026-11-01","ends_at":"2026-11-01","note":"..."}'

DELETE /api/v1/app/companies/{company}/access/{kind}/{id}

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`kind`	string · time-zones\|levels\|assignments	The record's ID.
`id`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/access/{kind}/{id}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

accounting 13 endpoints

GET /api/v1/app/companies/{company}/accounting

Sign-in: App token or company API key
Permission: integrations.manage.*
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/accounting" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/accounting/{provider}

Sign-in: App token or company API key
Permission: integrations.manage.*
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`provider`	string · odoo\|quickbooks\|xero\|netsuite\|business_central\|sap_b1\|sap_s4hana\|dynamics_fo	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/accounting/{provider}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/accounting/{provider}

Sign-in: App token or company API key
Permission: integrations.manage.*
Rate limit: 20 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`provider`	string · odoo\|quickbooks\|xero\|netsuite\|business_central\|sap_b1\|sap_s4hana\|dynamics_fo	The record's ID.

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/accounting/{provider}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/accounting/{provider}

Sign-in: App token or company API key
Permission: integrations.manage.*
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`provider`	string · odoo\|quickbooks\|xero\|netsuite\|business_central\|sap_b1\|sap_s4hana\|dynamics_fo	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/accounting/{provider}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/accounting/{provider}/test

Sign-in: App token or company API key
Permission: integrations.manage.*
Rate limit: 20 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`provider`	string · odoo\|quickbooks\|xero\|netsuite\|business_central\|sap_b1\|sap_s4hana\|dynamics_fo	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/accounting/{provider}/test" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/accounting/{provider}/refresh

Sign-in: App token or company API key
Permission: integrations.manage.*
Rate limit: 20 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`provider`	string · odoo\|quickbooks\|xero\|netsuite\|business_central\|sap_b1\|sap_s4hana\|dynamics_fo	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/accounting/{provider}/refresh" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/accounting/{provider}/catalog The ledger's accounts, analytics, partners and journals as last read.

The ledger's accounts, analytics, partners and journals as last read.

Sign-in: App token or company API key
Permission: integrations.manage.*
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`provider`	string · odoo\|quickbooks\|xero\|netsuite\|business_central\|sap_b1\|sap_s4hana\|dynamics_fo	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/accounting/{provider}/catalog" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/accounting/{provider}/oauth-url OAuth 2 (QuickBooks, Xero): the consent link to open in a browser signed in to Mihnaro as...

OAuth 2 (QuickBooks, Xero): the consent link to open in a browser signed in to Mihnaro as the same person.

Sign-in: App token or company API key
Permission: integrations.manage.*
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`provider`	string · odoo\|quickbooks\|xero\|netsuite\|business_central\|sap_b1\|sap_s4hana\|dynamics_fo	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/accounting/{provider}/oauth-url" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/accounting/{provider}/mappings

Sign-in: App token or company API key
Permission: integrations.manage.*
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`provider`	string · odoo\|quickbooks\|xero\|netsuite\|business_central\|sap_b1\|sap_s4hana\|dynamics_fo	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/accounting/{provider}/mappings" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/accounting/{provider}/mappings PUT items: [{type, local_key, external_id}]; auto_match: true maps accounts whose codes ma...

PUT items: [{type, local_key, external_id}]; auto_match: true maps accounts whose codes match.

Sign-in: App token or company API key
Permission: integrations.manage.*
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`provider`	string · odoo\|quickbooks\|xero\|netsuite\|business_central\|sap_b1\|sap_s4hana\|dynamics_fo	The record's ID.

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/accounting/{provider}/mappings" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/accounting/{provider}/preview

Sign-in: App token or company API key
Permission: integrations.manage.*
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`provider`	string · odoo\|quickbooks\|xero\|netsuite\|business_central\|sap_b1\|sap_s4hana\|dynamics_fo	The record's ID.

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

run_idrequired required|integer

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/accounting/{provider}/preview?run_id=1" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/accounting/{provider}/post

Sign-in: App token or company API key
Permission: integrations.manage.*
Rate limit: 20 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`provider`	string · odoo\|quickbooks\|xero\|netsuite\|business_central\|sap_b1\|sap_s4hana\|dynamics_fo	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

run_idrequired required|integer

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/accounting/{provider}/post" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"run_id":1}'

POST /api/v1/app/companies/{company}/accounting/{provider}/sync-employees

Sign-in: App token or company API key
Permission: integrations.manage.*
Rate limit: 10 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`provider`	string · odoo\|quickbooks\|xero\|netsuite\|business_central\|sap_b1\|sap_s4hana\|dynamics_fo	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`employee_ids`	`sometimes\|array`
`employee_ids.*`	`integer`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/accounting/{provider}/sync-employees" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"employee_ids":[]}'

accounting-postings 3 endpoints

GET /api/v1/app/companies/{company}/accounting-postings

Sign-in: App token or company API key
Permission: integrations.manage.*
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/accounting-postings" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/accounting-postings/{posting}

Sign-in: App token or company API key
Permission: integrations.manage.*
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`posting`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/accounting-postings/{posting}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/accounting-postings/{posting}/{action}

Sign-in: App token or company API key
Permission: integrations.manage.*
Rate limit: 30 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`posting`	integer	The record's ID.
`action`	string · retry\|reverse\|repost	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/accounting-postings/{posting}/{action}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

activity-log 1 endpoint

GET /api/v1/app/companies/{company}/activity-log GET activity-log?tab=changes|requests|sign_ins plus the tab's filters

GET activity-log?tab=changes|requests|sign_ins plus the tab's filters

Sign-in: App token or company API key
Permission: activity.view
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/activity-log" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

air-ticket-policies 7 endpoints

GET /api/v1/app/companies/{company}/air-ticket-policies

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/air-ticket-policies" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/air-ticket-policies

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`apply_changes`	`nullable\|in:update,new`
`balance_date`	`required_if:apply_changes,new\|nullable\|date`
`name_ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(150)`
`name_en`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`tickets`required	`required\|numeric\|min:0\|max:20`
`period_months`required	`required\|integer\|min:1\|max:120`
`period_anchor`required	`required\|in:hire,calendar`
`accrual`required	`required\|in:period_start,monthly`
`amount`required	`required\|numeric\|min:0`
`family_members`	`nullable\|integer\|min:0\|max:20`
`eligible_after_months`	`nullable\|integer\|min:0\|max:120`
`applies_to`required	`required\|in:all,assigned`
`expire_option`	`nullable\|in:after,immediately,none`
`expire_after_months`	`required_if:expire_option,after\|nullable\|integer\|min:1\|max:120`
`distribution`	`nullable\|in:per_person,shared`
`default_payroll`	`nullable\|in:in_payroll,off_cycle`
`default_request_type`	`nullable\|in:cash_out,ticket`
`transaction_type_id`	`nullable\|exists:transaction_types,id`
`gl_identifier`	`nullable\|string\|max:60`
`clearance_account`	`nullable\|string\|max:60`
`setups`	`nullable\|array\|max:30`
`setups.*.position_ids`	`nullable\|array`
`setups..position_ids.`	`integer\|exists:positions,id`
`setups.*.nationalities`	`nullable\|string\|max:500`
`setups.*.years_from`	`nullable\|numeric\|min:0\|max:60`
`setups.*.years_to`	`nullable\|numeric\|min:0\|max:60`
`setups.*.amount`	`nullable\|numeric\|min:0`
`setups.*.currency`	`nullable\|string\|max:3`
`setups.*.beneficiaries`	`nullable\|array`
`setups..beneficiaries..relation`	`nullable\|in:parent,spouse,child,sibling`
`setups..beneficiaries..deduction`	`nullable\|numeric\|min:0\|max:100`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/air-ticket-policies" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"apply_changes":"update","balance_date":"2026-11-01","name_ar":"...","name_en":"...","tickets":1.5,"period_months":1,"period_anchor":"hire","accrual":"period_start","amount":1.5,"family_members":1,"eligible_after_months":1,"applies_to":"all","expire_option":"after","expire_after_months":1,"distribution":"per_person","default_payroll":"in_payroll","default_request_type":"cash_out","transaction_type_id":"...","gl_identifier":"...","clearance_account":"...","setups":[]}'

GET /api/v1/app/companies/{company}/air-ticket-policies/{policy} The policy and the employees in my payroll.manage scope it was given to, with their openin...

The policy and the employees in my payroll.manage scope it was given to, with their opening balance.

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`policy`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/air-ticket-policies/{policy}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/air-ticket-policies/{policy}

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`policy`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`apply_changes`	`nullable\|in:update,new`
`balance_date`	`required_if:apply_changes,new\|nullable\|date`
`name_ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(150)`
`name_en`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`tickets`required	`required\|numeric\|min:0\|max:20`
`period_months`required	`required\|integer\|min:1\|max:120`
`period_anchor`required	`required\|in:hire,calendar`
`accrual`required	`required\|in:period_start,monthly`
`amount`required	`required\|numeric\|min:0`
`family_members`	`nullable\|integer\|min:0\|max:20`
`eligible_after_months`	`nullable\|integer\|min:0\|max:120`
`applies_to`required	`required\|in:all,assigned`
`expire_option`	`nullable\|in:after,immediately,none`
`expire_after_months`	`required_if:expire_option,after\|nullable\|integer\|min:1\|max:120`
`distribution`	`nullable\|in:per_person,shared`
`default_payroll`	`nullable\|in:in_payroll,off_cycle`
`default_request_type`	`nullable\|in:cash_out,ticket`
`transaction_type_id`	`nullable\|exists:transaction_types,id`
`gl_identifier`	`nullable\|string\|max:60`
`clearance_account`	`nullable\|string\|max:60`
`setups`	`nullable\|array\|max:30`
`setups.*.position_ids`	`nullable\|array`
`setups..position_ids.`	`integer\|exists:positions,id`
`setups.*.nationalities`	`nullable\|string\|max:500`
`setups.*.years_from`	`nullable\|numeric\|min:0\|max:60`
`setups.*.years_to`	`nullable\|numeric\|min:0\|max:60`
`setups.*.amount`	`nullable\|numeric\|min:0`
`setups.*.currency`	`nullable\|string\|max:3`
`setups.*.beneficiaries`	`nullable\|array`
`setups..beneficiaries..relation`	`nullable\|in:parent,spouse,child,sibling`
`setups..beneficiaries..deduction`	`nullable\|numeric\|min:0\|max:100`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/air-ticket-policies/{policy}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"apply_changes":"update","balance_date":"2026-11-01","name_ar":"...","name_en":"...","tickets":1.5,"period_months":1,"period_anchor":"hire","accrual":"period_start","amount":1.5,"family_members":1,"eligible_after_months":1,"applies_to":"all","expire_option":"after","expire_after_months":1,"distribution":"per_person","default_payroll":"in_payroll","default_request_type":"cash_out","transaction_type_id":"...","gl_identifier":"...","clearance_account":"...","setups":[]}'

DELETE /api/v1/app/companies/{company}/air-ticket-policies/{policy}

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`policy`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/air-ticket-policies/{policy}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/air-ticket-policies/{policy}/assign scope all | selected (employee_ids[]), opening_balance.

scope all | selected (employee_ids[]), opening_balance.

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`policy`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`scope`required	`required\|in:all,selected`
`employee_ids`	`required_if:scope,selected\|array`
`employee_ids.*`	`integer`
`opening_balance`	`nullable\|numeric\|min:0\|max:99`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/air-ticket-policies/{policy}/assign" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"scope":"all","employee_ids":[],"opening_balance":1.5}'

DELETE /api/v1/app/companies/{company}/air-ticket-policies/{policy}/employees/{employee}

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`policy`	integer	The record's ID.
`employee`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/air-ticket-policies/{policy}/employees/{employee}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

air-tickets 6 endpoints

GET /api/v1/app/companies/{company}/air-tickets Transactions in my scope with the screen's filters (employee_id, policy, status, payment,...

Transactions in my scope with the screen's filters (employee_id, policy, status, payment, payroll, request_status, from, to, paid_from, paid_to, resident_id).

Sign-in: App token or company API key
Permission: payroll.air_tickets.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/air-tickets" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/air-tickets/balances Every active employee's balance in my scope under each of their policies (policy filters o...

Every active employee's balance in my scope under each of their policies (policy filters one).

Sign-in: App token or company API key
Permission: payroll.air_tickets.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/air-tickets/balances" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/air-tickets

Sign-in: App token or company API key
Permission: payroll.air_tickets.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`employee_id`required	`required\|integer`
`policy_id`	`nullable\|integer`
`slice`	`nullable\|integer\|min:0`
`tickets`	`required_without:owners\|nullable\|array\|min:1\|max:20`
`tickets.*.owner`required	`required\|string\|max:20\|distinct`
`tickets.*.count`	`nullable\|numeric\|gt:0\|max:50`
`tickets.*.amount`	`nullable\|numeric\|min:0`
`owners`	`required_without:tickets\|nullable\|array\|min:1`
`owners.*`	`string\|max:20`
`cash_out`	`nullable\|boolean`
`amount`	`nullable\|numeric\|min:0`
`destination`	`nullable\|string\|max:150`
`travel_date`required	`required\|date`
`return_date`	`nullable\|date\|after_or_equal:travel_date`
`notes`	`nullable\|string\|'max:' . \App\Support\Limits::chars(500)`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/air-tickets" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"employee_id":1,"policy_id":1,"slice":1,"tickets":[],"owners":[],"cash_out":true,"amount":1.5,"destination":"...","travel_date":"2026-11-01","return_date":"2026-11-01","notes":"..."}'

POST /api/v1/app/companies/{company}/air-tickets/paid ids[], paid_at, payment_reference: booked (not cash out) unpaid ones are marked.

ids[], paid_at, payment_reference: booked (not cash out) unpaid ones are marked.

Sign-in: App token or company API key
Permission: payroll.air_tickets.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`ids`required	`required\|array\|min:1`
`ids.*`	`integer`
`paid_at`required	`required\|date`
`payment_reference`	`nullable\|string\|max:100`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/air-tickets/paid" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"ids":[],"paid_at":"2026-11-01","payment_reference":"..."}'

POST /api/v1/app/companies/{company}/air-tickets/bulk-delete ids[]: the unpaid ones are deleted; returns how many.

ids[]: the unpaid ones are deleted; returns how many.

Sign-in: App token or company API key
Permission: payroll.air_tickets.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`ids`required	`required\|array`
`ids.*`	`integer`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/air-tickets/bulk-delete" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"ids":[]}'

DELETE /api/v1/app/companies/{company}/air-tickets/{transaction}

Sign-in: App token or company API key
Permission: payroll.air_tickets.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`transaction`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/air-tickets/{transaction}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

announcements 9 endpoints

GET /api/v1/app/companies/{company}/announcements q: search; show; per_page. Only those the person may read (their targets; all with announc...

q: search; show; per_page. Only those the person may read (their targets; all with announcements.manage).

Sign-in: App token or company API key
Permission: self.announcements | announcements.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/announcements" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/announcements/{announcement}

Sign-in: App token or company API key
Permission: self.announcements | announcements.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`announcement`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/announcements/{announcement}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/announcements/{announcement}/read Marks one the person may read as read (their bell notice of it), as opening it on the scre...

Marks one the person may read as read (their bell notice of it), as opening it on the screen does.

Sign-in: App token or company API key
Permission: self.announcements | announcements.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`announcement`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/announcements/{announcement}/read" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/announcements/images/{file} A picture of the company's announcements (their text and galleries).

A picture of the company's announcements (their text and galleries).

Sign-in: App token or company API key
Permission: self.announcements | announcements.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`file`	string · [A-Za-z0-9_-]+\.(png\|jpe?g\|gif\|webp)	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/announcements/images/{file}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/announcements/{announcement}/attachments/{index} An attached file of an announcement the person may read (copied from ZenHR or added in Mih...

An attached file of an announcement the person may read (copied from ZenHR or added in Mihnaro).

Sign-in: App token or company API key
Permission: self.announcements | announcements.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`announcement`	integer	The record's ID.
`index`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/announcements/{announcement}/attachments/{index}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/announcements/media Multipart: file, kind (image: for the text or the gallery; file: an attachment). Returns t...

Multipart: file, kind (image: for the text or the gallery; file: an attachment). Returns the file to save with.

Sign-in: App token or company API key
Permission: announcements.create | announcements.edit
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/announcements/media" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/announcements title {en, ar}, body {en, ar}, pinned, starts_on, expires_on, gallery, attachments, target...

title {en, ar}, body {en, ar}, pinned, starts_on, expires_on, gallery, attachments, targets (Announcements::save). The people it is for are notified.

Sign-in: App token or company API key
Permission: announcements.create
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`title`required	`required\|array`
`title.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(200)`
`title.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(200)`
`body`required	`required\|array`
`body.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(200000)`
`body.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(200000)`
`starts_on`	`nullable\|date`
`expires_on`	`nullable\|date\|after_or_equal:starts_on`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/announcements" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"title":{"en":"...","ar":"..."},"body":{"en":"...","ar":"..."},"starts_on":"2026-11-01","expires_on":"2026-11-01"}'

PATCH PUT /api/v1/app/companies/{company}/announcements/{announcement}

Sign-in: App token or company API key
Permission: announcements.edit
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`announcement`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/announcements/{announcement}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/announcements/{announcement}

Sign-in: App token or company API key
Permission: announcements.delete
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`announcement`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/announcements/{announcement}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

api-keys 4 endpoints

GET /api/v1/app/companies/{company}/api-keys

Sign-in: App token or company API key
Permission: integrations.api_keys.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/api-keys" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/api-keys POST api-keys: the token is in the answer this once.

POST api-keys: the token is in the answer this once.

Sign-in: App token or company API key
Permission: integrations.api_keys.manage
Rate limit: 20 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`	`$req\|string\|max:100`
`abilities`	`$req\|array\|min:1`
`abilities.*`	`in:read,write,update,delete`
`ip_addresses`	`sometimes\|nullable\|string\|max:1000`
`expires_on`	`sometimes\|nullable\|date\|after:today`
`user_id`	`sometimes\|nullable\|integer`
`auth_type`	`sometimes\|in:basic,oauth1,oauth2,credentials`
`consumer_key`	`sometimes\|nullable\|string\|max:190`
`consumer_secret`	`sometimes\|nullable\|string\|max:500`
`realm`	`sometimes\|nullable\|string\|max:190`
`client_id`	`sometimes\|nullable\|string\|max:190`
`client_secret`	`sometimes\|nullable\|string\|max:500`
`username`	`sometimes\|nullable\|string\|max:190`
`password`	`sometimes\|nullable\|string\|max:500`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/api-keys" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":"...","abilities":[],"ip_addresses":"...","expires_on":"2026-11-01","user_id":1,"auth_type":"basic","consumer_key":"...","consumer_secret":"...","realm":"...","client_id":"...","client_secret":"...","username":"...","password":"..."}'

PATCH PUT /api/v1/app/companies/{company}/api-keys/{apiKey}

Sign-in: App token or company API key
Permission: integrations.api_keys.manage
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`apiKey`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`	`$req\|string\|max:100`
`abilities`	`$req\|array\|min:1`
`abilities.*`	`in:read,write,update,delete`
`ip_addresses`	`sometimes\|nullable\|string\|max:1000`
`expires_on`	`sometimes\|nullable\|date\|after:today`
`user_id`	`sometimes\|nullable\|integer`
`auth_type`	`sometimes\|in:basic,oauth1,oauth2,credentials`
`consumer_key`	`sometimes\|nullable\|string\|max:190`
`consumer_secret`	`sometimes\|nullable\|string\|max:500`
`realm`	`sometimes\|nullable\|string\|max:190`
`client_id`	`sometimes\|nullable\|string\|max:190`
`client_secret`	`sometimes\|nullable\|string\|max:500`
`username`	`sometimes\|nullable\|string\|max:190`
`password`	`sometimes\|nullable\|string\|max:500`

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/api-keys/{apiKey}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":"...","abilities":[],"ip_addresses":"...","expires_on":"2026-11-01","user_id":1,"auth_type":"basic","consumer_key":"...","consumer_secret":"...","realm":"...","client_id":"...","client_secret":"...","username":"...","password":"..."}'

POST /api/v1/app/companies/{company}/api-keys/{apiKey}/revoke

Sign-in: App token or company API key
Permission: integrations.api_keys.manage
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`apiKey`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/api-keys/{apiKey}/revoke" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

app-activity 1 endpoint

GET /api/v1/app/companies/{company}/app-activity GET app-activity: the sign-in activity of the people in the app_devices.view scope (filter...

GET app-activity: the sign-in activity of the people in the app_devices.view scope (filters: user_id, install_id, device_id, event, result, from, to).

Sign-in: App token or company API key
Permission: app_devices.view
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/app-activity" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

app-devices 10 endpoints

GET /api/v1/app/companies/{company}/app-devices GET app-devices: the phones of the people in the app_devices.view scope, with the summary...

GET app-devices: the phones of the people in the app_devices.view scope, with the summary (docs/platform-control.md).

Sign-in: App token or company API key
Permission: app_devices.view
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/app-devices" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/app-devices/people/{user} GET app-devices/people/{user}: one person's phones with their IPs and timelines (the perso...

GET app-devices/people/{user}: one person's phones with their IPs and timelines (the person themselves, or app_devices.view in scope).

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`user`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/app-devices/people/{user}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/app-devices/people/{user}/context GET app-devices/people/{user}/context (app_devices.context, docs/platform-control.md «بيان...

GET app-devices/people/{user}/context (app_devices.context, docs/platform-control.md «بيانات الهاتف»): the phone details this company's switches collected for a person in scope, latest per phone and the history.

Sign-in: App token or company API key
Permission: app_devices.context
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`user`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/app-devices/people/{user}/context" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/app-devices/phones/{install}/test-push POST app-devices/phones/{install}/test-push (app_devices.test_push, docs/notifications.md...

POST app-devices/phones/{install}/test-push (app_devices.test_push, docs/notifications.md «الإشعار التجريبي»): what Apple or Google answered.

Sign-in: App token or company API key
Permission: app_devices.test_push
Rate limit: 10 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`install`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/app-devices/phones/{install}/test-push" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/app-devices/shared GET app-devices/shared: the phones in scope used by more than one account (the fleet filte...

GET app-devices/shared: the phones in scope used by more than one account (the fleet filters too).

Sign-in: App token or company API key
Permission: app_devices.view
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/app-devices/shared" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/app-devices/allowances GET app-devices/allowances (?phone_key=, ?active=1): HR's exceptions for the people in sco...

GET app-devices/allowances (?phone_key=, ?active=1): HR's exceptions for the people in scope.

Sign-in: App token or company API key
Permission: app_devices.view
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/app-devices/allowances" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/app-devices/allowances POST app-devices/allowances: user_id, install_id (or phone_key), reason.

POST app-devices/allowances: user_id, install_id (or phone_key), reason.

Sign-in: App token or company API key
Permission: app_devices.allow_shared
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`user_id`required	`required\|integer`
`install_id`	`nullable\|integer\|required_without:phone_key`
`phone_key`	`nullable\|string\|max:140\|required_without:install_id`
`reason`required	`required\|string\|min:3\|'max:' . \App\Support\Limits::chars(500)`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/app-devices/allowances" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"user_id":1,"install_id":1,"phone_key":"...","reason":"..."}'

DELETE /api/v1/app/companies/{company}/app-devices/allowances/{allowance} DELETE app-devices/allowances/{id}: takes the exception back.

DELETE app-devices/allowances/{id}: takes the exception back.

Sign-in: App token or company API key
Permission: app_devices.allow_shared
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`allowance`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/app-devices/allowances/{allowance}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/app-devices/not-on-app GET app-devices/not-on-app: q, branch_id, account (yes|no); page, per_page.

GET app-devices/not-on-app: q, branch_id, account (yes|no); page, per_page.

Sign-in: App token or company API key
Permission: app_devices.view
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/app-devices/not-on-app" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/app-devices/reminders POST app-devices/reminders: channel (email|whatsapp), employee_ids[] or all=true (with fil...

POST app-devices/reminders: channel (email|whatsapp), employee_ids[] or all=true (with filters {q, branch_id, account}).

Sign-in: App token or company API key
Permission: app_devices.remind
Rate limit: 10 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`channel`required	`required\|in:email,whatsapp`
`all`	`sometimes\|boolean`
`employee_ids`	`required_without:all\|array\|max:500`
`employee_ids.*`	`integer`
`filters`	`sometimes\|array`
`q`	`nullable\|string\|'max:' . \App\Support\Limits::chars(100)`
`branch_id`	`nullable\|integer`
`account`	`nullable\|in:yes,no`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/app-devices/reminders" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"channel":"email","all":true,"employee_ids":[],"filters":[],"q":"...","branch_id":1,"account":"yes"}'

app-policy 2 endpoints

GET /api/v1/app/companies/{company}/app-policy Every mobile app rule for the signed-in employee: {live_location, app_lock, punch_auth} (d...

Every mobile app rule for the signed-in employee: {live_location, app_lock, punch_auth} (docs/live-location.md).

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/app-policy" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/app-policy/screen-captures/{kind} The app saw a screenshot (iOS can't stop one, only black it out) or a screen recording sta...

The app saw a screenshot (iOS can't stop one, only black it out) or a screen recording start while it blocks them. Nothing is stored here: the activity log keeps the request (route app-policy.screen-captures, the kind in the path).

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 30 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`kind`	string · screenshot\|recording	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/app-policy/screen-captures/{kind}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

approval-chains 1 endpoint

PUT /api/v1/app/companies/{company}/approval-chains chain_<kind> per kind: a CHAINS value, "tpl:<id>", or "none" (salary batches).

chain_<kind> per kind: a CHAINS value, "tpl:<id>", or "none" (salary batches).

Sign-in: App token or company API key
Permission: approval_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/approval-chains" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

approval-setup 2 endpoints

GET /api/v1/app/companies/{company}/approval-setup Approval chains of each request kind ('' = the kind's default), and the approval templates...

Approval chains of each request kind ('' = the kind's default), and the approval templates.

Sign-in: App token or company API key
Permission: approval_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/approval-setup" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/approval-setup/approvers GET approval-setup/approvers: who "Approved By" can name for a template (template_id) or a...

GET approval-setup/approvers: who "Approved By" can name for a template (template_id) or a new one, from its own branch only.

Sign-in: App token or company API key
Permission: approval_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/approval-setup/approvers" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

approval-templates 3 endpoints

POST /api/v1/app/companies/{company}/approval-templates

Sign-in: App token or company API key
Permission: approval_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`required	`required\|array`
`name.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(100)`
`name.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(100)`
`object_type`	`nullable\|in:leave,transaction,overtime,general,air_ticket,payroll_batch,in_advance_salary,loan,salary_adjustment,missing_punch,business_trip,suspension,expense,vacation_resumption,vacation_encashment,hr_letter,timesheet`
`object_id`	`nullable\|integer`
`assign`	`nullable\|array`
`assign.*`	`nullable\|array`
`steps`required	`required\|array\|min:1\|max:8`
`steps.*.kind`required	`required\|string`
`steps.*.members`	`nullable\|array`
`skip_after`	`nullable\|integer\|min:0\|max:720`
`skip_after_unit`	`nullable\|in:days,hours`
`notify_user_ids`	`nullable\|array`
`overrider_ids`	`nullable\|array`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/approval-templates" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":{"en":"...","ar":"..."},"object_type":"leave","object_id":1,"assign":[],"steps":[],"skip_after":1,"skip_after_unit":"days","notify_user_ids":[],"overrider_ids":[]}'

PATCH PUT /api/v1/app/companies/{company}/approval-templates/{template}

Sign-in: App token or company API key
Permission: approval_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`template`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/approval-templates/{template}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/approval-templates/{template}

Sign-in: App token or company API key
Permission: approval_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`template`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/approval-templates/{template}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

approvals 6 endpoints

GET /api/v1/app/companies/{company}/approvals The approvals page: tab (approvals, my, team, override), status, type. Leave requests and...

The approvals page: tab (approvals, my, team, override), status, type. Leave requests and employee requests together.

Sign-in: App token or company API key
Permission: self.approvals.decide | requests.view | requests.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

`tab`	`nullable\|'in:' . implode(',', $tabs)`
`status`	`nullable\|in:all,pending,approved,rejected,withdrawn,cancelled`
`type`	`nullable\|string`
`my_action`	`nullable\|in:waiting,pending,approved,rejected,withdrawn,approved_non_deduct,added_by_hr,delegated,skipped,cancelled,cancel_requested,none`
`f`	`nullable\|array`
`action_type`	`nullable\|in:approval,cancellation`
`employee`	`nullable\|integer`
`sort`	`nullable\|in:employee,serial,requested,received,my_action`
`dir`	`nullable\|in:asc,desc`

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/approvals?tab=...&status=all&type=...&my_action=waiting" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/approvals/override Override approvals: decide a request waiting on someone else. item is "leave:ID" or "reque...

Override approvals: decide a request waiting on someone else. item is "leave:ID" or "request:ID".

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`item`required	`required\|string\|regex:/^(leave\|request):\d+$/`
`decision`required	`required\|in:approved,rejected`
`decision_note`	`nullable\|string\|max:500`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/approvals/override" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"item":"...","decision":"approved","decision_note":"..."}'

POST /api/v1/app/companies/{company}/approvals/bulk Approve or reject several items; the ones that can't be decided are skipped.

Approve or reject several items; the ones that can't be decided are skipped.

Sign-in: App token or company API key
Permission: self.approvals.decide | requests.view | requests.manage
Module: hrm
Rate limit: 30 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`items`required	`required\|array\|min:1\|max:200`
`items.*`	`string\|regex:/^(leave\|request):\d+$/`
`decision`required	`required\|in:approved,rejected`
`decision_note`	`nullable\|string\|max:500`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/approvals/bulk" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"items":[],"decision":"approved","decision_note":"..."}'

GET /api/v1/app/companies/{company}/approvals/delegations Approval delegations I gave or received (ZenHR's "Delegated").

Approval delegations I gave or received (ZenHR's "Delegated").

Sign-in: App token or company API key
Permission: self.approvals.delegate | requests.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/approvals/delegations" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/approvals/delegations Delegate my approvals: delegate_id (a user of the company), starts_on, ends_on (empty = un...

Delegate my approvals: delegate_id (a user of the company), starts_on, ends_on (empty = until ended), note.

Sign-in: App token or company API key
Permission: self.approvals.delegate | requests.manage
Module: hrm
Rate limit: 20 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`delegate_id`required	`required\|integer\|Rule::notIn([$user->id])\|exists:company_user,user_id`
`starts_on`required	`required\|date`
`ends_on`	`nullable\|date\|after_or_equal:starts_on`
`note`	`nullable\|string\|'max:' . \App\Support\Limits::chars(300)`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/approvals/delegations" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"delegate_id":1,"starts_on":"2026-11-01","ends_on":"2026-11-01","note":"..."}'

DELETE /api/v1/app/companies/{company}/approvals/delegations/{delegation}

Sign-in: App token or company API key
Permission: self.approvals.delegate | requests.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`delegation`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/approvals/delegations/{delegation}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

assessments 28 endpoints

GET /api/v1/app/companies/{company}/assessments/summary

Sign-in: App token or company API key
Permission: assessments.manage.* | assessments.grade
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/assessments/summary" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/assessments/grading Attempts waiting for a person, with the answers to grade.

Attempts waiting for a person, with the answers to grade.

Sign-in: App token or company API key
Permission: assessments.manage.* | assessments.grade
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/assessments/grading" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/assessments/attempts/{attempt} An attempt with every answer, the right ones and the anti-cheating log.

An attempt with every answer, the right ones and the anti-cheating log.

Sign-in: App token or company API key
Permission: assessments.manage.* | assessments.grade
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`attempt`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/assessments/attempts/{attempt}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/assessments/answers/{answer}/grade points (0 to the question's points), note; reason when changing a grade already given (an...

points (0 to the question's points), note; reason when changing a grade already given (an automatic one too).

Sign-in: App token or company API key
Permission: assessments.manage.* | assessments.grade
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`answer`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`points`required	`required\|numeric\|min:0\|'max:' . $max`
`note`	`nullable\|string\|'max:' . \App\Support\Limits::chars(2000)`
`reason`	`Rule::requiredIf($changing)\|nullable\|string\|min:3\|'max:' . \App\Support\Limits::chars(500)`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/assessments/answers/{answer}/grade" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"points":1.5,"note":"...","reason":"..."}'

GET /api/v1/app/companies/{company}/assessments/answers/{answer}/media

Sign-in: App token or company API key
Permission: assessments.manage.* | assessments.grade
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`answer`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/assessments/answers/{answer}/media" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/assessments/tests/{test}/results Every attempt with its score and checks, and how each question did.

Every attempt with its score and checks, and how each question did.

Sign-in: App token or company API key
Permission: assessments.manage.* | assessments.grade
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`test`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/assessments/tests/{test}/results" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/assessments/tests/{test}/export

Sign-in: App token or company API key
Permission: assessments.manage.* | assessments.grade
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`test`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/assessments/tests/{test}/export" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/assessments/invitations Filters: test, status, candidate, employee.

Filters: test, status, candidate, employee.

Sign-in: App token or company API key
Permission: assessments.manage.* | assessments.grade
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/assessments/invitations" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/assessments/templates

Sign-in: App token or company API key
Permission: assessments.manage.* | assessments.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/assessments/templates" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/assessments/templates/{key}

Sign-in: App token or company API key
Permission: assessments.manage.* | assessments.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`key`	string · [a-z_]+	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/assessments/templates/{key}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/assessments/categories

Sign-in: App token or company API key
Permission: assessments.manage.* | assessments.questions.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/assessments/categories" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/assessments/categories name {en, ar}, description {en, ar}, competency_id.

name {en, ar}, description {en, ar}, competency_id.

Sign-in: App token or company API key
Permission: assessments.manage.* | assessments.questions.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`required	`required\|array`
`name.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(120)`
`name.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(120)`
`description`	`nullable\|array`
`description.en`	`nullable\|string\|'max:' . \App\Support\Limits::chars(1000)`
`description.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(1000)`
`competency_id`	`nullable\|integer\|exists:competencies,id`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/assessments/categories" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":{"en":"...","ar":"..."},"description":{"en":"...","ar":"..."},"competency_id":1}'

PATCH PUT /api/v1/app/companies/{company}/assessments/categories/{category}

Sign-in: App token or company API key
Permission: assessments.manage.* | assessments.questions.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`category`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/assessments/categories/{category}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/assessments/categories/{category}

Sign-in: App token or company API key
Permission: assessments.manage.* | assessments.questions.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`category`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/assessments/categories/{category}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/assessments/questions Filters: category, type, difficulty, active, q.

Filters: category, type, difficulty, active, q.

Sign-in: App token or company API key
Permission: assessments.manage.* | assessments.questions.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/assessments/questions" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/assessments/questions/{question}

Sign-in: App token or company API key
Permission: assessments.manage.* | assessments.questions.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`question`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/assessments/questions/{question}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/assessments/questions/{question}/media

Sign-in: App token or company API key
Permission: assessments.manage.* | assessments.questions.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`question`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/assessments/questions/{question}/media" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/assessments/questions type, assessment_category_id, difficulty, prompt {en, ar}, options [{key?, text {en, ar}}]...

type, assessment_category_id, difficulty, prompt {en, ar}, options [{key?, text {en, ar}}], targets, answer, points, time_limit_seconds, explanation, is_active.

Sign-in: App token or company API key
Permission: assessments.manage.* | assessments.questions.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`type`required	`required\|in:single,multiple,true_false,short_text,long_text,ordering,matching,numeric,file_upload`
`assessment_category_id`	`nullable\|integer\|exists:assessment_categories,id`
`difficulty`required	`required\|in:easy,medium,hard`
`prompt`required	`required\|array`
`prompt.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(5000)`
`prompt.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(5000)`
`explanation`	`nullable\|array`
`explanation.en`	`nullable\|string\|'max:' . \App\Support\Limits::chars(2000)`
`explanation.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(2000)`
`points`required	`required\|numeric\|min:0.25\|max:100`
`time_limit_seconds`	`nullable\|integer\|between:10,3600`
`is_active`	`sometimes\|boolean`
`options`	`Rule::requiredIf(in_array($type, ['single', 'multiple', 'ordering', 'matching'],...\|nullable\|array\|max:12`
`options.*.key`	`nullable\|string\|max:20`
`options.*.text`required	`required\|array`
`options.*.text.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(500)`
`options.*.text.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(500)`
`targets`	`Rule::requiredIf($type === 'matching')\|nullable\|array\|max:12`
`targets.*.key`	`nullable\|string\|max:20`
`targets.*.text`required	`required\|array`
`targets.*.text.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(500)`
`targets.*.text.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(500)`
`answer`	`nullable`
`correct`	`nullable`
`remove_media`	`nullable\|boolean`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/assessments/questions" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"type":"single","assessment_category_id":1,"difficulty":"easy","prompt":{"en":"...","ar":"..."},"explanation":{"en":"...","ar":"..."},"points":1.5,"time_limit_seconds":1,"is_active":true,"options":[],"targets":[],"answer":"...","correct":"...","remove_media":true}'

PATCH PUT /api/v1/app/companies/{company}/assessments/questions/{question}

Sign-in: App token or company API key
Permission: assessments.manage.* | assessments.questions.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`question`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/assessments/questions/{question}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/assessments/questions/{question}

Sign-in: App token or company API key
Permission: assessments.manage.* | assessments.questions.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`question`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/assessments/questions/{question}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/assessments/tests Filters: status, purpose, q.

Filters: status, purpose, q.

Sign-in: App token or company API key
Permission: assessments.manage.*
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/assessments/tests" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/assessments/tests/{test} A test with its items.

A test with its items.

Sign-in: App token or company API key
Permission: assessments.manage.*
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`test`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/assessments/tests/{test}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/assessments/tests title, description, instructions ({en, ar}), purpose, time_limit_minutes, shuffle_question...

title, description, instructions ({en, ar}), purpose, time_limit_minutes, shuffle_questions, shuffle_options, attempts_allowed, pass_mark, negative_marking, negative_ratio, show_score, competency_id, pass_stage, fail_stage, status, items.

Sign-in: App token or company API key
Permission: assessments.manage.* | assessments.tests.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`title`required	`required\|array`
`title.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`title.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(150)`
`description`	`nullable\|array`
`description.en`	`nullable\|string\|'max:' . \App\Support\Limits::chars(2000)`
`description.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(2000)`
`instructions`	`nullable\|array`
`instructions.en`	`nullable\|string\|'max:' . \App\Support\Limits::chars(3000)`
`instructions.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(3000)`
`purpose`required	`required\|in:pre_employment,post_employment`
`time_limit_minutes`	`nullable\|integer\|between:1,480`
`shuffle_questions`	`boolean`
`shuffle_options`	`boolean`
`negative_marking`	`boolean`
`show_score`	`boolean`
`attempts_allowed`required	`required\|integer\|between:1,10`
`pass_mark`required	`required\|numeric\|between:0,100`
`negative_ratio`	`nullable\|numeric\|between:0,1`
`competency_id`	`nullable\|integer\|exists:competencies,id`
`pass_stage`	`nullable\|Rule::in($stages)`
`fail_stage`	`nullable\|Rule::in($stages)`
`status`required	`required\|in:draft,active,archived`
`items`	`nullable\|array\|max:200`
`items.*.kind`required	`required\|in:question,random`
`items.*.assessment_question_id`	`required_if:items.*.kind,question\|nullable\|integer\|exists:assessment_questions,id`
`items.*.assessment_category_id`	`required_if:items.*.kind,random\|nullable\|integer\|exists:assessment_categories,id`
`items.*.difficulty`	`nullable\|in:easy,medium,hard`
`items.*.draw_count`	`required_if:items.*.kind,random\|nullable\|integer\|between:1,100`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/assessments/tests" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"title":{"en":"...","ar":"..."},"description":{"en":"...","ar":"..."},"instructions":{"en":"...","ar":"..."},"purpose":"pre_employment","time_limit_minutes":1,"shuffle_questions":true,"shuffle_options":true,"negative_marking":true,"show_score":true,"attempts_allowed":1,"pass_mark":1.5,"negative_ratio":1.5,"competency_id":1,"pass_stage":"...","fail_stage":"...","status":"draft","items":[]}'

PATCH PUT /api/v1/app/companies/{company}/assessments/tests/{test}

Sign-in: App token or company API key
Permission: assessments.manage.* | assessments.tests.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`test`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/assessments/tests/{test}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/assessments/tests/{test}

Sign-in: App token or company API key
Permission: assessments.manage.* | assessments.tests.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`test`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/assessments/tests/{test}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/assessments/tests/{test}/invitations candidate_ids, employee_ids, expires_at, locale. The candidates' links are in the answer.

candidate_ids, employee_ids, expires_at, locale. The candidates' links are in the answer.

Sign-in: App token or company API key
Permission: assessments.manage.* | assessments.invite
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`test`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`candidate_ids`	`nullable\|array\|max:200`
`candidate_ids.*`	`integer\|exists:candidates,id`
`employee_ids`	`nullable\|array\|max:500`
`employee_ids.*`	`integer\|exists:employees,id`
`expires_at`	`nullable\|date\|after:now`
`locale`	`nullable\|in:en,ar`
`pass_stage`	`nullable\|Rule::in(array_diff(\App\Models\Candidate::STAGES, ['hired']))`
`fail_stage`	`nullable\|Rule::in(array_diff(\App\Models\Candidate::STAGES, ['hired']))`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/assessments/tests/{test}/invitations" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"candidate_ids":[],"employee_ids":[],"expires_at":"2026-11-01","locale":"en","pass_stage":"...","fail_stage":"..."}'

POST /api/v1/app/companies/{company}/assessments/invitations/{invitation}/cancel

Sign-in: App token or company API key
Permission: assessments.manage.* | assessments.invite
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`invitation`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/assessments/invitations/{invitation}/cancel" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/assessments/invitations/{invitation}/resend expires_at (optional; required when the link has expired). sent and reason (sandbox, mail_...

expires_at (optional; required when the link has expired). sent and reason (sandbox, mail_off, employees_held, no_email, failed) say what happened.

Sign-in: App token or company API key
Permission: assessments.manage.* | assessments.invite
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`invitation`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

expires_at nullable|date|after:now

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/assessments/invitations/{invitation}/resend" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"expires_at":"2026-11-01"}'

asset-types 4 endpoints

GET /api/v1/app/companies/{company}/asset-types

Sign-in: App token or company API key
Permission: assets.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/asset-types" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/asset-types name {en, ar}, branch_ids (ids, or ["all"]), active.

name {en, ar}, branch_ids (ids, or ["all"]), active.

Sign-in: App token or company API key
Permission: assets.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`required	`required\|array`
`name.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(100)`
`name.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(100)`
`branch_ids`required	`required\|array\|min:1`
`branch_ids.*`	`string`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/asset-types" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":{"en":"...","ar":"..."},"branch_ids":[]}'

PATCH PUT /api/v1/app/companies/{company}/asset-types/{assetType}

Sign-in: App token or company API key
Permission: assets.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`assetType`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`required	`required\|array`
`name.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(100)`
`name.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(100)`
`branch_ids`required	`required\|array\|min:1`
`branch_ids.*`	`string`

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/asset-types/{assetType}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":{"en":"...","ar":"..."},"branch_ids":[]}'

DELETE /api/v1/app/companies/{company}/asset-types/{assetType}

Sign-in: App token or company API key
Permission: assets.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`assetType`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/asset-types/{assetType}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

assets 8 endpoints

GET /api/v1/app/companies/{company}/assets The list: status, type, owner (branch id or none), holder, expiry_from, expiry_to, q.

The list: status, type, owner (branch id or none), holder, expiry_from, expiry_to, q.

Sign-in: App token or company API key
Permission: assets.manage | assets.create | assets.edit | assets.delete | assets.assign | assets.status
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/assets" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/assets

Sign-in: App token or company API key
Permission: assets.create
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`asset_type_id`required	`required\|integer\|exists:asset_types,id`
`name`required	`required\|string\|max:150`
`serial_number`required	`required\|string\|max:100\|unique:assets,serial_number`
`owner_branch_id`	`nullable\|integer\|exists:branches,id`
`purchase_date`	`nullable\|date\|before_or_equal:today`
`value`	`nullable\|numeric\|min:0`
`notes`	`nullable\|string\|'max:' . \App\Support\Limits::chars(1000)`
`description`	`nullable\|string\|'max:' . \App\Support\Limits::chars(1000)`
`owner`	`nullable\|string\|max:150`
`production_date`	`nullable\|date`
`expiry_date`	`nullable\|date\|after_or_equal:production_date`
`attachments`	`nullable\|array\|max:10`
`attachments.*`	`file\|mimes:png,jpg,jpeg,pdf,doc,docx,txt,rtf\|max:10240`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/assets" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"asset_type_id":1,"name":"...","serial_number":"...","owner_branch_id":1,"purchase_date":"2026-11-01","value":1.5,"notes":"...","description":"...","owner":"...","production_date":"2026-11-01","expiry_date":"2026-11-01","attachments":[]}'

GET /api/v1/app/companies/{company}/assets/{asset} An asset and its history.

An asset and its history.

Sign-in: App token or company API key
Permission: assets.manage | assets.create | assets.edit | assets.delete | assets.assign | assets.status
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`asset`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/assets/{asset}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH PUT /api/v1/app/companies/{company}/assets/{asset}

Sign-in: App token or company API key
Permission: assets.edit
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`asset`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`asset_type_id`required	`required\|integer\|exists:asset_types,id`
`name`required	`required\|string\|max:150`
`serial_number`required	`required\|string\|max:100\|unique:assets,serial_number`
`owner_branch_id`	`nullable\|integer\|exists:branches,id`
`purchase_date`	`nullable\|date\|before_or_equal:today`
`value`	`nullable\|numeric\|min:0`
`notes`	`nullable\|string\|'max:' . \App\Support\Limits::chars(1000)`
`description`	`nullable\|string\|'max:' . \App\Support\Limits::chars(1000)`
`owner`	`nullable\|string\|max:150`
`production_date`	`nullable\|date`
`expiry_date`	`nullable\|date\|after_or_equal:production_date`
`attachments`	`nullable\|array\|max:10`
`attachments.*`	`file\|mimes:png,jpg,jpeg,pdf,doc,docx,txt,rtf\|max:10240`

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/assets/{asset}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"asset_type_id":1,"name":"...","serial_number":"...","owner_branch_id":1,"purchase_date":"2026-11-01","value":1.5,"notes":"...","description":"...","owner":"...","production_date":"2026-11-01","expiry_date":"2026-11-01","attachments":[]}'

DELETE /api/v1/app/companies/{company}/assets/{asset}

Sign-in: App token or company API key
Permission: assets.delete
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`asset`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/assets/{asset}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/assets/{asset}/assign Hand it to an employee in scope: assigned_to, assigned_at, return_date, notes, attachments...

Hand it to an employee in scope: assigned_to, assigned_at, return_date, notes, attachments[].

Sign-in: App token or company API key
Permission: assets.assign
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`asset`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`assigned_to`required	`required\|integer`
`assigned_at`	`nullable\|date`
`return_date`	`nullable\|date\|after_or_equal:assigned_at`
`notes`	`nullable\|string\|max:10240`
`attachments`	`nullable\|array\|max:10`
`attachments.*`	`file\|mimes:png,jpg,jpeg,pdf,doc,docx,txt,rtf\|max:10240`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/assets/{asset}/assign" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"assigned_to":1,"assigned_at":"2026-11-01","return_date":"2026-11-01","notes":"...","attachments":[]}'

POST /api/v1/app/companies/{company}/assets/{asset}/release Take it back: it becomes available.

Take it back: it becomes available.

Sign-in: App token or company API key
Permission: assets.assign
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`asset`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/assets/{asset}/release" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/assets/{asset}/status status: damaged, under_repair, archived or available.

status: damaged, under_repair, archived or available.

Sign-in: App token or company API key
Permission: assets.status
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`asset`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/assets/{asset}/status" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

attendance 19 endpoints

POST /api/v1/app/companies/{company}/attendance/clock-in

Sign-in: App token or company API key
Permission: self.clock
Module: hrm
Rate limit: 20 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`attendance_function_id`	`nullable\|integer\|exists:attendance_functions,id`
`photo`required	`required\|image\|max:10240`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/attendance/clock-in" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -F "attendance_function_id=1" \
  -F "[email protected]"

POST /api/v1/app/companies/{company}/attendance/clock-out

Sign-in: App token or company API key
Permission: self.clock
Module: hrm
Rate limit: 20 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

photorequired required|image|max:10240

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/attendance/clock-out" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -F "[email protected]"

POST /api/v1/app/companies/{company}/attendance/scan Scanning a work location's QR code (the mobile app reads the code's link /clock/qr/{token}...

Scanning a work location's QR code (the mobile app reads the code's link /clock/qr/{token}?t=&s=): clocks out if a shift is open, otherwise in, with the same checks as the link. token, t and s from the code.

Sign-in: App token or company API key
Permission: self.clock
Module: hrm
Rate limit: 20 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`token`required	`required\|string\|max:100`
`t`	`nullable\|integer`
`s`	`nullable\|string\|max:64`
`attendance_function_id`	`nullable\|integer\|exists:attendance_functions,id`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/attendance/scan" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"token":"...","t":1,"s":"...","attendance_function_id":1}'

GET /api/v1/app/companies/{company}/attendance/punch-log The punch log: employee, branch, from, to, channel, device, ip, flagged, status, review; f...

The punch log: employee, branch, from, to, channel, device, ip, flagged, status, review; format=csv|xlsx for the branded export.

Sign-in: App token or company API key
Permission: attendance.security.review
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

`from`	`nullable\|date_format:Y-m-d`
`to`	`nullable\|date_format:Y-m-d`
`employee`	`nullable\|integer`
`branch`	`nullable\|integer`
`format`	`nullable\|in:json,csv,xlsx`

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/attendance/punch-log?from=2026-11-01&to=2026-11-01&employee=1&branch=1" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/attendance/punch-log/{context}

Sign-in: App token or company API key
Permission: attendance.security.review
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`context`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/attendance/punch-log/{context}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/attendance/punch-log/{context}/decide decision: approve or reject; note; approve_device to approve its pending device too.

decision: approve or reject; note; approve_device to approve its pending device too.

Sign-in: App token or company API key
Permission: attendance.security.review
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`context`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`decision`required	`required\|in:approve,reject`
`note`	`nullable\|string\|'max:' . \App\Support\Limits::chars(500)`
`approve_device`	`nullable\|boolean`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/attendance/punch-log/{context}/decide" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"decision":"approve","note":"...","approve_device":true}'

GET /api/v1/app/companies/{company}/attendance/team The team's month: totals per employee in reach (attendance.view).

The team's month: totals per employee in reach (attendance.view).

Sign-in: App token or company API key
Permission: attendance.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/attendance/team" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/attendance/today One day of the team (docs/mobile-hrm.md): date (today by default).

One day of the team (docs/mobile-hrm.md): date (today by default).

Sign-in: App token or company API key
Permission: attendance.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

date nullable|date_format:Y-m-d

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/attendance/today?date=2026-11-01" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/attendance/records Attendance records: from, to, employee, shift (work shift id), state (incomplete, complete...

Attendance records: from, to, employee, shift (work shift id), state (incomplete, complete, trusted).

Sign-in: App token or company API key
Permission: attendance.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

`from`	`nullable\|date`
`to`	`nullable\|date`
`employee`	`nullable\|integer`
`shift`	`nullable\|integer`
`state`	`nullable\|in:incomplete,complete,trusted`

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/attendance/records?from=2026-11-01&to=2026-11-01&employee=1&shift=1" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/attendance/records Add a record, or with "replace": true correct the day (its records are replaced).

Add a record, or with "replace": true correct the day (its records are replaced).

Sign-in: App token or company API key
Permission: attendance.records.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`employee_id`required	`required\|integer`
`work_date`required	`required\|date\|before_or_equal:today`
`clock_in`required	`required\|date_format:H:i`
`clock_out`	`nullable\|date_format:H:i\|after:clock_in`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/attendance/records" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"employee_id":1,"work_date":"2026-11-01","clock_in":"2026-11-01","clock_out":"2026-11-01"}'

POST /api/v1/app/companies/{company}/attendance/records/{record}/trust

Sign-in: App token or company API key
Permission: attendance.records.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`record`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/attendance/records/{record}/trust" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/attendance/sheets ZenHR's Attendance Sheets: sheets imported from machines. Filters: machine (device id), st...

ZenHR's Attendance Sheets: sheets imported from machines. Filters: machine (device id), status, from, to (import date).

Sign-in: App token or company API key
Permission: attendance.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

`machine`	`nullable\|integer`
`status`	`nullable\|in:completed,with_errors,failed`
`from`	`nullable\|date_format:Y-m-d`
`to`	`nullable\|date_format:Y-m-d`

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/attendance/sheets?machine=1&status=completed&from=2026-11-01&to=2026-11-01" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/attendance/sheets/template/{device} A machine's blank attendance sheet in its template (rows of cells; the first is the headin...

A machine's blank attendance sheet in its template (rows of cells; the first is the headings).

Sign-in: App token or company API key
Permission: attendance.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`device`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/attendance/sheets/template/{device}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/attendance/day-analysis ZenHR history (docs/zenhr-import.md): kind days (day analysis) or punches (punch details)...

ZenHR history (docs/zenhr-import.md): kind days (day analysis) or punches (punch details) for attendance.view, balances (vacation balances by year) for leaves.manage. Filters: employee, from, to, status (days), type, year (balances).

Sign-in: App token or company API key
Permission: attendance.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

`employee`	`nullable\|integer`
`from`	`nullable\|date_format:Y-m-d`
`to`	`nullable\|date_format:Y-m-d`
`status`	`nullable\|in:present,absent,partial`
`type`	`nullable\|integer`
`year`	`nullable\|integer`

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/attendance/day-analysis?employee=1&from=2026-11-01&to=2026-11-01&status=present" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/attendance/punches ZenHR history (docs/zenhr-import.md): kind days (day analysis) or punches (punch details)...

Sign-in: App token or company API key
Permission: attendance.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

`employee`	`nullable\|integer`
`from`	`nullable\|date_format:Y-m-d`
`to`	`nullable\|date_format:Y-m-d`
`status`	`nullable\|in:present,absent,partial`
`type`	`nullable\|integer`
`year`	`nullable\|integer`

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/attendance/punches?employee=1&from=2026-11-01&to=2026-11-01&status=present" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/attendance/recommendations Recommendations of the employees in reach: status (pending, applied, ignored), kind, from,...

Recommendations of the employees in reach: status (pending, applied, ignored), kind, from, to.

Sign-in: App token or company API key
Permission: attendance.recommendations.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

`status`	`nullable\|in:pending,applied,ignored`
`kind`	`nullable\|in:absence,lateness,early_out,incomplete,overtime,leave`
`from`	`nullable\|date`
`to`	`nullable\|date`

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/attendance/recommendations?status=pending&kind=absence&from=2026-11-01&to=2026-11-01" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/attendance/recommendations/refresh

Sign-in: App token or company API key
Permission: attendance.recommendations.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/attendance/recommendations/refresh" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/attendance/recommendations/act Apply, ignore or tell the manager: ids and action.

Apply, ignore or tell the manager: ids and action.

Sign-in: App token or company API key
Permission: attendance.recommendations.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/attendance/recommendations/act" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/attendance/missing-punches ZenHR Manage missing punches: status, punch dates from / to, employee; 50 a page.

ZenHR Manage missing punches: status, punch dates from / to, employee; 50 a page.

Sign-in: App token or company API key
Permission: attendance.missing_punches.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

`status`	`nullable\|in:pending,approved,rejected,cancelled,withdrawn`
`from`	`nullable\|date_format:Y-m-d`
`to`	`nullable\|date_format:Y-m-d`
`employee`	`nullable\|integer`
`employee_status`	`nullable\|in:active,suspended,terminated`

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/attendance/missing-punches?status=pending&from=2026-11-01&to=2026-11-01&employee=1" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

attest 2 endpoints

POST /api/v1/app/attest/challenge App Attest: a one-time challenge for the next attestation (five minutes).
App Attest: a one-time challenge for the next attestation (five minutes).

Sign-in
App token or company API key

Permission
Any signed-in user of the company

Rate limit
20 requests a minute
Example request
Link to this endpoint
```
curl -X POST "https://api.mihnaro.com/api/v1/app/attest/challenge" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

POST /api/v1/app/attest/register App Attest: key_id, attestation (base64), challenge, device_id (the device.id sent with pu...

App Attest: key_id, attestation (base64), challenge, device_id (the device.id sent with punches).

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 10 requests a minute

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`key_id`required	`required\|string\|max:100`
`attestation`required	`required\|string\|max:20000`
`challenge`required	`required\|string\|max:100`
`device_id`required	`required\|string\|max:100`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/attest/register" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"key_id":"...","attestation":"...","challenge":"...","device_id":"..."}'

biometric-devices 9 endpoints

GET /api/v1/app/companies/{company}/biometric-devices

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/biometric-devices" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/biometric-devices/detected Clocks calling in from the caller's own public IP that no company has added yet (docs/devi...

Clocks calling in from the caller's own public IP that no company has added yet (docs/devices.md).

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/biometric-devices/detected" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/biometric-devices

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/biometric-devices" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/app/companies/{company}/biometric-devices/{device} Send only what changes.

Send only what changes.

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`device`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/biometric-devices/{device}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/biometric-devices/{device}

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`device`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/biometric-devices/{device}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/biometric-devices/{device}/token A new secret for the punches endpoint, shown this once.

A new secret for the punches endpoint, shown this once.

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`device`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/biometric-devices/{device}/token" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/biometric-devices/{device}/users GET biometric-devices/{id}/users: the machine's users and the numbers it sent, each with t...

GET biometric-devices/{id}/users: the machine's users and the numbers it sent, each with the employee it links to.

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`device`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/biometric-devices/{device}/users" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/biometric-devices/{device}/sheet POST biometric-devices/{id}/sheet (multipart sheet): reads an attendance sheet exported fr...

POST biometric-devices/{id}/sheet (multipart sheet): reads an attendance sheet exported from the machine.

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`device`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

sheetrequired required|file|mimes:csv,txt,xlsx|max:10240

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/biometric-devices/{device}/sheet" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -F "[email protected]"

POST /api/v1/app/companies/{company}/biometric-devices/reprocess Matches punches whose number now belongs to an employee.

Matches punches whose number now belongs to an employee.

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/biometric-devices/reprocess" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

biometric-templates 3 endpoints

POST /api/v1/app/companies/{company}/biometric-templates/{template}/resolve version_id: keep that version everywhere; or re_enroll_device_id: ask that device to enrol...

version_id: keep that version everywhere; or re_enroll_device_id: ask that device to enrol the slot again.

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`template`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`version_id`	`nullable\|integer\|required_without:re_enroll_device_id`
`re_enroll_device_id`	`nullable\|integer`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/biometric-templates/{template}/resolve" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"version_id":1,"re_enroll_device_id":1}'

POST /api/v1/app/companies/{company}/biometric-templates/{template}/publish

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`template`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/biometric-templates/{template}/publish" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/biometric-templates/{template}/remove Remove a slot from one device (device_id) or from the master set; needs confirm: true.

Remove a slot from one device (device_id) or from the master set; needs confirm: true.

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`template`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`confirm`	`accepted`
`device_id`	`nullable\|integer`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/biometric-templates/{template}/remove" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"confirm":true,"device_id":1}'

boarding-templates 6 endpoints

GET /api/v1/app/companies/{company}/boarding-templates

Sign-in: App token or company API key
Permission: employee_settings.boarding_templates.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/boarding-templates" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/boarding-templates

Sign-in: App token or company API key
Permission: employee_settings.boarding_templates.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`category`required	`required\|in:onboarding,offboarding,clearance,resumption`
`name`required	`required\|array`
`name.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`name.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(150)`
`description`	`nullable\|string\|'max:' . \App\Support\Limits::chars(2000)`
`when_to_send`	`nullable\|in:on_date,before`
`days_to_send`	`match ($category) { 'onboarding' => 'required_if:when_to_send,before', '...\|nullable\|integer\|min:0\|max:365`
`arrive_by`	`nullable\|date_format:H:i`
`location_name`	`nullable\|string\|max:150`
`contact_employee_id`	`nullable\|integer\|$employees`
`sequential`	`nullable\|boolean`
`min_vacation_days`	`in_array($category, ['clearance', 'resumption'], true) ? 'required' : 'nullable'\|nullable\|integer\|min:1\|max:365`
`leave_type_id`	`nullable\|integer\|exists:leave_types,id`
`resumption_trigger`	`$category === 'resumption' ? 'required' : 'nullable'\|nullable\|in:first_punch,employee_request,auto_send`
`auto_adjust`	`nullable\|boolean`
`notify_after_days`	`nullable\|integer\|min:0\|max:365`
`notify_user_ids`	`nullable\|array\|max:50`
`notify_user_ids.*`	`integer\|$employees`
`filters`	`nullable\|array`
`filters.*`	`nullable\|array`
`filters..`	`nullable\|string\|max:80`
`tasks`required	`required\|array\|min:1\|max:50`
`tasks.*.kind`required	`required\|Rule::in($kinds)`
`tasks.*.title`	`nullable\|required_if:tasks.*.kind,custom\|string\|max:200`
`tasks.*.document_type_id`	`nullable\|required_if:tasks.*.kind,document_upload\|integer\|exists:document_types,id`
`tasks.*.document_id`	`nullable\|required_if:tasks.*.kind,document_download\|integer\|exists:employee_documents,id`
`tasks.*.asset_type_id`	`nullable\|required_if:tasks.*.kind,give_asset,take_asset\|integer\|exists:asset_types,id`
`tasks.*.assignee`	`nullable\|in:employee,person`
`tasks.*.assignee_employee_id`	`nullable\|required_if:tasks..kind,give_asset,take_asset\|required_if:tasks..assignee,person\|integer\|$employees`
`tasks.*.due_days`	`nullable\|integer\|min:0\|max:365`
`tasks.*.notes`	`nullable\|string\|'max:' . \App\Support\Limits::chars(2000)`
`tasks.*.notes_required`	`nullable\|boolean`
`tasks.*.attachments_required`	`nullable\|boolean`
`tasks.*.profile_fields`	`nullable\|required_if:tasks.*.kind,complete_profile\|array\|min:1`
`tasks..profile_fields.`	`in:email,gender,mobile,religion,birth_date,national_id,nationality,marital_status,emergency_contacts`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/boarding-templates" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"category":"onboarding","name":{"en":"...","ar":"..."},"description":"...","when_to_send":"on_date","days_to_send":1,"arrive_by":"2026-11-01","location_name":"...","contact_employee_id":1,"sequential":true,"min_vacation_days":1,"leave_type_id":1,"resumption_trigger":"first_punch","auto_adjust":true,"notify_after_days":1,"notify_user_ids":[],"filters":[],"tasks":[]}'

GET /api/v1/app/companies/{company}/boarding-templates/{template}

Sign-in: App token or company API key
Permission: employee_settings.boarding_templates.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`template`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/boarding-templates/{template}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT PATCH /api/v1/app/companies/{company}/boarding-templates/{template}

Sign-in: App token or company API key
Permission: employee_settings.boarding_templates.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`template`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`category`required	`required\|in:onboarding,offboarding,clearance,resumption`
`name`required	`required\|array`
`name.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`name.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(150)`
`description`	`nullable\|string\|'max:' . \App\Support\Limits::chars(2000)`
`when_to_send`	`nullable\|in:on_date,before`
`days_to_send`	`match ($category) { 'onboarding' => 'required_if:when_to_send,before', '...\|nullable\|integer\|min:0\|max:365`
`arrive_by`	`nullable\|date_format:H:i`
`location_name`	`nullable\|string\|max:150`
`contact_employee_id`	`nullable\|integer\|$employees`
`sequential`	`nullable\|boolean`
`min_vacation_days`	`in_array($category, ['clearance', 'resumption'], true) ? 'required' : 'nullable'\|nullable\|integer\|min:1\|max:365`
`leave_type_id`	`nullable\|integer\|exists:leave_types,id`
`resumption_trigger`	`$category === 'resumption' ? 'required' : 'nullable'\|nullable\|in:first_punch,employee_request,auto_send`
`auto_adjust`	`nullable\|boolean`
`notify_after_days`	`nullable\|integer\|min:0\|max:365`
`notify_user_ids`	`nullable\|array\|max:50`
`notify_user_ids.*`	`integer\|$employees`
`filters`	`nullable\|array`
`filters.*`	`nullable\|array`
`filters..`	`nullable\|string\|max:80`
`tasks`required	`required\|array\|min:1\|max:50`
`tasks.*.kind`required	`required\|Rule::in($kinds)`
`tasks.*.title`	`nullable\|required_if:tasks.*.kind,custom\|string\|max:200`
`tasks.*.document_type_id`	`nullable\|required_if:tasks.*.kind,document_upload\|integer\|exists:document_types,id`
`tasks.*.document_id`	`nullable\|required_if:tasks.*.kind,document_download\|integer\|exists:employee_documents,id`
`tasks.*.asset_type_id`	`nullable\|required_if:tasks.*.kind,give_asset,take_asset\|integer\|exists:asset_types,id`
`tasks.*.assignee`	`nullable\|in:employee,person`
`tasks.*.assignee_employee_id`	`nullable\|required_if:tasks..kind,give_asset,take_asset\|required_if:tasks..assignee,person\|integer\|$employees`
`tasks.*.due_days`	`nullable\|integer\|min:0\|max:365`
`tasks.*.notes`	`nullable\|string\|'max:' . \App\Support\Limits::chars(2000)`
`tasks.*.notes_required`	`nullable\|boolean`
`tasks.*.attachments_required`	`nullable\|boolean`
`tasks.*.profile_fields`	`nullable\|required_if:tasks.*.kind,complete_profile\|array\|min:1`
`tasks..profile_fields.`	`in:email,gender,mobile,religion,birth_date,national_id,nationality,marital_status,emergency_contacts`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/boarding-templates/{template}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"category":"onboarding","name":{"en":"...","ar":"..."},"description":"...","when_to_send":"on_date","days_to_send":1,"arrive_by":"2026-11-01","location_name":"...","contact_employee_id":1,"sequential":true,"min_vacation_days":1,"leave_type_id":1,"resumption_trigger":"first_punch","auto_adjust":true,"notify_after_days":1,"notify_user_ids":[],"filters":[],"tasks":[]}'

POST /api/v1/app/companies/{company}/boarding-templates/{template}/copy

Sign-in: App token or company API key
Permission: employee_settings.boarding_templates.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`template`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/boarding-templates/{template}/copy" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/boarding-templates/{template}

Sign-in: App token or company API key
Permission: employee_settings.boarding_templates.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`template`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/boarding-templates/{template}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

boardings 5 endpoints

GET /api/v1/app/companies/{company}/boardings/{workflow}/pdf The workflow as a PDF file (application/pdf); lang en|ar, else the reader's language.

The workflow as a PDF file (application/pdf); lang en|ar, else the reader's language.

Sign-in: App token or company API key
Permission: self.workflows | employees.view
Module: hrm
Rate limit: 30 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`workflow`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/boardings/{workflow}/pdf" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/boardings

Sign-in: App token or company API key
Permission: employees.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/boardings" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/boardings/{workflow}

Sign-in: App token or company API key
Permission: employees.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`workflow`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/boardings/{workflow}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/boardings/mass-onboard

Sign-in: App token or company API key
Permission: employees.boardings.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`boarding_template_id`required	`required\|integer\|exists:boarding_templates,id`
`description`	`nullable\|string\|'max:' . \App\Support\Limits::chars(2000)`
`notes`	`nullable\|string\|'max:' . \App\Support\Limits::chars(2000)`
`employee_ids`required	`required\|array\|min:1\|max:500`
`employee_ids.*`	`integer`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/boardings/mass-onboard" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"boarding_template_id":1,"description":"...","notes":"...","employee_ids":[]}'

DELETE /api/v1/app/companies/{company}/boardings/{workflow}

Sign-in: App token or company API key
Permission: employees.boardings.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`workflow`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/boardings/{workflow}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

branch 2 endpoints

GET /api/v1/app/companies/{company}/branch

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/branch" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/branch

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

branchrequired required|regex:/^(\d+|all)$/

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/branch" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"branch":"..."}'

branches 5 endpoints

PUT PATCH /api/v1/app/companies/{company}/branches/{branch}/regional-settings

Sign-in: App token or company API key
Permission: branches.manage
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`branch`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/branches/{branch}/regional-settings" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/branches

Sign-in: App token or company API key
Permission: branches.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/branches" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/branches

Sign-in: App token or company API key
Permission: branches.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/branches" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH POST /api/v1/app/companies/{company}/branches/{branch}

Sign-in: App token or company API key
Permission: branches.manage
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`branch`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/branches/{branch}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/branches/{branch}/main

Sign-in: App token or company API key
Permission: branches.manage
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`branch`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/branches/{branch}/main" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

buddy-punching 13 endpoints

GET /api/v1/app/companies/{company}/buddy-punching/people The people with a score, highest first; format=csv|xlsx with attendance.buddy.export.

The people with a score, highest first; format=csv|xlsx with attendance.buddy.export.

Sign-in: App token or company API key
Permission: attendance.buddy.view | attendance.buddy.export
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/buddy-punching/people" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/buddy-punching/signals

Sign-in: App token or company API key
Permission: attendance.buddy.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/buddy-punching/signals" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/buddy-punching/signals/{signal}

Sign-in: App token or company API key
Permission: attendance.buddy.review
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`signal`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`decision`required	`required\|in:confirm,dismiss`
`note`	`nullable\|string\|'max:' . \App\Support\Limits::chars(500)`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/buddy-punching/signals/{signal}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"decision":"confirm","note":"..."}'

GET /api/v1/app/companies/{company}/buddy-punching/presence

Sign-in: App token or company API key
Permission: attendance.buddy.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/buddy-punching/presence" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/buddy-punching/presence/{check}

Sign-in: App token or company API key
Permission: attendance.buddy.review
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`check`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`decision`required	`required\|in:excuse,confirm`
`note`	`nullable\|string\|'max:' . \App\Support\Limits::chars(500)`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/buddy-punching/presence/{check}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"decision":"excuse","note":"..."}'

GET /api/v1/app/companies/{company}/buddy-punching/faces

Sign-in: App token or company API key
Permission: attendance.face.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/buddy-punching/faces" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/buddy-punching/faces/missing Who hasn't taken the biometric photo yet.

Who hasn't taken the biometric photo yet.

Sign-in: App token or company API key
Permission: attendance.face.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/buddy-punching/faces/missing" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/buddy-punching/faces/{template}/photo The photo waiting for HR's approval, as a JPEG. Each look goes in the audit trail.

The photo waiting for HR's approval, as a JPEG. Each look goes in the audit trail.

Sign-in: App token or company API key
Permission: attendance.face.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`template`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/buddy-punching/faces/{template}/photo" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/buddy-punching/consents

Sign-in: App token or company API key
Permission: attendance.face.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/buddy-punching/consents" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/buddy-punching/faces/{template}/approve

Sign-in: App token or company API key
Permission: attendance.face.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`template`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/buddy-punching/faces/{template}/approve" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/buddy-punching/faces/reset/{employee}

Sign-in: App token or company API key
Permission: attendance.face.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/buddy-punching/faces/reset/{employee}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/buddy-punching/keys

Sign-in: App token or company API key
Permission: attendance.buddy.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/buddy-punching/keys" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/buddy-punching/keys/{key}

Sign-in: App token or company API key
Permission: attendance.device_key.approve
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`key`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

actionrequired required|in:approve,reset

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/buddy-punching/keys/{key}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"action":"approve"}'

business-travel 7 endpoints

GET /api/v1/app/companies/{company}/business-travel/setup

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/business-travel/setup" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/business-travel/setup

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`trip_per_diem_type_id`required	`required\|$type`
`trip_payment`required	`required\|in:in_payroll,off_cycle`
`trip_air_ticket_type_id`required	`required\|$type`
`trip_accommodation_type_id`required	`required\|$type`
`trip_remind_days`required	`required\|integer\|min:0\|max:60`
`trip_expense_type_ids`	`nullable\|array`
`trip_expense_type_ids.*`	`integer\|$type`
`components`	`nullable\|array`
`components.*.id`	`nullable\|integer`
`components.*.name_en`	`nullable\|string\|'max:' . \App\Support\Limits::chars(100)`
`components.*.name_ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(100)`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/business-travel/setup" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"trip_per_diem_type_id":"...","trip_payment":"in_payroll","trip_air_ticket_type_id":"...","trip_accommodation_type_id":"...","trip_remind_days":1,"trip_expense_type_ids":[],"components":[]}'

GET /api/v1/app/companies/{company}/business-travel/policies

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/business-travel/policies" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/business-travel/policies

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name_en`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`name_ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(150)`
`position_ids`required	`required\|array\|min:1`
`position_ids.*`	`integer\|exists:positions,id`
`destinations`required	`required\|array\|min:1\|max:30`
`destinations.*.category`required	`required\|in:domestic,international`
`destinations.*.country`	`nullable\|string\|max:80`
`destinations.*.departure_cities`	`nullable\|string\|'max:' . \App\Support\Limits::chars(500)`
`destinations.*.arrival_cities`	`nullable\|string\|'max:' . \App\Support\Limits::chars(500)`
`destinations.*.departure_countries`	`nullable`
`destinations.*.arrival_countries`	`nullable`
`destinations..departure_countries.`	`string\|'max:' . \App\Support\Limits::chars(80)`
`destinations..arrival_countries.`	`string\|'max:' . \App\Support\Limits::chars(80)`
`destinations.*.travel_types`	`nullable\|array`
`destinations..travel_types.`	`in:airplane,bus,car,train`
`destinations.*.air_classes`	`nullable\|array`
`destinations..air_classes.`	`in:economy,business,first`
`destinations.*.max_air_ticket`	`nullable\|numeric\|min:0`
`destinations.*.max_travel_cost`	`nullable\|numeric\|min:0`
`destinations.*.hotel_tiers`	`nullable\|array`
`destinations..hotel_tiers.`	`integer\|between:1,5`
`destinations.*.max_accommodation`	`nullable\|numeric\|min:0`
`destinations.*.components`	`nullable\|array`
`destinations..components..type_id`	`nullable\|integer\|exists:per_diem_types,id`
`destinations..components..amount`	`nullable\|numeric\|min:0`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/business-travel/policies" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name_en":"...","name_ar":"...","position_ids":[],"destinations":[]}'

GET /api/v1/app/companies/{company}/business-travel/policies/{policy}

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`policy`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/business-travel/policies/{policy}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/business-travel/policies/{policy}

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`policy`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name_en`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`name_ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(150)`
`position_ids`required	`required\|array\|min:1`
`position_ids.*`	`integer\|exists:positions,id`
`destinations`required	`required\|array\|min:1\|max:30`
`destinations.*.category`required	`required\|in:domestic,international`
`destinations.*.country`	`nullable\|string\|max:80`
`destinations.*.departure_cities`	`nullable\|string\|'max:' . \App\Support\Limits::chars(500)`
`destinations.*.arrival_cities`	`nullable\|string\|'max:' . \App\Support\Limits::chars(500)`
`destinations.*.departure_countries`	`nullable`
`destinations.*.arrival_countries`	`nullable`
`destinations..departure_countries.`	`string\|'max:' . \App\Support\Limits::chars(80)`
`destinations..arrival_countries.`	`string\|'max:' . \App\Support\Limits::chars(80)`
`destinations.*.travel_types`	`nullable\|array`
`destinations..travel_types.`	`in:airplane,bus,car,train`
`destinations.*.air_classes`	`nullable\|array`
`destinations..air_classes.`	`in:economy,business,first`
`destinations.*.max_air_ticket`	`nullable\|numeric\|min:0`
`destinations.*.max_travel_cost`	`nullable\|numeric\|min:0`
`destinations.*.hotel_tiers`	`nullable\|array`
`destinations..hotel_tiers.`	`integer\|between:1,5`
`destinations.*.max_accommodation`	`nullable\|numeric\|min:0`
`destinations.*.components`	`nullable\|array`
`destinations..components..type_id`	`nullable\|integer\|exists:per_diem_types,id`
`destinations..components..amount`	`nullable\|numeric\|min:0`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/business-travel/policies/{policy}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name_en":"...","name_ar":"...","position_ids":[],"destinations":[]}'

DELETE /api/v1/app/companies/{company}/business-travel/policies/{policy}

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`policy`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/business-travel/policies/{policy}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

cancellations 3 endpoints

GET /api/v1/app/companies/{company}/cancellations

Sign-in: App token or company API key
Permission: self.requests.cancel | self.leaves.cancel | requests.manage | leaves.manage | self.approvals.decide
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/cancellations" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/cancellations/{kind}/{id}

Sign-in: App token or company API key
Permission: self.requests.cancel | self.leaves.cancel | requests.manage | leaves.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`kind`	string · requests\|leaves	The record's ID.
`id`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/cancellations/{kind}/{id}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/cancellations/{kind}/{id}/decide

Sign-in: App token or company API key
Permission: self.approvals.decide | requests.manage | leaves.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`kind`	string · requests\|leaves	The record's ID.
`id`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/cancellations/{kind}/{id}/decide" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

checklist-items 2 endpoints

POST /api/v1/app/companies/{company}/checklist-items/{item}/toggle

Sign-in: App token or company API key
Permission: employees.view
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`item`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/checklist-items/{item}/toggle" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/checklist-items/{item}

Sign-in: App token or company API key
Permission: employees.view
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`item`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/checklist-items/{item}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

checklists 1 endpoint

GET /api/v1/app/companies/{company}/checklists

Sign-in: App token or company API key
Permission: employees.view
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/checklists" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

clocking-devices 2 endpoints

GET /api/v1/app/companies/{company}/clocking-devices Devices: employee, kind (phone, browser), status, device.

Devices: employee, kind (phone, browser), status, device.

Sign-in: App token or company API key
Permission: attendance.security.review
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/clocking-devices" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/clocking-devices/{device} action: approve, block, reset, rename (label) or share (shared, browsers only).

action: approve, block, reset, rename (label) or share (shared, browsers only).

Sign-in: App token or company API key
Permission: attendance.security.review
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`device`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/clocking-devices/{device}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

clocking-wifi-networks 3 endpoints

GET /api/v1/app/companies/{company}/clocking-wifi-networks

Sign-in: App token or company API key
Permission: attendance.security.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/clocking-wifi-networks" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/clocking-wifi-networks

Sign-in: App token or company API key
Permission: attendance.security.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/clocking-wifi-networks" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/clocking-wifi-networks/{network}

Sign-in: App token or company API key
Permission: attendance.security.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`network`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/clocking-wifi-networks/{network}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

companies 1 endpoint

GET /api/v1/app/companies/{company} What the company gives this user: license, modules, branches.

What the company gives this user: license, modules, branches.

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

competency-ratings 2 endpoints

GET /api/v1/app/companies/{company}/competency-ratings Ratings of the employees in scope (employee filter).

Ratings of the employees in scope (employee filter).

Sign-in: App token or company API key
Permission: performance.view | performance.manage.* | performance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/competency-ratings" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/competency-ratings employee_id, competency_id, level.

employee_id, competency_id, level.

Sign-in: App token or company API key
Permission: performance.manage.* | performance.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`employee_id`required	`required\|integer\|exists:employees,id`
`competency_id`required	`required\|integer\|exists:competencies,id`
`level`required	`required\|integer\|'between:1,' . \App\Models\CompetencyLevel::scale()`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/competency-ratings" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"employee_id":1,"competency_id":1,"level":1}'

competency-setup 3 endpoints

POST /api/v1/app/companies/{company}/competency-setup/{kind} kind categories | levels | competencies: as on the competencies screen.

kind categories | levels | competencies: as on the competencies screen.

Sign-in: App token or company API key
Permission: performance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`kind`	string · categories\|levels\|competencies	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/competency-setup/{kind}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH PUT /api/v1/app/companies/{company}/competency-setup/{kind}/{id} kind categories | levels | competencies: as on the competencies screen.

kind categories | levels | competencies: as on the competencies screen.

Sign-in: App token or company API key
Permission: performance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`kind`	string · categories\|levels\|competencies	The record's ID.
`id`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/competency-setup/{kind}/{id}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/competency-setup/{kind}/{id}

Sign-in: App token or company API key
Permission: performance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`kind`	string · categories\|levels\|competencies	The record's ID.
`id`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/competency-setup/{kind}/{id}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

connected-apps 2 endpoints

GET /api/v1/app/companies/{company}/connected-apps

Sign-in: App token or company API key
Permission: integrations.ai_apps.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/connected-apps" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/connected-apps/{grant}

Sign-in: App token or company API key
Permission: integrations.ai_apps.manage
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`grant`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/connected-apps/{grant}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

cost-allocations 3 endpoints

GET /api/v1/app/companies/{company}/cost-allocations Allocations in scope: employee_id, status (active | inactive | upcoming), group (cost cent...

Allocations in scope: employee_id, status (active | inactive | upcoming), group (cost center group id), and the org filters.

Sign-in: App token or company API key
Permission: payroll.cost_allocations.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/cost-allocations" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/cost-allocations

Sign-in: App token or company API key
Permission: payroll.cost_allocations.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`employee_id`required	`required\|integer`
`start_date`required	`required\|date`
`end_date`	`nullable\|date\|after_or_equal:start_date`
`rows`required	`required\|array`
`rows.*.cost_center_id`required	`required\|distinct\|exists:cost_centers,id`
`rows.*.percent`required	`required\|numeric\|between:0.01,100`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/cost-allocations" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"employee_id":1,"start_date":"2026-11-01","end_date":"2026-11-01","rows":[]}'

DELETE /api/v1/app/companies/{company}/cost-allocations/{allocation}

Sign-in: App token or company API key
Permission: payroll.cost_allocations.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`allocation`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/cost-allocations/{allocation}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

cost-center-groups 5 endpoints

GET /api/v1/app/companies/{company}/cost-center-groups Groups with the cost centers they include: code, center (a cost center id).

Groups with the cost centers they include: code, center (a cost center id).

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/cost-center-groups" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/cost-center-groups

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name_en`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`name_ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(150)`
`code`	`nullable\|string\|max:30`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/cost-center-groups" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name_en":"...","name_ar":"...","code":"..."}'

GET /api/v1/app/companies/{company}/cost-center-groups/{group}

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`group`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/cost-center-groups/{group}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH PUT /api/v1/app/companies/{company}/cost-center-groups/{group}

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`group`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name_en`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`name_ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(150)`
`code`	`nullable\|string\|max:30`

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/cost-center-groups/{group}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name_en":"...","name_ar":"...","code":"..."}'

DELETE /api/v1/app/companies/{company}/cost-center-groups/{group}

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`group`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/cost-center-groups/{group}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

custom-reports 6 endpoints

GET /api/v1/app/companies/{company}/custom-reports

Sign-in: App token or company API key
Permission: reports.custom
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/custom-reports" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/custom-reports POST custom-reports: name {en, ar}, locale, employee_status, schedule, notify_user_ids, co...

POST custom-reports: name {en, ar}, locale, employee_status, schedule, notify_user_ids, columns ["source.field", …] in order, shared_branch_ids (branches you work in).

Sign-in: App token or company API key
Permission: reports.custom
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`required	`required\|array`
`name.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`name.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(150)`
`locale`required	`required\|in:en,ar`
`employee_status`required	`required\|in:active,inactive,both`
`schedule`required	`required\|in:none,daily,weekly,monthly,annually`
`notify_user_ids`	`nullable\|array`
`notify_user_ids.*`	`integer`
`shared_branch_ids`	`nullable\|array`
`shared_branch_ids.*`	`integer`
`columns`required	`required\|array\|min:1\|max:120`
`columns.*`	`string\|max:60`
`order`	`nullable\|array`
`order.*`	`nullable\|integer\|min:1\|max:999`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/custom-reports" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":{"en":"...","ar":"..."},"locale":"en","employee_status":"active","schedule":"none","notify_user_ids":[],"shared_branch_ids":[],"columns":[],"order":[]}'

GET /api/v1/app/companies/{company}/custom-reports/{report}

Sign-in: App token or company API key
Permission: reports.custom
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`report`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/custom-reports/{report}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/app/companies/{company}/custom-reports/{report}

Sign-in: App token or company API key
Permission: reports.custom
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`report`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`required	`required\|array`
`name.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`name.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(150)`
`locale`required	`required\|in:en,ar`
`employee_status`required	`required\|in:active,inactive,both`
`schedule`required	`required\|in:none,daily,weekly,monthly,annually`
`notify_user_ids`	`nullable\|array`
`notify_user_ids.*`	`integer`
`shared_branch_ids`	`nullable\|array`
`shared_branch_ids.*`	`integer`
`columns`required	`required\|array\|min:1\|max:120`
`columns.*`	`string\|max:60`
`order`	`nullable\|array`
`order.*`	`nullable\|integer\|min:1\|max:999`

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/custom-reports/{report}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":{"en":"...","ar":"..."},"locale":"en","employee_status":"active","schedule":"none","notify_user_ids":[],"shared_branch_ids":[],"columns":[],"order":[]}'

DELETE /api/v1/app/companies/{company}/custom-reports/{report}

Sign-in: App token or company API key
Permission: reports.custom
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`report`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/custom-reports/{report}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/custom-reports/{report}/run GET custom-reports/{id}/run: the rows (limit, 500 by default), or format=csv.

GET custom-reports/{id}/run: the rows (limit, 500 by default), or format=csv.

Sign-in: App token or company API key
Permission: reports.custom
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`report`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/custom-reports/{report}/run" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

dashboard-metrics 1 endpoint

GET /api/v1/app/companies/{company}/dashboard-metrics

Sign-in: App token or company API key
Permission: self.dashboard
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/dashboard-metrics" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

dashboards 1 endpoint

GET /api/v1/app/companies/{company}/dashboards/{section} GET dashboards/{section}: hr, attendance, payroll, assets or performance (403 without that...

GET dashboards/{section}: hr, attendance, payroll, assets or performance (403 without that section's permission). For hr: only the widgets the person may see are computed (widgets=key,key narrows them further), with the filter period (this_month, last_month, last_30, this_quarter, this_year) or from/to, branch_id and department_id.

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`section`	string · hr\|attendance\|payroll\|assets\|performance	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/dashboards/{section}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

device-audit-log 1 endpoint

GET /api/v1/app/companies/{company}/device-audit-log

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/device-audit-log" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

device-batches 1 endpoint

GET /api/v1/app/companies/{company}/device-batches/{batch}

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`batch`	string · [\da-fA-F]{8}-[\da-fA-F]{4}-[\da-fA-F]{4}-[\da-fA-F]{4}-[\da-fA-F]{12}	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/device-batches/{batch}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

device-commands 1 endpoint

POST /api/v1/app/companies/{company}/device-commands/{command}/{do}

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`command`	integer	The record's ID.
`do`	string · retry\|cancel	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/device-commands/{command}/{do}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

device-compatibility 1 endpoint

GET /api/v1/app/companies/{company}/device-compatibility

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/device-compatibility" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

device-enrollments 2 endpoints

POST /api/v1/app/companies/{company}/device-enrollments

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`by`required	`required\|Rule::in(['employees', ...\App\Models\DeviceEnrollmentRule::TARGETS])`
`ids`	`array`
`ids.*`	`integer`
`device_ids`required	`required\|array\|min:1`
`device_ids.*`	`integer`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/device-enrollments" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"by":"...","ids":[],"device_ids":[]}'

DELETE /api/v1/app/companies/{company}/device-enrollments

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

`employee_id`	`required_without:group_id\|nullable\|integer`
`group_id`	`nullable\|integer`
`device_ids`required	`required\|array\|min:1`
`device_ids.*`	`integer`

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/device-enrollments?employee_id=1&group_id=1&device_ids=..." \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

device-people 1 endpoint

GET /api/v1/app/companies/{company}/device-people People on devices: q (number, biometric ID or name), department; paged.

People on devices: q (number, biometric ID or name), department; paged.

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/device-people" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

device-settings 2 endpoints

GET /api/v1/app/companies/{company}/device-settings/auto-publish

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/device-settings/auto-publish" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/device-settings/auto-publish

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

auto_publishrequired required|boolean

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/device-settings/auto-publish" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"auto_publish":true}'

device-sync-report 1 endpoint

GET /api/v1/app/companies/{company}/device-sync-report People whose devices are not all in sync; format=csv to export.

People whose devices are not all in sync; format=csv to export.

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/device-sync-report" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

devices 12 endpoints

GET /api/v1/app/companies/{company}/devices

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/devices" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/devices/{device}

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`device`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/devices/{device}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/app/companies/{company}/devices/{device} Settings and punch rules; recompute_from pairs the device's punches since that date again...

Settings and punch rules; recompute_from pairs the device's punches since that date again under the rule.

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`device`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`access_mode`	`sometimes\|in:attendance,access,both`
`family`	`sometimes\|nullable\|in:terminal,panel`
`sync_enabled`	`sometimes\|boolean`
`strict_users`	`sometimes\|boolean`
`lock_count`	`sometimes\|nullable\|integer\|between:0,8`
`all_branches`	`sometimes\|boolean`
`branch_ids`	`sometimes\|array\|min:1`
`branch_ids.*`	`integer\|distinct\|exists:branches,id`
`punch_mode`	`sometimes\|nullable\|in:first_last,all,function`
`pair_breaks`	`sometimes\|boolean`
`break_function_id`	`sometimes\|nullable\|integer\|exists:attendance_functions,id`
`debounce_minutes`	`sometimes\|nullable\|integer\|between:0,60`
`punch_in_window_minutes`	`sometimes\|nullable\|integer\|between:0,720`
`punch_out_grace_minutes`	`sometimes\|nullable\|integer\|between:0,720`
`allowed_ips`	`sometimes\|nullable\|string\|max:1000\|function ($attribute, $value, $fail) { foreach (array_filter(array_map('trim...`
`confirm_ip`	`sometimes\|boolean`

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/devices/{device}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"access_mode":"attendance","family":"terminal","sync_enabled":true,"strict_users":true,"lock_count":1,"all_branches":true,"branch_ids":[],"punch_mode":"first_last","pair_breaks":true,"break_function_id":1,"debounce_minutes":1,"punch_in_window_minutes":1,"punch_out_grace_minutes":1,"allowed_ips":"...","confirm_ip":true}'

POST /api/v1/app/companies/{company}/devices/{device}/recompute

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`device`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/devices/{device}/recompute" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/devices/{device}/remove-users Remove numbers from one device: people who left or numbers no employee owns (not current e...

Remove numbers from one device: people who left or numbers no employee owns (not current employees).

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 30 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`device`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`pins`required	`required\|array\|max:5000`
`pins.*`	`string\|max:32`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/devices/{device}/remove-users" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"pins":[]}'

POST /api/v1/app/companies/{company}/devices/{device}/actions/{action}

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`device`	integer	The record's ID.
`action`	string · sync\|pull\|pull_logs\|info\|check\|reboot\|clear_log\|open_door\|close_door\|set_time\|duplicate_check	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`door`	`nullable\|integer\|between:1,8`
`seconds`	`nullable\|integer\|between:1,254`
`from`	`nullable\|date`
`to`	`nullable\|date`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/devices/{device}/actions/{action}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"door":1,"seconds":1,"from":"2026-11-01","to":"2026-11-01"}'

GET /api/v1/app/companies/{company}/devices/{device}/commands

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`device`	integer	The record's ID.

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

status nullable|in:queued,sent,done,failed,cancelled

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/devices/{device}/commands?status=queued" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/devices/{device}/users

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`device`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/devices/{device}/users" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/devices/{device}/plan

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`device`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/devices/{device}/plan" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/devices/{device}/enrollment-rules A device's enrolment rules and the people enrolled one by one.

A device's enrolment rules and the people enrolled one by one.

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`device`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/devices/{device}/enrollment-rules" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/devices/{device}/enrollment-rules target_type department|branch|position|group|all with ids (include), or employee with ids...

target_type department|branch|position|group|all with ids (include), or employee with ids and effect exclude.

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`device`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`target_type`required	`required\|Rule::in([...\App\Models\DeviceEnrollmentRule::TARGETS, 'employee'])`
`ids`	`array`
`ids.*`	`integer`
`effect`	`nullable\|in:include,exclude`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/devices/{device}/enrollment-rules" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"target_type":"...","ids":[],"effect":"include"}'

POST /api/v1/app/companies/{company}/devices/update-all "Update all devices" for one employee or everyone in reach: returns the batch whose progre...

"Update all devices" for one employee or everyone in reach: returns the batch whose progress device-batches/{batch} shows.

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/devices/update-all" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

directory 1 endpoint

GET /api/v1/app/companies/{company}/directory

Sign-in: App token or company API key
Permission: self.directory.view | employees.view
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/directory" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

disciplinary-action-types 3 endpoints

POST /api/v1/app/companies/{company}/disciplinary-action-types

Sign-in: App token or company API key
Permission: discipline_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`required	`required\|array`
`name.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`name.ar`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`letter_template_id`	`nullable\|integer\|exists:letter_templates,id`
`deduction_type`required	`required\|in:none,balanced_vacation,fixed,salary_day,percent`
`leave_type_id`	`nullable\|required_if:deduction_type,balanced_vacation\|integer\|exists:leave_types,id`
`transaction_type_id`	`nullable\|required_if:deduction_type,fixed\|integer\|exists:transaction_types,id`
`deduction_value`	`nullable\|required_unless:deduction_type,none\|numeric\|min:0\|($input['deduction_type'] ?? null) === 'percent' ? 'max:100' : 'max:100000000'`
`allowance_type_ids`	`nullable\|array`
`allowance_type_ids.*`	`integer\|exists:transaction_types,id`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/disciplinary-action-types" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":{"en":"...","ar":"..."},"letter_template_id":1,"deduction_type":"none","leave_type_id":1,"transaction_type_id":1,"deduction_value":1.5,"allowance_type_ids":[]}'

PUT PATCH /api/v1/app/companies/{company}/disciplinary-action-types/{type}

Sign-in: App token or company API key
Permission: discipline_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`type`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`required	`required\|array`
`name.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`name.ar`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`letter_template_id`	`nullable\|integer\|exists:letter_templates,id`
`deduction_type`required	`required\|in:none,balanced_vacation,fixed,salary_day,percent`
`leave_type_id`	`nullable\|required_if:deduction_type,balanced_vacation\|integer\|exists:leave_types,id`
`transaction_type_id`	`nullable\|required_if:deduction_type,fixed\|integer\|exists:transaction_types,id`
`deduction_value`	`nullable\|required_unless:deduction_type,none\|numeric\|min:0\|($input['deduction_type'] ?? null) === 'percent' ? 'max:100' : 'max:100000000'`
`allowance_type_ids`	`nullable\|array`
`allowance_type_ids.*`	`integer\|exists:transaction_types,id`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/disciplinary-action-types/{type}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":{"en":"...","ar":"..."},"letter_template_id":1,"deduction_type":"none","leave_type_id":1,"transaction_type_id":1,"deduction_value":1.5,"allowance_type_ids":[]}'

DELETE /api/v1/app/companies/{company}/disciplinary-action-types/{type}

Sign-in: App token or company API key
Permission: discipline_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`type`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/disciplinary-action-types/{type}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

disciplinary-actions 6 endpoints

GET /api/v1/app/companies/{company}/disciplinary-actions

Sign-in: App token or company API key
Permission: discipline.view | discipline.manage | discipline.record | discipline.approve | discipline.delete
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/disciplinary-actions" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/disciplinary-actions/suggest

Sign-in: App token or company API key
Permission: discipline.record
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

`employee_id`required	`required\|integer`
`disciplinary_type_id`required	`required\|integer`
`incident_date`	`nullable\|date`

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/disciplinary-actions/suggest?employee_id=1&disciplinary_type_id=1&incident_date=2026-11-01" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/disciplinary-actions

Sign-in: App token or company API key
Permission: discipline.record
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`employee_id`required	`required\|integer`
`disciplinary_type_id`required	`required\|integer\|exists:disciplinary_types,id`
`incident_date`required	`required\|date\|before_or_equal:today`
`description`required	`required\|string\|'max:' . \App\Support\Limits::chars(2000)`
`disciplinary_action_type_id`	`nullable\|integer\|exists:disciplinary_action_types,id`
`action`	`nullable\|in:verbal_warning,written_warning,final_warning,deduction`
`deduction_amount`	`nullable\|numeric\|min:0\|max:100000000`
`draft`	`sometimes\|boolean`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/disciplinary-actions" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"employee_id":1,"disciplinary_type_id":1,"incident_date":"2026-11-01","description":"...","disciplinary_action_type_id":1,"action":"verbal_warning","deduction_amount":1.5,"draft":true}'

POST /api/v1/app/companies/{company}/disciplinary-actions/generate

Sign-in: App token or company API key
Permission: discipline.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`leave_type_id`required	`required\|integer\|exists:leave_types,id`
`kind`required	`required\|in:redundant,grace`
`effective_date`required	`required\|date`
`from`required	`required\|date`
`to`required	`required\|date\|after_or_equal:from`
`employee_id`	`nullable\|integer`
`branch_id`	`nullable\|integer`
`department_id`	`nullable\|integer`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/disciplinary-actions/generate" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"leave_type_id":1,"kind":"redundant","effective_date":"2026-11-01","from":"2026-11-01","to":"2026-11-01","employee_id":1,"branch_id":1,"department_id":1}'

POST /api/v1/app/companies/{company}/disciplinary-actions/{action}/approve

Sign-in: App token or company API key
Permission: discipline.approve
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`action`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/disciplinary-actions/{action}/approve" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/disciplinary-actions/{action}

Sign-in: App token or company API key
Permission: discipline.delete
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`action`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/disciplinary-actions/{action}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

disciplinary-rules 3 endpoints

POST /api/v1/app/companies/{company}/disciplinary-rules

Sign-in: App token or company API key
Permission: discipline_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`disciplinary_type_id`	`$rule ? 'sometimes' : 'required'\|integer\|exists:disciplinary_types,id\|unique:disciplinary_rules,disciplinary_type_id`
`name`required	`required\|array`
`name.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`name.ar`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`rule_type`	`nullable\|in:sequential,separate`
`drop_after`	`nullable\|integer\|min:1\|max:1000`
`drop_unit`	`nullable\|in:day,month,year`
`prevent_repetition`	`nullable\|integer\|min:0\|max:1000`
`prevent_unit`	`nullable\|in:day,month,year`
`action_type_ids`required	`required\|array\|min:1\|max:20`
`action_type_ids.*`	`integer\|exists:disciplinary_action_types,id`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/disciplinary-rules" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"disciplinary_type_id":1,"name":{"en":"...","ar":"..."},"rule_type":"sequential","drop_after":1,"drop_unit":"day","prevent_repetition":1,"prevent_unit":"day","action_type_ids":[]}'

PUT PATCH /api/v1/app/companies/{company}/disciplinary-rules/{rule}

Sign-in: App token or company API key
Permission: discipline_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`rule`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`disciplinary_type_id`	`$rule ? 'sometimes' : 'required'\|integer\|exists:disciplinary_types,id\|unique:disciplinary_rules,disciplinary_type_id`
`name`required	`required\|array`
`name.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`name.ar`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`rule_type`	`nullable\|in:sequential,separate`
`drop_after`	`nullable\|integer\|min:1\|max:1000`
`drop_unit`	`nullable\|in:day,month,year`
`prevent_repetition`	`nullable\|integer\|min:0\|max:1000`
`prevent_unit`	`nullable\|in:day,month,year`
`action_type_ids`required	`required\|array\|min:1\|max:20`
`action_type_ids.*`	`integer\|exists:disciplinary_action_types,id`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/disciplinary-rules/{rule}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"disciplinary_type_id":1,"name":{"en":"...","ar":"..."},"rule_type":"sequential","drop_after":1,"drop_unit":"day","prevent_repetition":1,"prevent_unit":"day","action_type_ids":[]}'

DELETE /api/v1/app/companies/{company}/disciplinary-rules/{rule}

Sign-in: App token or company API key
Permission: discipline_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`rule`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/disciplinary-rules/{rule}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

discipline-setup 1 endpoint

GET /api/v1/app/companies/{company}/discipline-setup

Sign-in: App token or company API key
Permission: discipline_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/discipline-setup" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

documents 4 endpoints

GET /api/v1/app/companies/{company}/documents

Sign-in: App token or company API key
Permission: self.documents.view | employees.view_sensitive
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/documents" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/documents

Sign-in: App token or company API key
Permission: self.documents.upload | employees.view_sensitive
Rate limit: 30 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/documents" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/documents/{document}/download

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`document`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/documents/{document}/download" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/documents/{document}

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`document`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/documents/{document}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

door-events 2 endpoints

GET /api/v1/app/companies/{company}/door-events

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

`result`	`nullable\|in:granted,denied,alarm,state,info`
`from`	`nullable\|date`
`to`	`nullable\|date`
`format`	`nullable\|in:json,csv`

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/door-events?result=granted&from=2026-11-01&to=2026-11-01&format=json" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/door-events/{event}/acknowledge

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`event`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/door-events/{event}/acknowledge" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

employee-geolocations 2 endpoints

POST /api/v1/app/companies/{company}/employee-geolocations Employees' locations: action assign|unassign|replace, employees, locations.

Employees' locations: action assign|unassign|replace, employees, locations.

Sign-in: App token or company API key
Permission: attendance.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`action`required	`required\|in:assign,unassign,replace`
`employees`required	`required\|array\|min:1`
`employees.*`	`integer`
`locations`	`required_unless:action,unassign\|array`
`locations.*`	`integer`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employee-geolocations" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"action":"assign","employees":[],"locations":[]}'

POST /api/v1/app/companies/{company}/employee-geolocations/replace-all from_location → to_location for everyone in reach at from_location.

from_location → to_location for everyone in reach at from_location.

Sign-in: App token or company API key
Permission: attendance.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`from_location`required	`required\|integer`
`to_location`required	`required\|integer\|different:from_location`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employee-geolocations/replace-all" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"from_location":1,"to_location":1}'

employee-groups 6 endpoints

GET /api/v1/app/companies/{company}/employee-groups

Sign-in: App token or company API key
Permission: employee_groups.manage | devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employee-groups" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/employee-groups

Sign-in: App token or company API key
Permission: employee_groups.manage | devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`required	`required\|array`
`name.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(100)`
`name.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(100)`
`description`	`nullable\|array`
`description.en`	`nullable\|string\|'max:' . \App\Support\Limits::chars(500)`
`description.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(500)`
`color`	`nullable\|regex:/^#[0-9a-fA-F]{6}$/`
`branch_id`	`nullable\|integer\|exists:branches,id`
`rules`	`nullable\|array`
`rules.departments`	`nullable\|array`
`rules.departments.*`	`integer\|exists:org_units,id`
`rules.positions`	`nullable\|array`
`rules.positions.*`	`integer\|exists:positions,id`
`rules.branches`	`nullable\|array`
`rules.branches.*`	`integer\|exists:branches,id`
`member_ids`	`nullable\|array`
`member_ids.*`	`integer`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employee-groups" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":{"en":"...","ar":"..."},"description":{"en":"...","ar":"..."},"color":"...","branch_id":1,"rules":{"departments":[],"positions":[],"branches":[]},"member_ids":[]}'

GET /api/v1/app/companies/{company}/employee-groups/{group}

Sign-in: App token or company API key
Permission: employee_groups.manage | devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`group`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employee-groups/{group}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT PATCH /api/v1/app/companies/{company}/employee-groups/{group}

Sign-in: App token or company API key
Permission: employee_groups.manage | devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`group`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employee-groups/{group}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/employee-groups/{group}

Sign-in: App token or company API key
Permission: employee_groups.manage | devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`group`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employee-groups/{group}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST DELETE /api/v1/app/companies/{company}/employee-groups/{group}/members employee_ids: added (POST) or removed (DELETE).

employee_ids: added (POST) or removed (DELETE).

Sign-in: App token or company API key
Permission: employee_groups.manage | devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`group`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`employee_ids`required	`required\|array\|min:1`
`employee_ids.*`	`integer`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employee-groups/{group}/members" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"employee_ids":[]}'

employee-invitations 3 endpoints

GET /api/v1/app/companies/{company}/employee-invitations

Sign-in: App token or company API key
Permission: employees.import
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employee-invitations" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/employee-invitations/preview

Sign-in: App token or company API key
Permission: employees.import
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

`channel`required	`required\|Rule::in(self::CHANNELS)`
`branch_id`	`nullable\|integer\|exists:branches,id`
`department_id`	`nullable\|integer\|exists:org_units,id`

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employee-invitations/preview?channel=...&branch_id=1&department_id=1" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/employee-invitations

Sign-in: App token or company API key
Permission: employees.import
Rate limit: 5 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`expected`required	`required\|integer\|min:1`
`channel`required	`required\|Rule::in(self::CHANNELS)`
`branch_id`	`nullable\|integer\|exists:branches,id`
`department_id`	`nullable\|integer\|exists:org_units,id`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employee-invitations" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"expected":1,"channel":"...","branch_id":1,"department_id":1}'

employee-numbering 3 endpoints

GET /api/v1/app/companies/{company}/employee-numbering Employee numbering: the company's settings and each branch's (docs/employee-numbering.md).

Employee numbering: the company's settings and each branch's (docs/employee-numbering.md).

Sign-in: App token or company API key
Permission: employee_settings.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employee-numbering" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT PATCH /api/v1/app/companies/{company}/employee-numbering

Sign-in: App token or company API key
Permission: employee_settings.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employee-numbering" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT PATCH /api/v1/app/companies/{company}/employee-numbering/branches/{branch}

Sign-in: App token or company API key
Permission: employee_settings.manage
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`branch`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employee-numbering/branches/{branch}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

employee-settings 4 endpoints

GET /api/v1/app/companies/{company}/employee-settings/{kind}

Sign-in: App token or company API key
Permission: employee_settings.manage.*
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`kind`	string · contract_types\|job_grades\|document_types\|custom_fields\|org_levels\|field_rules\|e_signatures\|banks	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employee-settings/{kind}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/employee-settings/{kind}

Sign-in: App token or company API key
Permission: employee_settings.manage.*
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`kind`	string · contract_types\|job_grades\|document_types\|custom_fields\|org_levels\|field_rules\|e_signatures\|banks	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employee-settings/{kind}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/app/companies/{company}/employee-settings/{kind}/{id}

Sign-in: App token or company API key
Permission: employee_settings.manage.*
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`kind`	string · contract_types\|job_grades\|document_types\|custom_fields\|org_levels\|field_rules\|e_signatures\|banks	The record's ID.
`id`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employee-settings/{kind}/{id}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/employee-settings/e_signatures/{id}/image ZenHR E-Signatures: the signature image itself.

ZenHR E-Signatures: the signature image itself.

Sign-in: App token or company API key
Permission: employee_settings.e_signatures.manage | letters.manage
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`id`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employee-settings/e_signatures/{id}/image" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

employee-shifts 6 endpoints

GET /api/v1/app/companies/{company}/employee-shifts The schedule between from and to (a week by default) for the employees in reach.

The schedule between from and to (a week by default) for the employees in reach.

Sign-in: App token or company API key
Permission: attendance.shift_planner.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

`from`	`nullable\|date`
`to`	`nullable\|date\|after_or_equal:from`
`employee`	`nullable\|integer`

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employee-shifts?from=2026-11-01&to=2026-11-01&employee=1" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/employee-shifts/export The week (week=any date in it) as the Employee Shifts screen shows it, with its filters; f...

The week (week=any date in it) as the Employee Shifts screen shows it, with its filters; format csv (default) or json.

Sign-in: App token or company API key
Permission: attendance.shift_planner.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

`week`	`nullable\|date`
`format`	`nullable\|in:csv,json`

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employee-shifts/export?week=2026-11-01&format=csv" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/employee-shifts/regular Regular (non-roster) shift assignments and each person's own default shift, with the Emplo...

Regular (non-roster) shift assignments and each person's own default shift, with the Employee Shifts filters.

Sign-in: App token or company API key
Permission: attendance.shift_planner.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employee-shifts/regular" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/employee-shifts Assign Shift: employees, shift_id (or "off"), start_date, end_date (none = open-ended), co...

Assign Shift: employees, shift_id (or "off"), start_date, end_date (none = open-ended), conflict replace|keep, draft.

Sign-in: App token or company API key
Permission: attendance.shift_planner.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`employees`required	`required\|array\|min:1`
`employees.*`	`integer`
`shift_id`required	`required\|$request->input('shift_id') === 'off' ? 'in:off' : Rule::exists('shifts', 'id')-...`
`start_date`required	`required\|date`
`end_date`	`nullable\|date\|after_or_equal:start_date`
`conflict`	`nullable\|in:replace,keep`
`draft`	`sometimes\|boolean`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employee-shifts" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"employees":[],"shift_id":"...","start_date":"2026-11-01","end_date":"2026-11-01","conflict":"replace","draft":true}'

POST /api/v1/app/companies/{company}/employee-shifts/plan Shift planner (ZenHR's roster): drafts employees' days from start_date to end_date (at mos...

Shift planner (ZenHR's roster): drafts employees' days from start_date to end_date (at most 62 days, e.g. a month) with the chosen shifts and rules. employees = ids (none = everyone the role reaches).

Sign-in: App token or company API key
Permission: attendance.shift_planner.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`shift_ids`required	`required\|array\|min:1`
`shift_ids.*`	`exists:shifts,id`
`start_date`required	`required\|date`
`end_date`required	`required\|date\|after_or_equal:start_date`
`employees`	`nullable\|array`
`employees.*`	`integer`
`max_in_a_row`	`nullable\|integer\|between:1,14`
`days_off_a_week`	`nullable\|integer\|between:0,6`
`max_weekly_hours`	`nullable\|numeric\|between:1,168`
`fair_nights`	`sometimes\|boolean`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employee-shifts/plan" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"shift_ids":[],"start_date":"2026-11-01","end_date":"2026-11-01","employees":[],"max_in_a_row":1,"days_off_a_week":1,"max_weekly_hours":1.5,"fair_nights":true}'

POST /api/v1/app/companies/{company}/employee-shifts/publish Publishes the drafts between start_date and end_date (a week or a month), and tells those...

Publishes the drafts between start_date and end_date (a week or a month), and tells those people when notify is true.

Sign-in: App token or company API key
Permission: attendance.shift_planner.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`start_date`required	`required\|date`
`end_date`required	`required\|date\|after_or_equal:start_date`
`employees`	`nullable\|array`
`employees.*`	`integer`
`notify`	`sometimes\|boolean`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employee-shifts/publish" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"start_date":"2026-11-01","end_date":"2026-11-01","employees":[],"notify":true}'

employees 51 endpoints

GET /api/v1/app/companies/{company}/employees/{employee}/professional-data

Sign-in: App token or company API key
Permission: employees.view
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/professional-data" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/employees/{employee}/professional-data

Sign-in: App token or company API key
Permission: employees.edit
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/professional-data" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/employees/{employee}/rehire

Sign-in: App token or company API key
Permission: employees.manage
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`hire_date`required	`required\|date\|$old->terminated_on ? ['after:' . $old->terminated_on->toDateString()] : []`
`copy_bank_accounts`	`sometimes\|boolean`
`copy_family`	`sometimes\|boolean`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/rehire" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"hire_date":"2026-11-01","copy_bank_accounts":true,"copy_family":true}'

GET /api/v1/app/companies/{company}/employees/existing-users "Add Employee for an Existing User": ended records (latest per person) to rehire, and acco...

"Add Employee for an Existing User": ended records (latest per person) to rehire, and accounts with no employee record; q searches.

Sign-in: App token or company API key
Permission: employees.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/existing-users" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/employees/{employee}/temporary-password temporary_password (the company's password policy); they change it after signing in. Not t...

temporary_password (the company's password policy); they change it after signing in. Not the owner's or one's own account.

Sign-in: App token or company API key
Permission: employees.manage
Rate limit: 10 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

temporary_passwordrequired required|string|\App\Support\PasswordPolicy::rule($record->user)

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/temporary-password" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"temporary_password":"..."}'

POST /api/v1/app/companies/{company}/employees/{employee}/unlock Unlocks an account locked by failed sign-in attempts.

Unlocks an account locked by failed sign-in attempts.

Sign-in: App token or company API key
Permission: employees.manage
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/unlock" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/employees/{employee}/termination-check

Sign-in: App token or company API key
Permission: employees.terminate
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/termination-check" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/employees/{employee}/termination-check/{action} substitute, withdraw-requests, take-asset, expire-insurance, pay-loans, deduct-loans

substitute, withdraw-requests, take-asset, expire-insurance, pay-loans, deduct-loans

Sign-in: App token or company API key
Permission: employees.terminate
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.
`action`	string · substitute\|withdraw-requests\|take-asset\|expire-insurance\|pay-loans\|deduct-loans	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/termination-check/{action}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/employees/{employee}/cancel-termination

Sign-in: App token or company API key
Permission: employees.terminate
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/cancel-termination" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/employees/{employee}/checklist

Sign-in: App token or company API key
Permission: employees.view
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/checklist" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/employees/{employee}/checklist

Sign-in: App token or company API key
Permission: employees.view
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`type`required	`required\|in:onboarding,offboarding`
`title`required	`required\|array`
`title.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(200)`
`title.ar`required	`required\|string\|'max:' . \App\Support\Limits::chars(200)`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/checklist" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"type":"onboarding","title":{"en":"...","ar":"..."}}'

POST /api/v1/app/companies/{company}/employees/{employee}/boardings

Sign-in: App token or company API key
Permission: employees.boardings.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`category`required	`required\|in:onboarding,offboarding`
`boarding_template_id`required	`required\|integer\|exists:boarding_templates,id`
`boarding_date`	`nullable\|date`
`arrive_by`	`nullable\|date_format:H:i`
`location_name`	`nullable\|string\|max:150`
`contact_employee_id`	`nullable\|integer\|$employees`
`manager_employee_id`	`nullable\|integer\|$employees`
`description`	`nullable\|string\|'max:' . \App\Support\Limits::chars(2000)`
`sequential`	`nullable\|boolean`
`tasks`	`nullable\|array`
`tasks.*.include`	`nullable\|boolean`
`tasks.*.due_days`	`nullable\|integer\|min:0\|max:365`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/boardings" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"category":"onboarding","boarding_template_id":1,"boarding_date":"2026-11-01","arrive_by":"2026-11-01","location_name":"...","contact_employee_id":1,"manager_employee_id":1,"description":"...","sequential":true,"tasks":[]}'

GET /api/v1/app/companies/{company}/employees/{employee}/salary-packages An employee's salary packages, newest first, with the current one's id.

An employee's salary packages, newest first, with the current one's id.

Sign-in: App token or company API key
Permission: payroll.salary_packages.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/salary-packages" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/employees/{employee}/salary-packages

Sign-in: App token or company API key
Permission: payroll.salary_packages.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`effective_on`required	`required\|date\|'after_or_equal:' . $employee->hire_date->toDateString()`
`basic_salary`required	`required\|numeric\|min:0`
`currency`	nullable\|in:AED,AFN,ALL,AMD,ANG,AOA,ARS,AUD,AWG,AZN,BAM,BBD,BDT,BGN,BHD,BIF,BMD,BND,BOB,BRL,BSD,BTN,BWP,BYN,BZD,CAD,CDF,CHF,CLP,CNY,COP,CRC,CUP,CVE,CZK,DJF,DKK,DOP,DZD,EGP,ERN,ETB,EUR,FJD,FKP,GBP,GEL,GHS,GIP,GMD,GNF,GTQ,GYD,HKD,HNL,HTG,HUF,IDR,ILS,INR,IQD,IRR,ISK,JMD,JOD,JPY,KES,KGS,KHR,KMF,KPW,KRW,KWD,KYD,KZT,LAK,LBP,LKR,LRD,LSL,LYD,MAD,MDL,MGA,MKD,MMK,MNT,MOP,MRU,MUR,MVR,MWK,MXN,MYR,MZN,NAD,NGN,NIO,NOK,NPR,NZD,OMR,PAB,PEN,PGK,PHP,PKR,PLN,PYG,QAR,RON,RSD,RUB,RWF,SAR,SBD,SCR,SDG,SEK,SGD,SHP,SLE,SOS,SRD,SSP,STN,SVC,SYP,SZL,THB,TJS,TMT,TND,TOP,TRY,TTD,TWD,TZS,UAH,UGX,USD,UYU,UZS,VES,VND,VUV,WST,XAF,XCD,XOF,XPF,YER,ZAR,ZMW,ZWL
`salary_count`required	`required\|integer\|between:12,16`
`other_exemption`	`nullable\|numeric\|min:0`
`ss_salary`	`nullable\|numeric\|min:0`
`ss_currency`	nullable\|in:AED,AFN,ALL,AMD,ANG,AOA,ARS,AUD,AWG,AZN,BAM,BBD,BDT,BGN,BHD,BIF,BMD,BND,BOB,BRL,BSD,BTN,BWP,BYN,BZD,CAD,CDF,CHF,CLP,CNY,COP,CRC,CUP,CVE,CZK,DJF,DKK,DOP,DZD,EGP,ERN,ETB,EUR,FJD,FKP,GBP,GEL,GHS,GIP,GMD,GNF,GTQ,GYD,HKD,HNL,HTG,HUF,IDR,ILS,INR,IQD,IRR,ISK,JMD,JOD,JPY,KES,KGS,KHR,KMF,KPW,KRW,KWD,KYD,KZT,LAK,LBP,LKR,LRD,LSL,LYD,MAD,MDL,MGA,MKD,MMK,MNT,MOP,MRU,MUR,MVR,MWK,MXN,MYR,MZN,NAD,NGN,NIO,NOK,NPR,NZD,OMR,PAB,PEN,PGK,PHP,PKR,PLN,PYG,QAR,RON,RSD,RUB,RWF,SAR,SBD,SCR,SDG,SEK,SGD,SHP,SLE,SOS,SRD,SSP,STN,SVC,SYP,SZL,THB,TJS,TMT,TND,TOP,TRY,TTD,TWD,TZS,UAH,UGX,USD,UYU,UZS,VES,VND,VUV,WST,XAF,XCD,XOF,XPF,YER,ZAR,ZMW,ZWL
`social_security_rule_id`	`nullable\|exists:social_security_rules,id`
`ss_participation_date`	`nullable\|date`
`company_bank_account_id`	`nullable\|exists:company_bank_accounts,id`
`tax_number`	`nullable\|string\|max:50`
`ss_number`	`nullable\|string\|max:50`
`gl_account`	`nullable\|string\|max:50`
`notes`	`nullable\|string\|'max:' . \App\Support\Limits::chars(500)`
`items`	`array`
`items.*.kind`	`required_with:items.*.amount\|in:allowance,deduction,company_expense`
`items.*.transaction_type_id`	`nullable\|exists:transaction_types,id`
`items.*.name_en`	`nullable\|string\|'max:' . \App\Support\Limits::chars(150)`
`items.*.name_ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(150)`
`items.*.amount`	`nullable\|numeric\|min:0`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/salary-packages" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"effective_on":"2026-11-01","basic_salary":1.5,"currency":"AED","salary_count":1,"other_exemption":1.5,"ss_salary":1.5,"ss_currency":"AED","social_security_rule_id":"...","ss_participation_date":"2026-11-01","company_bank_account_id":"...","tax_number":"...","ss_number":"...","gl_account":"...","notes":"...","items":[]}'

DELETE /api/v1/app/companies/{company}/employees/{employee}/salary-packages/{package}

Sign-in: App token or company API key
Permission: payroll.salary_packages.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.
`package`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/salary-packages/{package}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/employees/{employee}/salary-stop Stop (reason) or resume an employee's salary: action = stop | resume.

Stop (reason) or resume an employee's salary: action = stop | resume.

Sign-in: App token or company API key
Permission: payroll.salary_packages.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`action`required	`required\|in:stop,resume`
`reason`required	`required\|string\|'max:' . \App\Support\Limits::chars(255)`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/salary-stop" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"action":"stop","reason":"..."}'

GET /api/v1/app/companies/{company}/employees/{employee}/project-contributions GET employees/{employee}/project-contributions?month=YYYY-MM: each project's contribution...

GET employees/{employee}/project-contributions?month=YYYY-MM: each project's contribution and the month's timesheet hours on it.

Sign-in: App token or company API key
Permission: payroll.cost_allocations.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/project-contributions" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/employees/{employee}/project-contributions PUT employees/{employee}/project-contributions {projects: [{project_id, contribution_perce...

PUT employees/{employee}/project-contributions {projects: [{project_id, contribution_percent}]} adding up to 100.

Sign-in: App token or company API key
Permission: payroll.cost_allocations.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`projects`required	`required\|array\|min:1`
`projects.*.project_id`required	`required\|integer\|distinct`
`projects.*.contribution_percent`required	`required\|numeric\|between:0,100`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/project-contributions" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"projects":[]}'

GET /api/v1/app/companies/{company}/employees/{employee}/salary-packages/{package} One salary package of an employee in scope, with its items and the package in force before...

One salary package of an employee in scope, with its items and the package in force before it.

Sign-in: App token or company API key
Permission: payroll.salary_packages.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.
`package`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/salary-packages/{package}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/employees/{employee}/salary-scale An employee's placement (payroll.view or payroll.manage, in scope).

An employee's placement (payroll.view or payroll.manage, in scope).

Sign-in: App token or company API key
Permission: payroll.salary_packages.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/salary-scale" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/employees/{employee}/salary-scale Places an employee in my payroll.manage scope; warning when the salary is outside the new...

Places an employee in my payroll.manage scope; warning when the salary is outside the new enforced range.

Sign-in: App token or company API key
Permission: payroll.salary_packages.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`scale_level_id`	`nullable\|$in('scale_levels')`
`scale_band_id`	`nullable\|$in('scale_bands')`
`scale_grade_id`	`nullable\|$in('scale_grades')`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/salary-scale" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"scale_level_id":"...","scale_band_id":"...","scale_grade_id":"..."}'

GET /api/v1/app/companies/{company}/employees/{employee}/stb-encashment What an employee in my scope could take now: years, accrued, taken, allowed, eligible, rea...

What an employee in my scope could take now: years, accrued, taken, allowed, eligible, reason.

Sign-in: App token or company API key
Permission: payroll.stb_encashments.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/stb-encashment" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/employees/{employee}/leave-balances An employee's balances (?year, ?as_of) and their time off setup rows.

An employee's balances (?year, ?as_of) and their time off setup rows.

Sign-in: App token or company API key
Permission: leaves.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/leave-balances" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH POST /api/v1/app/companies/{company}/employees/{employee}/timeoff/{leaveType} One employee's setup for a leave type; with "reset": true back to the company setup.

One employee's setup for a leave type; with "reset": true back to the company setup.

Sign-in: App token or company API key
Permission: leaves.balance_corrections.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.
`leaveType`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`entitlement_days`	`nullable\|numeric\|min:0\|max:365`
`open_balance`	`nullable\|numeric\|min:-365\|max:365`
`carry_balance`	`nullable\|numeric\|min:0\|max:365`
`balance_year`	`nullable\|integer\|min:2000\|max:2100`
`active`	`nullable\|boolean`

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/timeoff/{leaveType}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"entitlement_days":1.5,"open_balance":1.5,"carry_balance":1.5,"balance_year":1,"active":true}'

GET /api/v1/app/companies/{company}/employees/{employee}/timeoff/{leaveType}/balance ZenHR's "Show balance": each year since hiring (up to ten), split into opening, previous,...

ZenHR's "Show balance": each year since hiring (up to ten), split into opening, previous, adjustments, encashed, hourly, total, taken, pending, remaining.

Sign-in: App token or company API key
Permission: leaves.balance_corrections.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.
`leaveType`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/timeoff/{leaveType}/balance" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/employees/{employee}/timeoff/{leaveType}/{action} Timeoff setup: cancel-future (ZenHR's Cancel all future transactions) or deactivate-move (...

Timeoff setup: cancel-future (ZenHR's Cancel all future transactions) or deactivate-move (to_leave_type_id).

Sign-in: App token or company API key
Permission: leaves.balance_corrections.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.
`leaveType`	integer	The record's ID.
`action`	string · cancel-future\|deactivate-move	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

to_leave_type_idrequired required|integer|exists:leave_types,id

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/timeoff/{leaveType}/{action}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"to_leave_type_id":1}'

POST /api/v1/app/companies/{company}/employees/{employee}/clocking-devices/reset Resets an employee's phone: the next phone they clock from needs approval.

Resets an employee's phone: the next phone they clock from needs approval.

Sign-in: App token or company API key
Permission: attendance.security.review
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/clocking-devices/reset" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/employees/{employee}/clocking-from Where one employee clocks from: their own choice, the branch's, and what applies.

Where one employee clocks from: their own choice, the branch's, and what applies.

Sign-in: App token or company API key
Permission: attendance.clocking_from.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/clocking-from" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/app/companies/{company}/employees/{employee}/clocking-from clocking_from: both, web, mobile or device; null or "follow" goes back to the branch's.

clocking_from: both, web, mobile or device; null or "follow" goes back to the branch's.

Sign-in: App token or company API key
Permission: attendance.clocking_from.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

clocking_from present

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/clocking-from" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"clocking_from":"..."}'

GET /api/v1/app/companies/{company}/employees/{employee}/devices A person's devices: profile, enrolments, why they are (not) on each device, templates (no...

A person's devices: profile, enrolments, why they are (not) on each device, templates (no data).

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/devices" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT PATCH /api/v1/app/companies/{company}/employees/{employee}/device-profile

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`card`	`sometimes\|nullable\|string\|max:32\|regex:/^[0-9A-Za-z]*$/`
`password`	`sometimes\|nullable\|string\|max:8\|regex:/^[0-9]*$/`
`privilege`	`sometimes\|integer\|in:0,2,6,14`
`verify_mode`	`sometimes\|in:default,any,finger,pin,password,card,finger_or_password,finger_or_card,card_or_password,pin_and_finger,finger_and_password,card_and_finger,card_and_password,finger_password_card,pin_finger_password,finger_and_card_or_pin,face,face_and_finger,face_and_password,face_and_card,face_finger_card,face_finger_password,vein,palm`
`enabled`	`sometimes\|boolean`
`push_photo`	`sometimes\|boolean`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/device-profile" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"card":"...","password":"...","privilege":1,"verify_mode":"default","enabled":true,"push_photo":true}'

POST /api/v1/app/companies/{company}/employees/{employee}/remove-from-devices

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/remove-from-devices" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/employees/{employee}/pull-templates

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/pull-templates" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/employees/{employee}/biometric-templates Templates; the data itself only with include_data=1 and the permission to see sensitive em...

Templates; the data itself only with include_data=1 and the permission to see sensitive employee data.

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/biometric-templates" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/employees/{employee}/biometric-matrix The person's slots × devices (present, missing, outdated, conflict, pending, incompatible,...

The person's slots × devices (present, missing, outdated, conflict, pending, incompatible, capacity…).

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/biometric-matrix" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/employees/{employee}/publish-missing

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/publish-missing" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/employees/{employee}/file/{kind} The employee's file: contracts, bank_accounts, family or documents (wave 1 of moving Mawar...

The employee's file: contracts, bank_accounts, family or documents (wave 1 of moving Mawarid in).

Sign-in: App token or company API key
Permission: employees.view
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.
`kind`	string · contracts\|bank_accounts\|family\|documents	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/file/{kind}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/employees/{employee}/file/{kind}

Sign-in: App token or company API key
Permission: employees.edit
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.
`kind`	string · contracts\|bank_accounts\|family\|documents	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/file/{kind}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH POST /api/v1/app/companies/{company}/employees/{employee}/file/{kind}/{id}

Sign-in: App token or company API key
Permission: employees.edit
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.
`kind`	string · contracts\|bank_accounts\|family\|documents	The record's ID.
`id`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/file/{kind}/{id}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/employees/{employee}/file/{kind}/{id}

Sign-in: App token or company API key
Permission: employees.edit
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.
`kind`	string · contracts\|bank_accounts\|family\|documents	The record's ID.
`id`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/file/{kind}/{id}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/employees/{employee}/documents/{document}/download

Sign-in: App token or company API key
Permission: employees.view
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.
`document`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/documents/{document}/download" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/employees/{employee}/history

Sign-in: App token or company API key
Permission: employees.view
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/history" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/employees

Sign-in: App token or company API key
Permission: employees.view
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/employees/{employee}

Sign-in: App token or company API key
Permission: employees.view
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/employees

Sign-in: App token or company API key
Permission: employees.create
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/app/companies/{company}/employees/{employee}

Sign-in: App token or company API key
Permission: employees.edit
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/employees/{employee}/transfer

Sign-in: App token or company API key
Permission: employees.transfer
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`branch_id`required	`required\|integer\|exists:branches,id`
`effective_date`required	`required\|date\|'after_or_equal:' . $employee->started_on?->toDateString()`
`position_id`	`nullable\|integer\|exists:positions,id`
`work_location_id`	`$unitRule('work_location')`
`department_id`	`$unitRule('department')`
`section_id`	`$unitRule('section')`
`project_id`	`$unitRule('project')`
`note`	`nullable\|string\|'max:' . \App\Support\Limits::chars(500)`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/transfer" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"branch_id":1,"effective_date":"2026-11-01","position_id":1,"work_location_id":"...","department_id":"...","section_id":"...","project_id":"...","note":"..."}'

GET /api/v1/app/companies/{company}/employees/by-number/{number} One employee by the number people use (the current record first; ?branch_id= when numbers...

One employee by the number people use (the current record first; ?branch_id= when numbers repeat across branches).

Sign-in: App token or company API key
Permission: employees.view
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`number`	string	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/by-number/{number}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/employees/{employee}/archive "Delete": archives the record and keeps everything tied to it (docs/employee-numbering.md)...

"Delete": archives the record and keeps everything tied to it (docs/employee-numbering.md).

Sign-in: App token or company API key
Permission: employees.archive
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

reason nullable|string|'max:' . \App\Support\Limits::chars(500)

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/archive" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"reason":"..."}'

POST /api/v1/app/companies/{company}/employees/{employee}/restore

Sign-in: App token or company API key
Permission: employees.archive
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/restore" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/employees/{employee}/terminate

Sign-in: App token or company API key
Permission: employees.terminate
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`terminated_on`required	`required\|date\|'after_or_equal:' . ($employee->started_on ?? $employee->hire_date)?->toDateStri...`
`termination_type`required	`required\|in:resignation,dismissal,end_of_contract,other,retirement,transfer`
`note`	`nullable\|string\|'max:' . \App\Support\Limits::chars(500)`
`termination_reason_id`	`nullable\|integer\|exists:termination_reasons,id`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/employees/{employee}/terminate" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"terminated_on":"2026-11-01","termination_type":"resignation","note":"...","termination_reason_id":1}'

engine 16 endpoints

GET /api/v1/app/companies/{company}/engine/nav

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/engine/nav" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/engine/dashboard The dashboard in the app (docs/mobile-dashboards.md): the widgets open to the person here,...

The dashboard in the app (docs/mobile-dashboards.md): the widgets open to the person here, as blocks.

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/engine/dashboard" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/engine/dashboard/layout PUT dashboard/layout: order [keys], show [keys], or reset; on the phone only.

PUT dashboard/layout: order [keys], show [keys], or reset; on the phone only.

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/engine/dashboard/layout" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/engine/links GET links?url=: what a notice's or a result's link opens for this person, or why it can't.

GET links?url=: what a notice's or a result's link opens for this person, or why it can't.

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

url nullable|string|max:500

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/engine/links?url=..." \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/engine/sections/{section}

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`section`	string · [a-z_]+	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/engine/sections/{section}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/engine/sections/{section}/records

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`section`	string · [a-z_]+	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/engine/sections/{section}/records" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/engine/sections/{section}/records

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`section`	string · [a-z_]+	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/engine/sections/{section}/records" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/engine/sections/{section}/records/{record}

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`section`	string · [a-z_]+	The record's ID.
`record`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/engine/sections/{section}/records/{record}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH POST /api/v1/app/companies/{company}/engine/sections/{section}/records/{record}

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`section`	string · [a-z_]+	The record's ID.
`record`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/engine/sections/{section}/records/{record}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/engine/sections/{section}/records/{record}/actions/{action}

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`section`	string · [a-z_]+	The record's ID.
`record`	integer	The record's ID.
`action`	string · [a-z_]+	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/engine/sections/{section}/records/{record}/actions/{action}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/engine/sections/{section}/records/{record}/files/{field}

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`section`	string · [a-z_]+	The record's ID.
`record`	integer	The record's ID.
`field`	string · [a-z_]+	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/engine/sections/{section}/records/{record}/files/{field}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/engine/sections/{section}/bulk/{action}

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 20 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`section`	string · [a-z_]+	The record's ID.
`action`	string · [a-z_]+	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/engine/sections/{section}/bulk/{action}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/engine/sections/{section}/form

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`section`	string · [a-z_]+	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/engine/sections/{section}/form" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/engine/sections/{section}/options/{field}

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`section`	string · [a-z_]+	The record's ID.
`field`	string · [a-z_]+	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/engine/sections/{section}/options/{field}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/engine/sections/{section}/blocks

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`section`	string · [a-z_]+	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/engine/sections/{section}/blocks" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/engine/sections/{section}/export

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 10 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`section`	string · [a-z_]+	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/engine/sections/{section}/export" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

enrollment-rules 1 endpoint

DELETE /api/v1/app/companies/{company}/enrollment-rules/{rule}

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`rule`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/enrollment-rules/{rule}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

eos-policies 5 endpoints

GET /api/v1/app/companies/{company}/eos-policies Filters: name, category, contract_type (limited | unlimited), defaults_only.

Filters: name, category, contract_type (limited | unlimited), defaults_only.

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/eos-policies" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/eos-policies

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name_en`required	`required\|string\|'max:' . \App\Support\Limits::chars(120)`
`name_ar`required	`required\|string\|'max:' . \App\Support\Limits::chars(120)`
`termination_category`required	`required\|in:any,resignation,termination,end_of_contract,retirement,transfer,other`
`min_years`required	`required\|integer\|min:0\|max:50`
`tiers`required	`required\|string\|max:1000`
`worth_tiers`	`nullable\|string\|max:1000`
`contract_type`	`nullable\|in:both,limited,unlimited`
`exclude_unpaid`	`nullable\|array`
`exclude_unpaid.*`	`string`
`nationalities`	`nullable\|array`
`nationalities.*`	`string\|max:60`
`end_date`	`nullable\|date`
`allowance_type_ids`	`nullable\|array`
`allowance_type_ids.*`	`integer\|exists:transaction_types,id`
`calc_base`	`nullable\|in:calendar,365,360`
`year_definition`	`nullable\|in:calendar,fixed`
`fixed_year_days`	`nullable\|required_if:year_definition,fixed\|integer\|between:300,400`
`calc_type`	`nullable\|in:service,remaining,both`
`remaining_direction`	`nullable\|in:add,deduct`
`service_min_salaries`	`nullable\|numeric\|min:0`
`service_max_salaries`	`nullable\|numeric\|min:0`
`remaining_min_salaries`	`nullable\|numeric\|min:0`
`remaining_max_salaries`	`nullable\|numeric\|min:0`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/eos-policies" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name_en":"...","name_ar":"...","termination_category":"any","min_years":1,"tiers":"...","worth_tiers":"...","contract_type":"both","exclude_unpaid":[],"nationalities":[],"end_date":"2026-11-01","allowance_type_ids":[],"calc_base":"calendar","year_definition":"calendar","fixed_year_days":1,"calc_type":"service","remaining_direction":"add","service_min_salaries":1.5,"service_max_salaries":1.5,"remaining_min_salaries":1.5,"remaining_max_salaries":1.5}'

GET /api/v1/app/companies/{company}/eos-policies/{policy}

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`policy`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/eos-policies/{policy}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/eos-policies/{policy}

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`policy`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name_en`required	`required\|string\|'max:' . \App\Support\Limits::chars(120)`
`name_ar`required	`required\|string\|'max:' . \App\Support\Limits::chars(120)`
`termination_category`required	`required\|in:any,resignation,termination,end_of_contract,retirement,transfer,other`
`min_years`required	`required\|integer\|min:0\|max:50`
`tiers`required	`required\|string\|max:1000`
`worth_tiers`	`nullable\|string\|max:1000`
`contract_type`	`nullable\|in:both,limited,unlimited`
`exclude_unpaid`	`nullable\|array`
`exclude_unpaid.*`	`string`
`nationalities`	`nullable\|array`
`nationalities.*`	`string\|max:60`
`end_date`	`nullable\|date`
`allowance_type_ids`	`nullable\|array`
`allowance_type_ids.*`	`integer\|exists:transaction_types,id`
`calc_base`	`nullable\|in:calendar,365,360`
`year_definition`	`nullable\|in:calendar,fixed`
`fixed_year_days`	`nullable\|required_if:year_definition,fixed\|integer\|between:300,400`
`calc_type`	`nullable\|in:service,remaining,both`
`remaining_direction`	`nullable\|in:add,deduct`
`service_min_salaries`	`nullable\|numeric\|min:0`
`service_max_salaries`	`nullable\|numeric\|min:0`
`remaining_min_salaries`	`nullable\|numeric\|min:0`
`remaining_max_salaries`	`nullable\|numeric\|min:0`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/eos-policies/{policy}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name_en":"...","name_ar":"...","termination_category":"any","min_years":1,"tiers":"...","worth_tiers":"...","contract_type":"both","exclude_unpaid":[],"nationalities":[],"end_date":"2026-11-01","allowance_type_ids":[],"calc_base":"calendar","year_definition":"calendar","fixed_year_days":1,"calc_type":"service","remaining_direction":"add","service_min_salaries":1.5,"service_max_salaries":1.5,"remaining_min_salaries":1.5,"remaining_max_salaries":1.5}'

DELETE /api/v1/app/companies/{company}/eos-policies/{policy}

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`policy`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/eos-policies/{policy}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

evaluation-criteria 1 endpoint

DELETE /api/v1/app/companies/{company}/evaluation-criteria/{criterion}

Sign-in: App token or company API key
Permission: performance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`criterion`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/evaluation-criteria/{criterion}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

evaluation-cycles 9 endpoints

GET /api/v1/app/companies/{company}/evaluation-cycles The cycles, with the list's filters: q (name), status (draft, open, closed) and stage (cur...

The cycles, with the list's filters: q (name), status (draft, open, closed) and stage (current stage).

Sign-in: App token or company API key
Permission: performance.view | performance.manage.* | performance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/evaluation-cycles" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/evaluation-cycles/{cycle} The cycle and its evaluations in scope, with the cycle page's filters (q, branch, position...

The cycle and its evaluations in scope, with the cycle page's filters (q, branch, position, work_location, department, section, project, hierarchy_group, stage, status, action, okrs, missing, employee_status).

Sign-in: App token or company API key
Permission: performance.view | performance.manage.* | performance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`cycle`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/evaluation-cycles/{cycle}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/evaluation-cycles/{cycle}/calibration Who sits in which result band of a cycle, in what the person reaches, and whose result the...

Who sits in which result band of a cycle, in what the person reaches, and whose result they may move.

Sign-in: App token or company API key
Permission: performance.calibrate
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`cycle`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/evaluation-cycles/{cycle}/calibration" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/evaluation-cycles evaluation_template_id, name, branch_ids, year, evaluation_part, stages {stage: {start, en...

evaluation_template_id, name, branch_ids, year, evaluation_part, stages {stage: {start, end}}.

Sign-in: App token or company API key
Permission: performance.manage.* | performance.cycles.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`	`nullable\|string\|max:150`
`branch_ids`	`nullable\|array`
`branch_ids.*`	`integer\|exists:branches,id`
`year`required	`required\|integer\|between:2000,2100`
`evaluation_part`required	`required\|Rule::in(array_keys(\App\Models\EvaluationCycle::parts($template->period)))`
`stages`required	`required\|array`
`stages.*.start`	`nullable\|date`
`stages.*.end`	`nullable\|date`
`stages.*.on_start_end`	`nullable\|boolean`
`stages.*.before_end`	`nullable\|boolean`
`stages.*.on_submit`	`nullable\|boolean`
`stages.*.before_end_days`	`nullable\|integer\|min:0\|max:60`
`stages.*.notify_ids`	`nullable\|array`
`stages..notify_ids.`	`integer\|exists:employees,id`
`send_before_start`	`nullable\|boolean`
`send_before_start_days`	`nullable\|integer\|min:1\|max:60`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/evaluation-cycles" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":"...","branch_ids":[],"year":1,"evaluation_part":"...","stages":[],"send_before_start":true,"send_before_start_days":1}'

POST /api/v1/app/companies/{company}/evaluation-cycles/{cycle}/launch

Sign-in: App token or company API key
Permission: performance.manage.* | performance.cycles.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`cycle`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/evaluation-cycles/{cycle}/launch" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/evaluation-cycles/{cycle}/close

Sign-in: App token or company API key
Permission: performance.manage.* | performance.cycles.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`cycle`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/evaluation-cycles/{cycle}/close" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/evaluation-cycles/{cycle}/dates

Sign-in: App token or company API key
Permission: performance.manage.* | performance.cycles.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`cycle`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/evaluation-cycles/{cycle}/dates" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/evaluation-cycles/{cycle}/employees employees (ids).

employees (ids).

Sign-in: App token or company API key
Permission: performance.manage.* | performance.cycles.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`cycle`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/evaluation-cycles/{cycle}/employees" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/evaluation-cycles/{cycle}

Sign-in: App token or company API key
Permission: performance.manage.* | performance.cycles.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`cycle`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/evaluation-cycles/{cycle}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

evaluation-templates 4 endpoints

POST /api/v1/app/companies/{company}/evaluation-templates

Sign-in: App token or company API key
Permission: performance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/evaluation-templates" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH PUT /api/v1/app/companies/{company}/evaluation-templates/{template}

Sign-in: App token or company API key
Permission: performance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`template`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/evaluation-templates/{template}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/evaluation-templates/{template}

Sign-in: App token or company API key
Permission: performance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`template`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/evaluation-templates/{template}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/evaluation-templates/{template}/criteria title {en, ar}, weight, kind factor|okr, target, measurement_unit_id.

title {en, ar}, weight, kind factor|okr, target, measurement_unit_id.

Sign-in: App token or company API key
Permission: performance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`template`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`title`required	`required\|array`
`title.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(200)`
`title.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(200)`
`weight`required	`required\|numeric\|min:0.01\|max:100`
`kind`	`nullable\|in:factor,okr`
`target`	`nullable\|required_if:kind,okr\|numeric\|gt:0`
`measurement_unit_id`	`nullable\|integer\|exists:measurement_units,id`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/evaluation-templates/{template}/criteria" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"title":{"en":"...","ar":"..."},"weight":1.5,"kind":"factor","target":1.5,"measurement_unit_id":1}'

evaluations 11 endpoints

GET /api/v1/app/companies/{company}/evaluations/{evaluation}

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`evaluation`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/evaluations/{evaluation}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/evaluations/{evaluation}/self

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`evaluation`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`attachments`	`nullable\|array\|max:10`
`attachments.*`	`file\|max:10240`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/evaluations/{evaluation}/self" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"attachments":[]}'

POST /api/v1/app/companies/{company}/evaluations/{evaluation}/review

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`evaluation`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/evaluations/{evaluation}/review" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/evaluations/{evaluation}/objectives objective: name {en, ar}, description {en, ar}, weight, key_results [{name {en, ar}, weigh...

objective: name {en, ar}, description {en, ar}, weight, key_results [{name {en, ar}, weight, measurement_unit_id, target}].

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`evaluation`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/evaluations/{evaluation}/objectives" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/evaluations/{evaluation}/okrs/publish

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`evaluation`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/evaluations/{evaluation}/okrs/publish" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/evaluations/{evaluation}/notes performance_summary, key_strengths, weaknesses, recommendations, attachments[].

performance_summary, key_strengths, weaknesses, recommendations, attachments[].

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`evaluation`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/evaluations/{evaluation}/notes" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/evaluations/{evaluation}/final final_rate_override (0–100), final_notes, notify_people.

final_rate_override (0–100), final_notes, notify_people.

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`evaluation`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`final_rate_override`required	`required\|numeric\|min:0\|max:100`
`final_notes`	`nullable\|string\|max:3000`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/evaluations/{evaluation}/final" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"final_rate_override":1.5,"final_notes":"..."}'

POST /api/v1/app/companies/{company}/evaluations/{evaluation}/calibrate score (0–100), reason.

score (0–100), reason.

Sign-in: App token or company API key
Permission: performance.calibrate
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`evaluation`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`score`required	`required\|numeric\|min:0\|max:100`
`reason`required	`required\|string\|min:3\|'max:' . \App\Support\Limits::chars(1000)`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/evaluations/{evaluation}/calibrate" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"score":1.5,"reason":"..."}'

PUT /api/v1/app/companies/{company}/evaluations/{evaluation}/task-holders okr_writer_id, okr_auditor_ids, result_writer_id, result_auditor_ids (employee ids).

okr_writer_id, okr_auditor_ids, result_writer_id, result_auditor_ids (employee ids).

Sign-in: App token or company API key
Permission: performance.manage.* | performance.evaluations.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`evaluation`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`okr_writer_id`	`nullable\|integer\|$person`
`okr_auditor_ids`	`nullable\|array`
`okr_auditor_ids.*`	`integer\|$person`
`result_writer_id`	`nullable\|integer\|$person`
`result_auditor_ids`	`nullable\|array`
`result_auditor_ids.*`	`integer\|$person`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/evaluations/{evaluation}/task-holders" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"okr_writer_id":1,"okr_auditor_ids":[],"result_writer_id":1,"result_auditor_ids":[]}'

PUT /api/v1/app/companies/{company}/evaluations/{evaluation}/dates stages {stage: {start, end}}.

stages {stage: {start, end}}.

Sign-in: App token or company API key
Permission: performance.manage.* | performance.evaluations.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`evaluation`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/evaluations/{evaluation}/dates" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/evaluations/{evaluation}

Sign-in: App token or company API key
Permission: performance.manage.* | performance.evaluations.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`evaluation`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/evaluations/{evaluation}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

events 4 endpoints

GET /api/v1/app/companies/{company}/events month (YYYY-MM): coming up, past, the month's events by day and its holidays.

month (YYYY-MM): coming up, past, the month's events by day and its holidays.

Sign-in: App token or company API key
Permission: self.events | events.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/events" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/events title {en, ar}, date, start_time (HH:MM), location, description.

title {en, ar}, date, start_time (HH:MM), location, description.

Sign-in: App token or company API key
Permission: events.create
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`title`required	`required\|array`
`title.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`title.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(150)`
`date`required	`required\|date`
`start_time`	`nullable\|date_format:H:i`
`location`	`nullable\|string\|max:150`
`description`	`nullable\|string\|'max:' . \App\Support\Limits::chars(2000)`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/events" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"title":{"en":"...","ar":"..."},"date":"2026-11-01","start_time":"2026-11-01","location":"...","description":"..."}'

PATCH PUT /api/v1/app/companies/{company}/events/{event}

Sign-in: App token or company API key
Permission: events.edit
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`event`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`title`required	`required\|array`
`title.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`title.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(150)`
`date`required	`required\|date`
`start_time`	`nullable\|date_format:H:i`
`location`	`nullable\|string\|max:150`
`description`	`nullable\|string\|'max:' . \App\Support\Limits::chars(2000)`

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/events/{event}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"title":{"en":"...","ar":"..."},"date":"2026-11-01","start_time":"2026-11-01","location":"...","description":"..."}'

DELETE /api/v1/app/companies/{company}/events/{event}

Sign-in: App token or company API key
Permission: events.delete
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`event`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/events/{event}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

exchange-rates 5 endpoints

GET /api/v1/app/companies/{company}/exchange-rates Rates, by pair and newest date first: currency (either side), branch (an id, or "company"...

Rates, by pair and newest date first: currency (either side), branch (an id, or "company" for company-wide).

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/exchange-rates" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/exchange-rates

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`from_currency`	`$currency`
`to_currency`	`$currency\|different:from_currency`
`rate`required	`required\|numeric\|gt:0`
`effective_date`required	`required\|date`
`reverse_rate`	`nullable\|numeric\|gt:0`
`branch_id`	`nullable\|exists:branches,id`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/exchange-rates" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"from_currency":"...","to_currency":"...","rate":1.5,"effective_date":"2026-11-01","reverse_rate":1.5,"branch_id":"..."}'

PUT /api/v1/app/companies/{company}/exchange-rates/multi-currency

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

multi_currencyrequired required|boolean

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/exchange-rates/multi-currency" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"multi_currency":true}'

POST /api/v1/app/companies/{company}/exchange-rates/copy

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`branch_ids`required	`required\|array`
`branch_ids.*`	`exists:branches,id`
`effective_date`required	`required\|date`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/exchange-rates/copy" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"branch_ids":[],"effective_date":"2026-11-01"}'

DELETE /api/v1/app/companies/{company}/exchange-rates/{rate}

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`rate`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/exchange-rates/{rate}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

feedback-cycles 7 endpoints

GET /api/v1/app/companies/{company}/feedback-cycles/{cycle}/results/{employee} One employee's summary per reviewer group (HR any time, the employee once the cycle is clo...

One employee's summary per reviewer group (HR any time, the employee once the cycle is closed).

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`cycle`	integer	The record's ID.
`employee`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/feedback-cycles/{cycle}/results/{employee}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/feedback-cycles

Sign-in: App token or company API key
Permission: performance.manage.* | performance.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/feedback-cycles" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/feedback-cycles name, evaluation_template_id, due_date, peers_per_employee; or a survey cycle (Feedback::c...

name, evaluation_template_id, due_date, peers_per_employee; or a survey cycle (Feedback::createSurveyCycle).

Sign-in: App token or company API key
Permission: performance.manage.* | performance.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`required	`required\|string\|max:150`
`evaluation_template_id`required	`required\|integer\|exists:evaluation_templates,id`
`due_date`required	`required\|date\|after_or_equal:today`
`peers_per_employee`required	`required\|integer\|between:0,10`
`description`required	`required\|string\|'max:' . \App\Support\Limits::chars(2000)`
`start_date`required	`required\|date`
`groups`required	`required\|array`
`groups.*`	`nullable\|array`
`groups.report.count`	`nullable\|integer\|between:1,10`
`groups.peer.count`	`nullable\|integer\|between:1,10`
`groups.*.weight`	`nullable\|numeric\|between:0,100`
`assign_to`required	`required\|in:individual,group`
`employees`required	`exclude_unless:assign_to,individual\|required\|array\|min:1`
`employees.*`	`integer`
`group`	`nullable\|array`
`group.*`	`nullable\|alpha_dash\|max:30`
`questions`required	`required\|array\|min:1\|max:60`
`questions.*.type`required	`required\|in:rating,open`
`questions.*.text`required	`required\|string\|'max:' . \App\Support\Limits::chars(300)`
`questions.*.helper`	`nullable\|string\|'max:' . \App\Support\Limits::chars(500)`
`questions.*.max`	`nullable\|integer\|between:2,10`
`questions.*.low`	`nullable\|string\|'max:' . \App\Support\Limits::chars(40)`
`questions.*.high`	`nullable\|string\|'max:' . \App\Support\Limits::chars(40)`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/feedback-cycles" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":"...","evaluation_template_id":1,"due_date":"2026-11-01","peers_per_employee":1,"description":"...","start_date":"2026-11-01","groups":{"report":{"count":1},"peer":{"count":1}},"assign_to":"individual","employees":[],"group":[],"questions":[]}'

GET /api/v1/app/companies/{company}/feedback-cycles/{cycle} The cycle and, per employee in scope, how many were asked and answered.

The cycle and, per employee in scope, how many were asked and answered.

Sign-in: App token or company API key
Permission: performance.manage.* | performance.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`cycle`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/feedback-cycles/{cycle}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/feedback-cycles/{cycle}/launch

Sign-in: App token or company API key
Permission: performance.manage.* | performance.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`cycle`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/feedback-cycles/{cycle}/launch" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/feedback-cycles/{cycle}/close

Sign-in: App token or company API key
Permission: performance.manage.* | performance.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`cycle`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/feedback-cycles/{cycle}/close" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/feedback-cycles/{cycle}

Sign-in: App token or company API key
Permission: performance.manage.* | performance.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`cycle`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/feedback-cycles/{cycle}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

feedback-form-assignments 2 endpoints

GET /api/v1/app/companies/{company}/feedback-form-assignments/{assignment} A feedback form assigned to me: its questions and my answers (403 for anyone else).

A feedback form assigned to me: its questions and my answers (403 for anyone else).

Sign-in: App token or company API key
Permission: self.performance.forms
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`assignment`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/feedback-form-assignments/{assignment}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/feedback-form-assignments/{assignment}

Sign-in: App token or company API key
Permission: self.performance.forms
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`assignment`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/feedback-form-assignments/{assignment}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

feedback-forms 4 endpoints

GET /api/v1/app/companies/{company}/feedback-forms

Sign-in: App token or company API key
Permission: performance.feedback_forms.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/feedback-forms" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/feedback-forms/{form} The form, its questions and each question's answers (names hidden when anonymous).

The form, its questions and each question's answers (names hidden when anonymous).

Sign-in: App token or company API key
Permission: performance.feedback_forms.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`form`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/feedback-forms/{form}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/feedback-forms title, description, start_date, end_date, anonymous, questions [...], assign_to individual...

title, description, start_date, end_date, anonymous, questions [...], assign_to individual (employees) | group (group).

Sign-in: App token or company API key
Permission: performance.feedback_forms.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`title`required	`required\|string\|max:200`
`description`	`nullable\|string\|'max:' . \App\Support\Limits::chars(2000)`
`start_date`required	`required\|date`
`end_date`	`nullable\|date\|after_or_equal:start_date`
`questions`required	`required\|array\|min:1\|max:100`
`questions.*.type`required	`required\|in:text,textarea,checkbox,radio,rating,yes_no`
`questions.*.label`required	`required\|string\|max:300`
`questions.*.helper`	`nullable\|string\|max:300`
`questions.*.weight`	`nullable\|numeric\|min:0\|max:1000`
`questions.*.options`	`nullable\|array\|max:50`
`questions..options..label`required	`required\|string\|max:150`
`questions..options..value`required	`required\|string\|max:150`
`questions.*.min_rating`	`nullable\|integer\|between:0,100`
`questions.*.max_rating`	`nullable\|integer\|between:1,100`
`assign_to`required	`required\|in:individual,group`
`employees`required	`exclude_unless:assign_to,individual\|required\|array\|min:1`
`employees.*`	`integer`
`group`	`nullable\|array`
`group.*`	`nullable\|alpha_dash\|max:30`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/feedback-forms" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"title":"...","description":"...","start_date":"2026-11-01","end_date":"2026-11-01","questions":[],"assign_to":"individual","employees":[],"group":[]}'

DELETE /api/v1/app/companies/{company}/feedback-forms/{form}

Sign-in: App token or company API key
Permission: performance.feedback_forms.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`form`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/feedback-forms/{form}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

feedback-requests 1 endpoint

POST /api/v1/app/companies/{company}/feedback-requests/{feedbackRequest} scores {criterion id: 1–5}, comment.

scores {criterion id: 1–5}, comment.

Sign-in: App token or company API key
Permission: self.performance.feedback
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`feedbackRequest`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`scores`required	`required\|array`
`comment`	`nullable\|string\|'max:' . \App\Support\Limits::chars(2000)`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/feedback-requests/{feedbackRequest}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"scores":[],"comment":"..."}'

field 97 endpoints

GET /api/v1/app/companies/{company}/field/my-jobs The signed-in employee's jobs: open first, then the last 30 days.

The signed-in employee's jobs: open first, then the last 30 days.

Sign-in: App token or company API key
Permission: self.field_jobs | field.jobs.view | field.jobs.manage
Module: fsm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/my-jobs" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/my-jobs/{job} One of the employee's jobs with its photos.

One of the employee's jobs with its photos.

Sign-in: App token or company API key
Permission: self.field_jobs | field.jobs.view | field.jobs.manage
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`job`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/my-jobs/{job}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/field/time-anchor body: device_id, boot_id, elapsed_ms (the phone's since-boot clock as it asks).

body: device_id, boot_id, elapsed_ms (the phone's since-boot clock as it asks).

Sign-in: App token or company API key
Permission: self.field_jobs
Module: fsm
Rate limit: 30 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`device_id`required	`required\|string\|max:100`
`boot_id`	`nullable\|string\|max:100`
`elapsed_ms`	`nullable\|integer\|min:0`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/time-anchor" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"device_id":"...","boot_id":"...","elapsed_ms":1}'

POST /api/v1/app/companies/{company}/field/device-keys/challenge

Sign-in: App token or company API key
Permission: self.field_jobs
Module: fsm
Rate limit: 10 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/device-keys/challenge" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/field/device-keys device_id, public_key (base64 SPKI P-256), platform, challenge, attestation {android_key_c...

device_id, public_key (base64 SPKI P-256), platform, challenge, attestation {android_key_chain | ios_app_attest {key_id, attestation_object}}.

Sign-in: App token or company API key
Permission: self.field_jobs
Module: fsm
Rate limit: 10 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/device-keys" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/device-keys The signed-in person's keys in this company.

The signed-in person's keys in this company.

Sign-in: App token or company API key
Permission: self.field_jobs
Module: fsm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/device-keys" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/field/jobs/{job}/evidence multipart: photo (JPEG, as signed), meta (canonical JSON), signature (base64 ECDSA P-256 o...

multipart: photo (JPEG, as signed), meta (canonical JSON), signature (base64 ECDSA P-256 over meta).

Sign-in: App token or company API key
Permission: self.field_jobs
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`job`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`photo`required	`required\|file\|mimetypes:image/jpeg\|max:15360`
`meta`required	`required\|string\|max:20000`
`signature`required	`required\|string\|max:500`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/jobs/{job}/evidence" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -F "[email protected]" \
  -F "meta=..." \
  -F "signature=..."

GET /api/v1/app/companies/{company}/field/evidence/{evidence}/photo The original JPEG (?size=thumb for the thumbnail): reviewers, and the employee who took it...

The original JPEG (?size=thumb for the thumbnail): reviewers, and the employee who took it.

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`evidence`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/evidence/{evidence}/photo" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/my-overtime

Sign-in: App token or company API key
Permission: self.field_overtime
Module: fsm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/my-overtime" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/field/overtime/{employeeRequest}/submit body: reason (required), overtime_type_id (optional, a requestable type).

body: reason (required), overtime_type_id (optional, a requestable type).

Sign-in: App token or company API key
Permission: self.field_overtime
Module: fsm
Rate limit: 20 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employeeRequest`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`reason`required	`required\|string\|'max:' . \App\Support\Limits::chars(500)`
`overtime_type_id`	`nullable\|integer`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/overtime/{employeeRequest}/submit" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"reason":"...","overtime_type_id":1}'

POST /api/v1/app/companies/{company}/field/overtime/{employeeRequest}/discard

Sign-in: App token or company API key
Permission: self.field_overtime
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employeeRequest`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/overtime/{employeeRequest}/discard" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/flags Every flag and reason code with its plain-language label and explanation in English and Ar...

Every flag and reason code with its plain-language label and explanation in English and Arabic.

Sign-in: App token or company API key
Permission: self.field_jobs | field.evidence.review
Module: fsm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/flags" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/geocode/search q (2–200 characters), lang (en|ar, default the UI language), lat and lng (optional, to pre...

q (2–200 characters), lang (en|ar, default the UI language), lat and lng (optional, to prefer results near them), limit (1–10).

Sign-in: App token or company API key
Permission: self.field_jobs | field.jobs.view | field.jobs.manage | field_setup.manage
Module: fsm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

`q`required	`required\|string\|min:2\|'max:' . \App\Support\Limits::chars(200)`
`lang`	`nullable\|in:en,ar`
`lat`	`nullable\|numeric\|between:-90,90\|required_with:lng`
`lng`	`nullable\|numeric\|between:-180,180\|required_with:lat`
`limit`	`nullable\|integer\|between:1,10`

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/geocode/search?q=...&lang=en&lat=1.5&lng=1.5" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/geocode/reverse lat, lng, lang (en|ar, default the UI language).

lat, lng, lang (en|ar, default the UI language).

Sign-in: App token or company API key
Permission: self.field_jobs | field.jobs.view | field.jobs.manage | field_setup.manage
Module: fsm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

`lat`required	`required\|numeric\|between:-90,90`
`lng`required	`required\|numeric\|between:-180,180`
`lang`	`nullable\|in:en,ar`

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/geocode/reverse?lat=1.5&lng=1.5&lang=en" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/jobs status (one or a list), branch_id, site_id, employee_id, q, date, from, to, flagged, flag,...

status (one or a list), branch_id, site_id, employee_id, q, date, from, to, flagged, flag, per_page; each job has flagged_count.

Sign-in: App token or company API key
Permission: field.jobs.view | field.jobs.manage
Module: fsm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/jobs" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/jobs/summary The board's counts (per status, today, in progress, awaiting review, flagged) under the sa...

The board's counts (per status, today, in progress, awaiting review, flagged) under the same filters as jobs.

Sign-in: App token or company API key
Permission: field.jobs.view | field.jobs.manage
Module: fsm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/jobs/summary" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/jobs/{job}

Sign-in: App token or company API key
Permission: field.jobs.view | field.jobs.manage
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`job`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/jobs/{job}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/jobs/{job}/events

Sign-in: App token or company API key
Permission: field.jobs.view | field.jobs.manage
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`job`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/jobs/{job}/events" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/jobs/{job}/overtime

Sign-in: App token or company API key
Permission: field.overtime.view
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`job`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/jobs/{job}/overtime" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/overtime Overtime from field jobs in the person's branches. status (pending by default, or all), wa...

Overtime from field jobs in the person's branches. status (pending by default, or all), waiting_on_me, q, per_page.

Sign-in: App token or company API key
Permission: field.overtime.view
Module: fsm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/overtime" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/field/overtime/{employeeRequest}/decide decision approved or rejected, note (required to reject).

decision approved or rejected, note (required to reject).

Sign-in: App token or company API key
Permission: field.overtime.approve
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employeeRequest`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`decision`required	`required\|in:approved,rejected`
`note`	`nullable\|string\|'max:' . \App\Support\Limits::chars(1000)`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/overtime/{employeeRequest}/decide" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"decision":"approved","note":"..."}'

GET /api/v1/app/companies/{company}/field/sites

Sign-in: App token or company API key
Permission: field.sites.view
Module: fsm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/sites" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/dispatch date (Y-m-d, default today), branch_id, status, q.

date (Y-m-d, default today), branch_id, status, q.

Sign-in: App token or company API key
Permission: field.dispatch.view
Module: fsm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/dispatch" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/jobs/{job}/candidates Who could take the job, best first. q: find someone else of the branch by name or number.

Who could take the job, best first. q: find someone else of the branch by name or number.

Sign-in: App token or company API key
Permission: field.dispatch.manage
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`job`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/jobs/{job}/candidates" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/map-tiles Where the app's maps take their pictures from (config/mihnaro.php).

Where the app's maps take their pictures from (config/mihnaro.php).

Sign-in: App token or company API key
Permission: field.dispatch.view | field.evidence.review
Module: fsm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/map-tiles" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/field/jobs title, description, branch_id, field_site_id, priority, planned_start_at, planned_end_at,...

title, description, branch_id, field_site_id, priority, planned_start_at, planned_end_at, estimated_minutes, assignee_ids.

Sign-in: App token or company API key
Permission: field.jobs.create
Module: fsm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/jobs" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/app/companies/{company}/field/jobs/{job}

Sign-in: App token or company API key
Permission: field.jobs.edit | field.dispatch.manage
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`job`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/jobs/{job}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/field/jobs/{job}

Sign-in: App token or company API key
Permission: field.jobs.delete
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`job`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/jobs/{job}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/field/jobs/{job}/decide action approve | reject | cancel, note (required to reject or cancel).

action approve | reject | cancel, note (required to reject or cancel).

Sign-in: App token or company API key
Permission: field.jobs.review | field.jobs.cancel
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`job`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`action`required	`required\|in:approve,reject,cancel`
`note`	`nullable\|string\|'max:' . \App\Support\Limits::chars(1000)`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/jobs/{job}/decide" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"action":"approve","note":"..."}'

POST /api/v1/app/companies/{company}/field/jobs/{job}/submit-without-departure reason (required): a job waiting for its departure photo goes to review without it.

reason (required): a job waiting for its departure photo goes to review without it.

Sign-in: App token or company API key
Permission: field.jobs.review
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`job`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

reasonrequired required|string|min:3|'max:' . \App\Support\Limits::chars(1000)

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/jobs/{job}/submit-without-departure" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"reason":"..."}'

POST /api/v1/app/companies/{company}/field/jobs/{job}/request-upload note (optional): tells the job's employees to upload what is still on their phones.

note (optional): tells the job's employees to upload what is still on their phones.

Sign-in: App token or company API key
Permission: field.jobs.request_upload
Module: fsm
Rate limit: 30 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`job`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

note nullable|string|'max:' . \App\Support\Limits::chars(500)

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/jobs/{job}/request-upload" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"note":"..."}'

POST /api/v1/app/companies/{company}/field/jobs/{job}/reassign employee_id, note (optional).

employee_id, note (optional).

Sign-in: App token or company API key
Permission: field.dispatch.manage
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`job`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`employee_id`required	`required\|integer`
`note`	`nullable\|string\|'max:' . \App\Support\Limits::chars(1000)`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/jobs/{job}/reassign" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"employee_id":1,"note":"..."}'

POST /api/v1/app/companies/{company}/field/jobs/bulk-cancel job_ids[], reason → {cancelled: [ids], skipped: [{id, reason: not_found|not_open}]}.

job_ids[], reason → {cancelled: [ids], skipped: [{id, reason: not_found|not_open}]}.

Sign-in: App token or company API key
Permission: field.jobs.cancel
Module: fsm
Rate limit: 20 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/jobs/bulk-cancel" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/field/jobs/{job}/overtime Draft the job's overtime now (e.g. switched on after the job was submitted). 422 when the...

Draft the job's overtime now (e.g. switched on after the job was submitted). 422 when the job doesn't qualify.

Sign-in: App token or company API key
Permission: field.jobs.overtime
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`job`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/jobs/{job}/overtime" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/field/sites name, address, latitude, longitude, radius_m (empty = the company default), active, branch...

name, address, latitude, longitude, radius_m (empty = the company default), active, branch_id (new only).

Sign-in: App token or company API key
Permission: field.sites.create
Module: fsm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/sites" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/app/companies/{company}/field/sites/{site}

Sign-in: App token or company API key
Permission: field.sites.edit
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`site`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/sites/{site}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/field/sites/{site}

Sign-in: App token or company API key
Permission: field.sites.delete
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`site`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/sites/{site}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/customers q, branch_id, active, per_page.

q, branch_id, active, per_page.

Sign-in: App token or company API key
Permission: field.customers.view
Module: fsm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/customers" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/field/customers

Sign-in: App token or company API key
Permission: field.customers.create
Module: fsm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/customers" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/customers/{customer}

Sign-in: App token or company API key
Permission: field.customers.view
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`customer`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/customers/{customer}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/app/companies/{company}/field/customers/{customer}

Sign-in: App token or company API key
Permission: field.customers.edit
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`customer`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/customers/{customer}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/field/customers/{customer}

Sign-in: App token or company API key
Permission: field.customers.delete
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`customer`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/customers/{customer}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/field/evidence/{evidence}/void reason (required).

reason (required).

Sign-in: App token or company API key
Permission: field.evidence.void
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`evidence`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

reasonrequired required|string|min:3|'max:' . \App\Support\Limits::chars(1000)

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/evidence/{evidence}/void" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"reason":"..."}'

GET /api/v1/app/companies/{company}/field/devices Every phone key in the reviewer's branches.

Every phone key in the reviewer's branches.

Sign-in: App token or company API key
Permission: field.evidence.devices
Module: fsm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/devices" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/field/devices/{key}/revoke

Sign-in: App token or company API key
Permission: field.evidence.devices
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`key`	string	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/devices/{key}/revoke" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/evidence job_id, stage, employee_id, accepted, flag, voided, per_page.

job_id, stage, employee_id, accepted, flag, voided, per_page.

Sign-in: App token or company API key
Permission: field.evidence.review
Module: fsm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/evidence" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/evidence/{evidence}

Sign-in: App token or company API key
Permission: field.evidence.review
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`evidence`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/evidence/{evidence}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/evidence/{evidence}/c2pa The photo's C2PA (Content Credentials) copy: its status, validation, trust and assertions...

The photo's C2PA (Content Credentials) copy: its status, validation, trust and assertions (docs/field-proof.md §22).

Sign-in: App token or company API key
Permission: field.evidence.review
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`evidence`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/evidence/{evidence}/c2pa" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/evidence/{evidence}/c2pa/download The C2PA copy itself (JPEG with the embedded, server-signed manifest), when signed, valid...

The C2PA copy itself (JPEG with the embedded, server-signed manifest), when signed, valid and the photo not voided.

Sign-in: App token or company API key
Permission: field.evidence.review
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`evidence`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/evidence/{evidence}/c2pa/download" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/technicians q, availability, skill, zone, branch_id, per_page. meta.options has the skills and zones i...

q, availability, skill, zone, branch_id, per_page. meta.options has the skills and zones in use.

Sign-in: App token or company API key
Permission: field.technicians.view | field.technicians.manage
Module: fsm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/technicians" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/technicians/export

Sign-in: App token or company API key
Permission: field.technicians.export
Module: fsm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/technicians/export" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/field/technicians employee_id, skills, zones, availability, available_until, work_days (0 = Sunday), day_sta...

employee_id, skills, zones, availability, available_until, work_days (0 = Sunday), day_start, day_end, max_daily_jobs, notes.

Sign-in: App token or company API key
Permission: field.technicians.create
Module: fsm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/technicians" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/technicians/{technician}

Sign-in: App token or company API key
Permission: field.technicians.view | field.technicians.manage
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`technician`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/technicians/{technician}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/app/companies/{company}/field/technicians/{technician}

Sign-in: App token or company API key
Permission: field.technicians.edit
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`technician`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/technicians/{technician}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/field/technicians/{technician}

Sign-in: App token or company API key
Permission: field.technicians.delete
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`technician`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/technicians/{technician}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/inventory/parts q, category, branch_id, low (1 = at or under the minimum), active, per_page.

q, category, branch_id, low (1 = at or under the minimum), active, per_page.

Sign-in: App token or company API key
Permission: field.inventory.view | field.inventory.manage
Module: fsm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/inventory/parts" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/inventory/parts/export

Sign-in: App token or company API key
Permission: field.inventory.export
Module: fsm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/inventory/parts/export" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/field/inventory/parts sku, name, category, unit, unit_cost, supplier, min_stock, notes, active, branch_id.

sku, name, category, unit, unit_cost, supplier, min_stock, notes, active, branch_id.

Sign-in: App token or company API key
Permission: field.inventory.create
Module: fsm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/inventory/parts" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/inventory/parts/{part}

Sign-in: App token or company API key
Permission: field.inventory.view | field.inventory.manage
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`part`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/inventory/parts/{part}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/app/companies/{company}/field/inventory/parts/{part}

Sign-in: App token or company API key
Permission: field.inventory.edit
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`part`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/inventory/parts/{part}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/field/inventory/parts/{part}

Sign-in: App token or company API key
Permission: field.inventory.delete
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`part`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/inventory/parts/{part}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/field/inventory/parts/{part}/receive location_id, quantity, reference, note.

location_id, quantity, reference, note.

Sign-in: App token or company API key
Permission: field.inventory.receive
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`part`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/inventory/parts/{part}/receive" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/field/inventory/parts/{part}/adjust location_id, counted, note (required).

location_id, counted, note (required).

Sign-in: App token or company API key
Permission: field.inventory.adjust
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`part`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/inventory/parts/{part}/adjust" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/field/inventory/parts/{part}/transfer from_location_id, to_location_id, quantity, note.

from_location_id, to_location_id, quantity, note.

Sign-in: App token or company API key
Permission: field.inventory.transfer
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`part`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/inventory/parts/{part}/transfer" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/field/inventory/parts/{part}/issue location_id, job_id, quantity, employee_id, note.

location_id, job_id, quantity, employee_id, note.

Sign-in: App token or company API key
Permission: field.inventory.issue
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`part`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/inventory/parts/{part}/issue" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/field/inventory/parts/{part}/return location_id, job_id, quantity, note.

location_id, job_id, quantity, note.

Sign-in: App token or company API key
Permission: field.inventory.issue
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`part`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/inventory/parts/{part}/return" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/inventory/locations q, active, branch_id.

q, active, branch_id.

Sign-in: App token or company API key
Permission: field.inventory.view | field.inventory.manage
Module: fsm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/inventory/locations" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/field/inventory/locations name, kind (warehouse, van, site), address, active, branch_id.

name, kind (warehouse, van, site), address, active, branch_id.

Sign-in: App token or company API key
Permission: field.inventory.locations
Module: fsm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/inventory/locations" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/inventory/locations/{location} The location and what it holds.

The location and what it holds.

Sign-in: App token or company API key
Permission: field.inventory.view | field.inventory.manage
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`location`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/inventory/locations/{location}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/app/companies/{company}/field/inventory/locations/{location}

Sign-in: App token or company API key
Permission: field.inventory.locations
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`location`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/inventory/locations/{location}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/field/inventory/locations/{location}

Sign-in: App token or company API key
Permission: field.inventory.locations
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`location`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/inventory/locations/{location}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/inventory/movements part_id, location_id, job_id, type, from, to, branch_id, q, per_page.

part_id, location_id, job_id, type, from, to, branch_id, q, per_page.

Sign-in: App token or company API key
Permission: field.inventory.view | field.inventory.manage
Module: fsm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/inventory/movements" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/inventory/movements/export

Sign-in: App token or company API key
Permission: field.inventory.export
Module: fsm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/inventory/movements/export" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/inventory/jobs/{job}/parts The parts on a work order, net of what came back.

The parts on a work order, net of what came back.

Sign-in: App token or company API key
Permission: field.inventory.view | field.inventory.manage
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`job`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/inventory/jobs/{job}/parts" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/vehicles q, status, driver_id, branch_id, per_page.

q, status, driver_id, branch_id, per_page.

Sign-in: App token or company API key
Permission: field.vehicles.view | field.vehicles.manage
Module: fsm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/vehicles" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/vehicles/alerts

Sign-in: App token or company API key
Permission: field.vehicles.view | field.vehicles.manage
Module: fsm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/vehicles/alerts" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/vehicles/export

Sign-in: App token or company API key
Permission: field.vehicles.export
Module: fsm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/vehicles/export" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/field/vehicles plate_number, make, model, year, vin, status, driver_employee_id, odometer_km, notes, bran...

plate_number, make, model, year, vin, status, driver_employee_id, odometer_km, notes, branch_id.

Sign-in: App token or company API key
Permission: field.vehicles.create
Module: fsm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/vehicles" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/vehicles/{vehicle}

Sign-in: App token or company API key
Permission: field.vehicles.view | field.vehicles.manage
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`vehicle`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/vehicles/{vehicle}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/app/companies/{company}/field/vehicles/{vehicle}

Sign-in: App token or company API key
Permission: field.vehicles.edit | field.vehicles.driver
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`vehicle`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/vehicles/{vehicle}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/field/vehicles/{vehicle}

Sign-in: App token or company API key
Permission: field.vehicles.delete
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`vehicle`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/vehicles/{vehicle}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/vehicles/{vehicle}/documents

Sign-in: App token or company API key
Permission: field.vehicles.view | field.vehicles.manage
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`vehicle`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/vehicles/{vehicle}/documents" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/field/vehicles/{vehicle}/documents documents: type, number, expires_on, note. maintenance: done_on, kind, description, vendor...

documents: type, number, expires_on, note. maintenance: done_on, kind, description, vendor, cost, odometer_km, next_due_on. fuel: filled_on, liters, cost, odometer_km, station, employee_id.

Sign-in: App token or company API key
Permission: field.vehicles.documents
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`vehicle`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/vehicles/{vehicle}/documents" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/app/companies/{company}/field/vehicles/{vehicle}/documents/{row}

Sign-in: App token or company API key
Permission: field.vehicles.documents
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`vehicle`	integer	The record's ID.
`row`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/vehicles/{vehicle}/documents/{row}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/field/vehicles/{vehicle}/documents/{row}

Sign-in: App token or company API key
Permission: field.vehicles.documents
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`vehicle`	integer	The record's ID.
`row`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/vehicles/{vehicle}/documents/{row}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/vehicles/{vehicle}/maintenance

Sign-in: App token or company API key
Permission: field.vehicles.view | field.vehicles.manage
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`vehicle`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/vehicles/{vehicle}/maintenance" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/field/vehicles/{vehicle}/maintenance documents: type, number, expires_on, note. maintenance: done_on, kind, description, vendor...

documents: type, number, expires_on, note. maintenance: done_on, kind, description, vendor, cost, odometer_km, next_due_on. fuel: filled_on, liters, cost, odometer_km, station, employee_id.

Sign-in: App token or company API key
Permission: field.vehicles.maintenance
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`vehicle`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/vehicles/{vehicle}/maintenance" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/app/companies/{company}/field/vehicles/{vehicle}/maintenance/{row}

Sign-in: App token or company API key
Permission: field.vehicles.maintenance
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`vehicle`	integer	The record's ID.
`row`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/vehicles/{vehicle}/maintenance/{row}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/field/vehicles/{vehicle}/maintenance/{row}

Sign-in: App token or company API key
Permission: field.vehicles.maintenance
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`vehicle`	integer	The record's ID.
`row`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/vehicles/{vehicle}/maintenance/{row}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/vehicles/{vehicle}/fuel

Sign-in: App token or company API key
Permission: field.vehicles.view | field.vehicles.manage
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`vehicle`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/vehicles/{vehicle}/fuel" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/field/vehicles/{vehicle}/fuel documents: type, number, expires_on, note. maintenance: done_on, kind, description, vendor...

documents: type, number, expires_on, note. maintenance: done_on, kind, description, vendor, cost, odometer_km, next_due_on. fuel: filled_on, liters, cost, odometer_km, station, employee_id.

Sign-in: App token or company API key
Permission: field.vehicles.fuel
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`vehicle`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/vehicles/{vehicle}/fuel" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/app/companies/{company}/field/vehicles/{vehicle}/fuel/{row}

Sign-in: App token or company API key
Permission: field.vehicles.fuel
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`vehicle`	integer	The record's ID.
`row`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/vehicles/{vehicle}/fuel/{row}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/field/vehicles/{vehicle}/fuel/{row}

Sign-in: App token or company API key
Permission: field.vehicles.fuel
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`vehicle`	integer	The record's ID.
`row`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/vehicles/{vehicle}/fuel/{row}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/settings

Sign-in: App token or company API key
Permission: field_setup.manage
Module: fsm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/settings" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/app/companies/{company}/field/settings Any field_* setting (docs/field-proof.md); the others keep their value.

Any field_* setting (docs/field-proof.md); the others keep their value.

Sign-in: App token or company API key
Permission: field_setup.manage
Module: fsm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/settings" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/field/settings/branches/{branch} Every key: {company, branch (null = inherited), effective, source}.

Every key: {company, branch (null = inherited), effective, source}.

Sign-in: App token or company API key
Permission: field_setup.manage
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`branch`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/settings/branches/{branch}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/app/companies/{company}/field/settings/branches/{branch} Any field_* key; null or "inherit" takes it back to the company's value.

Any field_* key; null or "inherit" takes it back to the company's value.

Sign-in: App token or company API key
Permission: field_setup.manage
Module: fsm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`branch`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/field/settings/branches/{branch}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

financial-transactions 8 endpoints

GET /api/v1/app/companies/{company}/financial-transactions Financial transactions in my scope: month, employee_id, type (earning | deduction), off_cy...

Financial transactions in my scope: month, employee_id, type (earning | deduction), off_cycle.

Sign-in: App token or company API key
Permission: payroll.transactions.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/financial-transactions" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/financial-transactions/{transaction} One transaction in my scope, with the employee and its attachments' names.

One transaction in my scope, with the employee and its attachments' names.

Sign-in: App token or company API key
Permission: payroll.transactions.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`transaction`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/financial-transactions/{transaction}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/financial-transactions As the Add new financial transaction page: effective_date (or month), off_cycle (with paid...

As the Add new financial transaction page: effective_date (or month), off_cycle (with paid_cash, deduct_tax, amount_type total|net, mark_paid), and attachment or attachments[] files.

Sign-in: App token or company API key
Permission: payroll.transactions.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`employee_id`required	`required\|integer`
`transaction_type_id`	`nullable\|integer\|exists:transaction_types,id`
`type`	`required_without:transaction_type_id\|nullable\|in:earning,deduction`
`category`	`required_without:transaction_type_id\|nullable\|in:bonus,commission,overtime,expense,per_diem,air_ticket,penalty,other`
`amount`required	`required\|numeric\|min:0.01`
`month`	`required_without:effective_date\|nullable\|date_format:Y-m`
`effective_date`	`nullable\|date_format:Y-m-d`
`description`	`nullable\|string\|'max:' . \App\Support\Limits::chars(255)`
`amount_type`	`nullable\|in:total,net`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/financial-transactions" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"employee_id":1,"transaction_type_id":1,"type":"earning","category":"bonus","amount":1.5,"month":"2026-11-01","effective_date":"2026-11-01","description":"...","amount_type":"total"}'

PUT /api/v1/app/companies/{company}/financial-transactions/{transaction} Edit an unpaid transaction added by HR: the fields of storeTransaction; new files join its...

Edit an unpaid transaction added by HR: the fields of storeTransaction; new files join its attachments.

Sign-in: App token or company API key
Permission: payroll.transactions.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`transaction`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`employee_id`required	`required\|integer`
`transaction_type_id`	`nullable\|integer\|exists:transaction_types,id`
`type`	`required_without:transaction_type_id\|nullable\|in:earning,deduction`
`category`	`required_without:transaction_type_id\|nullable\|in:bonus,commission,overtime,expense,per_diem,air_ticket,penalty,other`
`amount`required	`required\|numeric\|min:0.01`
`month`	`required_without:effective_date\|nullable\|date_format:Y-m`
`effective_date`	`nullable\|date_format:Y-m-d`
`description`	`nullable\|string\|'max:' . \App\Support\Limits::chars(255)`
`amount_type`	`nullable\|in:total,net`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/financial-transactions/{transaction}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"employee_id":1,"transaction_type_id":1,"type":"earning","category":"bonus","amount":1.5,"month":"2026-11-01","effective_date":"2026-11-01","description":"...","amount_type":"total"}'

DELETE /api/v1/app/companies/{company}/financial-transactions/{transaction}

Sign-in: App token or company API key
Permission: payroll.transactions.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`transaction`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/financial-transactions/{transaction}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/financial-transactions/bulk-delete ids: unpaid, regular-payroll transactions of employees in payroll.manage scope; returns ho...

ids: unpaid, regular-payroll transactions of employees in payroll.manage scope; returns how many were deleted.

Sign-in: App token or company API key
Permission: payroll.transactions.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`ids`required	`required\|array\|min:1`
`ids.*`	`integer`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/financial-transactions/bulk-delete" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"ids":[]}'

POST /api/v1/app/companies/{company}/financial-transactions/{transaction}/next-month

Sign-in: App token or company API key
Permission: payroll.transactions.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`transaction`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/financial-transactions/{transaction}/next-month" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/financial-transactions/amortized employee_id, type earning|deduction, amount, months (2-60), start_month (Y-m), description...

employee_id, type earning|deduction, amount, months (2-60), start_month (Y-m), description.

Sign-in: App token or company API key
Permission: payroll.expenses.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`employee_id`required	`required\|integer`
`type`required	`required\|in:earning,deduction`
`amount`required	`required\|numeric\|gt:0`
`months`required	`required\|integer\|min:2\|max:60`
`start_month`required	`required\|date_format:Y-m`
`description`required	`required\|string\|'max:' . \App\Support\Limits::chars(190)`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/financial-transactions/amortized" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"employee_id":1,"type":"earning","amount":1.5,"months":1,"start_month":"2026-11-01","description":"..."}'

general 2 endpoints

GET /api/v1/app/companies/{company}/{kind}/{id}/comments

Sign-in: App token or company API key
Permission: self.requests.view | self.approvals.decide | requests.view | requests.manage | self.leaves.view | leaves.view | leaves.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`kind`	string · requests\|leaves	The record's ID.
`id`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/{kind}/{id}/comments" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/{kind}/{id}/comments

Sign-in: App token or company API key
Permission: self.requests.view | self.approvals.decide | requests.view | requests.manage | self.leaves.view | leaves.view | leaves.manage
Module: hrm
Rate limit: 30 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`kind`	string · requests\|leaves	The record's ID.
`id`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/{kind}/{id}/comments" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

general-factor-templates 3 endpoints

POST /api/v1/app/companies/{company}/general-factor-templates name {en, ar}, branch_ids, factors [{name {en, ar}, weight}].

name {en, ar}, branch_ids, factors [{name {en, ar}, weight}].

Sign-in: App token or company API key
Permission: performance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/general-factor-templates" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH PUT /api/v1/app/companies/{company}/general-factor-templates/{template} name {en, ar}, branch_ids, factors [{name {en, ar}, weight}].

name {en, ar}, branch_ids, factors [{name {en, ar}, weight}].

Sign-in: App token or company API key
Permission: performance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`template`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/general-factor-templates/{template}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/general-factor-templates/{template}

Sign-in: App token or company API key
Permission: performance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`template`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/general-factor-templates/{template}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

geolocations 5 endpoints

GET /api/v1/app/companies/{company}/geolocations

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/geolocations" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/geolocations

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/geolocations" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/app/companies/{company}/geolocations/{location} Send only what changes.

Send only what changes.

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`location`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/geolocations/{location}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/geolocations/{location}

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`location`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/geolocations/{location}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/geolocations/{location}/bulk action assign|unassign|replace: this location for every active employee in reach (attendan...

action assign|unassign|replace: this location for every active employee in reach (attendance.manage).

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`location`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

actionrequired required|in:assign,unassign,replace

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/geolocations/{location}/bulk" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"action":"assign"}'

goals 3 endpoints

POST /api/v1/app/companies/{company}/goals employee_id or employee_ids (default: me), title, description, due_date.

employee_id or employee_ids (default: me), title, description, due_date.

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`employee_id`	`nullable\|integer`
`employee_ids`	`nullable\|array`
`employee_ids.*`	`integer`
`title`required	`required\|string\|max:200`
`description`	`nullable\|string\|'max:' . \App\Support\Limits::chars(2000)`
`due_date`	`nullable\|date`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/goals" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"employee_id":1,"employee_ids":[],"title":"...","description":"...","due_date":"2026-11-01"}'

PATCH /api/v1/app/companies/{company}/goals/{goal} progress, status.

progress, status.

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`goal`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/goals/{goal}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/goals/{goal}

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`goal`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/goals/{goal}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

help 1 endpoint

GET /api/v1/app/companies/{company}/help The help center: the topics the person may use, in their language (docs/help.md).

The help center: the topics the person may use, in their language (docs/help.md).

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/help" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

holiday-calendar 1 endpoint

GET /api/v1/app/companies/{company}/holiday-calendar GET holiday-calendar?month=YYYY-MM

GET holiday-calendar?month=YYYY-MM

Sign-in: App token or company API key
Permission: self.holiday_calendar | leaves.view | employees.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/holiday-calendar" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

holidays 4 endpoints

GET /api/v1/app/companies/{company}/holidays The year's holidays (?year, this year by default).

The year's holidays (?year, this year by default).

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/holidays" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/holidays

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`required	`required\|array`
`name.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(100)`
`name.ar`required	`required\|string\|'max:' . \App\Support\Limits::chars(100)`
`date`required	`required\|date\|unique:holidays,date`
`end_date`	`nullable\|date\|after_or_equal:date`
`religions`	`nullable\|array`
`religions.*`	`in:muslim,christian,hindu,buddhist,sikh,other`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/holidays" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":{"en":"...","ar":"..."},"date":"2026-11-01","end_date":"2026-11-01","religions":[]}'

PATCH /api/v1/app/companies/{company}/holidays/{holiday} Send only what changes.

Send only what changes.

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`holiday`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/holidays/{holiday}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/holidays/{holiday}

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`holiday`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/holidays/{holiday}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

import 3 endpoints

GET /api/v1/app/companies/{company}/import

Sign-in: App token or company API key
Permission: employees.import
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/import" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/import/{type}/template The CSV template (language en|ar); existing=1 fills it with the current data. Preview is u...

The CSV template (language en|ar); existing=1 fills it with the current data. Preview is upload without commit.

Sign-in: App token or company API key
Permission: employees.import
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`type`	string	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/import/{type}/template" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/import/{type}

Sign-in: App token or company API key
Permission: employees.import
Rate limit: 20 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`type`	string	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`file`required	`required\|file\|max:10240\|extensions:csv,xlsx`
`mode`	`nullable\|in:create,update`
`language`	`nullable\|in:en,ar`
`map`	`nullable\|array`
`commit`	`sometimes\|boolean`
`options`	`nullable\|array`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/import/{type}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -F "[email protected]" \
  -F "mode=create" \
  -F "language=en" \
  -F "map=..." \
  -F "commit=1" \
  -F "options=..."

imported-sheets 1 endpoint

GET /api/v1/app/companies/{company}/imported-sheets

Sign-in: App token or company API key
Permission: employees.import
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/imported-sheets" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

insurance-members 1 endpoint

DELETE /api/v1/app/companies/{company}/insurance-members/{member}

Sign-in: App token or company API key
Permission: payroll.insurance.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`member`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/insurance-members/{member}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

insurance-policies 6 endpoints

GET /api/v1/app/companies/{company}/insurance-policies Policies, latest expiry first, each with its members in my scope; active=1 keeps the polic...

Policies, latest expiry first, each with its members in my scope; active=1 keeps the policies in force today.

Sign-in: App token or company API key
Permission: payroll.insurance.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/insurance-policies" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/insurance-policies/{policy}

Sign-in: App token or company API key
Permission: payroll.insurance.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`policy`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/insurance-policies/{policy}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/insurance-policies/{policy}/members

Sign-in: App token or company API key
Permission: payroll.insurance.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`policy`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`employee_id`required	`required\|integer`
`family_member_id`	`nullable\|exists:family_members,id`
`offline_insurance_id`	`nullable\|string\|max:60`
`start_date`	`nullable\|date`
`end_date`	`nullable\|date\|after_or_equal:start_date`
`adult_dependents`	`nullable\|integer\|min:0\|max:20`
`minor_dependents`	`nullable\|integer\|min:0\|max:20`
`custom_cost`	`nullable\|required_if:custom_setup,1\|numeric\|min:0`
`monthly_deduction`	`nullable\|numeric\|min:0`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/insurance-policies/{policy}/members" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"employee_id":1,"family_member_id":"...","offline_insurance_id":"...","start_date":"2026-11-01","end_date":"2026-11-01","adult_dependents":1,"minor_dependents":1,"custom_cost":1.5,"monthly_deduction":1.5}'

POST /api/v1/app/companies/{company}/insurance-policies

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`insurer`required	`required\|string\|max:120`
`policy_number`	`nullable\|string\|max:60`
`start_date`required	`required\|date`
`expiry_date`required	`required\|date\|after:start_date`
`cost_adult`required	`required\|numeric\|min:0`
`cost_minor`required	`required\|numeric\|min:0`
`currency_adult`	nullable\|in:AED,AFN,ALL,AMD,ANG,AOA,ARS,AUD,AWG,AZN,BAM,BBD,BDT,BGN,BHD,BIF,BMD,BND,BOB,BRL,BSD,BTN,BWP,BYN,BZD,CAD,CDF,CHF,CLP,CNY,COP,CRC,CUP,CVE,CZK,DJF,DKK,DOP,DZD,EGP,ERN,ETB,EUR,FJD,FKP,GBP,GEL,GHS,GIP,GMD,GNF,GTQ,GYD,HKD,HNL,HTG,HUF,IDR,ILS,INR,IQD,IRR,ISK,JMD,JOD,JPY,KES,KGS,KHR,KMF,KPW,KRW,KWD,KYD,KZT,LAK,LBP,LKR,LRD,LSL,LYD,MAD,MDL,MGA,MKD,MMK,MNT,MOP,MRU,MUR,MVR,MWK,MXN,MYR,MZN,NAD,NGN,NIO,NOK,NPR,NZD,OMR,PAB,PEN,PGK,PHP,PKR,PLN,PYG,QAR,RON,RSD,RUB,RWF,SAR,SBD,SCR,SDG,SEK,SGD,SHP,SLE,SOS,SRD,SSP,STN,SVC,SYP,SZL,THB,TJS,TMT,TND,TOP,TRY,TTD,TWD,TZS,UAH,UGX,USD,UYU,UZS,VES,VND,VUV,WST,XAF,XCD,XOF,XPF,YER,ZAR,ZMW,ZWL
`currency_minor`	nullable\|in:AED,AFN,ALL,AMD,ANG,AOA,ARS,AUD,AWG,AZN,BAM,BBD,BDT,BGN,BHD,BIF,BMD,BND,BOB,BRL,BSD,BTN,BWP,BYN,BZD,CAD,CDF,CHF,CLP,CNY,COP,CRC,CUP,CVE,CZK,DJF,DKK,DOP,DZD,EGP,ERN,ETB,EUR,FJD,FKP,GBP,GEL,GHS,GIP,GMD,GNF,GTQ,GYD,HKD,HNL,HTG,HUF,IDR,ILS,INR,IQD,IRR,ISK,JMD,JOD,JPY,KES,KGS,KHR,KMF,KPW,KRW,KWD,KYD,KZT,LAK,LBP,LKR,LRD,LSL,LYD,MAD,MDL,MGA,MKD,MMK,MNT,MOP,MRU,MUR,MVR,MWK,MXN,MYR,MZN,NAD,NGN,NIO,NOK,NPR,NZD,OMR,PAB,PEN,PGK,PHP,PKR,PLN,PYG,QAR,RON,RSD,RUB,RWF,SAR,SBD,SCR,SDG,SEK,SGD,SHP,SLE,SOS,SRD,SSP,STN,SVC,SYP,SZL,THB,TJS,TMT,TND,TOP,TRY,TTD,TWD,TZS,UAH,UGX,USD,UYU,UZS,VES,VND,VUV,WST,XAF,XCD,XOF,XPF,YER,ZAR,ZMW,ZWL
`branch_id`	`nullable\|exists:branches,id`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/insurance-policies" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"insurer":"...","policy_number":"...","start_date":"2026-11-01","expiry_date":"2026-11-01","cost_adult":1.5,"cost_minor":1.5,"currency_adult":"AED","currency_minor":"AED","branch_id":"..."}'

PUT /api/v1/app/companies/{company}/insurance-policies/{policy}

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`policy`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`insurer`required	`required\|string\|max:120`
`policy_number`	`nullable\|string\|max:60`
`start_date`required	`required\|date`
`expiry_date`required	`required\|date\|after:start_date`
`cost_adult`required	`required\|numeric\|min:0`
`cost_minor`required	`required\|numeric\|min:0`
`currency_adult`	nullable\|in:AED,AFN,ALL,AMD,ANG,AOA,ARS,AUD,AWG,AZN,BAM,BBD,BDT,BGN,BHD,BIF,BMD,BND,BOB,BRL,BSD,BTN,BWP,BYN,BZD,CAD,CDF,CHF,CLP,CNY,COP,CRC,CUP,CVE,CZK,DJF,DKK,DOP,DZD,EGP,ERN,ETB,EUR,FJD,FKP,GBP,GEL,GHS,GIP,GMD,GNF,GTQ,GYD,HKD,HNL,HTG,HUF,IDR,ILS,INR,IQD,IRR,ISK,JMD,JOD,JPY,KES,KGS,KHR,KMF,KPW,KRW,KWD,KYD,KZT,LAK,LBP,LKR,LRD,LSL,LYD,MAD,MDL,MGA,MKD,MMK,MNT,MOP,MRU,MUR,MVR,MWK,MXN,MYR,MZN,NAD,NGN,NIO,NOK,NPR,NZD,OMR,PAB,PEN,PGK,PHP,PKR,PLN,PYG,QAR,RON,RSD,RUB,RWF,SAR,SBD,SCR,SDG,SEK,SGD,SHP,SLE,SOS,SRD,SSP,STN,SVC,SYP,SZL,THB,TJS,TMT,TND,TOP,TRY,TTD,TWD,TZS,UAH,UGX,USD,UYU,UZS,VES,VND,VUV,WST,XAF,XCD,XOF,XPF,YER,ZAR,ZMW,ZWL
`currency_minor`	nullable\|in:AED,AFN,ALL,AMD,ANG,AOA,ARS,AUD,AWG,AZN,BAM,BBD,BDT,BGN,BHD,BIF,BMD,BND,BOB,BRL,BSD,BTN,BWP,BYN,BZD,CAD,CDF,CHF,CLP,CNY,COP,CRC,CUP,CVE,CZK,DJF,DKK,DOP,DZD,EGP,ERN,ETB,EUR,FJD,FKP,GBP,GEL,GHS,GIP,GMD,GNF,GTQ,GYD,HKD,HNL,HTG,HUF,IDR,ILS,INR,IQD,IRR,ISK,JMD,JOD,JPY,KES,KGS,KHR,KMF,KPW,KRW,KWD,KYD,KZT,LAK,LBP,LKR,LRD,LSL,LYD,MAD,MDL,MGA,MKD,MMK,MNT,MOP,MRU,MUR,MVR,MWK,MXN,MYR,MZN,NAD,NGN,NIO,NOK,NPR,NZD,OMR,PAB,PEN,PGK,PHP,PKR,PLN,PYG,QAR,RON,RSD,RUB,RWF,SAR,SBD,SCR,SDG,SEK,SGD,SHP,SLE,SOS,SRD,SSP,STN,SVC,SYP,SZL,THB,TJS,TMT,TND,TOP,TRY,TTD,TWD,TZS,UAH,UGX,USD,UYU,UZS,VES,VND,VUV,WST,XAF,XCD,XOF,XPF,YER,ZAR,ZMW,ZWL
`branch_id`	`nullable\|exists:branches,id`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/insurance-policies/{policy}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"insurer":"...","policy_number":"...","start_date":"2026-11-01","expiry_date":"2026-11-01","cost_adult":1.5,"cost_minor":1.5,"currency_adult":"AED","currency_minor":"AED","branch_id":"..."}'

DELETE /api/v1/app/companies/{company}/insurance-policies/{policy}

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`policy`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/insurance-policies/{policy}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

integrations 7 endpoints

GET /api/v1/app/companies/{company}/integrations/marketplace GET integrations/marketplace?category=&active=active|inactive&q=: the connector catalogue...

GET integrations/marketplace?category=&active=active|inactive&q=: the connector catalogue and each one's state.

Sign-in: App token or company API key
Permission: integrations.manage.*
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/integrations/marketplace" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/integrations/connections

Sign-in: App token or company API key
Permission: integrations.manage.*
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/integrations/connections" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/integrations/connections/{provider}/mode

Sign-in: App token or company API key
Permission: integrations.manage.*
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`provider`	string · zoom\|google\|microsoft\|linkedin\|odoo\|quickbooks\|xero\|netsuite\|business_central\|sap_b1\|sap_s4hana\|dynamics_fo	The record's ID.

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/integrations/connections/{provider}/mode" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/integrations/connections/{provider}

Sign-in: App token or company API key
Permission: integrations.manage.*
Rate limit: 20 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`provider`	string · zoom\|google\|microsoft\|linkedin\|odoo\|quickbooks\|xero\|netsuite\|business_central\|sap_b1\|sap_s4hana\|dynamics_fo	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`app`	`sometimes\|in:own,platform`
`client_id`	`sometimes\|nullable\|string\|max:190`
`client_secret`	`sometimes\|nullable\|string\|max:500`
`tenant`	`sometimes\|nullable\|string\|max:64\|regex:/^[A-Za-z0-9.-]+$/`
`organization`	`sometimes\|nullable\|digits_between:3,20`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/integrations/connections/{provider}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"app":"own","client_id":"...","client_secret":"...","tenant":"...","organization":"..."}'

POST /api/v1/app/companies/{company}/integrations/connections/{provider}/authorize-url The consent page to open in a browser where the same person is signed in to Mihnaro.

The consent page to open in a browser where the same person is signed in to Mihnaro.

Sign-in: App token or company API key
Permission: integrations.manage.*
Rate limit: 20 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`provider`	string · zoom\|google\|microsoft\|linkedin\|odoo\|quickbooks\|xero\|netsuite\|business_central\|sap_b1\|sap_s4hana\|dynamics_fo	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/integrations/connections/{provider}/authorize-url" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/integrations/connections/{provider}/test

Sign-in: App token or company API key
Permission: integrations.manage.*
Rate limit: 20 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`provider`	string · zoom\|google\|microsoft\|linkedin\|odoo\|quickbooks\|xero\|netsuite\|business_central\|sap_b1\|sap_s4hana\|dynamics_fo	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/integrations/connections/{provider}/test" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/integrations/connections/{provider}

Sign-in: App token or company API key
Permission: integrations.manage.*
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`provider`	string · zoom\|google\|microsoft\|linkedin\|odoo\|quickbooks\|xero\|netsuite\|business_central\|sap_b1\|sap_s4hana\|dynamics_fo	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/integrations/connections/{provider}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

job-grade-levels 1 endpoint

DELETE /api/v1/app/companies/{company}/job-grade-levels/{level}

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`level`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/job-grade-levels/{level}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

job-grades 3 endpoints

GET /api/v1/app/companies/{company}/job-grades The job grades with their ranges, levels, leave days, headcount, average, compa-ratio and...

The job grades with their ranges, levels, leave days, headcount, average, compa-ratio and who is outside the range.

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/job-grades" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/job-grades/{grade}

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`grade`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`ideal_compa_ratio`required	`required\|numeric\|between:0.5,1.5`
`benefits`	`nullable\|string\|max:2000`
`leave`	`array`
`leave.*`	`nullable\|numeric\|min:0\|max:365`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/job-grades/{grade}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"ideal_compa_ratio":1.5,"benefits":"...","leave":[]}'

POST /api/v1/app/companies/{company}/job-grades/{grade}/levels

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`grade`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name_ar`required	`required\|string\|'max:' . \App\Support\Limits::chars(100)`
`name_en`required	`required\|string\|'max:' . \App\Support\Limits::chars(100)`
`rank`required	`required\|integer\|min:1\|max:100`
`salary`required	`required\|numeric\|min:0`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/job-grades/{grade}/levels" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name_ar":"...","name_en":"...","rank":1,"salary":1.5}'

key-positions 7 endpoints

GET /api/v1/app/companies/{company}/key-positions

Sign-in: App token or company API key
Permission: succession.manage.* | succession.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/key-positions" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/key-positions title {en, ar}, position_id, department_id, holder_id, risk_of_loss, impact, notes.

title {en, ar}, position_id, department_id, holder_id, risk_of_loss, impact, notes.

Sign-in: App token or company API key
Permission: succession.manage.* | succession.positions.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/key-positions" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH PUT /api/v1/app/companies/{company}/key-positions/{position} title {en, ar}, position_id, department_id, holder_id, risk_of_loss, impact, notes.

title {en, ar}, position_id, department_id, holder_id, risk_of_loss, impact, notes.

Sign-in: App token or company API key
Permission: succession.manage.* | succession.positions.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`position`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/key-positions/{position}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/key-positions/{position}

Sign-in: App token or company API key
Permission: succession.manage.* | succession.positions.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`position`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/key-positions/{position}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/key-positions/{position}/successors employee_id, readiness, development_plan.

employee_id, readiness, development_plan.

Sign-in: App token or company API key
Permission: succession.manage.* | succession.successors.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`position`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`employee_id`required	`required\|integer\|exists:employees,id\|Rule::notIn(array_filter([$position->holder_id]))`
`readiness`required	`required\|in:ready_now,one_two_years,three_plus_years`
`development_plan`	`nullable\|string\|max:255`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/key-positions/{position}/successors" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"employee_id":1,"readiness":"ready_now","development_plan":"..."}'

GET /api/v1/app/companies/{company}/key-positions/{position}/suggestions limit (1–50, default 10).

limit (1–50, default 10).

Sign-in: App token or company API key
Permission: succession.manage.* | succession.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`position`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/key-positions/{position}/suggestions" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/key-positions/{position}/suggestions/{employee}/explain

Sign-in: App token or company API key
Permission: succession.manage.* | succession.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`position`	integer	The record's ID.
`employee`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/key-positions/{position}/suggestions/{employee}/explain" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

leave-adjustments 3 endpoints

GET /api/v1/app/companies/{company}/leave-adjustments ZenHR Manage adjustments / Manage moved balances (kind=moved): type, year, employee; 50 a...

ZenHR Manage adjustments / Manage moved balances (kind=moved): type, year, employee; 50 a page.

Sign-in: App token or company API key
Permission: leaves.adjustments.view | leaves.moved_balances.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

`kind`	`nullable\|in:adjustments,moved`
`type`	`nullable\|integer`
`year`	`nullable\|integer`
`employee`	`nullable\|integer`

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/leave-adjustments?kind=adjustments&type=1&year=1&employee=1" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/leave-adjustments

Sign-in: App token or company API key
Permission: leaves.adjustments.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`employee_id`required	`required\|integer`
`leave_type_id`required	`required\|exists:leave_types,id`
`year`required	`required\|integer\|between:2000,2100`
`days`required	`required\|numeric\|not_in:0\|between:-365,365`
`reason`required	`required\|string\|'max:' . \App\Support\Limits::chars(255)`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/leave-adjustments" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"employee_id":1,"leave_type_id":"...","year":1,"days":1.5,"reason":"..."}'

DELETE /api/v1/app/companies/{company}/leave-adjustments/{adjustment}

Sign-in: App token or company API key
Permission: leaves.adjustments.manage | leaves.moved_balances.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`adjustment`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/leave-adjustments/{adjustment}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

leave-balance-history 1 endpoint

GET /api/v1/app/companies/{company}/leave-balance-history ZenHR history (docs/zenhr-import.md): kind days (day analysis) or punches (punch details)...

Sign-in: App token or company API key
Permission: leaves.balance_corrections.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

`employee`	`nullable\|integer`
`from`	`nullable\|date_format:Y-m-d`
`to`	`nullable\|date_format:Y-m-d`
`status`	`nullable\|in:present,absent,partial`
`type`	`nullable\|integer`
`year`	`nullable\|integer`

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/leave-balance-history?employee=1&from=2026-11-01&to=2026-11-01&status=present" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

leave-balances 1 endpoint

POST /api/v1/app/companies/{company}/leave-balances/move Moves unused days of a type into next year: leave_type_id, year, max_days (leaves.moved_ba...

Moves unused days of a type into next year: leave_type_id, year, max_days (leaves.moved_balances.manage over the company).

Sign-in: App token or company API key
Permission: leaves.moved_balances.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`leave_type_id`required	`required\|integer`
`year`required	`required\|integer\|between:2000,2100`
`max_days`required	`required\|numeric\|min:0\|max:365`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/leave-balances/move" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"leave_type_id":1,"year":1,"max_days":1.5}'

leave-encashments 3 endpoints

GET /api/v1/app/companies/{company}/leave-encashments

Sign-in: App token or company API key
Permission: leaves.encashments.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/leave-encashments" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/leave-encashments

Sign-in: App token or company API key
Permission: leaves.encashments.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`employee_id`required	`required\|integer`
`attachment`	`nullable\|file\|max:10240\|mimes:pdf,jpg,jpeg,png`
`leave_type_id`required	`required\|integer\|exists:leave_types,id`
`days`required	`required\|numeric\|min:0.5\|max:365`
`notes`	`nullable\|string\|'max:' . \App\Support\Limits::chars(500)`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/leave-encashments" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -F "employee_id=1" \
  -F "[email protected]" \
  -F "leave_type_id=1" \
  -F "days=1.5" \
  -F "notes=..."

DELETE /api/v1/app/companies/{company}/leave-encashments/{encashment}

Sign-in: App token or company API key
Permission: leaves.encashments.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`encashment`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/leave-encashments/{encashment}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

leave-types 6 endpoints

PUT PATCH /api/v1/app/companies/{company}/leave-types/{type}/discipline

Sign-in: App token or company API key
Permission: discipline_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`type`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/leave-types/{type}/discipline" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/leave-types/{leaveType}/apply Gives a leave type to employees: scope all|selected, employee_ids, entitlement_days, open_...

Gives a leave type to employees: scope all|selected, employee_ids, entitlement_days, open_balance, balance_year.

Sign-in: App token or company API key
Permission: leaves.balance_corrections.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`leaveType`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`scope`required	`required\|in:all,selected`
`employee_ids`	`required_if:scope,selected\|array`
`employee_ids.*`	`integer`
`entitlement_days`	`nullable\|numeric\|min:0\|max:365`
`open_balance`	`nullable\|numeric\|min:-365\|max:365`
`balance_year`	`nullable\|integer\|min:2000\|max:2100`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/leave-types/{leaveType}/apply" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"scope":"all","employee_ids":[],"entitlement_days":1.5,"open_balance":1.5,"balance_year":1}'

GET /api/v1/app/companies/{company}/leave-types Leave types, of one ?category, with how many employees have each.

Leave types, of one ?category, with how many employees have each.

Sign-in: App token or company API key
Permission: leave_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/leave-types" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/leave-types A new type: category and the whole form, as on the screen.

A new type: category and the whole form, as on the screen.

Sign-in: App token or company API key
Permission: leave_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`required	`required\|array`
`name.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(100)`
`name.ar`required	`required\|string\|'max:' . \App\Support\Limits::chars(100)`
`code`	`nullable\|alpha_dash\|max:30\|unique:leave_types`
`color`	`nullable\|regex:/^#[0-9a-fA-F]{6}$/`
`icon`	`nullable\|in:⏳,✈️,❄️,🌴,🏖️,🏠,👋,📅,📚,🕗,🤒,🤓,🤰,🚘`
`gl_identifier`	`nullable\|string\|max:50`
`balance_type`	`nullable\|in:contractual,normal,first_request`
`entitlement_days`	`nullable\|numeric\|min:0\|max:365`
`entitlement_hours`	`nullable\|numeric\|min:0\|max:200`
`allowed_after_value`	`nullable\|integer\|min:0\|max:3650`
`allowed_after_unit`	`nullable\|in:day,month,year`
`max_consecutive_days`	`nullable\|integer\|min:1\|max:365`
`min_consecutive_days`	`nullable\|integer\|min:1\|max:365`
`max_consecutive_hours`	`nullable\|numeric\|min:0.25\|max:24`
`min_consecutive_hours`	`nullable\|numeric\|min:0.25\|max:24`
`min_notice_days`	`nullable\|integer\|min:0\|max:365`
`notice_slices`	`nullable\|array`
`notice_slices.*.from`	`nullable\|numeric\|min:0`
`notice_slices.*.to`	`nullable\|numeric\|min:0`
`notice_slices.*.notice`	`nullable\|integer\|min:0\|max:365`
`max_weekend_exclude`	`nullable\|integer\|min:0\|max:365`
`exceed_by`	`nullable\|numeric\|min:0\|max:365`
`accrual_rate`	`nullable\|in:daily,monthly`
`balance_cap`	`nullable\|numeric\|min:0\|max:999`
`compensation_percent`	`nullable\|numeric\|min:0\|max:100`
`compensation_allowance_ids`	`nullable\|array`
`compensation_allowance_ids.*`	`integer\|exists:transaction_types,id`
`balance_setups`	`nullable\|array`
`balance_setups.*.from`	`nullable\|integer\|min:0\|max:60`
`balance_setups.*.to`	`nullable\|integer\|min:0\|max:60`
`balance_setups.*.open`	`nullable\|numeric\|min:0\|max:365`
`balance_setups.*.carry`	`nullable\|numeric\|min:0\|max:365`
`encash_payroll`	`nullable\|in:in_payroll,off_cycle`
`attachment_after`	`nullable\|numeric\|min:0\|max:999`
`deduction_percent`	`nullable\|numeric\|min:0\|$hourly && ($input['deduction_type'] ?? null) === 'fixed' ? 'max:100000000' : 'm...`
`deduction_type`	`nullable\|in:fixed,pro_rata`
`grace_amount`	`nullable\|integer\|min:0\|max:10000`
`grace_interval`	`nullable\|in:day,week,month`
`disciplinary_type_id`	`nullable\|integer`
`request_limit`	`nullable\|integer\|min:1\|max:100`
`request_limit_type`	`nullable\|in:service,per_year,none`
`rules`	`nullable\|array`
`rules.*.type`	`nullable\|in:gender,religion,nationality,department,section,work_location,work_type,job_role,hierarchy_group,business_unit,division,segment,main_project`
`rules.*.values`	`nullable\|array`
`minutes_allowed`	`nullable\|integer\|min:1\|max:100000`
`minutes_allowed_per`	`nullable\|in:day,week,month`
`transactions_allowed`	`nullable\|integer\|min:1\|max:1000`
`transactions_allowed_per`	`nullable\|in:day,week,month`
`hourly_deductions`	`nullable\|array`
`hourly_deductions.*.leave_type_id`	`nullable\|integer\|exists:leave_types,id`
`hourly_deductions.*.percent`	`nullable\|numeric\|min:0\|max:100`
`repeat_every`	`nullable\|integer\|min:1\|max:120`
`repeat_unit`	`nullable\|in:month,year,once`
`sick_slices`	`nullable\|array`
`sick_slices.*.from`	`nullable\|integer\|min:1\|max:366`
`sick_slices.*.to`	`nullable\|integer\|min:1\|max:366`
`sick_slices.*.deduction`	`nullable\|numeric\|min:0\|max:100`
`applies_to`	`nullable\|in:all,assigned`
`effective_date`	`nullable\|date`
`balance_update_type`	`nullable\|in:current,new`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/leave-types" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":{"en":"...","ar":"..."},"code":"...","color":"...","icon":"⏳","gl_identifier":"...","balance_type":"contractual","entitlement_days":1.5,"entitlement_hours":1.5,"allowed_after_value":1,"allowed_after_unit":"day","max_consecutive_days":1,"min_consecutive_days":1,"max_consecutive_hours":1.5,"min_consecutive_hours":1.5,"min_notice_days":1,"notice_slices":[],"max_weekend_exclude":1,"exceed_by":1.5,"accrual_rate":"daily","balance_cap":1.5,"compensation_percent":1.5,"compensation_allowance_ids":[],"balance_setups":[],"encash_payroll":"in_payroll","attachment_after":1.5,"deduction_percent":1.5,"deduction_type":"fixed","grace_amount":1,"grace_interval":"day","disciplinary_type_id":1,"request_limit":1,"request_limit_type":"service","rules":[],"minutes_allowed":1,"minutes_allowed_per":"day","transactions_allowed":1,"transactions_allowed_per":"day","hourly_deductions":[],"repeat_every":1,"repeat_unit":"month","sick_slices":[],"applies_to":"all","effective_date":"2026-11-01","balance_update_type":"current"}'

PUT /api/v1/app/companies/{company}/leave-types/{leaveType} A type's whole form, as on the screen (balance_update_type and effective_date for a new ba...

A type's whole form, as on the screen (balance_update_type and effective_date for a new balance from a date).

Sign-in: App token or company API key
Permission: leave_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`leaveType`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`required	`required\|array`
`name.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(100)`
`name.ar`required	`required\|string\|'max:' . \App\Support\Limits::chars(100)`
`code`	`nullable\|alpha_dash\|max:30\|unique:leave_types`
`color`	`nullable\|regex:/^#[0-9a-fA-F]{6}$/`
`icon`	`nullable\|in:⏳,✈️,❄️,🌴,🏖️,🏠,👋,📅,📚,🕗,🤒,🤓,🤰,🚘`
`gl_identifier`	`nullable\|string\|max:50`
`balance_type`	`nullable\|in:contractual,normal,first_request`
`entitlement_days`	`nullable\|numeric\|min:0\|max:365`
`entitlement_hours`	`nullable\|numeric\|min:0\|max:200`
`allowed_after_value`	`nullable\|integer\|min:0\|max:3650`
`allowed_after_unit`	`nullable\|in:day,month,year`
`max_consecutive_days`	`nullable\|integer\|min:1\|max:365`
`min_consecutive_days`	`nullable\|integer\|min:1\|max:365`
`max_consecutive_hours`	`nullable\|numeric\|min:0.25\|max:24`
`min_consecutive_hours`	`nullable\|numeric\|min:0.25\|max:24`
`min_notice_days`	`nullable\|integer\|min:0\|max:365`
`notice_slices`	`nullable\|array`
`notice_slices.*.from`	`nullable\|numeric\|min:0`
`notice_slices.*.to`	`nullable\|numeric\|min:0`
`notice_slices.*.notice`	`nullable\|integer\|min:0\|max:365`
`max_weekend_exclude`	`nullable\|integer\|min:0\|max:365`
`exceed_by`	`nullable\|numeric\|min:0\|max:365`
`accrual_rate`	`nullable\|in:daily,monthly`
`balance_cap`	`nullable\|numeric\|min:0\|max:999`
`compensation_percent`	`nullable\|numeric\|min:0\|max:100`
`compensation_allowance_ids`	`nullable\|array`
`compensation_allowance_ids.*`	`integer\|exists:transaction_types,id`
`balance_setups`	`nullable\|array`
`balance_setups.*.from`	`nullable\|integer\|min:0\|max:60`
`balance_setups.*.to`	`nullable\|integer\|min:0\|max:60`
`balance_setups.*.open`	`nullable\|numeric\|min:0\|max:365`
`balance_setups.*.carry`	`nullable\|numeric\|min:0\|max:365`
`encash_payroll`	`nullable\|in:in_payroll,off_cycle`
`attachment_after`	`nullable\|numeric\|min:0\|max:999`
`deduction_percent`	`nullable\|numeric\|min:0\|$hourly && ($input['deduction_type'] ?? null) === 'fixed' ? 'max:100000000' : 'm...`
`deduction_type`	`nullable\|in:fixed,pro_rata`
`grace_amount`	`nullable\|integer\|min:0\|max:10000`
`grace_interval`	`nullable\|in:day,week,month`
`disciplinary_type_id`	`nullable\|integer`
`request_limit`	`nullable\|integer\|min:1\|max:100`
`request_limit_type`	`nullable\|in:service,per_year,none`
`rules`	`nullable\|array`
`rules.*.type`	`nullable\|in:gender,religion,nationality,department,section,work_location,work_type,job_role,hierarchy_group,business_unit,division,segment,main_project`
`rules.*.values`	`nullable\|array`
`minutes_allowed`	`nullable\|integer\|min:1\|max:100000`
`minutes_allowed_per`	`nullable\|in:day,week,month`
`transactions_allowed`	`nullable\|integer\|min:1\|max:1000`
`transactions_allowed_per`	`nullable\|in:day,week,month`
`hourly_deductions`	`nullable\|array`
`hourly_deductions.*.leave_type_id`	`nullable\|integer\|exists:leave_types,id`
`hourly_deductions.*.percent`	`nullable\|numeric\|min:0\|max:100`
`repeat_every`	`nullable\|integer\|min:1\|max:120`
`repeat_unit`	`nullable\|in:month,year,once`
`sick_slices`	`nullable\|array`
`sick_slices.*.from`	`nullable\|integer\|min:1\|max:366`
`sick_slices.*.to`	`nullable\|integer\|min:1\|max:366`
`sick_slices.*.deduction`	`nullable\|numeric\|min:0\|max:100`
`applies_to`	`nullable\|in:all,assigned`
`effective_date`	`nullable\|date`
`balance_update_type`	`nullable\|in:current,new`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/leave-types/{leaveType}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":{"en":"...","ar":"..."},"code":"...","color":"...","icon":"⏳","gl_identifier":"...","balance_type":"contractual","entitlement_days":1.5,"entitlement_hours":1.5,"allowed_after_value":1,"allowed_after_unit":"day","max_consecutive_days":1,"min_consecutive_days":1,"max_consecutive_hours":1.5,"min_consecutive_hours":1.5,"min_notice_days":1,"notice_slices":[],"max_weekend_exclude":1,"exceed_by":1.5,"accrual_rate":"daily","balance_cap":1.5,"compensation_percent":1.5,"compensation_allowance_ids":[],"balance_setups":[],"encash_payroll":"in_payroll","attachment_after":1.5,"deduction_percent":1.5,"deduction_type":"fixed","grace_amount":1,"grace_interval":"day","disciplinary_type_id":1,"request_limit":1,"request_limit_type":"service","rules":[],"minutes_allowed":1,"minutes_allowed_per":"day","transactions_allowed":1,"transactions_allowed_per":"day","hourly_deductions":[],"repeat_every":1,"repeat_unit":"month","sick_slices":[],"applies_to":"all","effective_date":"2026-11-01","balance_update_type":"current"}'

DELETE /api/v1/app/companies/{company}/leave-types/{leaveType}

Sign-in: App token or company API key
Permission: leave_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`leaveType`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/leave-types/{leaveType}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

leaves 6 endpoints

POST /api/v1/app/companies/{company}/leaves Ask for time off (multipart with an attachment when the type needs one).

Ask for time off (multipart with an attachment when the type needs one).

Sign-in: App token or company API key
Permission: self.leaves.request
Module: hrm
Rate limit: 20 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`attachment`	`nullable\|file\|max:10240\|mimes:pdf,jpg,jpeg,png`
`half_day`	`nullable\|boolean`
`advance_requested`	`nullable\|boolean`
`start_time`required	`required`
`end_time`required	`required`
`end_date`required	`required`
`leave_type_id`required	`required\|exists:leave_types,id`
`start_date`required	`required\|date`
`reason`	`nullable\|string\|'max:' . \App\Support\Limits::chars(1000)`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/leaves" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -F "[email protected]" \
  -F "half_day=1" \
  -F "advance_requested=1" \
  -F "start_time=..." \
  -F "end_time=..." \
  -F "end_date=..." \
  -F "leave_type_id=..." \
  -F "start_date=2026-11-01" \
  -F "reason=..."

GET /api/v1/app/companies/{company}/leaves/{leave}

Sign-in: App token or company API key
Permission: self.leaves.view | self.approvals.decide | leaves.view | leaves.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`leave`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/leaves/{leave}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/leaves/{leave}/attachment GET leaves/{id}/attachment: the file, for the employee or whoever sees their leaves.

GET leaves/{id}/attachment: the file, for the employee or whoever sees their leaves.

Sign-in: App token or company API key
Permission: self.leaves.view | self.approvals.decide | leaves.view | leaves.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`leave`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/leaves/{leave}/attachment" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/leaves/{leave}/approval-cycle GET leaves/{id}/approval-cycle: ZenHR's "Approval Cycle" of a time off (ApprovalCycle), fo...

GET leaves/{id}/approval-cycle: ZenHR's "Approval Cycle" of a time off (ApprovalCycle), for the employee, whoever sees their leaves, or an approver.

Sign-in: App token or company API key
Permission: self.leaves.view | self.approvals.decide | leaves.view | leaves.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`leave`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/leaves/{leave}/approval-cycle" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/leaves/{leave}/withdraw

Sign-in: App token or company API key
Permission: self.leaves.cancel | leaves.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`leave`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/leaves/{leave}/withdraw" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/leaves/{leave}/decide Decide the step it waits on: decision approved|rejected, decision_note, non_deduct (leaves...

Decide the step it waits on: decision approved|rejected, decision_note, non_deduct (leaves.manage).

Sign-in: App token or company API key
Permission: self.approvals.decide | requests.manage | leaves.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`leave`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/leaves/{leave}/decide" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

legal-rules 3 endpoints

GET /api/v1/app/companies/{company}/legal-rules

Sign-in: App token or company API key
Permission: payroll_setup.manage | legal_rules.validate
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/legal-rules" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/legal-rules/{rule}

Sign-in: App token or company API key
Permission: payroll_setup.manage | legal_rules.validate
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`rule`	string · overtime_to_leave\|rest_day_overtime\|holiday_overtime\|loan_settlement_deduction\|eos_formula\|tax_scale\|day_divisor	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`validated_by`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`reference`required	`required\|string\|'max:' . \App\Support\Limits::chars(255)`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/legal-rules/{rule}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"validated_by":"...","reference":"..."}'

DELETE /api/v1/app/companies/{company}/legal-rules/{rule}

Sign-in: App token or company API key
Permission: payroll_setup.manage | legal_rules.validate
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`rule`	string · overtime_to_leave\|rest_day_overtime\|holiday_overtime\|loan_settlement_deduction\|eos_formula\|tax_scale\|day_divisor	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/legal-rules/{rule}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

letter-templates 9 endpoints

GET /api/v1/app/companies/{company}/letter-templates Letter templates: all for letters.manage, else the self-service ones I can generate.

Letter templates: all for letters.manage, else the self-service ones I can generate.

Sign-in: App token or company API key
Permission: self.letters.request | letters.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/letter-templates" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/letter-templates/{template} One template with its body (letters.manage).

One template with its body (letters.manage).

Sign-in: App token or company API key
Permission: letters.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`template`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/letter-templates/{template}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/letter-templates/placeholders What the editor can insert: the {placeholders} with their names, and the active e-signatur...

What the editor can insert: the {placeholders} with their names, and the active e-signatures as {signature:ID}.

Sign-in: App token or company API key
Permission: letters.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/letter-templates/placeholders" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/letter-templates/images A picture for a template, uploaded into Mihnaro (file, or data as a data: URL or base64 wi...

A picture for a template, uploaded into Mihnaro (file, or data as a data: URL or base64 with name); put its url in the body as <img src>.

Sign-in: App token or company API key
Permission: letters.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/letter-templates/images" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/letter-templates/preview A body as its letter prints, before saving: body, language, employee_id (none: placeholder...

A body as its letter prints, before saving: body, language, employee_id (none: placeholders shown by name); format=pdf for the PDF.

Sign-in: App token or company API key
Permission: letters.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`body`	`nullable\|string\|max:200000`
`language`	`nullable\|in:ar,en`
`employee_id`	`nullable\|integer`
`addressed_to`	`nullable\|string\|'max:' . \App\Support\Limits::chars(150)`
`effective_date`	`nullable\|date`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/letter-templates/preview" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"body":"...","language":"ar","employee_id":1,"addressed_to":"...","effective_date":"2026-11-01"}'

POST /api/v1/app/companies/{company}/letter-templates

Sign-in: App token or company API key
Permission: letters.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`required	`required\|array`
`name.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`name.ar`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`description`	`nullable\|array`
`description.en`	`nullable\|string\|'max:' . \App\Support\Limits::chars(1000)`
`description.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(1000)`
`language`required	`required\|in:ar,en`
`letter_category_id`	`nullable\|exists:letter_categories,id`
`body`required	`required\|string\|max:200000`
`direct_access`	`nullable\|in:no,yes,notify,approval`
`confirmation_days`	`nullable\|integer\|min:1\|max:365`
`branch_ids`	`nullable\|array`
`branch_ids.*`	`integer\|exists:branches,id`
`notify_employee_ids`	`nullable\|array`
`notify_employee_ids.*`	`integer\|exists:employees,id`
`financial`	`sometimes\|boolean`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/letter-templates" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":{"en":"...","ar":"..."},"description":{"en":"...","ar":"..."},"language":"ar","letter_category_id":"...","body":"...","direct_access":"no","confirmation_days":1,"branch_ids":[],"notify_employee_ids":[],"financial":true}'

PATCH PUT /api/v1/app/companies/{company}/letter-templates/{template}

Sign-in: App token or company API key
Permission: letters.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`template`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/letter-templates/{template}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/letter-templates/{template}/duplicate

Sign-in: App token or company API key
Permission: letters.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`template`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/letter-templates/{template}/duplicate" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/letter-templates/{template}/favorite

Sign-in: App token or company API key
Permission: letters.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`template`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/letter-templates/{template}/favorite" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

letters 7 endpoints

GET /api/v1/app/companies/{company}/letters Letters I may see (mine once released, and those in my letters scope): status, employee_id...

Letters I may see (mine once released, and those in my letters scope): status, employee_id.

Sign-in: App token or company API key
Permission: self.letters.view | letters.view | letters.manage | letters.issue | letters.decide
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/letters" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/letters/{letter} A letter with its text; opening my own marks it seen.

A letter with its text; opening my own marks it seen.

Sign-in: App token or company API key
Permission: self.letters.view | letters.view | letters.manage | letters.issue | letters.decide
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`letter`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/letters/{letter}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/letters/{letter}/pdf The letter as a PDF file (application/pdf), in the letter's language.

The letter as a PDF file (application/pdf), in the letter's language.

Sign-in: App token or company API key
Permission: self.letters.download | letters.view | letters.manage
Module: hrm
Rate limit: 30 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`letter`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/letters/{letter}/pdf" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/letters/generate Generate a self-service letter for myself.

Generate a self-service letter for myself.

Sign-in: App token or company API key
Permission: self.letters.request | letters.manage
Module: hrm
Rate limit: 20 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`letter_template_id`required	`required\|integer`
`addressed_to`	`nullable\|string\|max:150`
`effective_date`	`nullable\|date`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/letters/generate" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"letter_template_id":1,"addressed_to":"...","effective_date":"2026-11-01"}'

POST /api/v1/app/companies/{company}/letters/{letter}/confirm

Sign-in: App token or company API key
Permission: self.letters.request | letters.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`letter`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/letters/{letter}/confirm" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/letters Issue a letter from a template to an employee in scope (letters.manage).

Issue a letter from a template to an employee in scope (letters.manage).

Sign-in: App token or company API key
Permission: letters.issue
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`employee_id`required	`required\|integer`
`letter_template_id`required	`required\|integer`
`addressed_to`	`nullable\|string\|max:150`
`effective_date`	`nullable\|date`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/letters" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"employee_id":1,"letter_template_id":1,"addressed_to":"...","effective_date":"2026-11-01"}'

POST /api/v1/app/companies/{company}/letters/{letter}/decide Approve or reject a letter waiting for approval: decision approved|rejected (letters.manag...

Approve or reject a letter waiting for approval: decision approved|rejected (letters.manage, not one you issued).

Sign-in: App token or company API key
Permission: letters.decide
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`letter`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/letters/{letter}/decide" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

line-manager-access 2 endpoints

GET /api/v1/app/companies/{company}/line-manager-access What direct managers may do for their reports (LineManagerAccess).

What direct managers may do for their reports (LineManagerAccess).

Sign-in: App token or company API key
Permission: roles.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/line-manager-access" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/line-manager-access Turns direct-manager items on or off; keys left out keep their value.

Turns direct-manager items on or off; keys left out keep their value.

Sign-in: App token or company API key
Permission: roles.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/line-manager-access" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

live-location 4 endpoints

GET /api/v1/app/companies/{company}/live-location Latest positions: branch, department, group, status (online|lost|offline|none), q.

Latest positions: branch, department, group, status (online|lost|offline|none), q.

Sign-in: App token or company API key
Permission: live_location.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/live-location" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/live-location/employees/{employee}/trail One employee's trail on a day (date, default today).

One employee's trail on a day (date, default today).

Sign-in: App token or company API key
Permission: live_location.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

date nullable|date

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/live-location/employees/{employee}/trail?date=2026-11-01" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/live-location/export CSV: the positions by branch, department, group, status, q; or one employee's trail on dat...

CSV: the positions by branch, department, group, status, q; or one employee's trail on date. Logged as an api export.

Sign-in: App token or company API key
Permission: live_location.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

`employee`	`nullable\|integer`
`date`	`nullable\|date`

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/live-location/export?employee=1&date=2026-11-01" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/live-location/views Who looked at whose location (newest first).

Who looked at whose location (newest first).

Sign-in: App token or company API key
Permission: live_location.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/live-location/views" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

loans 6 endpoints

GET /api/v1/app/companies/{company}/loans Loans in my scope: employee_id, status (active | settled).

Loans in my scope: employee_id, status (active | settled).

Sign-in: App token or company API key
Permission: payroll.loans.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/loans" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/loans/{loan} One loan with its installment schedule (made on first read for a loan from before schedule...

One loan with its installment schedule (made on first read for a loan from before schedules were kept).

Sign-in: App token or company API key
Permission: payroll.loans.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`loan`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/loans/{loan}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/loans

Sign-in: App token or company API key
Permission: payroll.loans.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`employee_id`required	`required\|integer`
`loan_type_id`	`nullable\|integer\|exists:loan_types,id`
`amount`required	`required\|numeric\|min:1`
`installments`	`required_without:installment_amount\|nullable\|integer\|min:1\|max:120`
`installment_amount`	`nullable\|numeric\|gt:0\|lte:amount`
`effective_date`	`nullable\|date`
`first_installment_date`	`nullable\|date\|'after_or_equal:' . \App\Support\PayrollMonth::open() . '-01'`
`start_month`	`required_without:first_installment_date\|nullable\|date_format:Y-m\|'after_or_equal:' . \App\Support\PayrollMonth::open()`
`reason`	`nullable\|string\|'max:' . \App\Support\Limits::chars(255)`
`payout`	`nullable\|in:off_cycle,payroll`
`currency`	nullable\|in:AED,AFN,ALL,AMD,ANG,AOA,ARS,AUD,AWG,AZN,BAM,BBD,BDT,BGN,BHD,BIF,BMD,BND,BOB,BRL,BSD,BTN,BWP,BYN,BZD,CAD,CDF,CHF,CLP,CNY,COP,CRC,CUP,CVE,CZK,DJF,DKK,DOP,DZD,EGP,ERN,ETB,EUR,FJD,FKP,GBP,GEL,GHS,GIP,GMD,GNF,GTQ,GYD,HKD,HNL,HTG,HUF,IDR,ILS,INR,IQD,IRR,ISK,JMD,JOD,JPY,KES,KGS,KHR,KMF,KPW,KRW,KWD,KYD,KZT,LAK,LBP,LKR,LRD,LSL,LYD,MAD,MDL,MGA,MKD,MMK,MNT,MOP,MRU,MUR,MVR,MWK,MXN,MYR,MZN,NAD,NGN,NIO,NOK,NPR,NZD,OMR,PAB,PEN,PGK,PHP,PKR,PLN,PYG,QAR,RON,RSD,RUB,RWF,SAR,SBD,SCR,SDG,SEK,SGD,SHP,SLE,SOS,SRD,SSP,STN,SVC,SYP,SZL,THB,TJS,TMT,TND,TOP,TRY,TTD,TWD,TZS,UAH,UGX,USD,UYU,UZS,VES,VND,VUV,WST,XAF,XCD,XOF,XPF,YER,ZAR,ZMW,ZWL
`attachments`	`array\|max:10`
`attachments.*`	`file\|max:10240\|mimes:mp4,pdf,doc,docx,xls,xlsx,ppt,pptx,txt,csv,jpeg,png,gif,jpg,zip`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/loans" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"employee_id":1,"loan_type_id":1,"amount":1.5,"installments":1,"installment_amount":1.5,"effective_date":"2026-11-01","first_installment_date":"2026-11-01","start_month":"2026-11-01","reason":"...","payout":"off_cycle","currency":"AED","attachments":[]}'

DELETE /api/v1/app/companies/{company}/loans/{loan}

Sign-in: App token or company API key
Permission: payroll.loans.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`loan`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/loans/{loan}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/loans/{loan}/reschedule Reschedule: installment_amount or number_of_payments for what is still owed.

Reschedule: installment_amount or number_of_payments for what is still owed.

Sign-in: App token or company API key
Permission: payroll.loans.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`loan`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`installment_amount`	`required_without:number_of_payments\|nullable\|numeric\|gt:0`
`number_of_payments`	`required_without:installment_amount\|nullable\|integer\|min:1\|max:120`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/loans/{loan}/reschedule" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"installment_amount":1.5,"number_of_payments":1}'

POST /api/v1/app/companies/{company}/loans/{loan}/installments/{installment}/{action} Skip an unpaid installment (it moves to the end) or record it as paid in cash.

Skip an unpaid installment (it moves to the end) or record it as paid in cash.

Sign-in: App token or company API key
Permission: payroll.loans.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`loan`	integer	The record's ID.
`installment`	integer	The record's ID.
`action`	string · skip\|pay-cash	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/loans/{loan}/installments/{installment}/{action}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

location 2 endpoints

GET /api/v1/app/companies/{company}/location/policy The signed-in employee's policy: required, mode, interval_seconds, distance_meters, max_si...

The signed-in employee's policy: required, mode, interval_seconds, distance_meters, max_silence_minutes, reason_en, reason_ar, last_ping.

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/location/policy" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/location/pings A batch of pings: device {id, platform, app_version}, points [{lat, lng, accuracy, speed,...

A batch of pings: device {id, platform, app_version}, points [{lat, lng, accuracy, speed, heading, altitude, recorded_at, mocked, battery, elapsed_ms}].

Sign-in: App token or company API key
Permission: self.live_location
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`device`required	`required\|array`
`device.id`required	`required\|string\|max:100`
`device.platform`	`nullable\|string\|max:20`
`device.app_version`	`nullable\|string\|max:40`
`points`required	`required\|array\|min:1\|max:500`
`points.*.lat`required	`required\|numeric\|between:-90,90`
`points.*.lng`required	`required\|numeric\|between:-180,180`
`points.*.accuracy`	`nullable\|numeric\|min:0\|max:100000`
`points.*.speed`	`nullable\|numeric\|min:0\|max:1000`
`points.*.heading`	`nullable\|numeric\|between:0,360`
`points.*.altitude`	`nullable\|numeric\|between:-1000,20000`
`points.*.recorded_at`required	`required\|date`
`points.*.mocked`	`nullable\|boolean`
`points.*.battery`	`nullable\|integer\|between:0,100`
`points.*.elapsed_ms`	`nullable\|integer\|min:0`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/location/pings" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"device":{"id":"...","platform":"...","app_version":"..."},"points":[]}'

map-tiles 1 endpoint

GET /api/v1/app/map-tiles GET /api/v1/app/map-tiles (signed in): where the app's in-app maps take their pictures fro...
GET /api/v1/app/map-tiles (signed in): where the app's in-app maps take their pictures from (config/mihnaro.php map_tiles), for anyone signed in: the clock-in location map and a field job's site, not only field managers.

Sign-in
App token or company API key

Permission
Any signed-in user of the company

Rate limit
60 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/app/map-tiles" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

mass-actions 2 endpoints

GET /api/v1/app/companies/{company}/mass-actions GET mass-actions: the history.

GET mass-actions: the history.

Sign-in: App token or company API key
Permission: employees.edit | payroll.salary_packages.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/mass-actions" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/mass-actions/{tab} POST mass-actions/{tab}: the tab's fields and employee_ids; dry_run=1 only previews.

POST mass-actions/{tab}: the tab's fields and employee_ids; dry_run=1 only previews.

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 20 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`tab`	string · personal\|professional\|financial	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`employee_ids`required	`required\|array\|min:1\|max:1000`
`employee_ids.*`	`integer`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/mass-actions/{tab}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"employee_ids":[]}'

me 69 endpoints

GET /api/v1/app/me/two-factor My two-step verification: on or off, required or not, recovery codes left.
My two-step verification: on or off, required or not, recovery codes left.

Sign-in
App token or company API key

Permission
Any signed-in user of the company

Rate limit
60 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/app/me/two-factor" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
POST /api/v1/app/me/two-factor Starts setting it up: the key and the otpauth:// link for the authenticator app (only to t...
Starts setting it up: the key and the otpauth:// link for the authenticator app (only to the user themself).

Sign-in
App token or company API key

Permission
Any signed-in user of the company

Rate limit
60 requests a minute
Example request
Link to this endpoint
```
curl -X POST "https://api.mihnaro.com/api/v1/app/me/two-factor" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

POST /api/v1/app/me/two-factor/confirm Confirms with a code from the app; the recovery codes are returned this once.

Confirms with a code from the app; the recovery codes are returned this once.

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 10 requests a minute

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

coderequired required|string|max:20

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/me/two-factor/confirm" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"code":"..."}'

DELETE /api/v1/app/me/two-factor

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 10 requests a minute

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

passwordrequired required|string

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/me/two-factor?password=..." \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/me/two-factor/recovery-codes

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 10 requests a minute

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

passwordrequired required|string

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/me/two-factor/recovery-codes" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"password":"..."}'

GET /api/v1/app/me
Sign-in
App token or company API key

Permission
Any signed-in user of the company

Rate limit
60 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/app/me" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
PUT /api/v1/app/me/password
Sign-in
App token or company API key

Permission
Any signed-in user of the company

Rate limit
10 requests a minute
Example request
Link to this endpoint
```
curl -X PUT "https://api.mihnaro.com/api/v1/app/me/password" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
PATCH /api/v1/app/me/preferences
Sign-in
App token or company API key

Permission
Any signed-in user of the company

Rate limit
60 requests a minute
Example request
Link to this endpoint
```
curl -X PATCH "https://api.mihnaro.com/api/v1/app/me/preferences" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
GET /api/v1/app/me/list-columns Show / hide columns: every list with the columns I hid (list= one list).
Show / hide columns: every list with the columns I hid (list= one list).

Sign-in
App token or company API key

Permission
Any signed-in user of the company

Rate limit
60 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/app/me/list-columns" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

PUT /api/v1/app/me/list-columns/{list} Saves the columns I hide in a list: hidden[] (empty shows them all).

Saves the columns I hide in a list: hidden[] (empty shows them all).

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

list string · [a-z_.]+ The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`hidden`	`present\|array`
`hidden.*`	`string\|max:60`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/me/list-columns/{list}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"hidden":[]}'

GET /api/v1/app/me/deletion-request This person's account-deletion requests, newest first (docs/account-deletion.md).
This person's account-deletion requests, newest first (docs/account-deletion.md).

Sign-in
App token or company API key

Permission
Any signed-in user of the company

Rate limit
60 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/app/me/deletion-request" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
POST /api/v1/app/me/deletion-request Asks for the account and its data to be deleted: reason (optional). HR of each company and...
Asks for the account and its data to be deleted: reason (optional). HR of each company and the Mihnaro team are told.

Sign-in
App token or company API key

Permission
Any signed-in user of the company

Rate limit
10 requests a minute
Example request
Link to this endpoint
```
curl -X POST "https://api.mihnaro.com/api/v1/app/me/deletion-request" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
GET /api/v1/app/me/devices GET me/devices: the person's own phones, their IPs and sign-in activity (docs/platform-con...
GET me/devices: the person's own phones, their IPs and sign-in activity (docs/platform-control.md, "Phone activity").

Sign-in
App token or company API key

Permission
Any signed-in user of the company

Rate limit
60 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/app/me/devices" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
GET /api/v1/app/me/connected-apps
Sign-in
App token or company API key

Permission
Any signed-in user of the company

Rate limit
60 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/app/me/connected-apps" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

DELETE /api/v1/app/me/connected-apps/{grant}

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

grant integer The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/me/connected-apps/{grant}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/me/connected-apps/tokens A token by hand, for a client without OAuth. Its value is in this answer only.

A token by hand, for a client without OAuth. Its value is in this answer only.

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 10 requests a minute

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`company_id`required	`required\|integer`
`name`required	`required\|string\|max:80`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/me/connected-apps/tokens" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"company_id":1,"name":"..."}'

DELETE /api/v1/app/me/connected-apps/tokens/{token}

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

token integer The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/me/connected-apps/tokens/{token}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/me/push-tokens The phones this person gets push notices on (docs/mobile-app.md).
The phones this person gets push notices on (docs/mobile-app.md).

Sign-in
App token or company API key

Permission
Any signed-in user of the company

Rate limit
60 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/app/me/push-tokens" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

POST /api/v1/app/me/push-tokens

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 20 requests a minute

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`platform`required	`required\|in:ios,android`
`provider`required	`required\|in:fcm,apns`
`token`required	`required\|string\|max:512\|$input['provider'] === 'apns' ? 'regex:/^[0-9a-f]{64,200}$/' : 'regex:/^[A-Za-z0...`
`device_name`	`nullable\|string\|max:80`
`apns_environment`	`nullable\|in:production,sandbox`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/me/push-tokens" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"platform":"ios","provider":"fcm","token":"...","device_name":"...","apns_environment":"production"}'

DELETE /api/v1/app/me/push-tokens

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

tokenrequired required|string|max:512

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/me/push-tokens?token=..." \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/me/debug GET me/debug: {on, until, send_requested}. Asked at the 15th tap and at each open; never c...
GET me/debug: {on, until, send_requested}. Asked at the 15th tap and at each open; never cached.

Sign-in
App token or company API key

Permission
Any signed-in user of the company

Rate limit
60 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/app/me/debug" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
POST /api/v1/app/me/debug/reports POST me/debug/reports: the phone's state and recent log, redacted. 403 while debug mode is...
POST me/debug/reports: the phone's state and recent log, redacted. 403 while debug mode is off for this account.

Sign-in
App token or company API key

Permission
Any signed-in user of the company

Rate limit
6 requests a minute
Example request
Link to this endpoint
```
curl -X POST "https://api.mihnaro.com/api/v1/app/me/debug/reports" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

POST /api/v1/app/me/device-context

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 30 requests a minute

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`snapshots`required	`required\|array\|min:1\|max:20`
`snapshots.*.trigger`required	`required\|in:open,resume,sign_in,punch`
`snapshots.*.open_id`	`nullable\|string\|max:64\|regex:/^[A-Za-z0-9._:\-]+$/`
`snapshots.*.company_id`	`nullable\|integer`
`snapshots.*.location`	`nullable\|array`
`snapshots.*.context`	`nullable\|array`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/me/device-context" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"snapshots":[]}'

GET /api/v1/app/me/appearance
Sign-in
App token or company API key

Permission
Any signed-in user of the company

Rate limit
60 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/app/me/appearance" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
PATCH /api/v1/app/me/appearance
Sign-in
App token or company API key

Permission
Any signed-in user of the company

Rate limit
60 requests a minute
Example request
Link to this endpoint
```
curl -X PATCH "https://api.mihnaro.com/api/v1/app/me/appearance" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
DELETE /api/v1/app/me/appearance
Sign-in
App token or company API key

Permission
Any signed-in user of the company

Rate limit
60 requests a minute
Example request
Link to this endpoint
```
curl -X DELETE "https://api.mihnaro.com/api/v1/app/me/appearance" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

GET /api/v1/app/companies/{company}/me/permissions What the token's user may do here, and where.

What the token's user may do here, and where.

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/permissions" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/me/access What the mobile app shows: modules, permissions with their scope, and the features they op...

What the mobile app shows: modules, permissions with their scope, and the features they open (MyAccess).

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/access" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/me/locale

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/locale" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/me/profile My profile in this company (Mawarid's profile page).

My profile in this company (Mawarid's profile page).

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/profile" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/me/boardings

Sign-in: App token or company API key
Permission: self.workflows
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/boardings" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET PUT /api/v1/app/companies/{company}/me/dashboard-sections GET / PUT me/dashboard-sections: the HR dashboard sections this person shows ({key: bool})...

GET / PUT me/dashboard-sections: the HR dashboard sections this person shows ({key: bool}); PUT with show [keys].

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/dashboard-sections" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET PUT /api/v1/app/companies/{company}/me/home-widgets GET / PUT me/home-widgets: the Home Page widgets the person may see (the widget registry),...

GET / PUT me/home-widgets: the Home Page widgets the person may see (the widget registry), in their order, with width, shown and the permission each needs; PUT with order [keys], show [keys] and widths {key: 1–4}.

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/home-widgets" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/me/report-files GET me/report-files: the person's own background files.

GET me/report-files: the person's own background files.

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/report-files" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/me/report-files/{file}

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`file`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/report-files/{file}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/me/report-files/{file}/download

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`file`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/report-files/{file}/download" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/me/attendance My attendance: a month of days and today's records.

My attendance: a month of days and today's records.

Sign-in: App token or company API key
Permission: self.attendance.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/attendance" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/me/clock The dashboard's clock card: today's shift, in or out, and what clocking needs here.

The dashboard's clock card: today's shift, in or out, and what clocking needs here.

Sign-in: App token or company API key
Permission: self.clock
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/clock" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/me/face What the consent screen shows: the text, the answer so far, and whether a template exists.

What the consent screen shows: the text, the answer so far, and whether a template exists.

Sign-in: App token or company API key
Permission: self.face
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/face" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/me/face/consent

Sign-in: App token or company API key
Permission: self.face
Module: hrm
Rate limit: 20 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

decisionrequired required|in:granted,refused,withdrawn

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/face/consent" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"decision":"granted"}'

POST /api/v1/app/companies/{company}/me/face/enrol The biometric photo, before any punch (§20). Multipart: face_token, face_frames[] (3 JPEGs...

The biometric photo, before any punch (§20). Multipart: face_token, face_frames[] (3 JPEGs), face_mirrored.

Sign-in: App token or company API key
Permission: self.face
Module: hrm
Rate limit: 20 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/face/enrol" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/me/face/challenge

Sign-in: App token or company API key
Permission: self.clock | self.presence
Module: hrm
Rate limit: 30 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/face/challenge" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/me/device-key The phone's new key: public_key (base64 of SubjectPublicKeyInfo or the X9.63 point), devic...

The phone's new key: public_key (base64 of SubjectPublicKeyInfo or the X9.63 point), device_id, platform.

Sign-in: App token or company API key
Permission: self.clock
Module: hrm
Rate limit: 20 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`public_key`required	`required\|string\|max:1000`
`device_id`required	`required\|string\|max:100`
`platform`	`nullable\|in:ios,android`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/device-key" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"public_key":"...","device_id":"...","platform":"ios"}'

GET /api/v1/app/companies/{company}/me/presence-check

Sign-in: App token or company API key
Permission: self.presence
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/presence-check" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/me/presence-check/{check} Multipart: face_token, face_frames[] (3 JPEGs), face_mirrored. Without consent, an empty b...

Multipart: face_token, face_frames[] (3 JPEGs), face_mirrored. Without consent, an empty body counts as unverified.

Sign-in: App token or company API key
Permission: self.presence
Module: hrm
Rate limit: 20 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`check`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/presence-check/{check}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/me/schedule GET me/schedule?from=&to= (YYYY-MM-DD, up to 62 days; this week by default): each day's sh...

GET me/schedule?from=&to= (YYYY-MM-DD, up to 62 days; this week by default): each day's shift, day off, holiday and leave.

Sign-in: App token or company API key
Permission: self.schedule
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/schedule" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/me/team-calendar GET me/team-calendar?month=YYYY-MM: who is off or remote, holidays and events (MyCalendar)...

GET me/team-calendar?month=YYYY-MM: who is off or remote, holidays and events (MyCalendar).

Sign-in: App token or company API key
Permission: self.team_calendar
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/team-calendar" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/me/requests My requests: status (all by default).

My requests: status (all by default).

Sign-in: App token or company API key
Permission: self.requests.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/requests" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/me/performance My evaluations, the reviews waiting for me, my goals, my feedback requests and feedback fo...

My evaluations, the reviews waiting for me, my goals, my feedback requests and feedback forms.

Sign-in: App token or company API key
Permission: self.performance.view | self.performance.review | self.performance.goals
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/performance" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/me/assessments The signed-in employee's own tests, with the page to take each.

The signed-in employee's own tests, with the page to take each.

Sign-in: App token or company API key
Permission: self.assessments
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/assessments" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/me/payslips My payslips: the approved runs only.

My payslips: the approved runs only.

Sign-in: App token or company API key
Permission: self.payslips.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/payslips" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/me/earned-wage

Sign-in: App token or company API key
Permission: self.earned_wage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/earned-wage" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/me/leaves My balances this year (or ?year) and my requests.

My balances this year (or ?year) and my requests.

Sign-in: App token or company API key
Permission: self.leaves.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/leaves" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/me/notifications GET me/notifications?unread=1&category=&page=

GET me/notifications?unread=1&category=&page=

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/notifications" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/me/notifications/read-all

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/notifications/read-all" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/me/notifications/{notice}/read POST me/notifications/{notice}/read (unread=1 to mark it unread again)

POST me/notifications/{notice}/read (unread=1 to mark it unread again)

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`notice`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/notifications/{notice}/read" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/me/notification-preferences

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/notification-preferences" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/me/notification-preferences PUT me/notification-preferences {categories: {requests: {in_app, email, whatsapp}, ...}}

PUT me/notification-preferences {categories: {requests: {in_app, email, whatsapp}, ...}}

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/notification-preferences" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/me/dashboards

Sign-in: App token or company API key
Permission: self.dashboard
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/dashboards" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/me/dashboards

Sign-in: App token or company API key
Permission: self.dashboard
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`required	`required\|array`
`name.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(60)`
`name.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(60)`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/dashboards" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":{"en":"...","ar":"..."}}'

GET /api/v1/app/companies/{company}/me/dashboards/{dashboard} GET me/dashboards/{dashboard}: with every widget's figure.

GET me/dashboards/{dashboard}: with every widget's figure.

Sign-in: App token or company API key
Permission: self.dashboard
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`dashboard`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/dashboards/{dashboard}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH PUT /api/v1/app/companies/{company}/me/dashboards/{dashboard}

Sign-in: App token or company API key
Permission: self.dashboard
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`dashboard`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`required	`required\|array`
`name.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(60)`
`name.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(60)`

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/dashboards/{dashboard}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":{"en":"...","ar":"..."}}'

DELETE /api/v1/app/companies/{company}/me/dashboards/{dashboard}

Sign-in: App token or company API key
Permission: self.dashboard
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`dashboard`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/dashboards/{dashboard}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/me/dashboards/{dashboard}/order PUT me/dashboards/{dashboard}/order {ids: [...]}

PUT me/dashboards/{dashboard}/order {ids: [...]}

Sign-in: App token or company API key
Permission: self.dashboard
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`dashboard`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/dashboards/{dashboard}/order" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/me/dashboards/{dashboard}/interval

Sign-in: App token or company API key
Permission: self.dashboard
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`dashboard`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/dashboards/{dashboard}/interval" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/me/dashboards-order

Sign-in: App token or company API key
Permission: self.dashboard
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/dashboards-order" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/me/dashboards/{dashboard}/widgets

Sign-in: App token or company API key
Permission: self.dashboard
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`dashboard`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`metric`	`$widget ? 'sometimes' : 'required'\|Rule::in(array_keys(self::METRICS))`
`title`	`sometimes\|nullable\|array`
`title.en`	`nullable\|string\|'max:' . \App\Support\Limits::chars(60)`
`title.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(60)`
`chart`	`sometimes\|nullable\|Rule::in($metric === 'report' ? array_keys(\App\Support\CommandCenter::CHARTS) :...`
`width`	`sometimes\|integer\|in:1,2,3,4`
`report_type`required	`required\|in:approved_leaves,approved_vacations,contract_expiry,document_expiry,termination_reasons,end_of_probation,headcount,joiners_leavers,overtime_hours,pending_tasks,retention_rate,turnover,loans,net_salaries,overtime_pay`
`breakdown`	`nullable\|in:none,age_group,gender,nationality,service_period,work_type`
`level`required	`required\|in:company,branch,work_location,department,section,group,project,job_role`
`unit_ids`	`$hasUnits ? 'required' : 'nullable'\|array`
`unit_ids.*`	`integer\|Rule::in(array_keys(\App\Support\CommandCenter::units($level)))`
`interval`	`$intervals ? ['required', 'integer', Rule::in($intervals)] : ['nullable']`
`upcoming`	`nullable\|boolean`
`options`	`nullable\|array`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/dashboards/{dashboard}/widgets" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"metric":"...","title":{"en":"...","ar":"..."},"chart":"...","width":1,"report_type":"approved_leaves","breakdown":"none","level":"company","unit_ids":[],"interval":"...","upcoming":true,"options":[]}'

PATCH PUT /api/v1/app/companies/{company}/me/dashboard-widgets/{widget}

Sign-in: App token or company API key
Permission: self.dashboard
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`widget`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`metric`	`$widget ? 'sometimes' : 'required'\|Rule::in(array_keys(self::METRICS))`
`title`	`sometimes\|nullable\|array`
`title.en`	`nullable\|string\|'max:' . \App\Support\Limits::chars(60)`
`title.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(60)`
`chart`	`sometimes\|nullable\|Rule::in($metric === 'report' ? array_keys(\App\Support\CommandCenter::CHARTS) :...`
`width`	`sometimes\|integer\|in:1,2,3,4`
`report_type`required	`required\|in:approved_leaves,approved_vacations,contract_expiry,document_expiry,termination_reasons,end_of_probation,headcount,joiners_leavers,overtime_hours,pending_tasks,retention_rate,turnover,loans,net_salaries,overtime_pay`
`breakdown`	`nullable\|in:none,age_group,gender,nationality,service_period,work_type`
`level`required	`required\|in:company,branch,work_location,department,section,group,project,job_role`
`unit_ids`	`$hasUnits ? 'required' : 'nullable'\|array`
`unit_ids.*`	`integer\|Rule::in(array_keys(\App\Support\CommandCenter::units($level)))`
`interval`	`$intervals ? ['required', 'integer', Rule::in($intervals)] : ['nullable']`
`upcoming`	`nullable\|boolean`
`options`	`nullable\|array`

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/dashboard-widgets/{widget}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"metric":"...","title":{"en":"...","ar":"..."},"chart":"...","width":1,"report_type":"approved_leaves","breakdown":"none","level":"company","unit_ids":[],"interval":"...","upcoming":true,"options":[]}'

DELETE /api/v1/app/companies/{company}/me/dashboard-widgets/{widget}

Sign-in: App token or company API key
Permission: self.dashboard
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`widget`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/me/dashboard-widgets/{widget}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

miscellaneous-requests 3 endpoints

GET /api/v1/app/companies/{company}/miscellaneous-requests

Sign-in: App token or company API key
Permission: requests.miscellaneous.view
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/miscellaneous-requests" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/app/companies/{company}/miscellaneous-requests/{employeeRequest}

Sign-in: App token or company API key
Permission: requests.miscellaneous.view
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employeeRequest`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/miscellaneous-requests/{employeeRequest}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/miscellaneous-requests/{employeeRequest}

Sign-in: App token or company API key
Permission: requests.miscellaneous.view
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employeeRequest`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/miscellaneous-requests/{employeeRequest}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

nine-box 2 endpoints

GET /api/v1/app/companies/{company}/nine-box/employees/{employee}

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/nine-box/employees/{employee}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/nine-box cycle_id, branch_id, department_id, position_id; box narrows to one box. format=csv downlo...

cycle_id, branch_id, department_id, position_id; box narrows to one box. format=csv downloads it.

Sign-in: App token or company API key
Permission: performance.view | performance.manage | performance.nine_box.view | performance.nine_box.assess
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/nine-box" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

notification-events 1 endpoint

GET /api/v1/app/companies/{company}/notification-events GET notification-events?kind=&category=&q= — which events notify whom (notifications.manag...

GET notification-events?kind=&category=&q= — which events notify whom (notifications.manage).

Sign-in: App token or company API key
Permission: notifications.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/notification-events" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

notification-log 3 endpoints

GET /api/v1/app/companies/{company}/notification-log GET notification-log?from=&to=&category=&channel=&status=&person=&branch=&kind=&actor=&q=&...

GET notification-log?from=&to=&category=&channel=&status=&person=&branch=&kind=&actor=&q=&per_page=&summary=1

Sign-in: App token or company API key
Permission: notifications.log.view
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/notification-log" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/notification-log/export GET notification-log/export?format=csv|xlsx&…filters, or with send= one send's recipients.

GET notification-log/export?format=csv|xlsx&…filters, or with send= one send's recipients.

Sign-in: App token or company API key
Permission: notifications.log.view
Rate limit: 20 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

`format`	`nullable\|in:csv,xlsx`
`send`	`nullable\|integer`

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/notification-log/export?format=csv&send=1" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/notification-log/{send} GET notification-log/{send}: the send with every person in scope and what each channel ans...

GET notification-log/{send}: the send with every person in scope and what each channel answered.

Sign-in: App token or company API key
Permission: notifications.log.view
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`send`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/notification-log/{send}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

notification-setup 2 endpoints

GET /api/v1/app/companies/{company}/notification-setup

Sign-in: App token or company API key
Permission: notifications.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/notification-setup" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/notification-setup PUT notification-setup {categories_off, receiver_emails, email_everyone, reminders}

PUT notification-setup {categories_off, receiver_emails, email_everyone, reminders}

Sign-in: App token or company API key
Permission: notifications.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/notification-setup" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

objectives 2 endpoints

PATCH PUT /api/v1/app/companies/{company}/objectives/{objective}

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`objective`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/objectives/{objective}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/objectives/{objective}

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`objective`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/objectives/{objective}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

off-cycle-settlements 1 endpoint

POST /api/v1/app/companies/{company}/off-cycle-settlements ids: unpaid off-cycle transactions marked paid.

ids: unpaid off-cycle transactions marked paid.

Sign-in: App token or company API key
Permission: payroll.transactions.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`ids`required	`required\|array\|min:1`
`ids.*`	`integer`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/off-cycle-settlements" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"ids":[]}'

okr-templates 6 endpoints

POST /api/v1/app/companies/{company}/okr-templates name {en, ar}; objectives are added one by one.

name {en, ar}; objectives are added one by one.

Sign-in: App token or company API key
Permission: performance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/okr-templates" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH PUT /api/v1/app/companies/{company}/okr-templates/{template} name {en, ar}; objectives are added one by one.

name {en, ar}; objectives are added one by one.

Sign-in: App token or company API key
Permission: performance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`template`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/okr-templates/{template}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/okr-templates/{template}

Sign-in: App token or company API key
Permission: performance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`template`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/okr-templates/{template}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/okr-templates/{template}/objectives An objective (as for an employee's OKRs) added, or replaced at index.

An objective (as for an employee's OKRs) added, or replaced at index.

Sign-in: App token or company API key
Permission: performance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`template`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/okr-templates/{template}/objectives" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/okr-templates/{template}/objectives/{index} An objective (as for an employee's OKRs) added, or replaced at index.

An objective (as for an employee's OKRs) added, or replaced at index.

Sign-in: App token or company API key
Permission: performance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`template`	integer	The record's ID.
`index`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/okr-templates/{template}/objectives/{index}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/okr-templates/{template}/objectives/{index}

Sign-in: App token or company API key
Permission: performance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`template`	integer	The record's ID.
`index`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/okr-templates/{template}/objectives/{index}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

okrs 1 endpoint

POST /api/v1/app/companies/{company}/okrs/mass-assign template_id, evaluations (ids).

template_id, evaluations (ids).

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/okrs/mass-assign" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

org-chart 1 endpoint

GET /api/v1/app/companies/{company}/org-chart

Sign-in: App token or company API key
Permission: self.org_chart | employees.view
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/org-chart" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

org-units 5 endpoints

GET /api/v1/app/companies/{company}/org-units

Sign-in: App token or company API key
Permission: structure.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/org-units" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/org-units

Sign-in: App token or company API key
Permission: structure.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`type`	`$unit ? 'sometimes' : 'required'\|in:work_location,department,section,project,hierarchy_group,business_unit,division,segment`
`name`	`$unit ? 'sometimes' : 'required'\|array`
`name.en`	`$unit ? 'required_with:name' : 'required'\|string\|'max:' . \App\Support\Limits::chars(120)`
`name.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(120)`
`code`	`nullable\|alpha_dash\|max:30`
`establishment_number`	`nullable\|string\|max:60`
`subsidiary_id`	`nullable\|string\|max:60`
`external_ref`	`nullable\|string\|max:64`
`logo`	`nullable\|image\|mimes:png,jpg,jpeg,webp,svg\|max:10240`
`remove_logo`	`sometimes\|boolean`
`establishment_name`	`nullable\|string\|max:150`
`governance_location`	`nullable\|string\|max:100`
`ss_number`	`nullable\|string\|max:60`
`tax_number`	`nullable\|string\|max:60`
`address`	`nullable\|string\|max:255`
`po_box`	`nullable\|string\|max:30`
`branch_id`	`nullable\|integer\|exists:branches,id`
`parent_id`	`$type === 'section' && !$unit?->parent_id ? 'required' : 'nullable'\|integer\|exists:org_units,id`
`is_active`	`sometimes\|boolean`
`sort_order`	`sometimes\|integer\|min:0`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/org-units" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -F "type=work_location" \
  -F "name=..." \
  -F "name.en=..." \
  -F "name.ar=..." \
  -F "code=..." \
  -F "establishment_number=..." \
  -F "subsidiary_id=..." \
  -F "external_ref=..." \
  -F "[email protected]" \
  -F "remove_logo=1" \
  -F "establishment_name=..." \
  -F "governance_location=..." \
  -F "ss_number=..." \
  -F "tax_number=..." \
  -F "address=..." \
  -F "po_box=..." \
  -F "branch_id=1" \
  -F "parent_id=1" \
  -F "is_active=1" \
  -F "sort_order=1"

POST /api/v1/app/companies/{company}/org-units/inline Adds a missing level for an employee's job details, where the branch allows it (AddOrgLeve...

Adds a missing level for an employee's job details, where the branch allows it (AddOrgLevel).

Sign-in: App token or company API key
Permission: structure.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`type`required	`required\|in:work_location,department,section,project,hierarchy_group,business_unit,division,segment`
`employee_id`	`nullable\|integer\|exists:employees,id`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/org-units/inline" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"type":"work_location","employee_id":1}'

PATCH /api/v1/app/companies/{company}/org-units/{unit}

Sign-in: App token or company API key
Permission: structure.manage
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`unit`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`type`	`$unit ? 'sometimes' : 'required'\|in:work_location,department,section,project,hierarchy_group,business_unit,division,segment`
`name`	`$unit ? 'sometimes' : 'required'\|array`
`name.en`	`$unit ? 'required_with:name' : 'required'\|string\|'max:' . \App\Support\Limits::chars(120)`
`name.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(120)`
`code`	`nullable\|alpha_dash\|max:30`
`establishment_number`	`nullable\|string\|max:60`
`subsidiary_id`	`nullable\|string\|max:60`
`external_ref`	`nullable\|string\|max:64`
`logo`	`nullable\|image\|mimes:png,jpg,jpeg,webp,svg\|max:10240`
`remove_logo`	`sometimes\|boolean`
`establishment_name`	`nullable\|string\|max:150`
`governance_location`	`nullable\|string\|max:100`
`ss_number`	`nullable\|string\|max:60`
`tax_number`	`nullable\|string\|max:60`
`address`	`nullable\|string\|max:255`
`po_box`	`nullable\|string\|max:30`
`branch_id`	`nullable\|integer\|exists:branches,id`
`parent_id`	`$type === 'section' && !$unit?->parent_id ? 'required' : 'nullable'\|integer\|exists:org_units,id`
`is_active`	`sometimes\|boolean`
`sort_order`	`sometimes\|integer\|min:0`

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/org-units/{unit}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -F "type=work_location" \
  -F "name=..." \
  -F "name.en=..." \
  -F "name.ar=..." \
  -F "code=..." \
  -F "establishment_number=..." \
  -F "subsidiary_id=..." \
  -F "external_ref=..." \
  -F "[email protected]" \
  -F "remove_logo=1" \
  -F "establishment_name=..." \
  -F "governance_location=..." \
  -F "ss_number=..." \
  -F "tax_number=..." \
  -F "address=..." \
  -F "po_box=..." \
  -F "branch_id=1" \
  -F "parent_id=1" \
  -F "is_active=1" \
  -F "sort_order=1"

DELETE /api/v1/app/companies/{company}/org-units/{unit}

Sign-in: App token or company API key
Permission: structure.manage
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`unit`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/org-units/{unit}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

overtime-types 4 endpoints

GET /api/v1/app/companies/{company}/overtime-types

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/overtime-types" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/overtime-types

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`required	`required\|array`
`name.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`name.ar`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`applies_on`required	`required\|in:any,workday,weekend,holiday`
`rate`required	`required\|numeric\|min:0\|max:20`
`allowance_method`required	`required\|in:hourly,daily`
`allowances_rate`	`nullable\|numeric\|min:0\|max:20`
`allowance_type_ids`	`nullable\|array`
`allowance_type_ids.*`	`integer\|exists:transaction_types,id`
`transaction_type_id`	`nullable\|integer\|exists:transaction_types,id`
`limit_hours`	`nullable\|numeric\|min:0\|max:744`
`limit_period`	`nullable\|in:day,week,month`
`exceptions`	`nullable\|array`
`exceptions.*.day`	`nullable\|in:0,1,2,3,4,5,6,off`
`exceptions.*.from`	`nullable\|date_format:H:i`
`exceptions.*.to`	`nullable\|date_format:H:i`
`exceptions.*.basic_rate`	`nullable\|numeric\|min:0\|max:20`
`exceptions.*.allowances_rate`	`nullable\|numeric\|min:0\|max:20`
`exceptions.*.method`	`nullable\|in:hourly,daily`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/overtime-types" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":{"en":"...","ar":"..."},"applies_on":"any","rate":1.5,"allowance_method":"hourly","allowances_rate":1.5,"allowance_type_ids":[],"transaction_type_id":1,"limit_hours":1.5,"limit_period":"day","exceptions":[]}'

PUT /api/v1/app/companies/{company}/overtime-types/{type}

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`type`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`required	`required\|array`
`name.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`name.ar`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`applies_on`required	`required\|in:any,workday,weekend,holiday`
`rate`required	`required\|numeric\|min:0\|max:20`
`allowance_method`required	`required\|in:hourly,daily`
`allowances_rate`	`nullable\|numeric\|min:0\|max:20`
`allowance_type_ids`	`nullable\|array`
`allowance_type_ids.*`	`integer\|exists:transaction_types,id`
`transaction_type_id`	`nullable\|integer\|exists:transaction_types,id`
`limit_hours`	`nullable\|numeric\|min:0\|max:744`
`limit_period`	`nullable\|in:day,week,month`
`exceptions`	`nullable\|array`
`exceptions.*.day`	`nullable\|in:0,1,2,3,4,5,6,off`
`exceptions.*.from`	`nullable\|date_format:H:i`
`exceptions.*.to`	`nullable\|date_format:H:i`
`exceptions.*.basic_rate`	`nullable\|numeric\|min:0\|max:20`
`exceptions.*.allowances_rate`	`nullable\|numeric\|min:0\|max:20`
`exceptions.*.method`	`nullable\|in:hourly,daily`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/overtime-types/{type}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":{"en":"...","ar":"..."},"applies_on":"any","rate":1.5,"allowance_method":"hourly","allowances_rate":1.5,"allowance_type_ids":[],"transaction_type_id":1,"limit_hours":1.5,"limit_period":"day","exceptions":[]}'

DELETE /api/v1/app/companies/{company}/overtime-types/{type}

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`type`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/overtime-types/{type}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

overtimes 5 endpoints

GET /api/v1/app/companies/{company}/overtimes Overtimes in scope, newest first: employee_id, status, overtime_type, from / to (the overt...

Overtimes in scope, newest first: employee_id, status, overtime_type, from / to (the overtime date).

Sign-in: App token or company API key
Permission: payroll.overtime.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/overtimes" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/overtimes

Sign-in: App token or company API key
Permission: payroll.overtime.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`effective_date`	`nullable\|date`
`out_of_payroll`	`nullable\|boolean`
`attachment`	`nullable\|file\|max:10240\|mimes:mp4,pdf,doc,docx,xls,xlsx,ppt,pptx,txt,csv,jpeg,png,gif,jpg,zip`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/overtimes" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -F "effective_date=2026-11-01" \
  -F "out_of_payroll=1" \
  -F "[email protected]"

PUT /api/v1/app/companies/{company}/overtimes/{overtime}

Sign-in: App token or company API key
Permission: payroll.overtime.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`overtime`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`effective_date`	`nullable\|date`
`out_of_payroll`	`nullable\|boolean`
`attachment`	`nullable\|file\|max:10240\|mimes:mp4,pdf,doc,docx,xls,xlsx,ppt,pptx,txt,csv,jpeg,png,gif,jpg,zip`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/overtimes/{overtime}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -F "effective_date=2026-11-01" \
  -F "out_of_payroll=1" \
  -F "[email protected]"

POST /api/v1/app/companies/{company}/overtimes/convert Overtime → time off: from, to, leave_type_id, rate (%), effective_date, minimum_hours, com...

Overtime → time off: from, to, leave_type_id, rate (%), effective_date, minimum_hours, combined, notes, department, work_location, section, main_project.

Sign-in: App token or company API key
Permission: payroll.overtime.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`from`required	`required\|date`
`to`required	`required\|date\|after_or_equal:from`
`leave_type_id`required	`required\|integer`
`rate`required	`required\|numeric\|min:0.01\|max:1000`
`effective_date`required	`required\|date`
`minimum_hours`required	`required\|numeric\|min:0`
`combined`	`nullable\|boolean`
`notes`	`nullable\|string\|'max:' . \App\Support\Limits::chars(500)`
`department`	`nullable\|integer`
`work_location`	`nullable\|integer`
`section`	`nullable\|integer`
`main_project`	`nullable\|integer`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/overtimes/convert" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"from":"2026-11-01","to":"2026-11-01","leave_type_id":1,"rate":1.5,"effective_date":"2026-11-01","minimum_hours":1.5,"combined":true,"notes":"...","department":1,"work_location":1,"section":1,"main_project":1}'

POST /api/v1/app/companies/{company}/overtimes/batch-as-income An overtime batch as income: employee_id, transaction_type_id (an earning), overtime_type_...

An overtime batch as income: employee_id, transaction_type_id (an earning), overtime_type_id, hours, date, description.

Sign-in: App token or company API key
Permission: payroll.overtime.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`employee_id`required	`required\|integer`
`transaction_type_id`required	`required\|exists:transaction_types,id`
`overtime_type_id`	`nullable\|integer`
`hours`required	`required\|numeric\|gt:0\|max:744`
`date`required	`required\|date`
`description`	`nullable\|string\|'max:' . \App\Support\Limits::chars(190)`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/overtimes/batch-as-income" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"employee_id":1,"transaction_type_id":"...","overtime_type_id":1,"hours":1.5,"date":"2026-11-01","description":"..."}'

part-time-assignments 4 endpoints

GET /api/v1/app/companies/{company}/part-time-assignments Assignments in scope, newest first: employee_id, type (transaction type id), effective (a...

Assignments in scope, newest first: employee_id, type (transaction type id), effective (a date), from / to, and the org filters.

Sign-in: App token or company API key
Permission: payroll.part_time.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/part-time-assignments" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/part-time-assignments

Sign-in: App token or company API key
Permission: payroll.part_time.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`transaction_type_id`required	`required\|exists:transaction_types,id`
`amount`	`nullable\|numeric\|min:0`
`recurring_value`	`nullable\|numeric\|min:0`
`net`	`nullable\|boolean`
`effective_date`required	`required\|date`
`end_date`	`nullable\|date\|after_or_equal:effective_date`
`note`	`nullable\|string\|'max:' . \App\Support\Limits::chars(255)`
`attachment`	`nullable\|file\|max:10240\|mimes:pdf,doc,docx,xls,xlsx,ppt,pptx,txt,csv,jpeg,png,gif,jpg,zip`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/part-time-assignments" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -F "transaction_type_id=..." \
  -F "amount=1.5" \
  -F "recurring_value=1.5" \
  -F "net=1" \
  -F "effective_date=2026-11-01" \
  -F "end_date=2026-11-01" \
  -F "note=..." \
  -F "[email protected]"

DELETE /api/v1/app/companies/{company}/part-time-assignments/{assignment}

Sign-in: App token or company API key
Permission: payroll.part_time.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`assignment`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/part-time-assignments/{assignment}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/part-time-assignments/{assignment}

Sign-in: App token or company API key
Permission: payroll.part_time.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`assignment`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`transaction_type_id`required	`required\|exists:transaction_types,id`
`amount`	`nullable\|numeric\|min:0`
`recurring_value`	`nullable\|numeric\|min:0`
`net`	`nullable\|boolean`
`effective_date`required	`required\|date`
`end_date`	`nullable\|date\|after_or_equal:effective_date`
`note`	`nullable\|string\|'max:' . \App\Support\Limits::chars(255)`
`attachment`	`nullable\|file\|max:10240\|mimes:pdf,doc,docx,xls,xlsx,ppt,pptx,txt,csv,jpeg,png,gif,jpg,zip`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/part-time-assignments/{assignment}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -F "transaction_type_id=..." \
  -F "amount=1.5" \
  -F "recurring_value=1.5" \
  -F "net=1" \
  -F "effective_date=2026-11-01" \
  -F "end_date=2026-11-01" \
  -F "note=..." \
  -F "[email protected]"

payroll 1 endpoint

GET /api/v1/app/companies/{company}/payroll/{month} Mawarid's GET payroll/{YYYY-MM}: the month's approved regular run with its payslips (404 u...

Mawarid's GET payroll/{YYYY-MM}: the month's approved regular run with its payslips (404 until approved).

Sign-in: App token or company API key
Permission: payroll.runs.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`month`	string · [0-9]{4}-[0-9]{2}	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/payroll/{month}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

payroll-lists 1 endpoint

GET /api/v1/app/companies/{company}/payroll-lists/{list} air-tickets, business-trips, expenses or missing-punches: status, from, to, travel_policy,...

air-tickets, business-trips, expenses or missing-punches: status, from, to, travel_policy, travel_from, travel_to, expense_name; paged.

Sign-in: App token or company API key
Permission: payroll.view | payroll.manage | payroll.business_trips.view | payroll.expenses.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`list`	string · air-tickets\|business-trips\|expenses\|missing-punches	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/payroll-lists/{list}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

payroll-rules 4 endpoints

GET /api/v1/app/companies/{company}/payroll-rules/{section} A rules list; bank-accounts can be filtered by branch_id.

A rules list; bank-accounts can be filtered by branch_id.

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`section`	string · social-security\|tax\|extra-salaries\|bank-accounts\|bank-templates\|slip-templates	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/payroll-rules/{section}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/payroll-rules/{section}

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`section`	string · social-security\|tax\|extra-salaries\|bank-accounts\|bank-templates\|slip-templates	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name_ar`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`name_en`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`employee_percent`required	`required\|numeric\|min:0\|max:100`
`employer_percent`required	`required\|numeric\|min:0\|max:100`
`salary_from`	`nullable\|numeric\|min:0`
`salary_to`	`nullable\|numeric\|min:0\|gte:salary_from`
`ceiling`	`nullable\|numeric\|min:0`
`floor`	`nullable\|numeric\|min:0`
`base`required	`required\|in:basic,gross`
`external_ref`	`nullable\|string\|max:64`
`min_work_days`	`nullable\|integer\|min:0\|max:31`
`effective_from`required	`required\|date`
`effective_to`	`nullable\|date\|after_or_equal:effective_from`
`percent`required	`required\|numeric\|min:0\|max:1000`
`distribution`required	`required\|in:once,monthly`
`pay_month`required	`required\|integer\|between:1,12`
`country`	`nullable\|string\|max:60`
`bank_name`required	`required\|string\|max:150`
`bank_branch`	`nullable\|string\|max:150`
`account_name`	`nullable\|string\|max:150`
`account_number`required	`required\|string\|max:60`
`iban`	`nullable\|string\|max:60`
`exchange_account`	`nullable\|string\|max:60`
`establishment_number`	`nullable\|string\|max:60`
`currency`	`nullable\|alpha\|size:3`
`branch_id`	`nullable\|exists:branches,id`
`bank_export_template_id`	`nullable\|exists:bank_export_templates,id`
`brackets`	`$rows ? 'nullable' : 'required'\|string\|max:2000\|regex:/^(\s\d+(\.\d+)?\s:\s\d+(\.\d+)?\s(\r?\n\|$))+$/`
`bracket_period`	`nullable\|in:monthly,annual`
`bracket_rows`	`array\|max:30`
`bracket_rows.*.min`	`nullable\|numeric\|min:0`
`bracket_rows.*.max`	`nullable\|numeric\|min:0`
`bracket_rows.*.rate`required	`required\|numeric\|min:0\|max:100`
`bracket_rows.*.extra_exemption`	`nullable\|numeric\|min:0\|max:100`
`personal_exemption`	`nullable\|numeric\|min:0`
`family_exemption`	`nullable\|numeric\|min:0`
`other_exemption`	`nullable\|numeric\|min:0`
`notes`	`nullable\|string\|'max:' . \App\Support\Limits::chars(255)`
`kind`required	`required\|in:bank,wps`
`bank`	`nullable\|string\|max:150`
`extension`required	`required\|in:csv,txt,sif,xlsx`
`delimiter`required	`required\|in:,,;,\|,tab`
`header_lines`	`nullable\|string\|max:2000`
`footer_lines`	`nullable\|string\|max:2000`
`columns_text`required	`required\|string\|max:4000`
`date_format`required	`required\|string\|max:20`
`amount_decimals`required	`required\|integer\|between:0,4`
`slip_type`required	`required\|in:salary,settlement`
`language`required	`required\|in:en,ar\|unique:salary_slip_templates`
`header`	`nullable\|string\|max:5000`
`footer`	`nullable\|string\|max:5000`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/payroll-rules/{section}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name_ar":"...","name_en":"...","employee_percent":1.5,"employer_percent":1.5,"salary_from":1.5,"salary_to":1.5,"ceiling":1.5,"floor":1.5,"base":"basic","external_ref":"...","min_work_days":1,"effective_from":"2026-11-01","effective_to":"2026-11-01","percent":1.5,"distribution":"once","pay_month":1,"country":"...","bank_name":"...","bank_branch":"...","account_name":"...","account_number":"...","iban":"...","exchange_account":"...","establishment_number":"...","currency":"...","branch_id":"...","bank_export_template_id":"...","brackets":"...","bracket_period":"monthly","bracket_rows":[],"personal_exemption":1.5,"family_exemption":1.5,"other_exemption":1.5,"notes":"...","kind":"bank","bank":"...","extension":"csv","delimiter":"","header_lines":"...","footer_lines":"...","columns_text":"...","date_format":"...","amount_decimals":1,"slip_type":"salary","language":"en","header":"...","footer":"..."}'

PUT /api/v1/app/companies/{company}/payroll-rules/{section}/{id} The whole record is sent, as on the screen (a switch left out is off).

The whole record is sent, as on the screen (a switch left out is off).

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`section`	string · social-security\|tax\|extra-salaries\|bank-accounts\|bank-templates\|slip-templates	The record's ID.
`id`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name_ar`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`name_en`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`employee_percent`required	`required\|numeric\|min:0\|max:100`
`employer_percent`required	`required\|numeric\|min:0\|max:100`
`salary_from`	`nullable\|numeric\|min:0`
`salary_to`	`nullable\|numeric\|min:0\|gte:salary_from`
`ceiling`	`nullable\|numeric\|min:0`
`floor`	`nullable\|numeric\|min:0`
`base`required	`required\|in:basic,gross`
`external_ref`	`nullable\|string\|max:64`
`min_work_days`	`nullable\|integer\|min:0\|max:31`
`effective_from`required	`required\|date`
`effective_to`	`nullable\|date\|after_or_equal:effective_from`
`percent`required	`required\|numeric\|min:0\|max:1000`
`distribution`required	`required\|in:once,monthly`
`pay_month`required	`required\|integer\|between:1,12`
`country`	`nullable\|string\|max:60`
`bank_name`required	`required\|string\|max:150`
`bank_branch`	`nullable\|string\|max:150`
`account_name`	`nullable\|string\|max:150`
`account_number`required	`required\|string\|max:60`
`iban`	`nullable\|string\|max:60`
`exchange_account`	`nullable\|string\|max:60`
`establishment_number`	`nullable\|string\|max:60`
`currency`	`nullable\|alpha\|size:3`
`branch_id`	`nullable\|exists:branches,id`
`bank_export_template_id`	`nullable\|exists:bank_export_templates,id`
`brackets`	`$rows ? 'nullable' : 'required'\|string\|max:2000\|regex:/^(\s\d+(\.\d+)?\s:\s\d+(\.\d+)?\s(\r?\n\|$))+$/`
`bracket_period`	`nullable\|in:monthly,annual`
`bracket_rows`	`array\|max:30`
`bracket_rows.*.min`	`nullable\|numeric\|min:0`
`bracket_rows.*.max`	`nullable\|numeric\|min:0`
`bracket_rows.*.rate`required	`required\|numeric\|min:0\|max:100`
`bracket_rows.*.extra_exemption`	`nullable\|numeric\|min:0\|max:100`
`personal_exemption`	`nullable\|numeric\|min:0`
`family_exemption`	`nullable\|numeric\|min:0`
`other_exemption`	`nullable\|numeric\|min:0`
`notes`	`nullable\|string\|'max:' . \App\Support\Limits::chars(255)`
`kind`required	`required\|in:bank,wps`
`bank`	`nullable\|string\|max:150`
`extension`required	`required\|in:csv,txt,sif,xlsx`
`delimiter`required	`required\|in:,,;,\|,tab`
`header_lines`	`nullable\|string\|max:2000`
`footer_lines`	`nullable\|string\|max:2000`
`columns_text`required	`required\|string\|max:4000`
`date_format`required	`required\|string\|max:20`
`amount_decimals`required	`required\|integer\|between:0,4`
`slip_type`required	`required\|in:salary,settlement`
`language`required	`required\|in:en,ar\|unique:salary_slip_templates`
`header`	`nullable\|string\|max:5000`
`footer`	`nullable\|string\|max:5000`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/payroll-rules/{section}/{id}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name_ar":"...","name_en":"...","employee_percent":1.5,"employer_percent":1.5,"salary_from":1.5,"salary_to":1.5,"ceiling":1.5,"floor":1.5,"base":"basic","external_ref":"...","min_work_days":1,"effective_from":"2026-11-01","effective_to":"2026-11-01","percent":1.5,"distribution":"once","pay_month":1,"country":"...","bank_name":"...","bank_branch":"...","account_name":"...","account_number":"...","iban":"...","exchange_account":"...","establishment_number":"...","currency":"...","branch_id":"...","bank_export_template_id":"...","brackets":"...","bracket_period":"monthly","bracket_rows":[],"personal_exemption":1.5,"family_exemption":1.5,"other_exemption":1.5,"notes":"...","kind":"bank","bank":"...","extension":"csv","delimiter":"","header_lines":"...","footer_lines":"...","columns_text":"...","date_format":"...","amount_decimals":1,"slip_type":"salary","language":"en","header":"...","footer":"..."}'

DELETE /api/v1/app/companies/{company}/payroll-rules/{section}/{id}

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`section`	string · social-security\|tax\|extra-salaries\|bank-accounts\|bank-templates\|slip-templates	The record's ID.
`id`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/payroll-rules/{section}/{id}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

payroll-runs 12 endpoints

GET /api/v1/app/companies/{company}/payroll-runs Payroll runs, newest first: month, kind (regular | off_cycle), status.

Payroll runs, newest first: month, kind (regular | off_cycle), status.

Sign-in: App token or company API key
Permission: payroll.runs.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/payroll-runs" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/payroll-runs/{run}/review

Sign-in: App token or company API key
Permission: payroll.runs.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`run`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/payroll-runs/{run}/review" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/payroll-runs/{run} A run with its payslips (the ones in my scope).

A run with its payslips (the ones in my scope).

Sign-in: App token or company API key
Permission: payroll.runs.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`run`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/payroll-runs/{run}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/payroll-runs

Sign-in: App token or company API key
Permission: payroll.runs.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`month`required	`required\|date_format:Y-m`
`departments`	`nullable\|array`
`departments.*`	`integer`
`branches`	`nullable\|array`
`branches.*`	`integer`
`employees`	`nullable\|array`
`employees.*`	`integer`
`picks`	`nullable\|array`
`picks.*`	`string`
`period_from`	`nullable\|required_with:period_to\|date_format:Y-m-d`
`period_to`	`nullable\|required_with:period_from\|date_format:Y-m-d\|after_or_equal:period_from`
`batch_id`	`nullable\|integer`
`move_pending`	`nullable\|boolean`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/payroll-runs" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"month":"2026-11-01","departments":[],"branches":[],"employees":[],"picks":[],"period_from":"2026-11-01","period_to":"2026-11-01","batch_id":1,"move_pending":true}'

POST /api/v1/app/companies/{company}/payroll-runs/off-cycle

Sign-in: App token or company API key
Permission: payroll.runs.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`title`required	`required\|string\|max:100`
`month`required	`required\|date_format:Y-m`
`percent_of_basic`required	`required\|numeric\|min:1\|max:1000`
`picks`	`nullable\|array`
`picks.*`	`string`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/payroll-runs/off-cycle" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"title":"...","month":"2026-11-01","percent_of_basic":1.5,"picks":[]}'

POST /api/v1/app/companies/{company}/payroll-runs/{run}/recalculate

Sign-in: App token or company API key
Permission: payroll.runs.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`run`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/payroll-runs/{run}/recalculate" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/payroll-runs/{run}/approve Approve, or send through the salary batch approval chain: result is "approved" or "sent".

Approve, or send through the salary batch approval chain: result is "approved" or "sent".

Sign-in: App token or company API key
Permission: payroll.runs.approve
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`run`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/payroll-runs/{run}/approve" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/payroll-runs/{run}/paid

Sign-in: App token or company API key
Permission: payroll.runs.approve
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`run`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`paid_at`required	`required\|date`
`payment_reference`	`nullable\|string\|max:100`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/payroll-runs/{run}/paid" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"paid_at":"2026-11-01","payment_reference":"..."}'

DELETE /api/v1/app/companies/{company}/payroll-runs/{run}/payslips/{payslip} Salary row → Delete: takes one employee out of a draft batch.

Salary row → Delete: takes one employee out of a draft batch.

Sign-in: App token or company API key
Permission: payroll.runs.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`run`	integer	The record's ID.
`payslip`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/payroll-runs/{run}/payslips/{payslip}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/payroll-runs/{run}/revert Whether an approved run can go back to draft: can_revert and the reasons it can't (blocker...

Whether an approved run can go back to draft: can_revert and the reasons it can't (blockers, keyed).

Sign-in: App token or company API key
Permission: payroll.runs.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`run`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/payroll-runs/{run}/revert" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/payroll-runs/{run}/revert Revert to draft: undoes what approving did (reason optional); 422 with the blockers when r...

Revert to draft: undoes what approving did (reason optional); 422 with the blockers when refused.

Sign-in: App token or company API key
Permission: payroll.runs.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`run`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/payroll-runs/{run}/revert" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/payroll-runs/{run}

Sign-in: App token or company API key
Permission: payroll.runs.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`run`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/payroll-runs/{run}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

payroll-settings 2 endpoints

GET /api/v1/app/companies/{company}/payroll-settings/{section}

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`section`	string · payroll-setup\|in-advance\|extra-salaries\|tax-setup\|journal\|provision-setup	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/payroll-settings/{section}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/payroll-settings/{section} Only the fields sent change; the others keep their values.

Only the fields sent change; the others keep their values.

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`section`	string · payroll-setup\|in-advance\|extra-salaries\|tax-setup\|journal\|provision-setup	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`payroll_cutoff_day`	`nullable\|integer\|min:0\|max:28`
`day_base_absence`	`$base`
`day_base_unpaid`	`$base`
`day_base_overtime`	`$base`
`day_base_vacation`	`$base`
`absence_calc_mode`	`$mode`
`unpaid_calc_mode`	`$mode`
`gross_up_rate_on`required	`required\|in:net,gross`
`gross_up_type_id`	`nullable\|exists:transaction_types,id`
`gross_up_excluded`	`array`
`gross_up_excluded.*`	`Rule::in(array_keys(self::GROSS_UP_EXCLUSIONS))`
`tax_method`required	`required\|in:monthly,accumulative,distributed`
`slip_annual_types`	`array`
`slip_annual_types.*`	`$leaveType`
`slip_sick_types`	`array`
`slip_sick_types.*`	`$leaveType`
`slip_taken_types`	`array`
`slip_taken_types.*`	`$leaveType`
`neg_settlement_name_en`	`nullable\|string\|'max:' . \App\Support\Limits::chars(100)`
`neg_settlement_name_ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(100)`
`neg_deduction_name_en`	`nullable\|string\|'max:' . \App\Support\Limits::chars(100)`
`neg_deduction_name_ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(100)`
`payslip_header`	`nullable\|string\|'max:' . \App\Support\Limits::chars(500)`
`payslip_footer`	`nullable\|string\|'max:' . \App\Support\Limits::chars(500)`
`ss_base`	`nullable\|in:basic,gross`
`advance_calc_base`required	`required\|Rule::in(array_keys(self::advanceBases()))`
`advance_slip`required	`required\|in:regular,advance`
`advance_allowance_type_ids`	`nullable\|array`
`advance_allowance_type_ids.*`	`integer\|exists:transaction_types,id`
`es_reimburse_type_id`	`Rule::requiredIf($reimburse)\|nullable\|$type`
`es_calc_base`required	`required\|in:30,calendar`
`es_included_type_ids`	`nullable\|array`
`es_included_type_ids.*`	`integer\|$type`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/payroll-settings/{section}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"payroll_cutoff_day":1,"day_base_absence":"...","day_base_unpaid":"...","day_base_overtime":"...","day_base_vacation":"...","absence_calc_mode":"...","unpaid_calc_mode":"...","gross_up_rate_on":"net","gross_up_type_id":"...","gross_up_excluded":[],"tax_method":"monthly","slip_annual_types":[],"slip_sick_types":[],"slip_taken_types":[],"neg_settlement_name_en":"...","neg_settlement_name_ar":"...","neg_deduction_name_en":"...","neg_deduction_name_ar":"...","payslip_header":"...","payslip_footer":"...","ss_base":"basic","advance_calc_base":"...","advance_slip":"regular","advance_allowance_type_ids":[],"es_reimburse_type_id":"...","es_calc_base":"30","es_included_type_ids":[]}'

payslips 3 endpoints

GET /api/v1/app/companies/{company}/payslips/{payslip} A payslip: my own once its run is approved, or any in my payroll scope.

A payslip: my own once its run is approved, or any in my payroll scope.

Sign-in: App token or company API key
Permission: self.payslips.view | payroll.runs.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`payslip`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/payslips/{payslip}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/payslips/{payslip}/pdf The payslip as a PDF file (application/pdf), with the same access as showPayslip; lang=en|...

The payslip as a PDF file (application/pdf), with the same access as showPayslip; lang=en|ar picks its language.

Sign-in: App token or company API key
Permission: self.payslips.download | payroll.runs.view
Module: hrm
Rate limit: 30 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`payslip`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/payslips/{payslip}/pdf" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/payslips/{payslip}/adjustment

Sign-in: App token or company API key
Permission: payroll.runs.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`payslip`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`adjustment`required	`required\|numeric`
`note`	`nullable\|string\|'max:' . \App\Support\Limits::chars(255)`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/payslips/{payslip}/adjustment" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"adjustment":1.5,"note":"..."}'

pending-biometrics 3 endpoints

GET /api/v1/app/companies/{company}/pending-biometrics New biometrics and conflicts waiting for HR, each with the devices a publish reaches and t...

New biometrics and conflicts waiting for HR, each with the devices a publish reaches and the ones that can't take it.

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/pending-biometrics" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/pending-biometrics/publish-all Every pending biometric, one employee's (employee_id) or the ticked people's (employee_ids...

Every pending biometric, one employee's (employee_id) or the ticked people's (employee_ids).

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`employee_ids`	`nullable\|array`
`employee_ids.*`	`integer`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/pending-biometrics/publish-all" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"employee_ids":[]}'

POST /api/v1/app/companies/{company}/pending-biometrics/{template}/decide action publish (device_ids for chosen devices only), source_only or reject.

action publish (device_ids for chosen devices only), source_only or reject.

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`template`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`action`required	`required\|in:publish,source_only,reject`
`device_ids`	`nullable\|array`
`device_ids.*`	`integer`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/pending-biometrics/{template}/decide" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"action":"publish","device_ids":[]}'

people 2 endpoints

GET /api/v1/app/companies/{company}/people/{user}/access See as them: everything a person has on the web and in the app. ?about=employee id for the...

See as them: everything a person has on the web and in the app. ?about=employee id for the field levels about one employee.

Sign-in: App token or company API key
Permission: roles.manage
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`user`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/people/{user}/access" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/people/{user}/access/explain Why is this open? ?permission=key

Why is this open? ?permission=key

Sign-in: App token or company API key
Permission: roles.manage
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`user`	integer	The record's ID.

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

permissionrequired required|string|Rule::in(\App\Models\Role::allPermissions())

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/people/{user}/access/explain?permission=..." \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

performance-kpis 1 endpoint

GET /api/v1/app/companies/{company}/performance-kpis

Sign-in: App token or company API key
Permission: performance.view | performance.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/performance-kpis" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

performance-setup 1 endpoint

GET /api/v1/app/companies/{company}/performance-setup/{kind} One list of setup records: templates, general_factors, okr_templates, rating_types, compet...

One list of setup records: templates, general_factors, okr_templates, rating_types, competency categories, levels, competencies, position_competencies.

Sign-in: App token or company API key
Permission: performance.view | performance.manage.* | performance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`kind`	string · evaluation-templates\|general-factor-templates\|okr-templates\|rating-types\|categories\|levels\|competencies\|position-competencies	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/performance-setup/{kind}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

permission-groups 4 endpoints

GET /api/v1/app/companies/{company}/permission-groups

Sign-in: App token or company API key
Permission: roles.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/permission-groups" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/permission-groups

Sign-in: App token or company API key
Permission: roles.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`	`$group ? 'sometimes' : 'required'\|array`
`name.en`	`$group ? 'required_with:name' : 'required'\|string\|'max:' . \App\Support\Limits::chars(120)`
`name.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(120)`
`description`	`nullable\|array`
`description.*`	`nullable\|string\|max:300`
`is_active`	`sometimes\|boolean`
`branch_ids`	`sometimes\|nullable\|array`
`branch_ids.*`	`integer\|exists:branches,id`
`unit_rules`	`sometimes\|nullable\|array`
`unit_rules.*`	`array`
`unit_rules..`	`integer\|exists:org_units,id`
`people`	`sometimes\|nullable\|array`
`people.*`	`integer\|exists:employees,id`
`manager_role_id`	`sometimes\|$roleRule`
`team_leader_role_id`	`sometimes\|$roleRule`
`employee_role_id`	`sometimes\|$roleRule`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/permission-groups" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":{"en":"...","ar":"..."},"description":[],"is_active":true,"branch_ids":[],"unit_rules":[],"people":[],"manager_role_id":"...","team_leader_role_id":"...","employee_role_id":"..."}'

PATCH /api/v1/app/companies/{company}/permission-groups/{group}

Sign-in: App token or company API key
Permission: roles.manage
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`group`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`	`$group ? 'sometimes' : 'required'\|array`
`name.en`	`$group ? 'required_with:name' : 'required'\|string\|'max:' . \App\Support\Limits::chars(120)`
`name.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(120)`
`description`	`nullable\|array`
`description.*`	`nullable\|string\|max:300`
`is_active`	`sometimes\|boolean`
`branch_ids`	`sometimes\|nullable\|array`
`branch_ids.*`	`integer\|exists:branches,id`
`unit_rules`	`sometimes\|nullable\|array`
`unit_rules.*`	`array`
`unit_rules..`	`integer\|exists:org_units,id`
`people`	`sometimes\|nullable\|array`
`people.*`	`integer\|exists:employees,id`
`manager_role_id`	`sometimes\|$roleRule`
`team_leader_role_id`	`sometimes\|$roleRule`
`employee_role_id`	`sometimes\|$roleRule`

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/permission-groups/{group}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":{"en":"...","ar":"..."},"description":[],"is_active":true,"branch_ids":[],"unit_rules":[],"people":[],"manager_role_id":"...","team_leader_role_id":"...","employee_role_id":"..."}'

DELETE /api/v1/app/companies/{company}/permission-groups/{group}

Sign-in: App token or company API key
Permission: roles.manage
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`group`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/permission-groups/{group}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

permission-overrides 3 endpoints

GET /api/v1/app/companies/{company}/permission-overrides One person's exceptions, or everyone's.

One person's exceptions, or everyone's.

Sign-in: App token or company API key
Permission: roles.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/permission-overrides" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/permission-overrides Sets a person's exception; both channels empty take it off (data is then null).

Sets a person's exception; both channels empty take it off (data is then null).

Sign-in: App token or company API key
Permission: roles.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`user_id`required	`required\|integer`
`kind`required	`required\|in:action,field`
`subject`required	`required\|string\|Rule::in($kind === \App\Models\PermissionOverride::FIELD ? \App\Tenancy\FieldAcc...`
`web`	`nullable\|Rule::in($values)`
`app`	`nullable\|Rule::in($values)`
`scope`	`nullable\|in:company,branch,department,work_location,section,project,hierarchy_group,business_unit,division,segment,reports,team,reports_of`
`scope_id`	`nullable\|integer`
`reason`	`nullable\|string\|'max:' . \App\Support\Limits::chars(500)`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/permission-overrides" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"user_id":1,"kind":"action","subject":"...","web":"...","app":"...","scope":"company","scope_id":1,"reason":"..."}'

DELETE /api/v1/app/companies/{company}/permission-overrides/{override}

Sign-in: App token or company API key
Permission: roles.manage
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`override`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/permission-overrides/{override}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

plan-actions 2 endpoints

PATCH PUT /api/v1/app/companies/{company}/plan-actions/{action} Fields not sent stay as they are.

Fields not sent stay as they are.

Sign-in: App token or company API key
Permission: succession.manage.* | succession.successors.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`action`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`title`required	`required\|string\|max:255`
`kind`	`nullable\|in:training,mentoring,assignment,project,other`
`owner_id`	`nullable\|integer\|exists:employees,id`
`due_date`	`nullable\|date`
`status`	`nullable\|in:planned,in_progress,done`
`progress`	`nullable\|integer\|between:0,100`
`competency_id`	`nullable\|integer\|exists:competencies,id`
`notes`	`nullable\|string\|'max:' . \App\Support\Limits::chars(2000)`

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/plan-actions/{action}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"title":"...","kind":"training","owner_id":1,"due_date":"2026-11-01","status":"planned","progress":1,"competency_id":1,"notes":"..."}'

DELETE /api/v1/app/companies/{company}/plan-actions/{action}

Sign-in: App token or company API key
Permission: succession.manage.* | succession.successors.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`action`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/plan-actions/{action}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

position-competencies 2 endpoints

POST /api/v1/app/companies/{company}/position-competencies position_id, competency_id, required_level, weight.

position_id, competency_id, required_level, weight.

Sign-in: App token or company API key
Permission: performance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`position_id`required	`required\|integer\|exists:positions,id`
`competency_id`required	`required\|integer\|exists:competencies,id`
`required_level`required	`required\|integer\|'between:1,' . \App\Models\CompetencyLevel::scale()`
`weight`	`nullable\|numeric\|min:0\|max:100`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/position-competencies" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"position_id":1,"competency_id":1,"required_level":1,"weight":1.5}'

DELETE /api/v1/app/companies/{company}/position-competencies/{link}

Sign-in: App token or company API key
Permission: performance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`link`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/position-competencies/{link}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

positions 3 endpoints

GET /api/v1/app/companies/{company}/positions

Sign-in: App token or company API key
Permission: positions.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/positions" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/positions

Sign-in: App token or company API key
Permission: positions.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`	`$position ? 'sometimes' : 'required'\|array`
`name.en`	`$position ? 'required_with:name' : 'required'\|string\|'max:' . \App\Support\Limits::chars(120)`
`name.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(120)`
`code`	`nullable\|alpha_dash\|max:30`
`is_active`	`sometimes\|boolean`
`job_description`	`nullable\|string\|max:20000`
`job_role_type`	`sometimes\|in:regular,hazardous`
`company_level`	`sometimes\|boolean`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/positions" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":{"en":"...","ar":"..."},"code":"...","is_active":true,"job_description":"...","job_role_type":"regular","company_level":true}'

PATCH /api/v1/app/companies/{company}/positions/{position}

Sign-in: App token or company API key
Permission: positions.manage
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`position`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`	`$position ? 'sometimes' : 'required'\|array`
`name.en`	`$position ? 'required_with:name' : 'required'\|string\|'max:' . \App\Support\Limits::chars(120)`
`name.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(120)`
`code`	`nullable\|alpha_dash\|max:30`
`is_active`	`sometimes\|boolean`
`job_description`	`nullable\|string\|max:20000`
`job_role_type`	`sometimes\|in:regular,hazardous`
`company_level`	`sometimes\|boolean`

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/positions/{position}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":{"en":"...","ar":"..."},"code":"...","is_active":true,"job_description":"...","job_role_type":"regular","company_level":true}'

potential-assessments 2 endpoints

POST /api/v1/app/companies/{company}/potential-assessments employee_id, rating (low|medium|high), criteria {learning_agility, leadership, drive, adap...

employee_id, rating (low|medium|high), criteria {learning_agility, leadership, drive, adaptability, aspiration: 1–5}, notes, evaluation_cycle_id, assessed_on.

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`employee_id`required	`required\|integer\|exists:employees,id`
`rating`required	`required\|in:low,medium,high`
`criteria`	`nullable\|array`
`criteria.*`	`nullable\|integer\|between:1,5`
`notes`	`nullable\|string\|'max:' . \App\Support\Limits::chars(2000)`
`evaluation_cycle_id`	`nullable\|integer\|exists:evaluation_cycles,id`
`assessed_on`	`nullable\|date\|before_or_equal:today`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/potential-assessments" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"employee_id":1,"rating":"low","criteria":[],"notes":"...","evaluation_cycle_id":1,"assessed_on":"2026-11-01"}'

DELETE /api/v1/app/companies/{company}/potential-assessments/{assessment}

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`assessment`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/potential-assessments/{assessment}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

professional-data 3 endpoints

POST /api/v1/app/companies/{company}/professional-data/{record}/cancel

Sign-in: App token or company API key
Permission: employees.edit
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`record`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/professional-data/{record}/cancel" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/app/companies/{company}/professional-data/{record}

Sign-in: App token or company API key
Permission: employees.manage
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`record`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/professional-data/{record}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/professional-data/{record}

Sign-in: App token or company API key
Permission: employees.manage
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`record`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/professional-data/{record}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

projects 6 endpoints

GET /api/v1/app/companies/{company}/projects

Sign-in: App token or company API key
Permission: projects.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/projects" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/projects

Sign-in: App token or company API key
Permission: projects.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`code`required	`required\|string\|max:30\|unique:org_units,code`
`name`required	`required\|array`
`name.ar`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`name.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`client`	`nullable\|string\|max:150`
`group_name`	`nullable\|string\|max:150`
`group_code`	`nullable\|string\|max:30`
`entity_code`	`nullable\|string\|max:30`
`manager_id`	`nullable\|integer\|exists:employees,id`
`start_date`	`nullable\|date`
`end_date`	`nullable\|date\|after_or_equal:start_date`
`budget_hours`	`nullable\|numeric\|min:0`
`cost_center_id`	`nullable\|integer\|exists:cost_centers,id`
`status`required	`required\|Rule::in(self::STATUSES)`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/projects" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"code":"...","name":{"ar":"...","en":"..."},"client":"...","group_name":"...","group_code":"...","entity_code":"...","manager_id":1,"start_date":"2026-11-01","end_date":"2026-11-01","budget_hours":1.5,"cost_center_id":1,"status":"..."}'

GET /api/v1/app/companies/{company}/projects/{project}

Sign-in: App token or company API key
Permission: projects.manage
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`project`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/projects/{project}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/app/companies/{company}/projects/{project}

Sign-in: App token or company API key
Permission: projects.manage
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`project`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/projects/{project}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/projects/{project}/assignments

Sign-in: App token or company API key
Permission: projects.manage
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`project`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`employee_id`required	`required\|integer`
`position_id`	`nullable\|integer\|exists:positions,id`
`contribution_percent`required	`required\|numeric\|min:0\|max:100`
`staff_code`	`nullable\|string\|max:30`
`start_date`	`nullable\|date`
`end_date`	`nullable\|date\|after_or_equal:start_date`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/projects/{project}/assignments" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"employee_id":1,"position_id":1,"contribution_percent":1.5,"staff_code":"...","start_date":"2026-11-01","end_date":"2026-11-01"}'

DELETE /api/v1/app/companies/{company}/projects/{project}/assignments/{assignment}

Sign-in: App token or company API key
Permission: projects.manage
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`project`	integer	The record's ID.
`assignment`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/projects/{project}/assignments/{assignment}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

proof 3 endpoints

POST /api/v1/app/companies/{company}/proof/time-anchor body: device_id, boot_id, elapsed_ms (the phone's since-boot clock as it asks).

body: device_id, boot_id, elapsed_ms (the phone's since-boot clock as it asks).

Sign-in: App token or company API key
Permission: self.tasks.capture | self.field_capture
Rate limit: 30 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`device_id`required	`required\|string\|max:100`
`boot_id`	`nullable\|string\|max:100`
`elapsed_ms`	`nullable\|integer\|min:0`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/proof/time-anchor" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"device_id":"...","boot_id":"...","elapsed_ms":1}'

POST /api/v1/app/companies/{company}/proof/device-keys/challenge

Sign-in: App token or company API key
Permission: self.tasks.capture | self.field_capture
Rate limit: 10 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/proof/device-keys/challenge" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/proof/device-keys device_id, public_key (base64 SPKI P-256), platform, challenge, attestation {android_key_c...

device_id, public_key (base64 SPKI P-256), platform, challenge, attestation {android_key_chain | ios_app_attest {key_id, attestation_object}}.

Sign-in: App token or company API key
Permission: self.tasks.capture | self.field_capture
Rate limit: 10 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/proof/device-keys" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

provisions 5 endpoints

GET /api/v1/app/companies/{company}/provisions Rows: month (YYYY-MM, default this month) or from / to; stb_types[], contract_type, employ...

Rows: month (YYYY-MM, default this month) or from / to; stb_types[], contract_type, employee_status, kind, and the org filters (branch, department, …) of the screens.

Sign-in: App token or company API key
Permission: payroll.provisions.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/provisions" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/provisions/months The calculated months (last 24) with the people, the month's provisions and the running to...

The calculated months (last 24) with the people, the month's provisions and the running total, for the employees in scope.

Sign-in: App token or company API key
Permission: payroll.provisions.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/provisions/months" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/provisions

Sign-in: App token or company API key
Permission: payroll.provisions.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/provisions" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/provisions/bulk-delete ids[]: an earlier month a later one builds on stays (deleted < chosen).

ids[]: an earlier month a later one builds on stays (deleted < chosen).

Sign-in: App token or company API key
Permission: payroll.provisions.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`ids`required	`required\|array`
`ids.*`	`integer`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/provisions/bulk-delete" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"ids":[]}'

DELETE /api/v1/app/companies/{company}/provisions/{month}

Sign-in: App token or company API key
Permission: payroll.provisions.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`month`	string · [0-9]{4}-[0-9]{2}	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/provisions/{month}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

rating-types 3 endpoints

POST /api/v1/app/companies/{company}/rating-types name {en, ar}, units [{id?, name {en, ar}}].

name {en, ar}, units [{id?, name {en, ar}}].

Sign-in: App token or company API key
Permission: performance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/rating-types" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH PUT /api/v1/app/companies/{company}/rating-types/{type} name {en, ar}, units [{id?, name {en, ar}}].

name {en, ar}, units [{id?, name {en, ar}}].

Sign-in: App token or company API key
Permission: performance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`type`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/rating-types/{type}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/rating-types/{type}

Sign-in: App token or company API key
Permission: performance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`type`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/rating-types/{type}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

recruitment 56 endpoints

POST /api/v1/app/companies/{company}/recruitment/interviews/{interview}/scorecard A panel member's own scorecard: ratings [{criterion, rating}], overall 1–5, recommendation...

A panel member's own scorecard: ratings [{criterion, rating}], overall 1–5, recommendation, notes.

Sign-in: App token or company API key
Permission: self.interviews | recruitment.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`interview`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`ratings`	`nullable\|array\|max:20`
`ratings.*.criterion`required	`required\|string\|'max:' . \App\Support\Limits::chars(120)`
`ratings.*.rating`required	`required\|integer\|between:1,5`
`overall`required	`required\|integer\|between:1,5`
`recommendation`required	`required\|in:strong_yes,yes,no,strong_no`
`notes`	`nullable\|string\|'max:' . \App\Support\Limits::chars(5000)`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/interviews/{interview}/scorecard" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"ratings":[],"overall":1,"recommendation":"strong_yes","notes":"..."}'

POST /api/v1/app/companies/{company}/recruitment/offers/{offer}/decide decision: approve or reject, note (needed to reject). Needs recruitment.approve_offers.

decision: approve or reject, note (needed to reject). Needs recruitment.approve_offers.

Sign-in: App token or company API key
Permission: recruitment.approve_offers
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`offer`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/offers/{offer}/decide" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/recruitment/offers Filter: status.

Filter: status.

Sign-in: App token or company API key
Permission: recruitment.view | recruitment.manage.* | recruitment.approve_offers
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/offers" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/recruitment/offers/{offer}

Sign-in: App token or company API key
Permission: recruitment.view | recruitment.manage.* | recruitment.approve_offers
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`offer`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/offers/{offer}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/recruitment/dashboard Filters: from, to (dates, default the last 90 days), job.

Filters: from, to (dates, default the last 90 days), job.

Sign-in: App token or company API key
Permission: recruitment.view | recruitment.manage.*
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/dashboard" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/recruitment/pipeline The board: the stages and who is in each, for one job or all that are open, with what the...

The board: the stages and who is in each, for one job or all that are open, with what the person may see and whether they may move people. The app's pipeline screen and list_recruitment_ats kind pipeline.

Sign-in: App token or company API key
Permission: recruitment.view | recruitment.manage.*
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/pipeline" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/recruitment/pool Filters: q (name, email, skills, tags), tag.

Filters: q (name, email, skills, tags), tag.

Sign-in: App token or company API key
Permission: recruitment.view | recruitment.manage.*
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/pool" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/recruitment/availability Filter: employee.

Filter: employee.

Sign-in: App token or company API key
Permission: recruitment.view | recruitment.manage.*
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/availability" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/recruitment/interviews/{interview}/ics

Sign-in: App token or company API key
Permission: recruitment.view | recruitment.manage.*
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`interview`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/interviews/{interview}/ics" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/recruitment/templates

Sign-in: App token or company API key
Permission: recruitment.view | recruitment.manage.*
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/templates" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/recruitment/candidates/{candidate}/assessments A candidate's tests: status, best result, pass or fail, the gate and the link.

A candidate's tests: status, best result, pass or fail, the gate and the link.

Sign-in: App token or company API key
Permission: recruitment.view | recruitment.manage.*
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`candidate`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/candidates/{candidate}/assessments" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/recruitment/stage-assessments The test each pipeline stage sends, and its gate.

The test each pipeline stage sends, and its gate.

Sign-in: App token or company API key
Permission: recruitment.view | recruitment.manage.*
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/stage-assessments" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/recruitment/settings AI switches, the candidate email language, and which accounts are connected (secrets are n...

AI switches, the candidate email language, and which accounts are connected (secrets are never returned).

Sign-in: App token or company API key
Permission: recruitment.view | recruitment.manage.*
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/settings" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/recruitment/summary Counts, and whether the careers page is on, with its address.

Counts, and whether the careers page is on, with its address.

Sign-in: App token or company API key
Permission: recruitment.view | recruitment.manage.*
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/summary" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/recruitment/jobs Filters: status, type, department, branch, q.

Filters: status, type, department, branch, q.

Sign-in: App token or company API key
Permission: recruitment.view | recruitment.manage.*
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/jobs" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/recruitment/jobs/{job} A job opening and its candidates by stage.

A job opening and its candidates by stage.

Sign-in: App token or company API key
Permission: recruitment.view | recruitment.manage.*
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`job`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/jobs/{job}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/recruitment/candidates Filters: job, stage, source, q.

Filters: job, stage, source, q.

Sign-in: App token or company API key
Permission: recruitment.view | recruitment.manage.*
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/candidates" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/recruitment/candidates/{candidate} A candidate with notes and interviews.

A candidate with notes and interviews.

Sign-in: App token or company API key
Permission: recruitment.view | recruitment.manage.*
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`candidate`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/candidates/{candidate}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/recruitment/candidates/{candidate}/cv

Sign-in: App token or company API key
Permission: recruitment.view | recruitment.manage.*
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`candidate`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/candidates/{candidate}/cv" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/recruitment/interviews Filters: status (scheduled, done, cancelled), from, to (dates), candidate.

Filters: status (scheduled, done, cancelled), from, to (dates), candidate.

Sign-in: App token or company API key
Permission: recruitment.view | recruitment.manage.*
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/interviews" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/recruitment/careers enabled: true or false.

enabled: true or false.

Sign-in: App token or company API key
Permission: recruitment.manage.* | recruitment.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/careers" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/recruitment/jobs title {en, ar}, department_id, branch_id, position_id, employment_type, description, requi...

title {en, ar}, department_id, branch_id, position_id, employment_type, description, requirements, positions, closing_date, status.

Sign-in: App token or company API key
Permission: recruitment.manage.* | recruitment.jobs.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`title`required	`required\|array`
`title.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`title.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(150)`
`department_id`	`nullable\|integer\|exists:org_units,id`
`branch_id`	`nullable\|integer\|exists:branches,id`
`position_id`	`nullable\|integer\|exists:positions,id`
`employment_type`required	`required\|in:full_time,part_time,contract,internship`
`description`required	`required\|string\|max:5000`
`requirements`	`nullable\|string\|max:5000`
`description_ar`	`nullable\|string\|max:5000`
`requirements_ar`	`nullable\|string\|max:5000`
`in_job_feed`	`nullable\|boolean`
`positions`required	`required\|integer\|between:1,100`
`closing_date`	`nullable\|date`
`status`required	`required\|in:draft,open,closed`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/jobs" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"title":{"en":"...","ar":"..."},"department_id":1,"branch_id":1,"position_id":1,"employment_type":"full_time","description":"...","requirements":"...","description_ar":"...","requirements_ar":"...","in_job_feed":true,"positions":1,"closing_date":"2026-11-01","status":"draft"}'

PATCH PUT /api/v1/app/companies/{company}/recruitment/jobs/{job}

Sign-in: App token or company API key
Permission: recruitment.manage.* | recruitment.jobs.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`job`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/jobs/{job}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/recruitment/jobs/{job}

Sign-in: App token or company API key
Permission: recruitment.manage.* | recruitment.jobs.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`job`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/jobs/{job}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/recruitment/jobs/{job}/candidates name, email, phone, source, cover_note, cv (file).

name, email, phone, source, cover_note, cv (file).

Sign-in: App token or company API key
Permission: recruitment.manage.* | recruitment.candidates.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`job`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`required	`required\|string\|max:150`
`email`required	`required\|email\|max:150\|unique:candidates,email`
`phone`	`nullable\|string\|max:30`
`source`required	`required\|in:careers_page,referral,linkedin,job_board,other`
`cover_note`	`nullable\|string\|max:3000`
`rating`	`nullable\|integer\|between:1,5`
`expected_salary`	`nullable\|numeric\|min:0\|max:999999999`
`expected_salary_currency`	`nullable\|string\|size:3`
`cv`	`nullable\|file\|max:10240\|mimes:pdf,doc,docx`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/jobs/{job}/candidates" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -F "name=..." \
  -F "[email protected]" \
  -F "phone=..." \
  -F "source=careers_page" \
  -F "cover_note=..." \
  -F "rating=1" \
  -F "expected_salary=1.5" \
  -F "expected_salary_currency=..." \
  -F "[email protected]"

PATCH PUT /api/v1/app/companies/{company}/recruitment/candidates/{candidate} stage (not hired: use hire), rejection_reason, rating 1–5.

stage (not hired: use hire), rejection_reason, rating 1–5.

Sign-in: App token or company API key
Permission: recruitment.manage.* | recruitment.candidates.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`candidate`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`stage`required	`sometimes\|required\|Rule::in(array_diff(\App\Models\Candidate::STAGES, ['hired']))`
`rating`	`sometimes\|nullable\|integer\|between:1,5`
`rejection_reason`	`sometimes\|nullable\|string\|'max:' . \App\Support\Limits::chars(500)`
`expected_salary`	`sometimes\|nullable\|numeric\|min:0\|max:999999999`
`expected_salary_currency`	`sometimes\|nullable\|string\|size:3`

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/candidates/{candidate}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"stage":"...","rating":1,"rejection_reason":"...","expected_salary":1.5,"expected_salary_currency":"..."}'

DELETE /api/v1/app/companies/{company}/recruitment/candidates/{candidate}

Sign-in: App token or company API key
Permission: recruitment.manage.* | recruitment.candidates.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`candidate`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/candidates/{candidate}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/recruitment/candidates/{candidate}/notes body.

body.

Sign-in: App token or company API key
Permission: recruitment.manage.* | recruitment.candidates.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`candidate`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

bodyrequired required|string|'max:' . \App\Support\Limits::chars(3000)

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/candidates/{candidate}/notes" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"body":"..."}'

POST /api/v1/app/companies/{company}/recruitment/candidates/{candidate}/interviews interviewer_id (employee), panel_ids, scheduled_at, kind (onsite, video, phone), duration_...

interviewer_id (employee), panel_ids, scheduled_at, kind (onsite, video, phone), duration_minutes, location, video_provider (zoom, google_meet, teams, manual), video_link.

Sign-in: App token or company API key
Permission: recruitment.manage.* | recruitment.interviews.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`candidate`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/candidates/{candidate}/interviews" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH PUT /api/v1/app/companies/{company}/recruitment/interviews/{interview} status, rating, feedback, video_link, location.

status, rating, feedback, video_link, location.

Sign-in: App token or company API key
Permission: recruitment.manage.* | recruitment.interviews.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`interview`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`status`required	`sometimes\|required\|Rule::in(array_diff(\App\Models\Interview::STATUSES, ['awaiting_booking']))`
`rating`	`sometimes\|nullable\|integer\|between:1,5`
`feedback`	`sometimes\|nullable\|string\|max:3000`
`video_link`	`sometimes\|nullable\|url\|max:500`
`location`	`sometimes\|nullable\|string\|max:255`

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/interviews/{interview}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"status":"...","rating":1,"feedback":"...","video_link":"...","location":"..."}'

POST /api/v1/app/companies/{company}/recruitment/candidates/{candidate}/hire Make the employee record: employee_number, hire_date, branch_id, department_id, position_i...

Make the employee record: employee_number, hire_date, branch_id, department_id, position_id, manager_id, basic_salary, create_login.

Sign-in: App token or company API key
Permission: recruitment.manage.* | recruitment.candidates.hire
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`candidate`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/candidates/{candidate}/hire" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/recruitment/candidates/{candidate}/stage stage, reason (for rejected).

stage, reason (for rejected).

Sign-in: App token or company API key
Permission: recruitment.manage.* | recruitment.candidates.move
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`candidate`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/candidates/{candidate}/stage" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/recruitment/candidates/bulk ids, action (move, reject, tag, untag, pool, unpool, email, delete), stage, reason, tags,...

ids, action (move, reject, tag, untag, pool, unpool, email, delete), stage, reason, tags, template, send_email.

Sign-in: App token or company API key
Permission: recruitment.manage.* | recruitment.candidates.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`action`required	`required\|Rule::in(self::BULK_ACTIONS)`
`ids`required	`required\|array\|max:500`
`ids.*`	`integer`
`stage`	`required_if:action,move\|nullable\|Rule::in(array_diff(\App\Models\Candidate::STAGES, ['hired']))`
`reason`	`nullable\|string\|'max:' . \App\Support\Limits::chars(500)`
`tags`	`required_if:action,tag\|required_if:action,untag\|nullable`
`template`	`required_if:action,email\|nullable\|in:applied,screening,interview,offer,hired,rejected`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/candidates/bulk" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"action":"...","ids":[],"stage":"...","reason":"...","tags":"...","template":"applied"}'

PATCH PUT /api/v1/app/companies/{company}/recruitment/candidates/{candidate}/profile tags, in_talent_pool, linkedin_url.

tags, in_talent_pool, linkedin_url.

Sign-in: App token or company API key
Permission: recruitment.manage.* | recruitment.candidates.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`candidate`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`tags`	`sometimes\|nullable`
`in_talent_pool`	`sometimes\|boolean`
`linkedin_url`	`sometimes\|nullable\|url\|max:255\|regex:#^https://([a-z]+\.)?linkedin\.com/#i`

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/candidates/{candidate}/profile" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"tags":"...","in_talent_pool":true,"linkedin_url":"..."}'

POST /api/v1/app/companies/{company}/recruitment/candidates/{candidate}/email template: the stage whose email to send.

template: the stage whose email to send.

Sign-in: App token or company API key
Permission: recruitment.manage.* | recruitment.candidates.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`candidate`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/candidates/{candidate}/email" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/recruitment/candidates/{candidate}/add-to-job job_opening_id: puts a pool or past candidate forward for a job (a new candidate on that j...

job_opening_id: puts a pool or past candidate forward for a job (a new candidate on that job).

Sign-in: App token or company API key
Permission: recruitment.manage.* | recruitment.candidates.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`candidate`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/candidates/{candidate}/add-to-job" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/recruitment/pool name, email, phone, linkedin_url, tags, source, cover_note, cv (file).

name, email, phone, linkedin_url, tags, source, cover_note, cv (file).

Sign-in: App token or company API key
Permission: recruitment.manage.* | recruitment.candidates.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`required	`required\|string\|max:150`
`email`required	`required\|email\|max:150\|unique:candidates,email`
`phone`	`nullable\|string\|max:30`
`linkedin_url`	`nullable\|url\|max:255\|regex:#^https://([a-z]+\.)?linkedin\.com/#i`
`source`	`nullable\|in:careers_page,referral,linkedin,job_board,other`
`cover_note`	`nullable\|string\|max:3000`
`tags`	`nullable`
`cv`	`nullable\|file\|max:10240\|mimes:pdf,doc,docx`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/pool" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -F "name=..." \
  -F "[email protected]" \
  -F "phone=..." \
  -F "linkedin_url=..." \
  -F "source=careers_page" \
  -F "cover_note=..." \
  -F "tags=..." \
  -F "[email protected]"

POST /api/v1/app/companies/{company}/recruitment/candidates/{candidate}/ai/parse

Sign-in: App token or company API key
Permission: recruitment.manage.* | recruitment.candidates.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`candidate`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/candidates/{candidate}/ai/parse" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/recruitment/candidates/{candidate}/ai/match

Sign-in: App token or company API key
Permission: recruitment.manage.* | recruitment.candidates.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`candidate`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/candidates/{candidate}/ai/match" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/recruitment/jobs/{job}/ai/rank refresh: score everyone again. Returns the job's active candidates, best match first.

refresh: score everyone again. Returns the job's active candidates, best match first.

Sign-in: App token or company API key
Permission: recruitment.manage.* | recruitment.jobs.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`job`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/jobs/{job}/ai/rank" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/recruitment/jobs/{job}/ai/questions count (3–15).

count (3–15).

Sign-in: App token or company API key
Permission: recruitment.manage.* | recruitment.jobs.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`job`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/jobs/{job}/ai/questions" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/recruitment/ai/job-draft title, department, employment_type, notes → description {en, ar}, requirements {en, ar}.

title, department, employment_type, notes → description {en, ar}, requirements {en, ar}.

Sign-in: App token or company API key
Permission: recruitment.manage.* | recruitment.jobs.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`title`required	`required\|string\|max:150`
`department`	`nullable\|string\|max:150`
`employment_type`	`nullable\|in:full_time,part_time,contract,internship`
`notes`	`nullable\|string\|'max:' . \App\Support\Limits::chars(2000)`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/ai/job-draft" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"title":"...","department":"...","employment_type":"full_time","notes":"..."}'

POST /api/v1/app/companies/{company}/recruitment/jobs/{job}/linkedin Posts the job to the company's LinkedIn page; without a connected page answers with the sh...

Posts the job to the company's LinkedIn page; without a connected page answers with the share link.

Sign-in: App token or company API key
Permission: recruitment.manage.* | recruitment.jobs.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`job`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/jobs/{job}/linkedin" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/recruitment/candidates/{candidate}/booking interviewer_id, panel_ids, kind, duration_minutes, location, video_provider, video_link, b...

interviewer_id, panel_ids, kind, duration_minutes, location, video_provider, video_link, booking_from, booking_to.

Sign-in: App token or company API key
Permission: recruitment.manage.* | recruitment.interviews.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`candidate`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/candidates/{candidate}/booking" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/recruitment/availability/{employee} windows: [{weekday 0–6 (Sunday = 0), starts_at HH:MM, ends_at HH:MM}], replacing the emplo...

windows: [{weekday 0–6 (Sunday = 0), starts_at HH:MM, ends_at HH:MM}], replacing the employee's.

Sign-in: App token or company API key
Permission: recruitment.manage.* | recruitment.interviews.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employee`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/availability/{employee}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/recruitment/candidates/{candidate}/offers offer_template_id, salary_package_id, job_title {en, ar}, start_date, basic_salary, curren...

offer_template_id, salary_package_id, job_title {en, ar}, start_date, basic_salary, currency, items [{type, transaction_type_id, name {en, ar}, amount}], expires_on, language, body_en, body_ar.

Sign-in: App token or company API key
Permission: recruitment.manage.* | recruitment.offers.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`candidate`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/candidates/{candidate}/offers" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH PUT /api/v1/app/companies/{company}/recruitment/offers/{offer}

Sign-in: App token or company API key
Permission: recruitment.manage.* | recruitment.offers.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`offer`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/offers/{offer}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/recruitment/offers/{offer}/{action} action: submit, send, withdraw.

action: submit, send, withdraw.

Sign-in: App token or company API key
Permission: recruitment.manage.* | recruitment.offers.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`offer`	integer	The record's ID.
`action`	string · submit\|send\|withdraw	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/offers/{offer}/{action}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/recruitment/offers/{offer}/convert employee_number, branch_id, department_id, position_id, manager_id, create_login, boarding...

employee_number, branch_id, department_id, position_id, manager_id, create_login, boarding_template_id.

Sign-in: App token or company API key
Permission: recruitment.manage.* | recruitment.candidates.hire
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`offer`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

boarding_template_id integer|exists:boarding_templates,id

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/offers/{offer}/convert" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"boarding_template_id":1}'

PUT /api/v1/app/companies/{company}/recruitment/templates/emails/{stage} subject {en, ar}, body {en, ar}, auto_send.

subject {en, ar}, body {en, ar}, auto_send.

Sign-in: App token or company API key
Permission: recruitment.manage.* | recruitment.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`stage`	string · applied\|screening\|interview\|offer\|hired\|rejected\|assessment	The record's ID.

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/templates/emails/{stage}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/recruitment/candidates/{candidate}/assessments assessment_id, due_date (Y-m-d), pass_stage, fail_stage, locale: sends the link by the "As...

assessment_id, due_date (Y-m-d), pass_stage, fail_stage, locale: sends the link by the "Assessment" email.

Sign-in: App token or company API key
Permission: recruitment.manage.* | recruitment.candidates.manage | assessments.invite
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`candidate`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`assessment_id`required	`required\|integer`
`due_date`	`nullable\|date\|after_or_equal:today`
`pass_stage`	`nullable\|Rule::in(self::gateStages())`
`fail_stage`	`nullable\|Rule::in(self::gateStages())`
`locale`	`nullable\|in:en,ar`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/candidates/{candidate}/assessments" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"assessment_id":1,"due_date":"2026-11-01","pass_stage":"...","fail_stage":"...","locale":"en"}'

PUT /api/v1/app/companies/{company}/recruitment/stage-assessments {stage: {assessment_test_id (null removes), auto_send, pass_stage, fail_stage, due_days}}...

{stage: {assessment_test_id (null removes), auto_send, pass_stage, fail_stage, due_days}} (or under "stages").

Sign-in: App token or company API key
Permission: recruitment.manage.* | recruitment.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`stages`	`array`
`stages.*`	`array`
`stages.*.assessment_test_id`	`nullable\|integer\|exists:assessment_tests,id`
`stages.*.auto_send`	`nullable\|boolean`
`stages.*.pass_stage`	`nullable\|Rule::in(self::gateStages())`
`stages.*.fail_stage`	`nullable\|Rule::in(self::gateStages())`
`stages.*.due_days`	`nullable\|integer\|between:1,90`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/stage-assessments" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"stages":[]}'

POST /api/v1/app/companies/{company}/recruitment/templates/offers name {en, ar}, body {en, ar}, active.

name {en, ar}, body {en, ar}, active.

Sign-in: App token or company API key
Permission: recruitment.manage.* | recruitment.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`required	`required\|array`
`name.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`name.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(150)`
`body`required	`required\|array`
`body.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(20000)`
`body.ar`required	`required\|string\|'max:' . \App\Support\Limits::chars(20000)`
`active`	`nullable\|boolean`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/templates/offers" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":{"en":"...","ar":"..."},"body":{"en":"...","ar":"..."},"active":true}'

PATCH PUT /api/v1/app/companies/{company}/recruitment/templates/offers/{template} name {en, ar}, body {en, ar}, active.

name {en, ar}, body {en, ar}, active.

Sign-in: App token or company API key
Permission: recruitment.manage.* | recruitment.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`template`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`required	`required\|array`
`name.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`name.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(150)`
`body`required	`required\|array`
`body.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(20000)`
`body.ar`required	`required\|string\|'max:' . \App\Support\Limits::chars(20000)`
`active`	`nullable\|boolean`

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/templates/offers/{template}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":{"en":"...","ar":"..."},"body":{"en":"...","ar":"..."},"active":true}'

DELETE /api/v1/app/companies/{company}/recruitment/templates/offers/{template}

Sign-in: App token or company API key
Permission: recruitment.manage.* | recruitment.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`template`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/templates/offers/{template}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH PUT /api/v1/app/companies/{company}/recruitment/settings ai_enabled, ai_candidate_data, ai_auto_parse, recruitment_email_language (en, ar, both).

ai_enabled, ai_candidate_data, ai_auto_parse, recruitment_email_language (en, ar, both).

Sign-in: App token or company API key
Permission: recruitment.manage.* | recruitment.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`ai_enabled`	`sometimes\|boolean`
`ai_candidate_data`	`sometimes\|boolean`
`ai_auto_parse`	`sometimes\|boolean`
`recruitment_email_language`	`sometimes\|in:en,ar,both`

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/recruitment/settings" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"ai_enabled":true,"ai_candidate_data":true,"ai_auto_parse":true,"recruitment_email_language":"en"}'

regional-settings 2 endpoints

GET /api/v1/app/companies/{company}/regional-settings

Sign-in: App token or company API key
Permission: settings.manage | branches.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/regional-settings" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT PATCH /api/v1/app/companies/{company}/regional-settings

Sign-in: App token or company API key
Permission: settings.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/regional-settings" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

reports 5 endpoints

GET /api/v1/app/companies/{company}/reports GET reports: the reports by group (the ones the person may run, and the ones coming with a...

GET reports: the reports by group (the ones the person may run, and the ones coming with a module), their saved options.

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/reports" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/reports/{report} GET reports/{report}: its filters with their options, columns, switches and exports.

GET reports/{report}: its filters with their options, columns, switches and exports.

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`report`	string · [a-z_]+	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/reports/{report}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET POST /api/v1/app/companies/{company}/reports/{report}/run GET|POST reports/{report}/run: the filters as the screen's query keys (multi filters as ar...

GET|POST reports/{report}/run: the filters as the screen's query keys (multi filters as arrays, date ranges as key_from / key_to), cols, show, show_zero, saved_id to start from saved options, limit (rows per table, 500 by default, 5000 at most), format=csv|xlsx for a file, or one of the report's own exports (xlsx_colored for the Salaries report).

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`report`	string · [a-z_]+	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/reports/{report}/run" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/reports/{report}/queue POST reports/{report}/queue: format xlsx|csv and the run's options; the file is built in t...

POST reports/{report}/queue: format xlsx|csv and the run's options; the file is built in the background (202).

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 20 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`report`	string · [a-z_]+	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

formatrequired required|in:xlsx,csv

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/reports/{report}/queue" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"format":"xlsx"}'

POST /api/v1/app/companies/{company}/reports/{report}/saved POST reports/{report}/saved: {name, options: {…the run input…}}.

POST reports/{report}/saved: {name, options: {…the run input…}}.

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`report`	string · [a-z_]+	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`required	`required\|string\|max:100`
`options`	`nullable\|array`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/reports/{report}/saved" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":"...","options":[]}'

request-types 1 endpoint

GET /api/v1/app/companies/{company}/request-types The request types this company offers, with the fields each asks for and their choices (fo...

The request types this company offers, with the fields each asks for and their choices (for my own requests).

Sign-in: App token or company API key
Permission: self.requests.file | requests.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/request-types" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

requests 6 endpoints

POST /api/v1/app/companies/{company}/requests/{type} File a request of a type: its fields, an attachment (multipart), and employee_id to file f...

File a request of a type: its fields, an attachment (multipart), and employee_id to file for someone else.

Sign-in: App token or company API key
Permission: self.requests.file | requests.manage
Module: hrm
Rate limit: 20 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`type`	string · [a-z_]+	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`attachment`	`nullable\|file\|max:10240\|mimes:pdf,jpg,jpeg,png,doc,docx`
`employee_id`	`nullable\|integer`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/requests/{type}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -F "[email protected]" \
  -F "employee_id=1"

GET /api/v1/app/companies/{company}/requests/{employeeRequest}

Sign-in: App token or company API key
Permission: self.requests.view | self.approvals.decide | requests.view | requests.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employeeRequest`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/requests/{employeeRequest}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/requests/{employeeRequest}/attachment

Sign-in: App token or company API key
Permission: self.requests.view | self.approvals.decide | requests.view | requests.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employeeRequest`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/requests/{employeeRequest}/attachment" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/requests/{employeeRequest}/approval-cycle GET requests/{id}/approval-cycle: ZenHR's "Approval Cycle" — every step, its approver, sta...

GET requests/{id}/approval-cycle: ZenHR's "Approval Cycle" — every step, its approver, status, times and note (ApprovalCycle).

Sign-in: App token or company API key
Permission: self.requests.view | self.approvals.decide | requests.view | requests.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employeeRequest`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/requests/{employeeRequest}/approval-cycle" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/requests/{employeeRequest}/decide Decide the step a request waits on: decision approved|rejected, decision_note.

Decide the step a request waits on: decision approved|rejected, decision_note.

Sign-in: App token or company API key
Permission: self.approvals.decide | requests.manage | leaves.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employeeRequest`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/requests/{employeeRequest}/decide" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/requests/{employeeRequest}/withdraw Withdraw my pending request.

Withdraw my pending request.

Sign-in: App token or company API key
Permission: self.requests.cancel | requests.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`employeeRequest`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/requests/{employeeRequest}/withdraw" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

role-assignments 3 endpoints

GET /api/v1/app/companies/{company}/role-assignments

Sign-in: App token or company API key
Permission: roles.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/role-assignments" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/role-assignments Give a role to an employee's sign-in account: employee_id, role_id, scope, scope_id.

Give a role to an employee's sign-in account: employee_id, role_id, scope, scope_id.

Sign-in: App token or company API key
Permission: roles.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`role_id`required	`required\|integer\|exists:roles,id`
`scope`required	`required\|in:company,branch,department,work_location,section,project,hierarchy_group,business_unit,division,segment,reports,team,reports_of`
`scope_id`	`Rule::requiredIf(in_array($input['scope'] ?? null, self::TARGETED, true))\|nullable\|integer\|match ($input['scope'] ?? null) { 'branch' => Rule::exists('branches', 'id')...`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/role-assignments" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"role_id":1,"scope":"company","scope_id":1}'

DELETE /api/v1/app/companies/{company}/role-assignments/{assignment}

Sign-in: App token or company API key
Permission: roles.manage
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`assignment`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/role-assignments/{assignment}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

roles 7 endpoints

GET /api/v1/app/companies/{company}/roles/{role}/matrix A role's whole table of web and app switches and field levels (docs/mobile-setup.md).

A role's whole table of web and app switches and field levels (docs/mobile-setup.md).

Sign-in: App token or company API key
Permission: setup.roles.permissions
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`role`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/roles/{role}/matrix" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/roles/{role}/matrix Changes the rows sent, the rest stays; the same rules as saving a role (nobody gives what...

Changes the rows sent, the rest stays; the same rules as saving a role (nobody gives what they don't have).

Sign-in: App token or company API key
Permission: setup.roles.permissions
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`role`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`actions`	`sometimes\|array`
`actions.*`	`array`
`fields`	`sometimes\|array`
`fields.*`	`array`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/roles/{role}/matrix" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"actions":[],"fields":[]}'

GET /api/v1/app/companies/{company}/roles

Sign-in: App token or company API key
Permission: roles.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/roles" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/roles

Sign-in: App token or company API key
Permission: roles.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`	`$role ? 'sometimes' : 'required'\|array`
`name.en`	`$role ? 'required_with:name' : 'required'\|string\|'max:' . \App\Support\Limits::chars(80)`
`name.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(80)`
`description`	`nullable\|array`
`description.*`	`nullable\|string\|max:300`
`permissions`	`$role ? 'sometimes' : 'required'\|array\|$role?->isEveryone() ? 'min:0' : 'min:1'`
`permissions.*`	`Rule::in($role?->isEveryone() ? \App\Models\Role::selfPermissions() : \App\Model...`
`channels`	`sometimes\|nullable\|array`
`channels.*`	`in:both,web,app,none`
`fields`	`sometimes\|nullable\|array`
`fields.*`	`array:web,app`
`fields.*.web`required	`required\|in:hidden,view,edit`
`fields.*.app`required	`required\|in:hidden,view,edit`
`is_active`	`sometimes\|boolean`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/roles" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":{"en":"...","ar":"..."},"description":[],"permissions":[],"channels":[],"fields":[],"is_active":true}'

PATCH /api/v1/app/companies/{company}/roles/{role}

Sign-in: App token or company API key
Permission: roles.manage
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`role`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`	`$role ? 'sometimes' : 'required'\|array`
`name.en`	`$role ? 'required_with:name' : 'required'\|string\|'max:' . \App\Support\Limits::chars(80)`
`name.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(80)`
`description`	`nullable\|array`
`description.*`	`nullable\|string\|max:300`
`permissions`	`$role ? 'sometimes' : 'required'\|array\|$role?->isEveryone() ? 'min:0' : 'min:1'`
`permissions.*`	`Rule::in($role?->isEveryone() ? \App\Models\Role::selfPermissions() : \App\Model...`
`channels`	`sometimes\|nullable\|array`
`channels.*`	`in:both,web,app,none`
`fields`	`sometimes\|nullable\|array`
`fields.*`	`array:web,app`
`fields.*.web`required	`required\|in:hidden,view,edit`
`fields.*.app`required	`required\|in:hidden,view,edit`
`is_active`	`sometimes\|boolean`

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/roles/{role}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":{"en":"...","ar":"..."},"description":[],"permissions":[],"channels":[],"fields":[],"is_active":true}'

DELETE /api/v1/app/companies/{company}/roles/{role}

Sign-in: App token or company API key
Permission: roles.manage
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`role`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/roles/{role}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/roles/{role}/where What a role shows on the web and in the app.

What a role shows on the web and in the app.

Sign-in: App token or company API key
Permission: roles.manage
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`role`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/roles/{role}/where" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

salaries 5 endpoints

GET /api/v1/app/companies/{company}/salaries Filters as the screen: year, month (1-12), salary_type (regular | off_cycle), run_status (...

Sign-in: App token or company API key
Permission: payroll.runs.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/salaries" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/salaries/calculate What Calculate offers for a month (?month=YYYY-MM, else the open one): the picker groups,...

What Calculate offers for a month (?month=YYYY-MM, else the open one): the picker groups, the cut-off date range and the draft batches to add to.

Sign-in: App token or company API key
Permission: payroll.runs.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/salaries/calculate" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/salaries/calculate Calculate (payroll.manage): salary_type monthly | extra; month; picks[] (branch:<id>, empl...

Calculate (payroll.manage): salary_type monthly | extra; month; picks[] (branch:<id>, employee:<id>, org:<id>); monthly: period_from / period_to, batch_id (an existing draft batch, else a new one), move_pending; extra: title, percent_of_basic.

Sign-in: App token or company API key
Permission: payroll.runs.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`salary_type`	`nullable\|in:monthly,extra`
`title`required	`required\|string\|max:100`
`month`required	`required\|date_format:Y-m`
`percent_of_basic`required	`required\|numeric\|min:1\|max:1000`
`picks`	`nullable\|array`
`picks.*`	`string`
`departments`	`nullable\|array`
`departments.*`	`integer`
`branches`	`nullable\|array`
`branches.*`	`integer`
`employees`	`nullable\|array`
`employees.*`	`integer`
`period_from`	`nullable\|required_with:period_to\|date_format:Y-m-d`
`period_to`	`nullable\|required_with:period_from\|date_format:Y-m-d\|after_or_equal:period_from`
`batch_id`	`nullable\|integer`
`move_pending`	`nullable\|boolean`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/salaries/calculate" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"salary_type":"monthly","title":"...","month":"2026-11-01","percent_of_basic":1.5,"picks":[],"departments":[],"branches":[],"employees":[],"period_from":"2026-11-01","period_to":"2026-11-01","batch_id":1,"move_pending":true}'

GET /api/v1/app/companies/{company}/salaries/off-cycle-settlement GET salaries/off-cycle-settlement: who can get an off-cycle settlement (docs/payroll-settl...

GET salaries/off-cycle-settlement: who can get an off-cycle settlement (docs/payroll-settlement-slips.md).

Sign-in: App token or company API key
Permission: payroll.runs.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/salaries/off-cycle-settlement" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/salaries/off-cycle-settlement POST salaries/off-cycle-settlement {employee_id}: the leaver's final settlement as its own...

POST salaries/off-cycle-settlement {employee_id}: the leaver's final settlement as its own draft batch.

Sign-in: App token or company API key
Permission: payroll.runs.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

employee_idrequired required|integer

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/salaries/off-cycle-settlement" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"employee_id":1}'

salary-batches 1 endpoint

GET /api/v1/app/companies/{company}/salary-batches Salary Batches: year, month (1-12), salary_type (regular | off_cycle), run_status (draft |...

Sign-in: App token or company API key
Permission: payroll.runs.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/salary-batches" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

salary-package-templates 6 endpoints

GET /api/v1/app/companies/{company}/salary-package-templates Salary package templates with their items (active=1 or 0 to filter).

Salary package templates with their items (active=1 or 0 to filter).

Sign-in: App token or company API key
Permission: payroll.salary_packages.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/salary-package-templates" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/salary-package-templates A new template: name_en, name_ar, basic_salary, active, external_ref.

A new template: name_en, name_ar, basic_salary, active, external_ref.

Sign-in: App token or company API key
Permission: payroll.salary_packages.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/salary-package-templates" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/salary-package-templates/{template} Changes only the given fields of a template.

Changes only the given fields of a template.

Sign-in: App token or company API key
Permission: payroll.salary_packages.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`template`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name_en`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`name_ar`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`basic_salary`required	`required\|numeric\|min:0`
`external_ref`	`nullable\|string\|max:64`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/salary-package-templates/{template}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name_en":"...","name_ar":"...","basic_salary":1.5,"external_ref":"..."}'

DELETE /api/v1/app/companies/{company}/salary-package-templates/{template}

Sign-in: App token or company API key
Permission: payroll.salary_packages.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`template`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/salary-package-templates/{template}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/salary-package-templates/{template}/items An item: type allowance | deduction, transaction_type_id or name_en / name_ar, amount.

An item: type allowance | deduction, transaction_type_id or name_en / name_ar, amount.

Sign-in: App token or company API key
Permission: payroll.salary_packages.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`template`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`type`required	`required\|in:allowance,deduction`
`transaction_type_id`	`nullable\|exists:transaction_types,id`
`name_en`	`nullable\|string\|'max:' . \App\Support\Limits::chars(100)`
`name_ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(100)`
`amount`required	`required\|numeric\|min:0`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/salary-package-templates/{template}/items" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"type":"allowance","transaction_type_id":"...","name_en":"...","name_ar":"...","amount":1.5}'

DELETE /api/v1/app/companies/{company}/salary-package-templates/{template}/items/{item}

Sign-in: App token or company API key
Permission: payroll.salary_packages.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`template`	integer	The record's ID.
`item`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/salary-package-templates/{template}/items/{item}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

salary-packages-screening 1 endpoint

GET /api/v1/app/companies/{company}/salary-packages-screening Salary packages screening: active_employees, effective_from, effective_to, approval_status...

Salary packages screening: active_employees, effective_from, effective_to, approval_status, package_status and the org filters; paged.

Sign-in: App token or company API key
Permission: payroll.salary_packages.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

`effective_from`	`nullable\|date`
`effective_to`	`nullable\|date`

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/salary-packages-screening?effective_from=2026-11-01&effective_to=2026-11-01" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

salary-scales 8 endpoints

GET /api/v1/app/companies/{company}/salary-scales Scales, newest activation first; status filter.

Scales, newest activation first; status filter.

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/salary-scales" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/salary-scales

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name_en`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`name_ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(150)`
`salary_range_layer`	`$layer`
`benefits_layer`	`$layer`
`timeoffs_layer`	`$layer`
`exceed_range_percent`	`nullable\|numeric\|between:0,1000`
`exceed_benefits_percent`	`nullable\|numeric\|between:0,1000`
`compa_from`	`nullable\|numeric\|between:0,1000\|required_with:compa_to`
`compa_to`	`nullable\|numeric\|between:0,1000\|required_with:compa_from\|gte:compa_from`
`activation_date`	`nullable\|date`
`status`required	`required\|in:active,inactive,draft`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/salary-scales" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name_en":"...","name_ar":"...","salary_range_layer":"...","benefits_layer":"...","timeoffs_layer":"...","exceed_range_percent":1.5,"exceed_benefits_percent":1.5,"compa_from":1.5,"compa_to":1.5,"activation_date":"2026-11-01","status":"active"}'

GET /api/v1/app/companies/{company}/salary-scales/{scale}

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`scale`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/salary-scales/{scale}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/salary-scales/{scale}

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`scale`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name_en`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`name_ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(150)`
`salary_range_layer`	`$layer`
`benefits_layer`	`$layer`
`timeoffs_layer`	`$layer`
`exceed_range_percent`	`nullable\|numeric\|between:0,1000`
`exceed_benefits_percent`	`nullable\|numeric\|between:0,1000`
`compa_from`	`nullable\|numeric\|between:0,1000\|required_with:compa_to`
`compa_to`	`nullable\|numeric\|between:0,1000\|required_with:compa_from\|gte:compa_from`
`activation_date`	`nullable\|date`
`status`required	`required\|in:active,inactive,draft`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/salary-scales/{scale}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name_en":"...","name_ar":"...","salary_range_layer":"...","benefits_layer":"...","timeoffs_layer":"...","exceed_range_percent":1.5,"exceed_benefits_percent":1.5,"compa_from":1.5,"compa_to":1.5,"activation_date":"2026-11-01","status":"active"}'

DELETE /api/v1/app/companies/{company}/salary-scales/{scale}

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`scale`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/salary-scales/{scale}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/salary-scales/{scale}/{layer}

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`scale`	integer	The record's ID.
`layer`	string · grade\|band\|level	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name_en`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`name_ar`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`scale_grade_id`	`$layer === 'grade' ? ['prohibited'] : $parent('grade')`
`scale_band_id`	`$layer === 'level' ? $parent('band') : ['prohibited']`
`min_salary`	`nullable\|numeric\|min:0`
`max_salary`	`nullable\|numeric\|min:0\|gte:min_salary`
`mid_salary`	`nullable\|numeric\|min:0`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/salary-scales/{scale}/{layer}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name_en":"...","name_ar":"...","scale_grade_id":"...","scale_band_id":"...","min_salary":1.5,"max_salary":1.5,"mid_salary":1.5}'

PUT /api/v1/app/companies/{company}/salary-scales/{scale}/{layer}/{id}

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`scale`	integer	The record's ID.
`layer`	string · grade\|band\|level	The record's ID.
`id`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name_en`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`name_ar`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`scale_grade_id`	`$layer === 'grade' ? ['prohibited'] : $parent('grade')`
`scale_band_id`	`$layer === 'level' ? $parent('band') : ['prohibited']`
`min_salary`	`nullable\|numeric\|min:0`
`max_salary`	`nullable\|numeric\|min:0\|gte:min_salary`
`mid_salary`	`nullable\|numeric\|min:0`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/salary-scales/{scale}/{layer}/{id}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name_en":"...","name_ar":"...","scale_grade_id":"...","scale_band_id":"...","min_salary":1.5,"max_salary":1.5,"mid_salary":1.5}'

DELETE /api/v1/app/companies/{company}/salary-scales/{scale}/{layer}/{id}

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`scale`	integer	The record's ID.
`layer`	string · grade\|band\|level	The record's ID.
`id`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/salary-scales/{scale}/{layer}/{id}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

saved-reports 1 endpoint

DELETE /api/v1/app/companies/{company}/saved-reports/{saved}

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`saved`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/saved-reports/{saved}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

search 1 endpoint

GET /api/v1/app/companies/{company}/search

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/search" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

settings 38 endpoints

GET /api/v1/app/companies/{company}/settings/limits

Sign-in: App token or company API key
Permission: limits.view
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

branch_id sometimes|nullable|integer

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/settings/limits?branch_id=1" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/app/companies/{company}/settings/limits values: {key: number, or null to go back to the level above}; sizes in KB. Only the keys s...

values: {key: number, or null to go back to the level above}; sizes in KB. Only the keys sent change.

Sign-in: App token or company API key
Permission: limits.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

branch_id sometimes|nullable|integer

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/settings/limits" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"branch_id":1}'

GET /api/v1/app/companies/{company}/settings/app-colors ?branch_id= one branch's own colors; none: the company's.

?branch_id= one branch's own colors; none: the company's.

Sign-in: App token or company API key
Permission: app_colors.view
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

branch_id sometimes|nullable|integer

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/settings/app-colors?branch_id=1" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/app/companies/{company}/settings/app-colors primary, secondary (#RRGGBB; empty follows the level above), branch_id. Only what's sent c...

primary, secondary (#RRGGBB; empty follows the level above), branch_id. Only what's sent changes.

Sign-in: App token or company API key
Permission: app_colors.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`primary`	`sometimes\|nullable\|regex:/^#[0-9A-Fa-f]{6}$/`
`secondary`	`sometimes\|nullable\|regex:/^#[0-9A-Fa-f]{6}$/`

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/settings/app-colors" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"primary":"...","secondary":"..."}'

DELETE /api/v1/app/companies/{company}/settings/app-colors

Sign-in: App token or company API key
Permission: app_colors.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/settings/app-colors" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/settings/account

Sign-in: App token or company API key
Permission: settings.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/settings/account" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH POST /api/v1/app/companies/{company}/settings/account PATCH: send only what changes. POST works too, for a logo as multipart/form-data.

PATCH: send only what changes. POST works too, for a logo as multipart/form-data.

Sign-in: App token or company API key
Permission: settings.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/settings/account" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/settings/mail

Sign-in: App token or company API key
Permission: settings.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/settings/mail" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT PATCH /api/v1/app/companies/{company}/settings/mail

Sign-in: App token or company API key
Permission: settings.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`host`	`nullable\|string\|max:190\|regex:/^[A-Za-z0-9.\-]+$/`
`port`	`$on ? 'required' : 'nullable'\|integer\|between:1,65535`
`username`	`nullable\|string\|max:190`
`password`	`nullable\|string\|max:190`
`encryption`	`$on ? 'required' : 'nullable'\|in:tls,ssl,none`
`from`	`$on ? 'required' : 'nullable'\|email:filter\|max:190`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/settings/mail" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"host":"...","port":1,"username":"...","password":"...","encryption":"tls","from":"[email protected]"}'

POST /api/v1/app/companies/{company}/settings/mail/test

Sign-in: App token or company API key
Permission: settings.manage
Rate limit: 10 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/settings/mail/test" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT PATCH /api/v1/app/companies/{company}/settings/mail/employees "Email employees" on or off (docs/mail.md): for branch_id when given, else the branch bein...

"Email employees" on or off (docs/mail.md): for branch_id when given, else the branch being worked in.

Sign-in: App token or company API key
Permission: settings.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/settings/mail/employees" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/settings/appearance

Sign-in: App token or company API key
Permission: settings.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/settings/appearance" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/app/companies/{company}/settings/appearance

Sign-in: App token or company API key
Permission: settings.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

allow_user_override boolean

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/settings/appearance" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"allow_user_override":true}'

DELETE /api/v1/app/companies/{company}/settings/appearance

Sign-in: App token or company API key
Permission: settings.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/settings/appearance" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/settings/sign-in

Sign-in: App token or company API key
Permission: settings.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/settings/sign-in" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/app/companies/{company}/settings/sign-in Send only what changes; the client secret is write-only (blank keeps it).

Send only what changes; the client secret is write-only (blank keeps it).

Sign-in: App token or company API key
Permission: settings.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`two_factor_required`	`sometimes\|boolean`
`sso_enabled`	`sometimes\|boolean`
`sso_protocol`	`sometimes\|in:oidc,saml`
`sso_name`	`sometimes\|nullable\|string\|max:40`
`sso_issuer`	`sometimes\|nullable\|url:https\|max:255`
`sso_client_id`	`sometimes\|nullable\|string\|max:255`
`sso_client_secret`	`sometimes\|nullable\|string\|max:500`
`sso_only`	`sometimes\|boolean`
`sso_exempt_user_ids`	`sometimes\|nullable\|array\|max:200`
`sso_exempt_user_ids.*`	`integer\|exists:company_user,user_id`
`saml_idp_entity_id`	`sometimes\|nullable\|string\|max:255`
`saml_idp_sso_url`	`sometimes\|nullable\|url:https\|max:500`
`saml_idp_cert`	`sometimes\|nullable\|string\|max:20000`
`saml_metadata_url`	`sometimes\|nullable\|url:https\|max:500`
`saml_metadata_xml`	`sometimes\|nullable\|string\|max:500000`
`saml_email_attribute`	`sometimes\|nullable\|string\|max:190`
`pw_min_length`	`sometimes\|integer\|min:6\|max:64`
`pw_upper`	`sometimes\|boolean`
`pw_lower`	`sometimes\|boolean`
`pw_numbers`	`sometimes\|boolean`
`pw_special`	`sometimes\|boolean`
`pw_max_age_days`	`sometimes\|integer\|min:0\|max:365`
`pw_reuse`	`sometimes\|integer\|min:0\|max:24`
`pw_max_attempts`	`sometimes\|integer\|min:0\|max:20\|fn($a, $v, $fail) => (int) $v === 0 \|\| (int) $v >= 3 \|\| $fail(__('Allow at least...`
`pw_lock_minutes`	`sometimes\|integer\|min:0\|max:1440`

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/settings/sign-in" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"two_factor_required":true,"sso_enabled":true,"sso_protocol":"oidc","sso_name":"...","sso_issuer":"...","sso_client_id":"...","sso_client_secret":"...","sso_only":true,"sso_exempt_user_ids":[],"saml_idp_entity_id":"...","saml_idp_sso_url":"...","saml_idp_cert":"...","saml_metadata_url":"...","saml_metadata_xml":"...","saml_email_attribute":"...","pw_min_length":1,"pw_upper":true,"pw_lower":true,"pw_numbers":true,"pw_special":true,"pw_max_age_days":1,"pw_reuse":1,"pw_max_attempts":1,"pw_lock_minutes":1}'

GET /api/v1/app/companies/{company}/settings/sign-in/sso-log The single sign-on audit log: sign-ins, refusals, blocked password sign-ins and settings c...

The single sign-on audit log: sign-ins, refusals, blocked password sign-ins and settings changes, newest first.

Sign-in: App token or company API key
Permission: settings.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

`limit`	`sometimes\|integer\|min:1\|'max:' . \App\Support\Limits::cap(200)`
`event`	`sometimes\|in:sign_in,sign_in_failed,password_blocked,settings_changed`

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/settings/sign-in/sso-log?limit=1&event=sign_in" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/settings/log-retention

Sign-in: App token or company API key
Permission: settings.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/settings/log-retention" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/app/companies/{company}/settings/log-retention

Sign-in: App token or company API key
Permission: settings.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

retentionrequired required|Rule::in(\App\Support\LogRetention::options())

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/settings/log-retention" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"retention":"..."}'

GET /api/v1/app/companies/{company}/settings/earned-wage

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/settings/earned-wage" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/app/companies/{company}/settings/earned-wage

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/settings/earned-wage" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/settings/salary-scale

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

salary_scale_enforcerequired required|in:off,block

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/settings/salary-scale" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"salary_scale_enforce":"off"}'

GET /api/v1/app/companies/{company}/settings/live-location

Sign-in: App token or company API key
Permission: live_location.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/settings/live-location" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/settings/live-location enabled, mode, interval_seconds, distance_meters, max_silence_minutes, retention_days, rea...

enabled, mode, interval_seconds, distance_meters, max_silence_minutes, retention_days, reason {en, ar}, rules [{target_type, target_id, effect}].

Sign-in: App token or company API key
Permission: live_location.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`enabled`	`sometimes\|boolean`
`mode`	`sometimes\|in:while_clocked_in,during_shift,always_when_app_open`
`interval_seconds`	`sometimes\|integer\|between:10,3600`
`distance_meters`	`sometimes\|integer\|between:0,5000`
`max_silence_minutes`	`sometimes\|integer\|between:2,1440`
`retention_days`	`sometimes\|integer\|between:7,730`
`reason`	`sometimes\|nullable\|array`
`reason.en`	`nullable\|string\|'max:' . \App\Support\Limits::chars(500)`
`reason.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(500)`
`rules`	`sometimes\|array`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/settings/live-location" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"enabled":true,"mode":"while_clocked_in","interval_seconds":1,"distance_meters":1,"max_silence_minutes":1,"retention_days":1,"reason":{"en":"...","ar":"..."},"rules":[]}'

GET /api/v1/app/companies/{company}/settings/app-policies/{policy} The app lock, the confirmation before a punch or blocking screenshots (app_policy.manage):...

The app lock, the confirmation before a punch or blocking screenshots (app_policy.manage): enabled, its options and rules.

Sign-in: App token or company API key
Permission: app_policy.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`policy`	string · app_lock\|punch_auth\|screen_capture\|phone_sharing\|event_location\|location_required\|context_device\|context_network\|context_battery\|context_permissions\|context_security\|context_time\|context_locale\|context_health	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/settings/app-policies/{policy}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/settings/app-policies/{policy} enabled; app_lock: when (every_open|after_background), after_minutes, methods (biometric|b...

enabled; app_lock: when (every_open|after_background), after_minutes, methods (biometric|biometric_or_passcode); punch_auth: methods; rules [{target_type, target_id, effect}]; screen_capture: enabled only.

Sign-in: App token or company API key
Permission: app_policy.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`policy`	string · app_lock\|punch_auth\|screen_capture\|phone_sharing\|event_location\|location_required\|context_device\|context_network\|context_battery\|context_permissions\|context_security\|context_time\|context_locale\|context_health	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`enabled`required	`required\|boolean`
`methods`	`sometimes\|in:biometric,biometric_or_passcode`
`when`	`sometimes\|in:every_open,after_background`
`after_minutes`	`sometimes\|integer\|between:1,240`
`rules`	`sometimes\|array`
`inherit`	`sometimes\|boolean`
`mode`	`sometimes\|in:allow,warn,block`
`max_accounts`	`sometimes\|integer\|between:1,10`
`rules.*.target_type`required	`required\|in:all,branch,department,section,work_location,group,employee`
`rules.*.target_id`	`nullable\|integer`
`rules.*.effect`	`sometimes\|in:include,exclude`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/settings/app-policies/{policy}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"enabled":true,"methods":"biometric","when":"every_open","after_minutes":1,"rules":[],"inherit":true,"mode":"allow","max_accounts":1}'

GET /api/v1/app/companies/{company}/settings/clocking-security The checks of the company, or of a branch (branch_id) where it has its own values.

The checks of the company, or of a branch (branch_id) where it has its own values.

Sign-in: App token or company API key
Permission: attendance.security.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/settings/clocking-security" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/app/companies/{company}/settings/clocking-security Send only what changes: checks {check: off|flag|hold|block|on}, the numbers and ranges; br...

Send only what changes: checks {check: off|flag|hold|block|on}, the numbers and ranges; branch_id for a branch's own values.

Sign-in: App token or company API key
Permission: attendance.security.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/settings/clocking-security" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/settings/buddy-punching

Sign-in: App token or company API key
Permission: attendance.buddy.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/settings/buddy-punching" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/app/companies/{company}/settings/buddy-punching/{layer} PATCH settings/buddy-punching/{layer}: inherit, or mode off|flag|refuse; the layer's own s...

PATCH settings/buddy-punching/{layer}: inherit, or mode off|flag|refuse; the layer's own settings; rules.

Sign-in: App token or company API key
Permission: attendance.buddy.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`layer`	string · bp_face\|bp_device_key\|bp_presence\|bp_pattern	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/settings/buddy-punching/{layer}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/settings/attendance

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/settings/attendance" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH POST /api/v1/app/companies/{company}/settings/attendance Attendance setup: send only what changes.

Attendance setup: send only what changes.

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/settings/attendance" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/settings/attendance/clock-button "Hide the clock button outside the work location" (docs/attendance-security.md §17): on or...

"Hide the clock button outside the work location" (docs/attendance-security.md §17): on or off, and who it reaches. branch_id reads a branch's own value; choices are what that level may name (strict branch isolation).

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

branch_id nullable|integer|exists:branches,id

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/settings/attendance/clock-button?branch_id=1" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/app/companies/{company}/settings/attendance/clock-button Send only what changes: clock_hide_outside_location, scope (all|chosen), branch_ids, depar...

Send only what changes: clock_hide_outside_location, scope (all|chosen), branch_ids, department_ids, employee_ids; branch_id for a branch's own value.

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

branch_id nullable|integer|exists:branches,id

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/settings/attendance/clock-button" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"branch_id":1}'

GET /api/v1/app/companies/{company}/settings/timesheets

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/settings/timesheets" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH POST /api/v1/app/companies/{company}/settings/timesheets Timesheets setup: send only what changes.

Timesheets setup: send only what changes.

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/settings/timesheets" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/settings/overtime-limit

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/settings/overtime-limit" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/settings/overtime-limit ot_limit_scope per_type|total, ot_total_limit_hours, ot_total_limit_period day|week|month.

ot_limit_scope per_type|total, ot_total_limit_hours, ot_total_limit_period day|week|month.

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/settings/overtime-limit" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

setup-forms 4 endpoints

GET /api/v1/app/companies/{company}/setup-forms/{entity}

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`entity`	string	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/setup-forms/{entity}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/setup-forms/{entity}

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`entity`	string	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/setup-forms/{entity}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH POST /api/v1/app/companies/{company}/setup-forms/{entity}/{id}

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`entity`	string	The record's ID.
`id`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/setup-forms/{entity}/{id}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/setup-forms/{entity}/{id}

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`entity`	string	The record's ID.
`id`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/setup-forms/{entity}/{id}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

shifts 9 endpoints

GET /api/v1/app/companies/{company}/shifts/{shift}/shares HR: who a shift is shared with.

HR: who a shift is shared with.

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`shift`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/shifts/{shift}/shares" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/shifts/{shift}/shares HR: replaces the shares. targets: [{target_type department|group|employee, target_id, can_...

HR: replaces the shares. targets: [{target_type department|group|employee, target_id, can_edit}].

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`shift`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/shifts/{shift}/shares" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/shifts

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/shifts" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/shifts

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`required	`required\|array`
`name.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`name.ar`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`type`required	`required\|in:regular,flexible,split,roster,roster_flexible`
`split_kind`	`nullable\|in:regular,flexible,roster`
`start_time`required	`required\|date_format:H:i`
`end_time`required	`required\|date_format:H:i`
`start_time_2`	`nullable\|required_if:type,split\|date_format:H:i`
`end_time_2`	`nullable\|required_if:type,split\|date_format:H:i`
`required_hours`	`nullable\|numeric\|min:0.5\|max:24`
`required_hours_2`	`nullable\|numeric\|min:0.5\|max:24`
`interval_margin_pct`	`nullable\|integer\|between:0,100`
`days_off`	`nullable\|array\|max:6`
`days_off.*`	`integer\|between:0,6`
`color`	`nullable\|regex:/^#[0-9a-fA-F]{6}$/`
`break_minutes`	`nullable\|integer\|between:0,600`
`late_grace_minutes`	`nullable\|integer\|between:0,600`
`early_grace_minutes`	`nullable\|integer\|between:0,600`
`flex_grace_minutes`	`nullable\|integer\|between:0,600`
`overtime_after_minutes`	`nullable\|integer\|between:0,1440`
`punch_in_window_minutes`	`nullable\|integer\|between:0,720`
`punch_out_grace_minutes`	`nullable\|integer\|between:0,720`
`extra_intervals`	`nullable\|array\|'max:' . (\App\Models\Shift::MAX_INTERVALS - 2)`
`extra_intervals.*.from`	`nullable\|date_format:H:i`
`extra_intervals.*.to`	`nullable\|date_format:H:i`
`extra_intervals.*.required_hours`	`nullable\|numeric\|min:0.25\|max:24`
`functions`	`nullable\|array`
`functions.*.attendance_function_id`	`nullable\|integer\|exists:attendance_functions,id`
`functions.*.from`	`nullable\|date_format:H:i`
`functions.*.to`	`nullable\|date_format:H:i`
`work_exceptions`	`nullable\|array`
`work_exceptions.*.day`	`nullable\|integer\|between:0,6`
`work_exceptions.*.from`	`nullable\|date_format:H:i`
`work_exceptions.*.to`	`nullable\|date_format:H:i`
`overtime_exceptions`	`nullable\|array`
`overtime_exceptions.*.day`	`nullable\|in:0,1,2,3,4,5,6,off`
`overtime_exceptions.*.from`	`nullable\|date_format:H:i`
`overtime_exceptions.*.to`	`nullable\|date_format:H:i`
`overtime_exceptions.*.basic_rate`	`nullable\|numeric\|min:0\|max:20`
`overtime_exceptions.*.allowances_rate`	`nullable\|numeric\|min:0\|max:20`
`overtime_exceptions.*.method`	`nullable\|in:hourly,daily`
`is_default`	`sometimes\|boolean`
`archived`	`sometimes\|boolean`
`deduct_grace`	`sometimes\|boolean`
`exclude_break`	`sometimes\|boolean`
`holiday_overtime`	`sometimes\|boolean`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/shifts" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":{"en":"...","ar":"..."},"type":"regular","split_kind":"regular","start_time":"2026-11-01","end_time":"2026-11-01","start_time_2":"2026-11-01","end_time_2":"2026-11-01","required_hours":1.5,"required_hours_2":1.5,"interval_margin_pct":1,"days_off":[],"color":"...","break_minutes":1,"late_grace_minutes":1,"early_grace_minutes":1,"flex_grace_minutes":1,"overtime_after_minutes":1,"punch_in_window_minutes":1,"punch_out_grace_minutes":1,"extra_intervals":[],"functions":[],"work_exceptions":[],"overtime_exceptions":[],"is_default":true,"archived":true,"deduct_grace":true,"exclude_break":true,"holiday_overtime":true}'

GET /api/v1/app/companies/{company}/shifts/{shift}

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`shift`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/shifts/{shift}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/shifts/{shift}/copy-to-roster A roster copy of a regular shift, as the shift screen's "Copy to roster".

A roster copy of a regular shift, as the shift screen's "Copy to roster".

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`shift`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/shifts/{shift}/copy-to-roster" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/shifts/{shift}/sync The shift to every active employee without one.

The shift to every active employee without one.

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`shift`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/shifts/{shift}/sync" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/shifts/{shift}

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`shift`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`required	`required\|array`
`name.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`name.ar`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`type`required	`required\|in:regular,flexible,split,roster,roster_flexible`
`split_kind`	`nullable\|in:regular,flexible,roster`
`start_time`required	`required\|date_format:H:i`
`end_time`required	`required\|date_format:H:i`
`start_time_2`	`nullable\|required_if:type,split\|date_format:H:i`
`end_time_2`	`nullable\|required_if:type,split\|date_format:H:i`
`required_hours`	`nullable\|numeric\|min:0.5\|max:24`
`required_hours_2`	`nullable\|numeric\|min:0.5\|max:24`
`interval_margin_pct`	`nullable\|integer\|between:0,100`
`days_off`	`nullable\|array\|max:6`
`days_off.*`	`integer\|between:0,6`
`color`	`nullable\|regex:/^#[0-9a-fA-F]{6}$/`
`break_minutes`	`nullable\|integer\|between:0,600`
`late_grace_minutes`	`nullable\|integer\|between:0,600`
`early_grace_minutes`	`nullable\|integer\|between:0,600`
`flex_grace_minutes`	`nullable\|integer\|between:0,600`
`overtime_after_minutes`	`nullable\|integer\|between:0,1440`
`punch_in_window_minutes`	`nullable\|integer\|between:0,720`
`punch_out_grace_minutes`	`nullable\|integer\|between:0,720`
`extra_intervals`	`nullable\|array\|'max:' . (\App\Models\Shift::MAX_INTERVALS - 2)`
`extra_intervals.*.from`	`nullable\|date_format:H:i`
`extra_intervals.*.to`	`nullable\|date_format:H:i`
`extra_intervals.*.required_hours`	`nullable\|numeric\|min:0.25\|max:24`
`functions`	`nullable\|array`
`functions.*.attendance_function_id`	`nullable\|integer\|exists:attendance_functions,id`
`functions.*.from`	`nullable\|date_format:H:i`
`functions.*.to`	`nullable\|date_format:H:i`
`work_exceptions`	`nullable\|array`
`work_exceptions.*.day`	`nullable\|integer\|between:0,6`
`work_exceptions.*.from`	`nullable\|date_format:H:i`
`work_exceptions.*.to`	`nullable\|date_format:H:i`
`overtime_exceptions`	`nullable\|array`
`overtime_exceptions.*.day`	`nullable\|in:0,1,2,3,4,5,6,off`
`overtime_exceptions.*.from`	`nullable\|date_format:H:i`
`overtime_exceptions.*.to`	`nullable\|date_format:H:i`
`overtime_exceptions.*.basic_rate`	`nullable\|numeric\|min:0\|max:20`
`overtime_exceptions.*.allowances_rate`	`nullable\|numeric\|min:0\|max:20`
`overtime_exceptions.*.method`	`nullable\|in:hourly,daily`
`is_default`	`sometimes\|boolean`
`archived`	`sometimes\|boolean`
`deduct_grace`	`sometimes\|boolean`
`exclude_break`	`sometimes\|boolean`
`holiday_overtime`	`sometimes\|boolean`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/shifts/{shift}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":{"en":"...","ar":"..."},"type":"regular","split_kind":"regular","start_time":"2026-11-01","end_time":"2026-11-01","start_time_2":"2026-11-01","end_time_2":"2026-11-01","required_hours":1.5,"required_hours_2":1.5,"interval_margin_pct":1,"days_off":[],"color":"...","break_minutes":1,"late_grace_minutes":1,"early_grace_minutes":1,"flex_grace_minutes":1,"overtime_after_minutes":1,"punch_in_window_minutes":1,"punch_out_grace_minutes":1,"extra_intervals":[],"functions":[],"work_exceptions":[],"overtime_exceptions":[],"is_default":true,"archived":true,"deduct_grace":true,"exclude_break":true,"holiday_overtime":true}'

DELETE /api/v1/app/companies/{company}/shifts/{shift}

Sign-in: App token or company API key
Permission: attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`shift`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/shifts/{shift}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

signatures 6 endpoints

GET /api/v1/app/companies/{company}/signatures Signature requests I may see: mine, and those in my letters scope.

Signature requests I may see: mine, and those in my letters scope.

Sign-in: App token or company API key
Permission: self.signatures | letters.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/signatures" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/signatures/{signature}

Sign-in: App token or company API key
Permission: self.signatures | letters.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`signature`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/signatures/{signature}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/signatures/{signature}/pdf A signed document as a PDF file (409 until it is signed).

A signed document as a PDF file (409 until it is signed).

Sign-in: App token or company API key
Permission: self.signatures | letters.view | letters.manage
Module: hrm
Rate limit: 30 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`signature`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/signatures/{signature}/pdf" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/signatures/{signature}/sign Sign my document: password, signature (a PNG data URL), agree.

Sign my document: password, signature (a PNG data URL), agree.

Sign-in: App token or company API key
Permission: self.signatures
Module: hrm
Rate limit: 10 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`signature`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`password`required	`required\|string\|fn($attribute, $value, $fail) => \Illuminate\Support\Facades\Hash::check((string...`
`signature`required	`required\|string\|max:300000\|regex:/^data:image\/png;base64,[A-Za-z0-9+\/=]+$/`
`agree`	`accepted`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/signatures/{signature}/sign" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"password":"...","signature":"...","agree":true}'

POST /api/v1/app/companies/{company}/signatures/{signature}/decline

Sign-in: App token or company API key
Permission: self.signatures
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`signature`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/signatures/{signature}/decline" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/signatures Send a document to sign: employee_ids, and title + body or letter_id (letters.manage).

Send a document to sign: employee_ids, and title + body or letter_id (letters.manage).

Sign-in: App token or company API key
Permission: letters.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`employee_ids`required	`required\|array\|min:1`
`employee_ids.*`	`integer`
`title`	`nullable\|string`
`body`	`nullable\|string`
`letter_id`	`nullable\|integer`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/signatures" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"employee_ids":[],"title":"...","body":"...","letter_id":1}'

slack 2 endpoints

GET /api/v1/app/companies/{company}/slack

Sign-in: App token or company API key
Permission: integrations.slack.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/slack" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/slack

Sign-in: App token or company API key
Permission: integrations.slack.manage
Rate limit: 20 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/slack" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

social-security-salaries 1 endpoint

POST /api/v1/app/companies/{company}/social-security-salaries Update social security salaries (base basic | gross) for the active employees in the perso...

Update social security salaries (base basic | gross) for the active employees in the person's payroll.manage scope.

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

baserequired required|in:basic,gross

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/social-security-salaries" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"base":"basic"}'

stb-encashments 5 endpoints

GET /api/v1/app/companies/{company}/stb-encashments/settings

Sign-in: App token or company API key
Permission: payroll.stb_encashments.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/stb-encashments/settings" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/stb-encashments Encashments in my scope, newest first (employee_id filter), with the company's limits.

Encashments in my scope, newest first (employee_id filter), with the company's limits.

Sign-in: App token or company API key
Permission: payroll.stb_encashments.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/stb-encashments" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/stb-encashments

Sign-in: App token or company API key
Permission: payroll.stb_encashments.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`employee_id`required	`required\|integer`
`amount`required	`required\|numeric\|gt:0`
`payment`required	`required\|in:payroll,off_cycle`
`notes`	`$limits['stb_encash_notes_required'] ? 'required' : 'nullable'\|string\|max:500`
`external_ref`	`nullable\|string\|max:64`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/stb-encashments" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"employee_id":1,"amount":1.5,"payment":"payroll","notes":"...","external_ref":"..."}'

DELETE /api/v1/app/companies/{company}/stb-encashments/{encashment}

Sign-in: App token or company API key
Permission: payroll.stb_encashments.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`encashment`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/stb-encashments/{encashment}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/app/companies/{company}/stb-encashments/settings

Sign-in: App token or company API key
Permission: payroll_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`stb_encash_max_percent`required	`required\|numeric\|min:0\|max:100`
`stb_encash_min_years`required	`required\|numeric\|min:0\|max:50`
`stb_encash_every_years`required	`required\|numeric\|min:0\|max:50`
`stb_encash_min_amount`	`nullable\|numeric\|min:0`
`stb_encash_max_amount`	`nullable\|numeric\|min:0\|gte:stb_encash_min_amount`
`stb_encash_after_months`	`nullable\|integer\|min:0\|max:600`
`stb_encash_times`	`nullable\|integer\|min:1\|max:100`
`stb_encash_per_years`	`nullable\|numeric\|min:0\|max:50\|required_with:stb_encash_times`
`stb_encash_eligible`	`nullable\|in:all,citizens,non_citizens`
`stb_encash_default_payment`	`nullable\|in:payroll,off_cycle`
`stb_encash_limited_policy_id`	`$policy`
`stb_encash_unlimited_policy_id`	`$policy`
`stb_encash_income_name_en`	`nullable\|string\|'max:' . \App\Support\Limits::chars(100)`
`stb_encash_income_name_ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(100)`
`stb_encash_deduction_name_en`	`nullable\|string\|'max:' . \App\Support\Limits::chars(100)`
`stb_encash_deduction_name_ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(100)`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/stb-encashments/settings" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"stb_encash_max_percent":1.5,"stb_encash_min_years":1.5,"stb_encash_every_years":1.5,"stb_encash_min_amount":1.5,"stb_encash_max_amount":1.5,"stb_encash_after_months":1,"stb_encash_times":1,"stb_encash_per_years":1.5,"stb_encash_eligible":"all","stb_encash_default_payment":"payroll","stb_encash_limited_policy_id":"...","stb_encash_unlimited_policy_id":"...","stb_encash_income_name_en":"...","stb_encash_income_name_ar":"...","stb_encash_deduction_name_en":"...","stb_encash_deduction_name_ar":"..."}'

succession 1 endpoint

GET /api/v1/app/companies/{company}/succession/coverage exposure (critical|exposed|watch|covered), department_id.

exposure (critical|exposed|watch|covered), department_id.

Sign-in: App token or company API key
Permission: succession.manage.* | succession.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/succession/coverage" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

successors 4 endpoints

DELETE /api/v1/app/companies/{company}/successors/{successor}

Sign-in: App token or company API key
Permission: succession.manage.* | succession.successors.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`successor`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/successors/{successor}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/successors/{successor}

Sign-in: App token or company API key
Permission: succession.manage.* | succession.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`successor`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/successors/{successor}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/successors/{successor}/draft-plan apply: true saves the drafted actions on the plan.

apply: true saves the drafted actions on the plan.

Sign-in: App token or company API key
Permission: succession.manage.* | succession.successors.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`successor`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/successors/{successor}/draft-plan" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/successors/{successor}/plan-actions title, kind, owner_id, due_date, status, progress, competency_id, notes.

title, kind, owner_id, due_date, status, progress, competency_id, notes.

Sign-in: App token or company API key
Permission: succession.manage.* | succession.successors.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`successor`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`title`required	`required\|string\|max:255`
`kind`	`nullable\|in:training,mentoring,assignment,project,other`
`owner_id`	`nullable\|integer\|exists:employees,id`
`due_date`	`nullable\|date`
`status`	`nullable\|in:planned,in_progress,done`
`progress`	`nullable\|integer\|between:0,100`
`competency_id`	`nullable\|integer\|exists:competencies,id`
`notes`	`nullable\|string\|'max:' . \App\Support\Limits::chars(2000)`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/successors/{successor}/plan-actions" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"title":"...","kind":"training","owner_id":1,"due_date":"2026-11-01","status":"planned","progress":1,"competency_id":1,"notes":"..."}'

suspensions 4 endpoints

GET /api/v1/app/companies/{company}/suspensions

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/suspensions" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/suspensions

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 30 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/suspensions" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/suspensions/{suspension}/{action} decide, withdraw, resume, decide-resumption, withdraw-resumption, cancel, decide-cancel, c...

decide, withdraw, resume, decide-resumption, withdraw-resumption, cancel, decide-cancel, cancel-resumption, decide-cancel-resumption

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`suspension`	integer	The record's ID.
`action`	string · decide\|withdraw\|resume\|decide-resumption\|withdraw-resumption\|cancel\|decide-cancel\|cancel-resumption\|decide-cancel-resumption	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/suspensions/{suspension}/{action}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/suspensions/{suspension}

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`suspension`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/suspensions/{suspension}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

system-announcements 3 endpoints

GET /api/v1/app/system-announcements
Sign-in
App token or company API key

Permission
Any signed-in user of the company

Rate limit
60 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/app/system-announcements" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

POST /api/v1/app/system-announcements/{announcement}/dismiss

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

announcement integer The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/system-announcements/{announcement}/dismiss" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/system-announcements/{announcement}/acknowledge

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Rate limit: 60 requests a minute

Path parameters

announcement integer The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/system-announcements/{announcement}/acknowledge" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

task-templates 4 endpoints

GET /api/v1/app/companies/{company}/task-templates

Sign-in: App token or company API key
Permission: tasks.templates.manage | tasks.templates.use
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/task-templates" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/task-templates title {en, ar}, description, priority, due_in_days, related_to (general, onboarding, offbo...

title {en, ar}, description, priority, due_in_days, related_to (general, onboarding, offboarding).

Sign-in: App token or company API key
Permission: tasks.templates.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`title`required	`required\|array`
`title.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(200)`
`title.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(200)`
`description`	`nullable\|string\|'max:' . \App\Support\Limits::chars(2000)`
`priority`	`nullable\|in:low,normal,high`
`due_in_days`	`nullable\|integer\|min:0\|max:365`
`related_to`	`nullable\|in:general,onboarding,offboarding`
`steps`	`nullable\|array`
`branch_id`	`nullable\|integer\|exists:branches,id`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/task-templates" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"title":{"en":"...","ar":"..."},"description":"...","priority":"low","due_in_days":1,"related_to":"general","steps":[],"branch_id":1}'

PATCH PUT /api/v1/app/companies/{company}/task-templates/{template}

Sign-in: App token or company API key
Permission: tasks.templates.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`template`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/task-templates/{template}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/task-templates/{template}

Sign-in: App token or company API key
Permission: tasks.templates.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`template`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/task-templates/{template}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

tasks 28 endpoints

GET /api/v1/app/companies/{company}/tasks tab (mine, assigned, employees), show (pending, past_due, completed, all), status, kind, e...

tab (mine, assigned, employees), show (pending, past_due, completed, all), status, kind, employee, template, q, per_page.

Sign-in: App token or company API key
Permission: self.tasks.view | tasks.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tasks" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/tasks Assign Task: kind, title, description, due_date, priority, task_template_id, employee_id o...

Assign Task: kind, title, description, due_date, priority, task_template_id, employee_id or assign_mode group with group_dimension and group_value, and the kind's fields.

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`kind`	`nullable\|Rule::in(array_diff(array_keys(\App\Models\Task::KINDS), \App\Models\Task::WORKF...`
`task_template_id`	`nullable\|integer\|exists:task_templates,id`
`title`	`$kind === 'custom' ? 'required' : 'nullable'\|string\|max:200`
`description`	`nullable\|string\|'max:' . \App\Support\Limits::chars(2000)`
`assign_mode`	`nullable\|in:individual,group`
`employee_id`	`$group ? 'nullable' : 'required'\|integer\|Rule::in($assignable)`
`group_dimension`	`$group ? 'required' : 'nullable'\|Rule::in(array_keys(self::dimensions()))`
`group_value`	`$group ? 'required' : 'nullable'\|string\|max:50`
`due_date`	`nullable\|date`
`priority`	`nullable\|in:low,normal,high`
`notes_required`	`nullable\|boolean`
`attachments_required`	`nullable\|boolean`
`proof_required`	`nullable\|boolean`
`steps`	`nullable\|array`
`document_type_id`	`$kind === 'document_upload' ? 'required' : 'nullable'\|integer\|exists:document_types,id`
`document_id`	`$kind === 'document_download' ? 'required' : 'nullable'\|integer\|exists:employee_documents,id`
`asset_type_id`	`$kind === 'give_asset' ? 'required' : 'nullable'\|integer\|exists:asset_types,id`
`target_employee_id`	`in_array($kind, ['give_asset', 'take_asset'], true) ? 'required' : 'nullable'\|integer`
`asset_id`	`$kind === 'take_asset' ? 'required' : 'nullable'\|integer\|exists:assets,id`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tasks" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"kind":"...","task_template_id":1,"title":"...","description":"...","assign_mode":"individual","employee_id":1,"group_dimension":"...","group_value":"...","due_date":"2026-11-01","priority":"low","notes_required":true,"attachments_required":true,"proof_required":true,"steps":[],"document_type_id":1,"document_id":1,"asset_type_id":1,"target_employee_id":1,"asset_id":1}'

POST /api/v1/app/companies/{company}/tasks/bulk-delete tasks: ids of pending tasks to delete.

tasks: ids of pending tasks to delete.

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tasks/bulk-delete" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/tasks/settings All the task settings: the photo switches and what a new task starts with (docs/communicat...

All the task settings: the photo switches and what a new task starts with (docs/communication.md §5هـ).

Sign-in: App token or company API key
Permission: tasks.proof.settings
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tasks/settings" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/app/companies/{company}/tasks/settings

Sign-in: App token or company API key
Permission: tasks.proof.settings
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tasks/settings" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/tasks/settings/branches/{branch}

Sign-in: App token or company API key
Permission: tasks.proof.settings
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`branch`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tasks/settings/branches/{branch}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/app/companies/{company}/tasks/settings/branches/{branch}

Sign-in: App token or company API key
Permission: tasks.proof.settings
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`branch`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tasks/settings/branches/{branch}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/tasks/proof The tasks with photos of the people in scope, for a manager: show (open, flagged, done, al...

The tasks with photos of the people in scope, for a manager: show (open, flagged, done, all), employee, q, page, per_page.

Sign-in: App token or company API key
Permission: tasks.proof.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tasks/proof" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/tasks/{task}

Sign-in: App token or company API key
Permission: self.tasks.view | tasks.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`task`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tasks/{task}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/tasks/{task}/status status: todo, in_progress or done (a task that needs its form is completed with /complete)...

status: todo, in_progress or done (a task that needs its form is completed with /complete).

Sign-in: App token or company API key
Permission: self.tasks.update | tasks.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`task`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tasks/{task}/status" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/tasks/{task}/complete completion_notes, attachments[] (files), attachment (the document of a document upload), e...

completion_notes, attachments[] (files), attachment (the document of a document upload), expires_at, asset_id (give asset).

Sign-in: App token or company API key
Permission: self.tasks.update | tasks.manage
Module: hrm
Rate limit: 30 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`task`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`completion_notes`	`$task->notes_required ? 'required' : 'nullable'\|string\|'max:' . \App\Support\Limits::chars(2000)`
`attachment`	`$task->kind === 'document_upload' ? 'required' : 'prohibited'\|nullable\|file\|mimes:pdf,jpg,jpeg,png,webp,doc,docx,xls,xlsx\|max:10240`
`expires_at`	`nullable\|date`
`attachments`	`$task->attachments_required && $task->kind !== 'document_upload' ? 'required' :...\|array\|'max:' . (int) \App\Support\Field\FieldSettings::value('task_attachment_max_file...`
`attachments.*`	`file\|mimes:png,jpg,jpeg,pdf,doc,docx,txt,rtf\|'max:' . 1024 * (int) \App\Support\Field\FieldSettings::value('task_attachment_m...`
`asset_id`	`$task->kind === 'give_asset' ? 'required' : 'nullable'\|integer\|exists:assets,id`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tasks/{task}/complete" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -F "completion_notes=..." \
  -F "[email protected]" \
  -F "expires_at=2026-11-01" \
  -F "attachments=..." \
  -F "asset_id=1"

POST /api/v1/app/companies/{company}/tasks/{task}/confirm-receipt The employee who got a handed-over asset confirms receiving it (give-asset tasks awaiting...

The employee who got a handed-over asset confirms receiving it (give-asset tasks awaiting confirmation).

Sign-in: App token or company API key
Permission: self.tasks.update | tasks.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`task`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tasks/{task}/confirm-receipt" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/tasks/{task}

Sign-in: App token or company API key
Permission: Any signed-in user of the company
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`task`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tasks/{task}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/tasks/proof/mine The open tasks that ask for proof, with photos and rules, for working offline.

The open tasks that ask for proof, with photos and rules, for working offline.

Sign-in: App token or company API key
Permission: self.tasks.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tasks/proof/mine" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/tasks/{task}/proof/mine One of the employee's own tasks with every photo they took, open or finished, waived or vo...

One of the employee's own tasks with every photo they took, open or finished, waived or voided included. Anyone else's: 404.

Sign-in: App token or company API key
Permission: self.tasks.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`task`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tasks/{task}/proof/mine" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/tasks/{task}/evidence/video meta, signature, bytes, chunk_bytes. Again for the same client_uuid: where it got to, or t...

meta, signature, bytes, chunk_bytes. Again for the same client_uuid: where it got to, or the record if it's all there.

Sign-in: App token or company API key
Permission: self.tasks.capture
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`task`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`meta`required	`required\|string\|max:20000`
`signature`required	`required\|string\|max:500`
`bytes`required	`required\|integer\|min:1`
`chunk_bytes`required	`required\|integer\|min:1024\|'max:' . \Illuminate\Http\UploadedFile::getMaxFilesize()`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tasks/{task}/evidence/video" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"meta":"...","signature":"...","bytes":1,"chunk_bytes":1}'

POST /api/v1/app/companies/{company}/tasks/{task}/evidence/video/{upload}/chunk offset, chunk (a file). A chunk that already arrived changes nothing, and the answer alway...

offset, chunk (a file). A chunk that already arrived changes nothing, and the answer always says how much the server has.

Sign-in: App token or company API key
Permission: self.tasks.capture
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`task`	integer	The record's ID.
`upload`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`offset`required	`required\|integer\|min:0`
`chunk`required	`required\|file`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tasks/{task}/evidence/video/{upload}/chunk" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -F "offset=1" \
  -F "[email protected]"

POST /api/v1/app/companies/{company}/tasks/{task}/evidence/video/{upload}/finish All there: the same checks as a photo. The answer is the same receipt as a photo's.

All there: the same checks as a photo. The answer is the same receipt as a photo's.

Sign-in: App token or company API key
Permission: self.tasks.capture
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`task`	integer	The record's ID.
`upload`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tasks/{task}/evidence/video/{upload}/finish" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/tasks/{task}/evidence multipart: photo, meta (with task_id, not job_id), signature. While the switch is off the...

multipart: photo, meta (with task_id, not job_id), signature. While the switch is off the phone gets 403 and keeps the draft.

Sign-in: App token or company API key
Permission: self.tasks.capture
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`task`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`photo`required	`required\|file\|mimetypes:image/jpeg\|'max:' . 1024 * (int) \App\Support\Field\FieldSettings::value('task_photo_max_mb...`
`meta`required	`required\|string\|max:20000`
`signature`required	`required\|string\|max:500`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tasks/{task}/evidence" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -F "[email protected]" \
  -F "meta=..." \
  -F "signature=..."

GET /api/v1/app/companies/{company}/tasks/{task}/proof

Sign-in: App token or company API key
Permission: tasks.proof.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`task`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tasks/{task}/proof" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/tasks/{task}/proof/request-upload

Sign-in: App token or company API key
Permission: tasks.proof.request_upload
Module: hrm
Rate limit: 30 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`task`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

note nullable|string|'max:' . \App\Support\Limits::chars(500)

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tasks/{task}/proof/request-upload" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"note":"..."}'

POST /api/v1/app/companies/{company}/tasks/{task}/proof/waive

Sign-in: App token or company API key
Permission: tasks.proof.waive
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`task`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

reasonrequired required|string|min:3|'max:' . \App\Support\Limits::chars(1000)

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tasks/{task}/proof/waive" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"reason":"..."}'

GET /api/v1/app/companies/{company}/tasks/proof/evidence/{evidence}/photo The photo: its employee, or who may see the task's proof. ?size=thumb

The photo: its employee, or who may see the task's proof. ?size=thumb

Sign-in: App token or company API key
Permission: self.tasks.view | tasks.proof.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`evidence`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tasks/proof/evidence/{evidence}/photo" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/tasks/proof/evidence/{evidence}/void reason (required).

reason (required).

Sign-in: App token or company API key
Permission: tasks.proof.void
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`evidence`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

reasonrequired required|string|min:3|'max:' . \App\Support\Limits::chars(1000)

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tasks/proof/evidence/{evidence}/void" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"reason":"..."}'

GET /api/v1/app/companies/{company}/tasks/proof/settings

Sign-in: App token or company API key
Permission: tasks.proof.settings
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tasks/proof/settings" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/app/companies/{company}/tasks/proof/settings

Sign-in: App token or company API key
Permission: tasks.proof.settings
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tasks/proof/settings" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/tasks/proof/settings/branches/{branch}

Sign-in: App token or company API key
Permission: tasks.proof.settings
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`branch`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tasks/proof/settings/branches/{branch}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/app/companies/{company}/tasks/proof/settings/branches/{branch}

Sign-in: App token or company API key
Permission: tasks.proof.settings
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`branch`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tasks/proof/settings/branches/{branch}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

team-leaves 2 endpoints

GET /api/v1/app/companies/{company}/team-leaves The team's leaves: status (pending by default, or all), type, employee, from, to.

The team's leaves: status (pending by default, or all), type, employee, from, to.

Sign-in: App token or company API key
Permission: leaves.view
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

`status`	`nullable\|in:pending,approved,rejected,withdrawn,all`
`kind`	`nullable\|in:days,hours`
`type`	`nullable\|integer`
`employee`	`nullable\|integer`
`from`	`nullable\|date`
`to`	`nullable\|date`

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/team-leaves?status=pending&kind=days&type=1&employee=1" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/team-leaves HR adds approved leave for an employee.

HR adds approved leave for an employee.

Sign-in: App token or company API key
Permission: leaves.record
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`employee_id`required	`required\|integer`
`leave_type_id`required	`required\|exists:leave_types,id`
`start_date`required	`required\|date`
`end_date`	`nullable\|date\|after_or_equal:start_date`
`start_time`	`nullable\|date_format:H:i`
`end_time`	`nullable\|date_format:H:i`
`reason`	`nullable\|string\|'max:' . \App\Support\Limits::chars(1000)`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/team-leaves" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"employee_id":1,"leave_type_id":"...","start_date":"2026-11-01","end_date":"2026-11-01","start_time":"2026-11-01","end_time":"2026-11-01","reason":"..."}'

team-schedule 7 endpoints

GET /api/v1/app/companies/{company}/team-schedule The shifts shared with the caller (every shift for HR), with whether they may change each,...

The shifts shared with the caller (every shift for HR), with whether they may change each, and their team.

Sign-in: App token or company API key
Permission: shifts.assign_team | attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/team-schedule" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/team-schedule/assign employees, shift_id (or "off"), start_date, end_date (none = open-ended), conflict replace...

employees, shift_id (or "off"), start_date, end_date (none = open-ended), conflict replace|keep, draft.

Sign-in: App token or company API key
Permission: shifts.assign_team | attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`employees`required	`required\|array\|min:1\|max:500`
`employees.*`	`integer`
`shift_id`required	`required`
`start_date`required	`required\|date`
`end_date`	`nullable\|date\|after_or_equal:start_date`
`conflict`	`sometimes\|in:replace,keep`
`draft`	`sometimes\|boolean`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/team-schedule/assign" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"employees":[],"shift_id":"...","start_date":"2026-11-01","end_date":"2026-11-01","conflict":"replace","draft":true}'

POST /api/v1/app/companies/{company}/team-schedule/clear

Sign-in: App token or company API key
Permission: shifts.assign_team | attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`employees`required	`required\|array\|min:1\|max:500`
`employees.*`	`integer`
`start_date`required	`required\|date`
`end_date`	`nullable\|date\|after_or_equal:start_date`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/team-schedule/clear" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"employees":[],"start_date":"2026-11-01","end_date":"2026-11-01"}'

POST /api/v1/app/companies/{company}/team-schedule/plan shift_ids (shared), start_date, end_date, employees (none = the whole team), max_in_a_row,...

shift_ids (shared), start_date, end_date, employees (none = the whole team), max_in_a_row, days_off_a_week, max_weekly_hours, fair_nights.

Sign-in: App token or company API key
Permission: shifts.assign_team | attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`shift_ids`required	`required\|array\|min:1`
`shift_ids.*`	`integer`
`employees`	`nullable\|array\|max:500`
`employees.*`	`integer`
`start_date`required	`required\|date`
`end_date`required	`required\|date\|after_or_equal:start_date`
`max_in_a_row`	`nullable\|integer\|between:1,14`
`days_off_a_week`	`nullable\|integer\|between:0,6`
`max_weekly_hours`	`nullable\|numeric\|between:1,168`
`fair_nights`	`sometimes\|boolean`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/team-schedule/plan" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"shift_ids":[],"employees":[],"start_date":"2026-11-01","end_date":"2026-11-01","max_in_a_row":1,"days_off_a_week":1,"max_weekly_hours":1.5,"fair_nights":true}'

POST /api/v1/app/companies/{company}/team-schedule/copy source_from, source_to, target_from, target_to, employees (none = the whole team), draft.

source_from, source_to, target_from, target_to, employees (none = the whole team), draft.

Sign-in: App token or company API key
Permission: shifts.assign_team | attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`employees`	`nullable\|array\|max:500`
`employees.*`	`integer`
`source_from`required	`required\|date`
`source_to`required	`required\|date\|after_or_equal:source_from`
`target_from`required	`required\|date`
`target_to`required	`required\|date\|after_or_equal:target_from`
`draft`	`sometimes\|boolean`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/team-schedule/copy" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"employees":[],"source_from":"2026-11-01","source_to":"2026-11-01","target_from":"2026-11-01","target_to":"2026-11-01","draft":true}'

POST /api/v1/app/companies/{company}/team-schedule/publish start_date, end_date, employees (none = the whole team).

start_date, end_date, employees (none = the whole team).

Sign-in: App token or company API key
Permission: shifts.assign_team | attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`employees`	`nullable\|array\|max:500`
`employees.*`	`integer`
`start_date`required	`required\|date`
`end_date`required	`required\|date\|after_or_equal:start_date`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/team-schedule/publish" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"employees":[],"start_date":"2026-11-01","end_date":"2026-11-01"}'

PUT PATCH /api/v1/app/companies/{company}/team-schedule/shifts/{shift} A shift's definition, where a share lets the caller change it (HR always). Same fields as...

A shift's definition, where a share lets the caller change it (HR always). Same fields as the shift setup.

Sign-in: App token or company API key
Permission: shifts.assign_team | attendance_setup.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`shift`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/team-schedule/shifts/{shift}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

template-conflicts 1 endpoint

GET /api/v1/app/companies/{company}/template-conflicts Slots devices hold different data for, with every version (no template data).

Slots devices hold different data for, with every version (no template data).

Sign-in: App token or company API key
Permission: devices.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/template-conflicts" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

terminations 1 endpoint

GET /api/v1/app/companies/{company}/terminations

Sign-in: App token or company API key
Permission: employees.terminate
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/terminations" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

timesheets 6 endpoints

GET /api/v1/app/companies/{company}/timesheets My period holding ?week (a date), with its entries, and all my periods.

My period holding ?week (a date), with its entries, and all my periods.

Sign-in: App token or company API key
Permission: self.timesheets.view | timesheets.approve
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/timesheets" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/timesheets

Sign-in: App token or company API key
Permission: self.timesheets.log
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`project_id`required	`required\|exists:org_units,id`
`work_date`required	`required\|date\|before_or_equal:today`
`hours`required	`required\|numeric\|min:0.25\|'max:' . $max`
`description`	`\App\Models\CompanySetting::get('ts_notes_required', $companyId) === '1' ? 'requ...\|string\|'max:' . \App\Support\Limits::chars(255)`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/timesheets" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"project_id":"...","work_date":"2026-11-01","hours":1.5,"description":"..."}'

POST /api/v1/app/companies/{company}/timesheets/submit

Sign-in: App token or company API key
Permission: self.timesheets.log
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/timesheets/submit" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/timesheets/{entry}

Sign-in: App token or company API key
Permission: self.timesheets.log
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`entry`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/timesheets/{entry}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/timesheets/review Submitted periods of the employees in reach.

Submitted periods of the employees in reach.

Sign-in: App token or company API key
Permission: timesheets.approve
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/timesheets/review" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/timesheets/review

Sign-in: App token or company API key
Permission: timesheets.approve
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

employee_idrequired required|integer

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/timesheets/review" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"employee_id":1}'

token 1 endpoint

DELETE /api/v1/app/token
Sign-in
App token or company API key

Permission
Any signed-in user of the company

Rate limit
60 requests a minute
Example request
Link to this endpoint
```
curl -X DELETE "https://api.mihnaro.com/api/v1/app/token" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

tv 11 endpoints

GET /api/v1/app/companies/{company}/tv The TV setup: channels, devices (no tokens), breaking news and slides.

The TV setup: channels, devices (no tokens), breaking news and slides.

Sign-in: App token or company API key
Permission: tv.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tv" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/tv/channels name, layout (full, split, quad), areas: one list of widgets per area.

name, layout (full, split, quad), areas: one list of widgets per area.

Sign-in: App token or company API key
Permission: tv.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`required	`required\|string\|max:100`
`layout`required	`required\|in:full,split,quad`
`areas`required	`required\|array`
`areas.*`	`nullable\|array`
`areas..`	`in:today,announcements,birthdays,off_today,coming_up,content,clock,attendance_qr`
`is_default`	`nullable\|boolean`
`active`	`nullable\|boolean`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tv/channels" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":"...","layout":"full","areas":[],"is_default":true,"active":true}'

PATCH PUT /api/v1/app/companies/{company}/tv/channels/{channel}

Sign-in: App token or company API key
Permission: tv.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`channel`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tv/channels/{channel}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/tv/channels/{channel}

Sign-in: App token or company API key
Permission: tv.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`channel`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tv/channels/{channel}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/tv/devices name, branch_id, work_location_id (site), tv_channel_id. The answer carries the TV's link...

name, branch_id, work_location_id (site), tv_channel_id. The answer carries the TV's link and token, once.

Sign-in: App token or company API key
Permission: tv.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`required	`required\|string\|max:100`
`branch_id`	`nullable\|integer\|exists:branches,id`
`tv_channel_id`	`nullable\|integer\|exists:tv_channels,id`
`work_location_id`	`nullable\|integer\|exists:org_units,id`
`locale`	`nullable\|in:en,ar`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tv/devices" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":"...","branch_id":1,"tv_channel_id":1,"work_location_id":1,"locale":"en"}'

PATCH PUT /api/v1/app/companies/{company}/tv/devices/{device}

Sign-in: App token or company API key
Permission: tv.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`device`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tv/devices/{device}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/tv/devices/{device}/token A new link; the old one stops working. The answer carries the new token, once.

A new link; the old one stops working. The answer carries the new token, once.

Sign-in: App token or company API key
Permission: tv.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`device`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tv/devices/{device}/token" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/app/companies/{company}/tv/devices/{device}

Sign-in: App token or company API key
Permission: tv.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`device`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tv/devices/{device}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/tv/items kind (news, slide), title {en, ar}, body {en, ar}, starts_on, ends_on, active, image (file...

kind (news, slide), title {en, ar}, body {en, ar}, starts_on, ends_on, active, image (file), remove_image.

Sign-in: App token or company API key
Permission: tv.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`kind`required	`required\|in:news,slide,video`
`title`required	`required\|array`
`title.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`title.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(150)`
`body`	`nullable\|array`
`body.en`	`nullable\|string\|'max:' . \App\Support\Limits::chars(1000)`
`body.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(1000)`
`starts_on`	`nullable\|date`
`ends_on`	`nullable\|date\|after_or_equal:starts_on`
`image`	`nullable\|image\|mimes:jpg,jpeg,png,webp\|max:10240`
`video`	`($input['kind'] ?? null) === 'video' && !$item?->video_path ? 'required' : 'null...\|file\|mimetypes:video/mp4,video/webm\|max:10240`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tv/items" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -F "kind=news" \
  -F "title=..." \
  -F "title.en=..." \
  -F "title.ar=..." \
  -F "body=..." \
  -F "body.en=..." \
  -F "body.ar=..." \
  -F "starts_on=2026-11-01" \
  -F "ends_on=2026-11-01" \
  -F "[email protected]" \
  -F "[email protected]"

PATCH POST /api/v1/app/companies/{company}/tv/items/{item}

Sign-in: App token or company API key
Permission: tv.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`item`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`kind`required	`required\|in:news,slide,video`
`title`required	`required\|array`
`title.en`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`title.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(150)`
`body`	`nullable\|array`
`body.en`	`nullable\|string\|'max:' . \App\Support\Limits::chars(1000)`
`body.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(1000)`
`starts_on`	`nullable\|date`
`ends_on`	`nullable\|date\|after_or_equal:starts_on`
`image`	`nullable\|image\|mimes:jpg,jpeg,png,webp\|max:10240`
`video`	`($input['kind'] ?? null) === 'video' && !$item?->video_path ? 'required' : 'null...\|file\|mimetypes:video/mp4,video/webm\|max:10240`

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tv/items/{item}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -F "kind=news" \
  -F "title=..." \
  -F "title.en=..." \
  -F "title.ar=..." \
  -F "body=..." \
  -F "body.en=..." \
  -F "body.ar=..." \
  -F "starts_on=2026-11-01" \
  -F "ends_on=2026-11-01" \
  -F "[email protected]" \
  -F "[email protected]"

DELETE /api/v1/app/companies/{company}/tv/items/{item}

Sign-in: App token or company API key
Permission: tv.manage
Module: hrm
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`item`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/tv/items/{item}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

users 3 endpoints

GET /api/v1/app/companies/{company}/users

Sign-in: App token or company API key
Permission: users.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/users" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/app/companies/{company}/users/{user}

Sign-in: App token or company API key
Permission: users.manage
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`user`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

statusrequired required|in:active,inactive

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/users/{user}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"status":"active"}'

POST /api/v1/app/companies/{company}/users/{user}/two-factor/reset

Sign-in: App token or company API key
Permission: users.manage
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`user`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/users/{user}/two-factor/reset" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

webhook-deliveries 3 endpoints

GET /api/v1/app/companies/{company}/webhook-deliveries GET webhook-deliveries?webhook_id=&status=delivered|failed

GET webhook-deliveries?webhook_id=&status=delivered|failed

Sign-in: App token or company API key
Permission: integrations.api_keys.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/webhook-deliveries" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/app/companies/{company}/webhook-deliveries/{delivery}

Sign-in: App token or company API key
Permission: integrations.api_keys.manage
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`delivery`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/webhook-deliveries/{delivery}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/webhook-deliveries/{delivery}/resend

Sign-in: App token or company API key
Permission: integrations.api_keys.manage
Rate limit: 20 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`delivery`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/webhook-deliveries/{delivery}/resend" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

webhook-events 1 endpoint

GET /api/v1/app/companies/{company}/webhook-events

Sign-in: App token or company API key
Permission: integrations.api_keys.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/webhook-events" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

webhooks 6 endpoints

GET /api/v1/app/companies/{company}/webhooks

Sign-in: App token or company API key
Permission: integrations.api_keys.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/webhooks" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/webhooks POST webhooks: the signing secret is in the answer this once.

POST webhooks: the signing secret is in the answer this once.

Sign-in: App token or company API key
Permission: integrations.api_keys.manage
Rate limit: 60 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`	`sometimes\|nullable\|string\|max:100`
`url`	`$req\|url:http,https\|max:500`
`events`	`$req\|array\|min:1`
`events.*`	`Rule::in($events)`
`format`	`sometimes\|in:json,xml`
`active`	`sometimes\|boolean`
`group`	`sometimes\|nullable\|in:financial_employee,financial_journal`
`api_key_id`	`sometimes\|nullable\|integer\|exists:api_keys,id`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/webhooks" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":"...","url":"...","events":[],"format":"json","active":true,"group":"financial_employee","api_key_id":1}'

PATCH PUT /api/v1/app/companies/{company}/webhooks/{webhook}

Sign-in: App token or company API key
Permission: integrations.api_keys.manage
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`webhook`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`	`sometimes\|nullable\|string\|max:100`
`url`	`$req\|url:http,https\|max:500`
`events`	`$req\|array\|min:1`
`events.*`	`Rule::in($events)`
`format`	`sometimes\|in:json,xml`
`active`	`sometimes\|boolean`
`group`	`sometimes\|nullable\|in:financial_employee,financial_journal`
`api_key_id`	`sometimes\|nullable\|integer\|exists:api_keys,id`

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/webhooks/{webhook}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":"...","url":"...","events":[],"format":"json","active":true,"group":"financial_employee","api_key_id":1}'

DELETE /api/v1/app/companies/{company}/webhooks/{webhook}

Sign-in: App token or company API key
Permission: integrations.api_keys.manage
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`webhook`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/webhooks/{webhook}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/webhooks/{webhook}/rotate-secret

Sign-in: App token or company API key
Permission: integrations.api_keys.manage
Rate limit: 60 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`webhook`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/webhooks/{webhook}/rotate-secret" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/app/companies/{company}/webhooks/{webhook}/test

Sign-in: App token or company API key
Permission: integrations.api_keys.manage
Rate limit: 20 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`webhook`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/app/companies/$MIHNARO_COMPANY/webhooks/{webhook}/test" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

Platform API

Mihnaro platform admins' keys only.

ai 3 endpoints

GET /api/v1/platform/ai
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/ai" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
PUT /api/v1/platform/ai
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl -X PUT "https://api.mihnaro.com/api/v1/platform/ai" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
GET /api/v1/platform/ai/models
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
20 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/ai/models" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

app-activity 1 endpoint

GET /api/v1/platform/app-activity GET app-activity: every phone's sign-in activity (filters: user_id, install_id, device_id,...
GET app-activity: every phone's sign-in activity (filters: user_id, install_id, device_id, event, result, from, to; page, per_page).

Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/app-activity" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

app-debug 5 endpoints

GET /api/v1/platform/app-debug/accounts GET app-debug/accounts: the accounts with debug mode, on or ended.
GET app-debug/accounts: the accounts with debug mode, on or ended.

Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/app-debug/accounts" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

PUT /api/v1/platform/app-debug/accounts/{user} PUT app-debug/accounts/{user}: on (boolean), hours (1–168, default 24; null = no end), sen...

PUT app-debug/accounts/{user}: on (boolean), hours (1–168, default 24; null = no end), send (ask the phone for a report).

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

user integer The record's ID.

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/platform/app-debug/accounts/{user}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/platform/app-debug/accounts/{user}/request POST app-debug/accounts/{user}/request: the phone sends a report at its next open.

POST app-debug/accounts/{user}/request: the phone sends a report at its next open.

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

user integer The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/platform/app-debug/accounts/{user}/request" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/platform/app-debug/reports GET app-debug/reports: newest first; filters user_id, install_id, build.

GET app-debug/reports: newest first; filters user_id, install_id, build.

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

`user_id`	`nullable\|integer`
`install_id`	`nullable\|string\|max:64`
`build`	`nullable\|string\|max:20`
`per_page`	`nullable\|integer\|min:1\|'max:' . \App\Support\Limits::pageMax(100)`

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/platform/app-debug/reports?user_id=1&install_id=...&build=...&per_page=1" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/platform/app-debug/reports/{report} GET app-debug/reports/{report}: the whole report.

GET app-debug/reports/{report}: the whole report.

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

report integer The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/platform/app-debug/reports/{report}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

app-fleet 4 endpoints

GET /api/v1/platform/app-fleet Phones and versions: every phone with the app, with the summary. Filters as AppFleet::vali...
Phones and versions: every phone with the app, with the summary. Filters as AppFleet::validateFilters; page, per_page.

Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/app-fleet" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

GET /api/v1/platform/app-fleet/people/{user}/context GET app-fleet/people/{user}/context: a person's phone details, latest per phone and the hi...

GET app-fleet/people/{user}/context: a person's phone details, latest per phone and the history (filters install_id, category, limit).

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

user integer The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/platform/app-fleet/people/{user}/context" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/platform/app-fleet/phones/{install}/test-push POST app-fleet/phones/{install}/test-push: one test notification to one phone (docs/notifi...

POST app-fleet/phones/{install}/test-push: one test notification to one phone (docs/notifications.md «الإشعار التجريبي»).

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 10 requests a minute

Path parameters

install integer The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/platform/app-fleet/phones/{install}/test-push" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/platform/app-fleet/people/{user} GET app-fleet/people/{user}: one person's phones with their IPs and timelines.

GET app-fleet/people/{user}: one person's phones with their IPs and timelines.

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

user integer The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/platform/app-fleet/people/{user}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

app-releases 6 endpoints

GET /api/v1/platform/app-releases
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/app-releases" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
POST /api/v1/platform/app-releases/sync Reads both stores' latest version now (also hourly), and returns each check.
Reads both stores' latest version now (also hourly), and returns each check.

Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
10 requests a minute
Example request
Link to this endpoint
```
curl -X POST "https://api.mihnaro.com/api/v1/platform/app-releases/sync" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

PATCH /api/v1/platform/app-releases/{platform} min_version (one of meta.known_versions), update_mode (none|suggest|force), message {en, a...

min_version (one of meta.known_versions), update_mode (none|suggest|force), message {en, ar}, release_notes {en, ar}: any of them. latest_version and store_url come from the stores: sending them is a 422.

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

platform string · android|ios The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/platform/app-releases/{platform}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/platform/app-releases/companies/{company} mode stricter (min_android and/or min_ios), exempt, or none to remove the company's rule.

mode stricter (min_android and/or min_ios), exempt, or none to remove the company's rule.

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/platform/app-releases/companies/$MIHNARO_COMPANY" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/platform/app-releases/{platform}/impact ?version=: how many phones and people a minimum of that version would block, against today...

?version=: how many phones and people a minimum of that version would block, against today (default: forcing the latest).

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

platform string · android|ios The record's ID.

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

version nullable|string|regex:/^\d{1,5}(\.\d{1,5}){0,3}$/

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/platform/app-releases/{platform}/impact?version=..." \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/platform/app-releases/{platform}/nudge "Please update": version_state outdated (default) or below_min; a push linking to the stor...

"Please update": version_state outdated (default) or below_min; a push linking to the store. Needs platform.broadcast too.

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 5 requests a minute

Path parameters

platform string · android|ios The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/platform/app-releases/{platform}/nudge" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

appearance 3 endpoints

GET /api/v1/platform/appearance
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/appearance" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
PATCH /api/v1/platform/appearance
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl -X PATCH "https://api.mihnaro.com/api/v1/platform/appearance" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
DELETE /api/v1/platform/appearance
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl -X DELETE "https://api.mihnaro.com/api/v1/platform/appearance" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

backups 14 endpoints

GET /api/v1/platform/backups
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/backups" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
GET /api/v1/platform/backups/runs
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/backups/runs" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

GET /api/v1/platform/backups/runs/{run}

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

run integer The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/platform/backups/runs/{run}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/platform/backups/restore-tests
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/backups/restore-tests" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
GET /api/v1/platform/backups/destinations
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/backups/destinations" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
PATCH /api/v1/platform/backups/settings
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl -X PATCH "https://api.mihnaro.com/api/v1/platform/backups/settings" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

PUT /api/v1/platform/backups/passphrase

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

passphraserequired required|string

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/platform/backups/passphrase" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"passphrase":"..."}'

POST /api/v1/platform/backups/destinations
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl -X POST "https://api.mihnaro.com/api/v1/platform/backups/destinations" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

PATCH /api/v1/platform/backups/destinations/{destination}

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

destination integer The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/platform/backups/destinations/{destination}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/platform/backups/destinations/{destination}

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

destination integer The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/platform/backups/destinations/{destination}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/platform/backups/destinations/{destination}/connect-link A link to open in a browser signed in to the panel; the sign-in on the service happens the...

A link to open in a browser signed in to the panel; the sign-in on the service happens there.

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 10 requests a minute

Path parameters

destination integer The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/platform/backups/destinations/{destination}/connect-link" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/platform/backups/destinations/{destination}/test

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 10 requests a minute

Path parameters

destination integer The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/platform/backups/destinations/{destination}/test" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/platform/backups/runs
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
10 requests a minute
Example request
Link to this endpoint
```
curl -X POST "https://api.mihnaro.com/api/v1/platform/backups/runs" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

POST /api/v1/platform/backups/runs/{run}/restore-test

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 10 requests a minute

Path parameters

run integer The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/platform/backups/runs/{run}/restore-test" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

branches 3 endpoints

GET /api/v1/platform/companies/{company}/branches

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/branches" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/platform/companies/{company}/branches Within the license's branch limit (platform.companies). Logos as multipart files.

Within the license's branch limit (platform.companies). Logos as multipart files.

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/branches" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT PATCH /api/v1/platform/companies/{company}/branches/{branch}

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`branch`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/branches/{branch}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

broadcasts 5 endpoints

POST /api/v1/platform/broadcasts/preview company_ids, roles, user_ids, branch_ids, install_ids, platform, version_state, version: h...
company_ids, roles, user_ids, branch_ids, install_ids, platform, version_state, version: how many people, phones and emails a send would reach.

Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl -X POST "https://api.mihnaro.com/api/v1/platform/broadcasts/preview" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
GET /api/v1/platform/broadcasts
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/broadcasts" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
POST /api/v1/platform/broadcasts title {en, ar}, body {en, ar}, url, push, email, the audience (company_ids, roles, user_id...
title {en, ar}, body {en, ar}, url, push, email, the audience (company_ids, roles, user_ids, branch_ids, install_ids, platform, version_state, version), image (a file, multipart), scheduled_at. test=true sends it now to your own phones and email only. Goes out in the background.

Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
5 requests a minute
Example request
Link to this endpoint
```
curl -X POST "https://api.mihnaro.com/api/v1/platform/broadcasts" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

GET /api/v1/platform/broadcasts/{broadcast} The send with a page of its people and what each channel answered; ?result=failed|no_devic...

The send with a page of its people and what each channel answered; ?result=failed|no_device|… filters push results.

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

broadcast integer The record's ID.

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

`result`	`nullable\|string\|max:20`
`per_page`	`nullable\|integer\|min:1\|'max:' . \App\Support\Limits::pageMax(200)`

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/platform/broadcasts/{broadcast}?result=...&per_page=1" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/platform/broadcasts/{broadcast}/cancel Cancels a send that hasn't started (scheduled or still waiting).

Cancels a send that hasn't started (scheduled or still waiting).

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

broadcast integer The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/platform/broadcasts/{broadcast}/cancel" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

buddy-punching 2 endpoints

GET /api/v1/platform/buddy-punching GET buddy-punching: the platform default of each buddy-punching layer and who set their ow...
GET buddy-punching: the platform default of each buddy-punching layer and who set their own (docs/attendance-security.md §19).

Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/buddy-punching" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

PUT /api/v1/platform/buddy-punching/{layer} PUT buddy-punching/{layer}: mode off|flag|refuse and the layer's own settings.

PUT buddy-punching/{layer}: mode off|flag|refuse and the layer's own settings.

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

layer string · bp_face|bp_device_key|bp_presence|bp_pattern The record's ID.

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/platform/buddy-punching/{layer}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

calculator-rule-sets 8 endpoints

GET /api/v1/platform/calculator-rule-sets
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/calculator-rule-sets" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

POST /api/v1/platform/calculator-rule-sets

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`country_code`required	`required\|string\|size:2\|fn($a, $v, $fail) => \App\Support\Countries::exists($v) ? null : $fail(__('Unkno...`
`variant`	`nullable\|string\|max:40\|regex:/^[a-z0-9-]+$/`
`variant_label`	`nullable\|array`
`variant_label.en`	`nullable\|string\|'max:' . \App\Support\Limits::chars(100)`
`variant_label.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(100)`
`effective_from`required	`required\|date_format:Y-m-d`
`copy_from`	`nullable\|integer\|exists:calculator_rule_sets,id`
`notes`	`nullable\|array`
`allow_estimates`	`sometimes\|boolean`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/platform/calculator-rule-sets" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"country_code":"...","variant":"...","variant_label":{"en":"...","ar":"..."},"effective_from":"2026-11-01","copy_from":1,"notes":[],"allow_estimates":true}'

GET /api/v1/platform/calculator-rule-sets/{ruleSet}

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

ruleSet integer The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/platform/calculator-rule-sets/{ruleSet}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/platform/calculator-rule-sets/{ruleSet}

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

ruleSet integer The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`rules`	`sometimes\|array`
`notes`	`sometimes\|nullable\|array`
`notes.en`	`nullable\|string\|'max:' . \App\Support\Limits::chars(3000)`
`notes.ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(3000)`
`allow_estimates`	`sometimes\|boolean`
`variant_label`	`sometimes\|nullable\|array`
`effective_from`	`sometimes\|date_format:Y-m-d`
`position`	`sometimes\|integer\|min:0\|max:100`

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/platform/calculator-rule-sets/{ruleSet}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"rules":[],"notes":{"en":"...","ar":"..."},"allow_estimates":true,"variant_label":[],"effective_from":"2026-11-01","position":1}'

POST /api/v1/platform/calculator-rule-sets/{ruleSet}/verify

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

ruleSet integer The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`keys`required	`required\|array\|min:1`
`keys.*`	`string`
`verified`	`sometimes\|boolean`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/platform/calculator-rule-sets/{ruleSet}/verify" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"keys":[],"verified":true}'

POST /api/v1/platform/calculator-rule-sets/{ruleSet}/publish

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

ruleSet integer The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/platform/calculator-rule-sets/{ruleSet}/publish" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/platform/calculator-rule-sets/{ruleSet}/unpublish

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

ruleSet integer The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/platform/calculator-rule-sets/{ruleSet}/unpublish" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/platform/calculator-rule-sets/{ruleSet}/restore/{revision}

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

`ruleSet`	integer	The record's ID.
`revision`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/platform/calculator-rule-sets/{ruleSet}/restore/{revision}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

companies 5 endpoints

DELETE /api/v1/platform/companies/{company} Body: confirm_name (the name or slug), confirm: true, force: true when it has payroll or a...

Body: confirm_name (the name or slug), confirm: true, force: true when it has payroll or attendance, reason.

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/platform/companies
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/companies" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
POST /api/v1/platform/companies Response includes the owner's temporary password once, when a new user was created.
Response includes the owner's temporary password once, when a new user was created.

Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl -X POST "https://api.mihnaro.com/api/v1/platform/companies" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

GET /api/v1/platform/companies/{company}

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT PATCH /api/v1/platform/companies/{company}

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

company-availability 1 endpoint

GET /api/v1/platform/company-availability
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/company-availability" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

deleted-companies 2 endpoints

GET /api/v1/platform/deleted-companies
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/deleted-companies" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

POST /api/v1/platform/deleted-companies/{company}/restore

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/platform/deleted-companies/$MIHNARO_COMPANY/restore" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

deletion-preview 1 endpoint

GET /api/v1/platform/companies/{company}/deletion-preview What a deletion would lose: the payroll runs and attendance that make it "real", employees...

What a deletion would lose: the payroll runs and attendance that make it "real", employees and accounts.

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/deletion-preview" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

demo 1 endpoint

POST /api/v1/platform/demo/reset
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl -X POST "https://api.mihnaro.com/api/v1/platform/demo/reset" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

device-data 2 endpoints

GET /api/v1/platform/device-data GET device-data: the platform defaults of location as a condition of using the app and of...
GET device-data: the platform defaults of location as a condition of using the app and of each category of phone details.

Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/device-data" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
PUT /api/v1/platform/device-data PUT device-data: location_required {enabled, precise, reason_en, reason_ar}, categories {c...
PUT device-data: location_required {enabled, precise, reason_en, reason_ar}, categories {category: {enabled, retention_days}}.

Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl -X PUT "https://api.mihnaro.com/api/v1/platform/device-data" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

domains 1 endpoint

GET /api/v1/platform/domains
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/domains" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

event-location 2 endpoints

GET /api/v1/platform/event-location GET event-location: the platform default for keeping the phone's GPS point with sign-ins a...
GET event-location: the platform default for keeping the phone's GPS point with sign-ins and opens, and the companies with their own.

Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/event-location" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

PUT /api/v1/platform/event-location PUT event-location: mode auto (companies with live location or the clock-in geofence) | on...

PUT event-location: mode auto (companies with live location or the clock-in geofence) | on | off.

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

moderequired required|Rule::in(self::MODES)

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/platform/event-location" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"mode":"..."}'

flash-messages 2 endpoints

GET /api/v1/platform/flash-messages
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/flash-messages" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
PATCH /api/v1/platform/flash-messages position, duration_seconds, auto_close: any of them; the rest keep their value.
position, duration_seconds, auto_close: any of them; the rest keep their value.

Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl -X PATCH "https://api.mihnaro.com/api/v1/platform/flash-messages" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

leads 5 endpoints

GET /api/v1/platform/leads
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/leads" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

GET /api/v1/platform/leads/{lead}

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

lead string The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/platform/leads/{lead}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/platform/leads/{lead}

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

lead string The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`status`	`sometimes\|in:new,contacted,closed`
`notes`	`sometimes\|nullable\|string\|'max:' . \App\Support\Limits::chars(5000)`
`assigned_to`	`sometimes\|nullable\|integer\|Rule::exists(\App\Models\User::class, 'id')->where('is_admin', true)`

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/platform/leads/{lead}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"status":"new","notes":"...","assigned_to":1}'

POST /api/v1/platform/leads/{lead}/archive Archive (soft delete, restorable); messages are never deleted.

Archive (soft delete, restorable); messages are never deleted.

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

lead string The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/platform/leads/{lead}/archive" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/platform/leads/{lead}/restore

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

lead string The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/platform/leads/{lead}/restore" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

licenses 6 endpoints

GET /api/v1/platform/companies/{company}/licenses

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/licenses" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/platform/companies/{company}/licenses

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/licenses" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/platform/companies/{company}/licenses/{license} Edits a license in place; fields left out keep their value (platform.companies).

Edits a license in place; fields left out keep their value (platform.companies).

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`license`	integer	The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/licenses/{license}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/platform/companies/{company}/licenses/{license}/suspend

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`license`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/licenses/{license}/suspend" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/platform/companies/{company}/licenses/{license}/reactivate

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`license`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/licenses/{license}/reactivate" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/platform/companies/{company}/licenses/{license} Never the only license or the one in effect (422).

Never the only license or the one in effect (422).

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`license`	integer	The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/licenses/{license}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

limits 2 endpoints

GET /api/v1/platform/limits
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/limits" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
PATCH /api/v1/platform/limits values: {key: number, or null for the built-in default}; sizes in KB. Only the keys sent c...
values: {key: number, or null for the built-in default}; sizes in KB. Only the keys sent change.

Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl -X PATCH "https://api.mihnaro.com/api/v1/platform/limits" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

login-designs 3 endpoints

GET /api/v1/platform/login-designs
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/login-designs" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
PATCH /api/v1/platform/login-designs/areas
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl -X PATCH "https://api.mihnaro.com/api/v1/platform/login-designs/areas" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

PATCH /api/v1/platform/login-designs/{design}

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

design string · [a-z]+ The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/platform/login-designs/{design}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

messaging 6 endpoints

GET /api/v1/platform/messaging/{channel} Secrets are never returned, only whether one is saved.

Secrets are never returned, only whether one is saved.

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

channel string · mail|whatsapp The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/platform/messaging/{channel}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/platform/messaging/{channel}

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

channel string · mail|whatsapp The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`password`required	`required`
`access_token`required	`required`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/platform/messaging/{channel}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"password":"...","access_token":"..."}'

POST /api/v1/platform/messaging/mail/test One test email through the saved settings; a failure is a 422 with the reason explained (d...
One test email through the saved settings; a failure is a 422 with the reason explained (docs/mail.md).

Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
10 requests a minute
Example request
Link to this endpoint
```
curl -X POST "https://api.mihnaro.com/api/v1/platform/messaging/mail/test" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
GET /api/v1/platform/messaging/mail/health Is email going anywhere: the sending method, last 24 hours, queued and failed (docs/mail.m...
Is email going anywhere: the sending method, last 24 hours, queued and failed (docs/mail.md).

Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/messaging/mail/health" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

GET /api/v1/platform/messaging/mail/deliveries Email deliveries, newest first; ?status=sent|logged|queued|failed, ?q= address or subject.

Email deliveries, newest first; ?status=sent|logged|queued|failed, ?q= address or subject.

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

`status`	`nullable\|in:sent,logged,queued,failed`
`q`	`nullable\|string\|'max:' . \App\Support\Limits::chars(190)`
`per_page`	`nullable\|integer\|min:1\|'max:' . \App\Support\Limits::pageMax(100)`

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/platform/messaging/mail/deliveries?status=sent&q=...&per_page=1" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/platform/messaging/mail/deliveries/{delivery}/retry Puts a failed email back in the queue; it goes out within a minute.

Puts a failed email back in the queue; it goes out within a minute.

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

delivery string The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/platform/messaging/mail/deliveries/{delivery}/retry" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

monitor 7 endpoints

GET /api/v1/platform/monitor/overview Everything the live page shows, with the value of each alert metric.
Everything the live page shows, with the value of each alert metric.

Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/monitor/overview" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

GET /api/v1/platform/monitor/history ?range=24h|7d|30d: chart series averaged per slot.

?range=24h|7d|30d: chart series averaged per slot.

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

range nullable|in:24h,7d,30d

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/platform/monitor/history?range=24h" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/platform/monitor/alerts/rules
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/monitor/alerts/rules" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

PATCH /api/v1/platform/monitor/alerts/rules/{rule} threshold, for_minutes, cooldown_minutes, enabled: any of them.

threshold, for_minutes, cooldown_minutes, enabled: any of them.

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

rule string The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`threshold`	`sometimes\|numeric\|'min:' . $bounds['min']\|'max:' . $bounds['max']`
`for_minutes`	`sometimes\|integer\|min:1\|max:1440`
`cooldown_minutes`	`sometimes\|integer\|min:5\|max:10080`
`enabled`	`sometimes\|boolean`

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/platform/monitor/alerts/rules/{rule}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"threshold":1.5,"for_minutes":1,"cooldown_minutes":1,"enabled":true}'

GET /api/v1/platform/monitor/alerts/recipients
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/monitor/alerts/recipients" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

PUT /api/v1/platform/monitor/alerts/recipients recipients: a list of addresses (an empty list stops alert emails), language: en|ar.

recipients: a list of addresses (an empty list stops alert emails), language: en|ar.

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`recipients`	`present\|array\|max:20`
`recipients.*`	`email:rfc\|max:190`
`language`	`sometimes\|in:en,ar`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/platform/monitor/alerts/recipients" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"recipients":[],"language":"en"}'

GET /api/v1/platform/monitor/alerts/events The alerts log, newest first; ?kind=fired|repeat|recovered, ?metric=.

The alerts log, newest first; ?kind=fired|repeat|recovered, ?metric=.

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

`kind`	`nullable\|in:fired,repeat,recovered`
`metric`	`nullable\|in:cpu,memory,disk,load,db_connections,db_timeouts,errors,failed_jobs,service_down,site_down,ssl_days,zenhr_sync_failed,device_offline_hours,backup_age_hours`
`per_page`	`nullable\|integer\|min:1\|'max:' . \App\Support\Limits::pageMax(100)`

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/platform/monitor/alerts/events?kind=fired&metric=cpu&per_page=1" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

notification-log 3 endpoints

GET /api/v1/platform/notification-log GET notification-log?tab=notices|broadcasts|emails&from=&to=&company=&category=&channel=&s...
GET notification-log?tab=notices|broadcasts|emails&from=&to=&company=&category=&channel=&status=&kind=&q=&per_page=

Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/notification-log" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
GET /api/v1/platform/notification-log/export GET notification-log/export?tab=&format=csv|xlsx&…filters, or send= one notice's recipient...
GET notification-log/export?tab=&format=csv|xlsx&…filters, or send= one notice's recipients.

Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
20 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/notification-log/export" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

GET /api/v1/platform/notification-log/{send} GET notification-log/{send}: one company notice with every person and each channel's answe...

GET notification-log/{send}: one company notice with every person and each channel's answer.

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

send integer The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/platform/notification-log/{send}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

phone-sharing 2 endpoints

GET /api/v1/platform/phone-sharing GET phone-sharing: the platform default for one account per phone (docs/platform-control.m...
GET phone-sharing: the platform default for one account per phone (docs/platform-control.md «الهاتف المشترك»), and the companies with their own.

Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/phone-sharing" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

PUT /api/v1/platform/phone-sharing PUT phone-sharing: mode (allow|warn|block), max_accounts (1–10).

PUT phone-sharing: mode (allow|warn|block), max_accounts (1–10).

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`mode`required	`required\|Rule::in(self::MODES)`
`max_accounts`required	`required\|integer\|between:1,10`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/platform/phone-sharing" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"mode":"...","max_accounts":1}'

platform-admins 5 endpoints

GET /api/v1/platform/platform-admins q (name or email), permission, sort (name, email, added) and dir. With per_page (10, 25, 5...
q (name or email), permission, sort (name, email, added) and dir. With per_page (10, 25, 50, 100) one page and its meta; without, all of them. Also the permissions there are, with what each allows.

Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/platform-admins" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

POST /api/v1/platform/platform-admins name, email, permissions. The temporary password is in the answer once.

name, email, permissions. The temporary password is in the answer once.

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`required	`required\|string\|max:120`
`email`required	`required\|email\|max:190`
`permissions`	`sometimes\|nullable\|array`
`permissions.*`	`string\|in:platform.ai,server.monitor,platform.app_control,platform.broadcast,platform.companies,platform.phones.location,platform.admins,platform.notifications,platform.zenhr,platform.flash_messages,platform.server_switch,platform.app_debug,platform.backups,platform.backups_change,platform.backups_run`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/platform/platform-admins" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":"...","email":"[email protected]","permissions":[]}'

GET /api/v1/platform/platform-admins/{platform_admin}

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

platform_admin string The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/platform/platform-admins/{platform_admin}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT PATCH /api/v1/platform/platform-admins/{platform_admin} name; permissions (the whole list kept), or grant / revoke one.

name; permissions (the whole list kept), or grant / revoke one.

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

platform_admin string The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`name`required	`sometimes\|required\|string\|max:120`
`permissions`	`sometimes\|nullable\|array`
`permissions.*`	`string\|in:platform.ai,server.monitor,platform.app_control,platform.broadcast,platform.companies,platform.phones.location,platform.admins,platform.notifications,platform.zenhr,platform.flash_messages,platform.server_switch,platform.app_debug,platform.backups,platform.backups_change,platform.backups_run`
`grant`	`sometimes\|string\|in:platform.ai,server.monitor,platform.app_control,platform.broadcast,platform.companies,platform.phones.location,platform.admins,platform.notifications,platform.zenhr,platform.flash_messages,platform.server_switch,platform.app_debug,platform.backups,platform.backups_change,platform.backups_run`
`revoke`	`sometimes\|string\|in:platform.ai,server.monitor,platform.app_control,platform.broadcast,platform.companies,platform.phones.location,platform.admins,platform.notifications,platform.zenhr,platform.flash_messages,platform.server_switch,platform.app_debug,platform.backups,platform.backups_change,platform.backups_run`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/platform/platform-admins/{platform_admin}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"name":"...","permissions":[],"grant":"platform.ai","revoke":"platform.ai"}'

DELETE /api/v1/platform/platform-admins/{platform_admin} Removes the admin access: no panel, no permissions, platform API keys revoked, signed out.

Removes the admin access: no panel, no permissions, platform API keys revoked, signed out.

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

platform_admin string The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/platform/platform-admins/{platform_admin}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

security 2 endpoints

GET /api/v1/platform/security
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/security" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
PATCH /api/v1/platform/security
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl -X PATCH "https://api.mihnaro.com/api/v1/platform/security" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

seo 5 endpoints

GET /api/v1/platform/seo
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/seo" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
PATCH /api/v1/platform/seo/settings
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl -X PATCH "https://api.mihnaro.com/api/v1/platform/seo/settings" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
PATCH /api/v1/platform/seo/robots
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl -X PATCH "https://api.mihnaro.com/api/v1/platform/seo/robots" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

GET /api/v1/platform/seo/pages/{key}

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

key string · [a-z]+\.[a-z-]+ The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/platform/seo/pages/{key}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/platform/seo/pages/{key}

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

key string · [a-z]+\.[a-z-]+ The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/platform/seo/pages/{key}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

server-switch 2 endpoints

GET /api/v1/platform/server-switch GET server-switch: the app's live/dev switch {on, until, by, at} (docs/mobile-server-switc...
GET server-switch: the app's live/dev switch {on, until, by, at} (docs/mobile-server-switch.md).

Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/server-switch" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
PUT /api/v1/platform/server-switch PUT server-switch: on (boolean); hours (1–168, default 24; null = no end) for how long it...
PUT server-switch: on (boolean); hours (1–168, default 24; null = no end) for how long it stays on.

Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl -X PUT "https://api.mihnaro.com/api/v1/platform/server-switch" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

sign-in-options 2 endpoints

GET /api/v1/platform/sign-in-options The sign-in screen switches {forgot_password, sso, privacy}, with meta.last_change {by, at...
The sign-in screen switches {forgot_password, sso, privacy}, with meta.last_change {by, at} (null = defaults).

Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/sign-in-options" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
PATCH /api/v1/platform/sign-in-options forgot_password, sso, privacy (booleans): any of them; the rest keep their value.
forgot_password, sso, privacy (booleans): any of them; the rest keep their value.

Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl -X PATCH "https://api.mihnaro.com/api/v1/platform/sign-in-options" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

site 22 endpoints

GET /api/v1/platform/site/settings
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/site/settings" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
PATCH /api/v1/platform/site/settings
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl -X PATCH "https://api.mihnaro.com/api/v1/platform/site/settings" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
GET /api/v1/platform/site/calculators A country's rates in force (Iraq by default, ?country= and ?variant= for another).
A country's rates in force (Iraq by default, ?country= and ?variant= for another).

Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/site/calculators" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
PATCH /api/v1/platform/site/calculators
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl -X PATCH "https://api.mihnaro.com/api/v1/platform/site/calculators" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
GET /api/v1/platform/site/plans
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/site/plans" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
POST /api/v1/platform/site/plans
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl -X POST "https://api.mihnaro.com/api/v1/platform/site/plans" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

PATCH /api/v1/platform/site/plans/{plan}

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

plan string The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/platform/site/plans/{plan}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/platform/site/plans/{plan}

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

plan string The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/platform/site/plans/{plan}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/platform/site/plans/{plan}/move/{direction}

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

`plan`	string	The record's ID.
`direction`	string · up\|down	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/platform/site/plans/{plan}/move/{direction}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/platform/site/section-types
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/site/section-types" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

GET /api/v1/platform/site/pages/{page}/sections

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

page string The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/platform/site/pages/{page}/sections" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/platform/site/pages/{page}/sections

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

page string The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

typerequired required|string

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/platform/site/pages/{page}/sections" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"type":"..."}'

PATCH /api/v1/platform/site/sections/{section}

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

section string The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/platform/site/sections/{section}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/platform/site/sections/{section}

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

section string The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/platform/site/sections/{section}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/platform/site/sections/{section}/move/{direction}

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

`section`	string	The record's ID.
`direction`	string · up\|down	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/platform/site/sections/{section}/move/{direction}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/platform/site/offices
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/site/offices" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
POST /api/v1/platform/site/offices
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl -X POST "https://api.mihnaro.com/api/v1/platform/site/offices" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

PATCH /api/v1/platform/site/offices/{office}

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

office string The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/platform/site/offices/{office}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/platform/site/offices/{office}

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

office string The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/platform/site/offices/{office}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/platform/site/offices/{office}/move/{direction}

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

`office`	string	The record's ID.
`direction`	string · up\|down	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/platform/site/offices/{office}/move/{direction}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/platform/site/contact-settings
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl "https://api.mihnaro.com/api/v1/platform/site/contact-settings" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```
PATCH /api/v1/platform/site/contact-settings
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl -X PATCH "https://api.mihnaro.com/api/v1/platform/site/contact-settings" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

support-sessions 3 endpoints

GET /api/v1/platform/companies/{company}/support-sessions

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/support-sessions" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/platform/companies/{company}/support-sessions

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 10 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

reasonrequired required|string|min:5|'max:' . \App\Support\Limits::chars(500)

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/support-sessions" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"reason":"..."}'

DELETE /api/v1/platform/support-sessions/{supportSession}

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

supportSession string The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/platform/support-sessions/{supportSession}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

system-announcements 5 endpoints

GET /api/v1/platform/system-announcements ?state=live|scheduled|ended|off

?state=live|scheduled|ended|off

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

`state`	`nullable\|in:live,scheduled,ended,off`
`per_page`	`nullable\|integer\|min:1\|'max:' . \App\Support\Limits::pageMax(100)`

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/platform/system-announcements?state=live&per_page=1" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/platform/system-announcements
Sign-in
Platform admin key

Permission
Any signed-in user of the company

Rate limit
120 requests a minute
Example request
Link to this endpoint
```
curl -X POST "https://api.mihnaro.com/api/v1/platform/system-announcements" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"
```

GET /api/v1/platform/system-announcements/{announcement}

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

announcement integer The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/platform/system-announcements/{announcement}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/platform/system-announcements/{announcement}

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

announcement integer The record's ID.

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/platform/system-announcements/{announcement}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

DELETE /api/v1/platform/system-announcements/{announcement} Only one nobody has seen yet (422 otherwise: switch it off with is_active false instead).

Only one nobody has seen yet (422 otherwise: switch it off with is_active false instead).

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

announcement integer The record's ID.

Example request

Link to this endpoint

curl -X DELETE "https://api.mihnaro.com/api/v1/platform/system-announcements/{announcement}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

users 6 endpoints

GET /api/v1/platform/companies/{company}/users The company's accounts: q (name or email), role (admin, user), status (active, temporary,...

The company's accounts: q (name or email), role (admin, user), status (active, temporary, disabled), sort (name, email, role, status, joined) and dir. With per_page (10, 25, 50, 100) one page and its meta; without, all of them.

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/users" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/platform/companies/{company}/users/{user}/reset-password

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`user`	string	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/users/{user}/reset-password" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/platform/companies/{company}/users/{user}/contact

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`user`	string	The record's ID.

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/users/{user}/contact" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/platform/companies/{company}/users/{user}/unlock

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`user`	string	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/users/{user}/unlock" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/platform/companies/{company}/users/{user}/two-factor/reset

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`user`	string	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/users/{user}/two-factor/reset" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PATCH /api/v1/platform/companies/{company}/users/{user}/access Switches the account on or off (is_active) and makes it a company admin or not (is_owner);...

Switches the account on or off (is_active) and makes it a company admin or not (is_owner); platform.companies.

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`user`	string	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`is_active`	`sometimes\|boolean`
`is_owner`	`sometimes\|boolean`

Example request

Link to this endpoint

curl -X PATCH "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/users/{user}/access" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"is_active":true,"is_owner":true}'

zenhr-sync 24 endpoints

PUT /api/v1/platform/zenhr-sync/emergency-stop Stops every company's sync, or lifts that.

Stops every company's sync, or lifts that.

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

onrequired required|boolean

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/platform/zenhr-sync/emergency-stop" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"on":true}'

GET /api/v1/platform/companies/{company}/zenhr-sync

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/zenhr-sync" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/platform/companies/{company}/zenhr-sync/switch On or off for this company ("off" when the move to Mihnaro is final). A run in progress st...

On or off for this company ("off" when the move to Mihnaro is final). A run in progress stops at its next safe place.

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

enabledrequired required|boolean

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/zenhr-sync/switch" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"enabled":true}'

GET /api/v1/platform/companies/{company}/zenhr-sync/health

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/zenhr-sync/health" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/platform/companies/{company}/zenhr-sync/runs

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

`status`	`sometimes\|string`
`trigger`	`sometimes\|string`
`per_page`	`sometimes\|integer\|min:1\|'max:' . \App\Support\Limits::pageMax(100)`

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/zenhr-sync/runs?status=...&trigger=...&per_page=1" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/platform/companies/{company}/zenhr-sync/runs Queues a run for the runner (it can take minutes); one at a time, whoever started it.

Queues a run for the runner (it can take minutes); one at a time, whoever started it.

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 6 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`source`	`sometimes\|in:api,extraction`
`dry_run`	`sometimes\|boolean`
`data_types`	`sometimes\|array`
`branch_ids`	`sometimes\|array`
`since`	`sometimes\|nullable\|date`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/zenhr-sync/runs" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"source":"api","dry_run":true,"data_types":[],"branch_ids":[],"since":"2026-11-01"}'

GET /api/v1/platform/companies/{company}/zenhr-sync/runs/{run}

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`run`	integer	The record's ID.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/zenhr-sync/runs/{run}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/platform/companies/{company}/zenhr-sync/runs/{run}/items The records a run touched: table, reference and column names, never values.

The records a run touched: table, reference and column names, never values.

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`run`	integer	The record's ID.

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

`action`	`sometimes\|in:inserted,updated,flagged`
`per_page`	`sometimes\|integer\|min:1\|'max:' . \App\Support\Limits::pageMax(200)`

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/zenhr-sync/runs/{run}/items?action=inserted&per_page=1" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/platform/companies/{company}/zenhr-sync/runs/{run}/stop

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`run`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/zenhr-sync/runs/{run}/stop" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/platform/companies/{company}/zenhr-sync/runs/{run}/resume

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`run`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/zenhr-sync/runs/{run}/resume" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/platform/companies/{company}/zenhr-sync/conflicts

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

`status`	`sometimes\|in:open,applied,kept,all`
`limit`	`sometimes\|integer\|min:1\|'max:' . \App\Support\Limits::cap(200)`
`offset`	`sometimes\|integer\|min:0`

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/zenhr-sync/conflicts?status=open&limit=1&offset=1" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/platform/companies/{company}/zenhr-sync/conflicts/{conflict}/{action}

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`conflict`	integer	The record's ID.
`action`	string · apply\|keep	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/zenhr-sync/conflicts/{conflict}/{action}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/platform/companies/{company}/zenhr-sync/connection

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/zenhr-sync/connection" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/platform/companies/{company}/zenhr-sync/connection Takes the keys as the screen does, and never returns them.

Takes the keys as the screen does, and never returns them.

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 20 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/zenhr-sync/connection" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/platform/companies/{company}/zenhr-sync/connection/authorize

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 10 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

coderequired required|string|max:2000

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/zenhr-sync/connection/authorize" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"code":"..."}'

POST /api/v1/platform/companies/{company}/zenhr-sync/connection/test

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 6 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/zenhr-sync/connection/test" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/platform/companies/{company}/zenhr-sync/branches/{branch}/link

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`branch`	integer	The record's ID.

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/zenhr-sync/branches/{branch}/link" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/platform/companies/{company}/zenhr-sync/branches/{branch}/switch

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`branch`	integer	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

enabledrequired required|boolean

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/zenhr-sync/branches/{branch}/switch" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"enabled":true}'

GET /api/v1/platform/companies/{company}/zenhr-sync/data-types

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/zenhr-sync/data-types" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

PUT /api/v1/platform/companies/{company}/zenhr-sync/data-types/{type}

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

`company`	integer	Your company's ID, from `GET /api/v1/app/me`.
`type`	string	The record's ID.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`branch_id`	`sometimes\|nullable\|integer`
`enabled`	`sometimes\|boolean`
`frequency`	`sometimes\|nullable\|string`
`starting_from`	`sometimes\|nullable\|date`

Example request

Link to this endpoint

curl -X PUT "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/zenhr-sync/data-types/{type}" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"branch_id":1,"enabled":true,"frequency":"...","starting_from":"2026-11-01"}'

GET /api/v1/platform/companies/{company}/zenhr-sync/totals

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/zenhr-sync/totals" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

GET /api/v1/platform/companies/{company}/zenhr-sync/payroll-compare

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/zenhr-sync/payroll-compare" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

POST /api/v1/platform/companies/{company}/zenhr-sync/payroll-compare

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 6 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

months sometimes|integer|min:1|max:12

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/zenhr-sync/payroll-compare" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"months":1}'

GET /api/v1/platform/companies/{company}/zenhr-sync/audit

Sign-in: Platform admin key
Permission: Any signed-in user of the company
Rate limit: 120 requests a minute

Path parameters

company integer Your company's ID, from GET /api/v1/app/me.

Query parameters

The rules as the code checks them. Some apply only in certain cases, as the description says.

`action`	`sometimes\|string\|max:40`
`per_page`	`sometimes\|integer\|min:1\|'max:' . \App\Support\Limits::pageMax(100)`

Example request

Link to this endpoint

curl "https://api.mihnaro.com/api/v1/platform/companies/$MIHNARO_COMPANY/zenhr-sync/audit?action=...&per_page=1" \
  -H "Authorization: Bearer $MIHNARO_TOKEN" \
  -H "Accept: application/json"

Fingerprint machines

The machine's X-Device-Token.

biometric 1 endpoint

POST /api/v1/biometric/punches POST {"punches":[{"pin":"12","time":"2026-10-19 08:03:00"}]} with the header X-Device-Toke...

POST {"punches":[{"pin":"12","time":"2026-10-19 08:03:00"}]} with the header X-Device-Token.

Sign-in: X-Device-Token
Permission: Any signed-in user of the company
Rate limit: 600 requests a minute

Body fields

The rules as the code checks them. Some apply only in certain cases, as the description says.

`punches`required	`required\|array\|max:2000`
`punches.*.pin`required	`required\|string\|max:32`
`punches.*.time`required	`required\|date`
`punches.*.status`	`nullable\|string\|max:8`

Example request

Link to this endpoint

curl -X POST "https://api.mihnaro.com/api/v1/biometric/punches" \
  -H "X-Device-Token: $MIHNARO_DEVICE_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"punches":[]}'

MCP servers

Streamable HTTP, with the same tokens and keys as the API. The tools do what the matching endpoints do. How to connect

`https://api.mihnaro.com/mcp/app` 306 tools

access_control changes data Door access control like BioTime (devices.manage, docs/devices.md). kind time_zones (name {en, ar},...

Door access control like BioTime (devices.manage, docs/devices.md). kind time_zones (name {en, ar}, device_tz_id 2-50, schedule {sun..sat, holiday: up to 3 [["08:00","12:00"]] intervals}), levels (name, access_time_zone_id, doors [{device_id, door (0 = all)}]) or assignments (access_level_id, target_type employee|group|department|branch|position|all|visitor, target_id (a group: whoever joins it gets the access, whoever leaves loses it; or target_ids [..] for several employees at once: one assignment each), effect allow|deny, biometric_device_id for a device-only deny, visitor_name, visitor_pin, visitor_card, starts_at, ends_at, note). action list, save (id to change; fields), delete (id). Every change syncs the devices.

Argument	Type	Description
`company_id`required	integer
`kind`required	string time_zones \| levels \| assignments
`action`required	string list \| save \| delete
`id`	integer
`fields`	object

account_deletion changes data The signed-in person's request to delete their Mihnaro account and data (docs/account-deletion.md),...

The signed-in person's request to delete their Mihnaro account and data (docs/account-deletion.md), as GET/POST /api/v1/app/me/deletion-request. action "status" lists their requests; "request" asks for deletion (optional reason): HR of each of their companies and the Mihnaro team are told. A pending request is returned instead of a new one.

Argument	Type	Description
`action`required	string status \| request	status: my requests; request: ask for deletion
`reason`	string	Optional: why

act_on_attendance_recommendations changes data Look at attendance again (action refresh, with from and to; the last month by default, three months...

Look at attendance again (action refresh, with from and to; the last month by default, three months at most), or act on pending recommendations by ids: ignore, notify (tell the direct manager) or apply (an absence becomes leave of leave_type_id; time taken from the leave type attendance setup names; overtime and salary deductions come with requests and payroll).

Argument	Type	Description
`company_id`required	integer
`action`required	string refresh \| ignore \| notify \| apply
`ids`	array
`from`	string
`to`	string
`leave_type_id`	integer	Apply: the leave type absences are recorded as

add_org_level changes data Add a missing organization level (department, section, work location…) while filling an employee's j...

Add a missing organization level (department, section, work location…) while filling an employee's job details, as the employee page does. Needs structure.manage, and the employee's branch (or, for a new hire, the branch worked in) must allow adding organization levels from the employee page.

Argument	Type	Description
`company_id`required	integer
`type`required	string work_location \| department \| section \| project \| hierarchy_group \| business_unit \| division \| segment
`name`required	object	{"en": "...", "ar": "..."}
`parent_id`	integer	For a section: its department.
`employee_id`	integer	The employee being edited (their branch decides); leave out for a new hire.

app_dashboard changes data The dashboard the mobile app draws for you: the widgets you may see, as blocks (stat, chart, list, c...

The dashboard the mobile app draws for you: the widgets you may see, as blocks (stat, chart, list, card), each with what it opens in the app. action read returns them, with the optional filters period (this_month, last_month, last_30, this_quarter, this_year), from, to, branch_id and department_id. action save changes the order and what shows on the phone, without touching the web: order (keys), show (keys; the others are hidden), or reset (true) to follow the web again. A widget you may not see is refused.

Argument	Type	Description
`company_id`required	integer
`action`required	string read \| save
`period`	string	read: this_month, last_month, last_30, this_quarter or this_year
`from`	string	read: Y-m-d
`to`	string	read: Y-m-d
`branch_id`	integer	read: narrow to this branch, inside what you reach
`department_id`	integer	read: narrow to this department, inside what you reach
`order`	array	save: widget keys in order
`show`	array	save: the widget keys to show; the others are hidden
`reset`	boolean	save: go back to following the web's layout

app_reminders changes data People not on the Mihnaro app yet (docs/platform-control.md «لم يدخلوا التطبيق بعد»): current employ...

People not on the Mihnaro app yet (docs/platform-control.md «لم يدخلوا التطبيق بعد»): current employees in your scope who never signed in to the app. action list (app_devices.view; filters q, branch_id, account yes|no; page, per_page): employee_id, number, name, branch, has_account, email and mobile half hidden, last_reminded_at, reminders. action send (app_devices.remind): channel email|whatsapp, employee_ids [..] or all=true (with filters), at most 500, nobody twice in 24 hours, a few a minute: someone with an account gets the store links and the sign-in steps, someone without one the invitation to choose a password; push can't reach them. Returns queued, invitations, skipped {reason: count}. Every send is in the notifications log.

Argument	Type	Description
`company_id`required	integer
`action`required	string list \| send
`channel`	string email \| whatsapp
`employee_ids`	array
`all`	boolean
`filters`	object
`page`	integer
`per_page`	integer

archive_employee changes data "Delete" an employee: the record is archived, never deleted. It leaves the lists, headcount, payroll...

"Delete" an employee: the record is archived, never deleted. It leaves the lists, headcount, payroll runs, approvals and fingerprint devices and the person can no longer sign in; attendance, payslips, requests, documents and history stay linked. Its number stays reserved. Not the same as terminate_employee (end of service). Undo with restore_employee. Needs employees.archive.

Argument	Type	Description
`company_id`required	integer
`employee_id`	integer	The internal id; or give employee_number.
`employee_number`	string
`branch_id`	integer	With employee_number, when numbers repeat across branches.
`reason`	string	Why it is archived (optional, up to 500 characters).

assign_role changes data Give a role to a current employee who has a sign-in account, in a scope: company, branch (scope_id =...

Give a role to a current employee who has a sign-in account, in a scope: company, branch (scope_id = branch id), department, work_location, section, project, hierarchy_group, business_unit, division or segment (scope_id = that unit's id), reports (the person's own reports) or reports_of (scope_id = an employee whose reports it covers).

Argument	Type	Description
`company_id`required	integer
`employee_id`required	integer
`role_id`required	integer
`scope`required	string company \| branch \| department \| work_location \| section \| project \| hierarchy_group \| business_unit \| division \| segment \| reports \| team \| reports_of
`scope_id`	integer	The branch, unit or employee, for those scopes.

assign_to_project changes data Assign an employee to a project, or change their assignment: job role (position), contribution perce...

Assign an employee to a project, or change their assignment: job role (position), contribution percentage, staff code, dates.

Argument	Type	Description
`company_id`required	integer
`project_id`required	integer
`employee_id`required	integer
`position_id`	integer	Job role on the project
`contribution_percent`	number	0-100, default what the employee has left (an employee's projects add up to 100% at most)
`staff_code`	string
`start_date`	string	YYYY-MM-DD
`end_date`	string	YYYY-MM-DD

biometric_templates read only Biometric templates and compatibility (devices.manage, docs/devices.md). view templates: an employee...

Biometric templates and compatibility (devices.manage, docs/devices.md). view templates: an employee's templates (type, algorithm version, source device); the template data only with include_data true and employees.view_sensitive, and the export is audited. view compatibility: every template against every device (or device_id) with the reason a device can't take one. view conflicts: slots two devices hold different data for, each version with its device, enrolment and seen time (settle with resolve_template_conflict). view duplicates: the same template data under different PINs (possible duplicate person).

Argument	Type	Description
`company_id`required	integer
`view`	string templates \| compatibility \| conflicts \| duplicates
`employee_id`	integer
`device_id`	integer
`include_data`	boolean

buddy_punching_review changes data HR's review of buddy punching (docs/attendance-security.md §19). Signals are evidence, never a verdi...

HR's review of buddy punching (docs/attendance-security.md §19). Signals are evidence, never a verdict, and change no attendance. attendance.buddy.view: action people (scores with what was found, highest first), signals (filters employee, kind, status), presence (filters employee, status, failed). attendance.buddy.review: action decide_signal (id, decision confirm|dismiss, note; dismissing takes its weight off the score), review_presence (id, decision excuse|confirm, note). attendance.buddy.export: action export (the people table as rows). Same API: buddy-punching/*.

Argument	Type	Description
`company_id`required	integer
`action`required	string people \| signals \| presence \| decide_signal \| review_presence \| export
`id`	integer
`decision`	string
`note`	string
`employee`	integer
`kind`	string
`status`	string
`failed`	boolean

buddy_punching_settings changes data The four layers against one employee clocking in for another (attendance.buddy.manage, docs/attendan...

The four layers against one employee clocking in for another (attendance.buddy.manage, docs/attendance-security.md §19). action get: each layer's mode, settings, rules, and whether the face model is on the server. action set with layer bp_face|bp_device_key|bp_presence|bp_pattern: inherit (use the Mihnaro default), or mode off|flag|refuse (bp_pattern can only flag); bp_face: enrol_required (the biometric photo in the app before anything else), enrol_approval (HR approves it before it counts), enrol_remind_days, enrol_photo_days, blink_required (a blink on a short clip as well as the head movement), weak_action flag|refuse, refused_action allow|flag|refuse; bp_presence: per_shift 1–4, respond_minutes 2–60, percent 1–100; bp_pattern: tandem_seconds, tandem_min, stay_minutes, dual_minutes, window_days, notify_score; rules [{target_type all|branch|department|section|work_location|group|employee, target_id, effect include|exclude}], no include = everyone. Off by default; demo and reviewer accounts are never reached. Same API: GET settings/buddy-punching, PATCH settings/buddy-punching/{layer}.

Argument	Type	Description
`company_id`required	integer
`action`required	string get \| set
`layer`	string bp_face \| bp_device_key \| bp_presence \| bp_pattern
`inherit`	boolean
`mode`	string off \| flag \| refuse
`weak_action`	string
`refused_action`	string
`enrol_required`	boolean
`enrol_approval`	boolean
`enrol_remind_days`	integer
`enrol_photo_days`	integer
`blink_required`	boolean
`per_shift`	integer
`respond_minutes`	integer
`percent`	integer
`tandem_seconds`	integer
`tandem_min`	integer
`stay_minutes`	integer
`dual_minutes`	integer
`window_days`	integer
`notify_score`	integer
`rules`	array

calculate_hr read only Run one of mihnaro.com's free HR calculators for a country (ISO code, default IQ; list_calculator_co...

Run one of mihnaro.com's free HR calculators for a country (ISO code, default IQ; list_calculator_countries lists the ones with rules) and get the breakdown, the total and the rules used, each with its source and basis "law" (verified on an official page), "confirmed" (the company accountant), "owner" (the owner, 2026-11-02) or "estimate". A calculator runs only when every rule it uses is verified against an official source; otherwise the answer is an error with code "not_confirmed", the rules not confirmed and the country's "requires confirmation" list. Results are not legal or tax advice; nothing is stored. tool: end-of-service (start_date, end_date as Y-m-d, basic; optional days_per_year, leaving_reason termination|resignation, min_years, unused_leave_days) | net-salary (basic; allowances, marital_status single|married, ss_employee_percent) | gross-salary (net; allowances, marital_status, ss_employee_percent) | overtime (basic; hours, rest_day_hours, holiday_hours, multiplier, rest_day_multiplier, holiday_multiplier, hours_per_day) | leave (basic; encash_days, unpaid_days, day_base) | cost-to-company (basic; allowances, other_monthly, annual_extras, marital_status, ss_employee_percent, ss_employer_percent). Some countries add region (state, province or region code), children (household tax) or month (1–12, cumulative tax) to the salary tools. The inputs a country takes are in list_hr_calculators. Money is monthly, in the country's currency. Same as GET /api/v1/tools/calculators/{tool}.

Argument	Type	Description
`tool`required	string end-of-service \| net-salary \| gross-salary \| overtime \| leave \| cost-to-company
`inputs`required	object	The tool's inputs, e.g. {"basic": 1500000, "allowances": 300000}.
`country`	string	ISO country code, e.g. "SA". Default IQ.
`variant`	string	The country's rule variant when it has more than one (e.g. "saudi", "non-saudi"); default its first.
`date`	string	Use the rules in force on this day (Y-m-d); default today.

cancel_request changes data Cancel an approved request or time off (ZenHR's Request to Cancel). action cancel: HR over the emplo...

Cancel an approved request or time off (ZenHR's Request to Cancel). action cancel: HR over the employee (requests.manage, or leaves.manage for time off) cancels it now; the employee's own ask walks the cancellation cycle (the request's approval chain, step by step); reason optional. Its payroll transactions, in-advance salary, hour deductions and probation extension are taken back, unless a closed payroll month already paid them. action decide: the approver of the step it waits on (or HR over the employee, whose decision is final) approves or rejects (decision approved|rejected, note optional); the last approval cancels it. action list: asks waiting for your decision, with cancel_chain, waiting_on and cancel_decisions. kind requests|leaves, id.

Argument	Type	Description
`company_id`required	integer
`action`required	string cancel \| decide \| list
`kind`	string requests \| leaves
`id`	integer
`reason`	string
`decision`	string approved \| rejected
`note`	string

clock changes data Clock in or out now, under the company's clocking rules (network, work location with lat and lng, da...

Clock in or out now, under the company's clocking rules (network, work location with lat and lng, days off, QR only). action: in or out, or scan with a work location's QR code (qr_token, and t and s of a rotating code: the parts of its /clock/qr/{token}?t=&s= link); attendance_function_id for a function (break, visit...). Punches are always now: a past time (occurred_at) is refused, since only the mobile app keeps punches offline and proves their time.

Argument	Type	Description
`company_id`required	integer
`action`required	string in \| out \| scan
`qr_token`	string
`t`	integer
`s`	string
`lat`	number
`lng`	number
`attendance_function_id`	integer
`occurred_at`	string

clocking_devices changes data The phones and browsers employees clock from (attendance.security.review, docs/attendance-security.m...

The phones and browsers employees clock from (attendance.security.review, docs/attendance-security.md). action list (filters employee_id, kind phone|browser, status pending|approved|blocked|retired, device), or for one device (id): approve, block, reset (the next punch from it needs approval again), rename (label), share (shared true/false: a shared computer, exempt from the same-device check; browsers only). action reset_employee with employee_id resets all of an employee's phones.

Argument	Type	Description
`company_id`required	integer
`action`required	string list \| approve \| block \| reset \| rename \| share \| reset_employee
`id`	integer
`employee_id`	integer
`kind`	string phone \| browser
`status`	string pending \| approved \| blocked \| retired
`device`	string
`label`	string
`shared`	boolean

company_connected_apps can delete The AI apps people connected to this company (integrations.ai_apps.manage). action list: each connec...

The AI apps people connected to this company (integrations.ai_apps.manage). action list: each connection with its person and last use. action revoke: grant_id; the app stops at once and its owner is told. Confirm before revoking. docs/ai-integrations.md.

Argument	Type	Description
`company_id`required	integer
`action`	string list \| revoke
`grant_id`	integer

company_limits changes data The company's file sizes, counts and lengths (docs/limits.md), as /api/v1 settings/limits. action re...

The company's file sizes, counts and lengths (docs/limits.md), as /api/v1 settings/limits. action read (limits.view): each limit with its company, branch and platform values, the value in force and the server's ceiling for files. action update (limits.manage): values {key: number, or null to go back to the level above}, sizes in KB; only the keys sent change. branch_id: one branch's own values.

Argument	Type	Description
`company_id`required	integer
`action`	string read \| update	read by default.
`branch_id`	integer	One branch's own values, not the main branch.
`values`	object	For update: {key: number or null}.

decide_leave changes data Decide the step a pending leave request waits on, when it is waiting on you (its approval chain: the...

Decide the step a pending leave request waits on, when it is waiting on you (its approval chain: the employee's manager, HR with requests.manage, or the people an approval template names): leave_id, decision approved or rejected, decision_note (some types need it to reject), non_deduct (approve without taking the days; needs leaves.manage and a type that allows it). Not your own.

Argument	Type	Description
`company_id`required	integer
`leave_id`required	integer
`decision`required	string approved \| rejected
`decision_note`	string
`non_deduct`	boolean

decide_request changes data Act on requests from the approvals page. action decide: approve or reject the step items wait on, wh...

Act on requests from the approvals page. action decide: approve or reject the step items wait on, when it is waiting on you (items: "request:ID" or "leave:ID", several at once; ones you can't decide are skipped). action override: decide one item waiting on someone else, when you may override it (the approval template's admins, else HR or a manager above). action withdraw: pull back your own pending request (items: one "request:ID"). decision approved or rejected, decision_note. Never your own request.

Argument	Type	Description
`company_id`required	integer
`action`required	string decide \| override \| withdraw
`items`required	array
`decision`	string approved \| rejected
`decision_note`	string

delete_document can delete Delete a document and its files (by id from list_documents). Allowed for whoever uploaded it, HR for...

Delete a document and its files (by id from list_documents). Allowed for whoever uploaded it, HR for employees in their scope, and company-wide HR for company documents.

Argument	Type	Description
`company_id`required	integer
`document_id`required	integer

delete_employee_file_record can delete Remove a contract, bank account, family member or document from an employee's file (its files are de...

Remove a contract, bank account, family member or document from an employee's file (its files are deleted too).

Argument	Type	Description
`company_id`required	integer
`employee_id`required	integer
`kind`required	string contracts \| bank_accounts \| family \| documents
`record_id`required	integer

delete_org_unit changes data Delete an unused unit of the organization structure. Refused while any employee (former ones include...

Delete an unused unit of the organization structure. Refused while any employee (former ones included) is in it, a section hangs under it, or anything else still uses it: turn it off with save_org_unit (is_active false) instead.

Argument	Type	Description
`company_id`required	integer
`unit_id`required	integer

delete_permission_group changes data Delete a group: its people lose what its seats gave them. As DELETE permission-groups/{id}. Needs ro...

Delete a group: its people lose what its seats gave them. As DELETE permission-groups/{id}. Needs roles.manage.

Argument	Type	Description
`company_id`required	integer
`group_id`required	integer

delete_permission_override changes data Take off one person's exception. As DELETE permission-overrides/{id}. Needs roles.manage.

Take off one person's exception. As DELETE permission-overrides/{id}. Needs roles.manage.

Argument	Type	Description
`company_id`required	integer
`override_id`required	integer

delete_role can delete Delete a role; everyone who had it loses it.

Delete a role; everyone who had it loses it.

Argument	Type	Description
`company_id`required	integer
`role_id`required	integer

delete_time_setup_item changes data Delete a time setup item by kind and id (attendance_setup.manage). A shift or work location still in...

Delete a time setup item by kind and id (attendance_setup.manage). A shift or work location still in use is kept, with an error.

Argument	Type	Description
`company_id`required	integer
`kind`required	string shifts \| overtime_types \| holidays \| geolocations \| biometric_devices
`id`required	integer

describe_section read only What an engine section is made of for you: its columns, filters, record fields, forms, actions and b...

What an engine section is made of for you: its columns, filters, record fields, forms, actions and blocks, each with its permission. What is closed to you isn't listed (docs/mobile-engine.md).

Argument	Type	Description
`company_id`required	integer
`section`required	string employees \| employee_contracts \| employee_bank_accounts \| employee_family \| employee_documents \| employee_job_history \| terminations \| attendance_sheet \| attendance_records \| missing_punches \| team_locations \| team_leaves \| leave_balances \| leave_adjustments \| employee_shifts \| team_schedule \| work_shifts \| approval_delegations \| manage_announcements \| manage_events \| manage_tasks \| manage_letters \| disciplinary_actions \| suspensions \| company_assets \| field_jobs \| field_sites \| field_customers \| field_customer_sites \| field_technicians \| field_parts \| field_part_movements \| field_stock_locations \| field_movements \| field_vehicles \| field_vehicle_documents \| field_vehicle_maintenance \| field_vehicle_fuel \| field_overtime \| evaluation_cycles \| cycle_evaluations \| goals \| key_positions \| successors \| job_openings \| job_candidates \| candidates \| candidate_notes \| candidate_interviews \| candidate_offers \| my_interviews \| offers \| assessment_tests \| assessment_questions \| assessment_invitations \| assessment_grading \| my_assessments \| boardings \| boarding_tasks \| boarding_templates \| employee_checklists \| payroll_runs \| payroll_run_payslips \| payroll_salaries \| payroll_packages \| payroll_package_templates \| payroll_transactions \| payroll_settlements \| payroll_settlement_slips \| payroll_loans \| payroll_loan_installments \| payroll_overtimes \| payroll_insurance \| payroll_air_tickets \| payroll_provisions \| setup_branches \| setup_org_units \| setup_positions \| setup_org_levels \| setup_termination_reasons \| setup_checklist_templates \| setup_shifts \| setup_holidays \| setup_overtime_types \| setup_attendance_functions \| setup_leave_types \| setup_payroll_general \| setup_payroll_advance \| setup_payroll_extra_settings \| setup_payroll_tax_settings \| setup_payroll_social_security \| setup_payroll_tax \| setup_payroll_extra \| setup_payroll_bank_accounts \| setup_transaction_types \| setup_part_time_transaction_types \| setup_loan_types \| setup_cost_centers \| setup_salary_bands \| setup_expense_types \| setup_cities \| setup_attendance_devices \| setup_device_time_zones \| setup_roles \| setup_roles_assignments \| setup_permission_groups \| setup_permission_exceptions \| setup_api_keys \| setup_webhooks \| setup_imports

device_action changes data Act on a device (devices.manage, docs/devices.md). action sync (send what differs), pull (all users...

Act on a device (devices.manage, docs/devices.md). action sync (send what differs), pull (all users and templates back from the device), pull_logs (the attendance log from the day from (Y-m-d) to the day to, default today; punches already received are not doubled), info, check, reboot, clear_log, open_door / close_door (door, seconds), set_time; queued for the device's next poll. action remove_users (pins): take people who left or numbers no employee owns off this device; current employees are refused. action settings: access_mode attendance (everyone enrolled; punches count) | access (door only: people with an access level, time zones enforced; punches not counted as attendance) | both (door rules and punches count), sync_enabled, strict_users, family terminal|panel, lock_count, and the branches it serves: all_branches true, or branch_ids (a device shared between branches); its punch rules (docs/devices.md, "Punch rules"): punch_mode first_last|all|function (null = the sheet template's), pair_breaks (with first_last: the punches between the first and the last pair up as breaks), break_function_id (breaks kept as records of that attendance function; none = break time is not worked), debounce_minutes (double-tap window, null = the company's), punch_in_window_minutes and punch_out_grace_minutes (punches by shift, docs/attendance.md: a shift's own windows come first, null = the company's); with recompute_from (Y-m-d) the device's punches since then are paired again under the rule; its network lock (docs/attendance-security.md): allowed_ips (addresses or CIDR ranges, comma-separated; requests from elsewhere are refused; empty = anywhere) and confirm_ip true (trust the address it reports from now, after an "address changed" alarm). action recompute with from (Y-m-d): pair the device's punches since then again. action retry or cancel with command_id.

Argument	Type	Description
`company_id`required	integer
`action`required	string sync \| pull \| pull_logs \| info \| check \| reboot \| clear_log \| open_door \| close_door \| set_time \| duplicate_check \| settings \| recompute \| retry \| cancel
`device_id`	integer
`command_id`	integer
`pins`	array	remove_users: device numbers to take off this device (people who left, unknown numbers; list_devices view users shows reason)
`door`	integer
`seconds`	integer
`from`	string	pull_logs: first day (Y-m-d); recompute: the date to pair punches again from
`to`	string	pull_logs: last day (Y-m-d), default today
`access_mode`	string attendance \| access \| both
`sync_enabled`	boolean
`strict_users`	boolean
`family`	string terminal \| panel
`lock_count`	integer
`all_branches`	boolean
`branch_ids`	array
`punch_mode`	string first_last \| all \| function
`pair_breaks`	boolean
`break_function_id`	integer
`debounce_minutes`	integer
`punch_in_window_minutes`	integer
`punch_out_grace_minutes`	integer
`recompute_from`	string
`allowed_ips`	string	settings: addresses or CIDR ranges the device may report from, comma-separated; empty = anywhere
`confirm_ip`	boolean

door_events changes data Door events the devices reported (devices.manage, docs/devices.md): granted, denied (with the reason...

Door events the devices reported (devices.manage, docs/devices.md): granted, denied (with the reason), alarm (forced door, duress, tamper) and state. action list with optional device, result, employee, pin, door, from, to, alerts (unacknowledged alerts only); up to 500, newest first. action acknowledge with event_id.

Argument	Type	Description
`company_id`required	integer
`action`	string list \| acknowledge
`event_id`	integer
`device`	integer
`result`	string granted \| denied \| alarm \| state \| info
`employee`	integer
`pin`	string
`door`	integer
`from`	string
`to`	string
`alerts`	boolean

download_letter_pdf changes data An HR letter (kind letter, in the letter's language) or a signed document with its signature and aud...

An HR letter (kind letter, in the letter's language) or a signed document with its signature and audit trail (kind signature) as a PDF file, as GET /api/v1/letters/{id}/pdf and /api/v1/signatures/{id}/pdf. Only letters and signatures I may see, and the file needs documents.download for the letter's employee; a signature request not signed yet has no PDF. Returns filename, mime, size and the file as base64, plus the download link in the app.

Argument	Type	Description
`company_id`required	integer
`kind`	string letter \| signature
`id`required	integer
`lang`	string en \| ar

download_payslip_pdf changes data A payslip as a PDF file, as GET /api/v1/payslips/{id}/pdf: my own once its run is approved, or any i...

A payslip as a PDF file, as GET /api/v1/payslips/{id}/pdf: my own once its run is approved, or any in my payroll scope. Returns filename, mime, size and the file as base64, plus the download link in the app. lang en or ar (default: my language).

Argument	Type	Description
`company_id`required	integer
`payslip_id`required	integer
`lang`	string en \| ar

download_salaries_excel read only The Salaries report as ZenHR's Excel sheet (docs/payroll-salaries-excel.md), as GET /reports/salarie...

The Salaries report as ZenHR's Excel sheet (docs/payroll-salaries-excel.md), as GET /reports/salaries/run?format=xlsx_colored (colored true, the default) or format=xlsx (colored false, "Not colored"): ZenHR's layout read from its own file: logo, title, branch and date, a band row (General Details, Incomes, Reserved Transactions, Company Expenses, Deductions, Company Contributions) over the columns in ZenHR's order, a Serial column, cells filled in their band's colour (or all white), money as "[$IQD] #,##0.000" and a Totals row; right to left in Arabic. filters: the Salaries report filters as run_report takes them (years[], months[], employees[], settlement_type, cols, show…). saved_id starts from saved options. lang en or ar (default: my language). Returns filename, mime, size and the file as base64.

Argument	Type	Description
`company_id`required	integer
`filters`	object
`saved_id`	integer
`lang`	string en \| ar
`colored`	boolean

download_workflow_pdf read only An onboarding, offboarding, clearance or resumption workflow as a printable PDF checklist (first-day...

An onboarding, offboarding, clearance or resumption workflow as a printable PDF checklist (first-day details, tasks in order with assignee, due date and status, sign-off lines), as GET /api/v1/app/companies/{id}/boardings/{workflow}/pdf. My own workflow once sent, or one whose employee is in my employees.view scope. lang en|ar (Arabic is right to left). Returns filename, mime, size and the file as base64, plus the download link in the app.

Argument	Type	Description
`company_id`required	integer
`id`required	integer
`lang`	string en \| ar

earned_wage changes data Earned wage access, the same as the screens. action available: what I can take now in the open payro...

Earned wage access, the same as the screens. action available: what I can take now in the open payroll month (earned so far, taken, limit, available, requests left, fee, and why not when blocked). To ask, file the "earned_wage" request type (amount, reason) with the requests tools. action settings: the company settings; action update_settings (payroll_setup.manage): any of ewa_enabled, ewa_percent (1-100 of what is earned), ewa_max_requests (a month), ewa_min_amount, ewa_fee (deducted with the advance), ewa_last_day (0 = any day), ewa_include_allowances, ewa_min_service_days.

Argument	Type	Description
`company_id`required	integer
`action`required	string available \| settings \| update_settings
`ewa_enabled`	boolean
`ewa_percent`	number
`ewa_max_requests`	integer
`ewa_min_amount`	number
`ewa_fee`	number
`ewa_last_day`	integer
`ewa_include_allowances`	boolean
`ewa_min_service_days`	integer

edit_letter_template changes data The letter template editor (letters.manage; docs/letters.md), as /api/v1 letter-templates: action ge...

The letter template editor (letters.manage; docs/letters.md), as /api/v1 letter-templates: action get: one template with its HTML body (template_id). action placeholders: what a body can have inserted ({name}, {salary}, … with their names, and {signature:ID} for active e-signatures). action upload_image: keep a picture (the logo, a stamp) in Mihnaro from data (a data: URL or base64, PNG, JPEG or GIF, within the letter_image_kb limit of company_limits) and name; put the returned url in the body as <img src="url" style="width: 30%">. action preview: the body (or template_id's) as its letter prints, filled for employee_id or with each placeholder shown by name; language ar|en. action preview_pdf: the same as a PDF file (base64). Save the body with save_letter_template.

Argument	Type	Description
`company_id`required	integer
`action`required	string get \| placeholders \| upload_image \| preview \| preview_pdf
`template_id`	integer
`body`	string	HTML or plain text with {placeholders}
`language`	string ar \| en
`employee_id`	integer
`addressed_to`	string
`effective_date`	string	YYYY-MM-DD
`data`	string	data:image/png;base64,… or base64
`name`	string

employee_accounts changes data Employees' sign-in accounts (employees.manage, in my scope; docs/company-management.md). action exis...

Employees' sign-in accounts (employees.manage, in my scope; docs/company-management.md). action existing_users: ZenHR's "Add Employee for an Existing User" list, the ended records (latest per person) to rehire with rehire_employee and company accounts with no employee record (q searches number, name, email). action temporary_password: employee_id with temporary_password (the company's password policy); they must change it after signing in; never the owner's or your own account. action unlock: employee_id, unlocks an account locked by failed sign-in attempts.

Argument	Type	Description
`company_id`required	integer
`action`required	string existing_users \| temporary_password \| unlock
`employee_id`	integer
`temporary_password`	string
`q`	string

employee_clocking_from changes data Where one employee clocks from (attendance.clocking_from.manage, docs/branch-settings.md §2.8). acti...

Where one employee clocks from (attendance.clocking_from.manage, docs/branch-settings.md §2.8). action get: their own choice, the branch's and what applies. action set with clocking_from: both, web, mobile or device (the fingerprint or face device only; refused while no working device serves their branch), or follow to go back to the branch's.

Argument	Type	Description
`company_id`required	integer
`employee_id`required	integer
`action`required	string get \| set
`clocking_from`	string both \| web \| mobile \| device \| follow

employee_groups changes data Employee groups like BioTime (employee_groups.manage or devices.manage, docs/employee-groups.md). ac...

Employee groups like BioTime (employee_groups.manage or devices.manage, docs/employee-groups.md). action list; get (id): members with how they are in (member = picked, rule = by department/position/branch); save (id to change; fields name {en, ar}, description {en, ar}, color #rrggbb, branch_id (empty = every branch), rules {departments, positions, branches: [ids]}, member_ids); delete (id: its door access and shift shares go too); add_members / remove_members (id, employee_ids). Put a group on devices with manage_device_people enroll by group, and give it door access with access_control assignments target_type group: joining or leaving the group then follows on the devices.

Argument	Type	Description
`company_id`required	integer
`action`required	string list \| get \| save \| delete \| add_members \| remove_members
`id`	integer
`fields`	object
`employee_ids`	array

explain_access read only Why is this open? For one person and one permission, on the web and in the app: open or closed, and...

Why is this open? For one person and one permission, on the web and in the app: open or closed, and what makes it so (owner, personal exception, role and scope, or group seat). As GET people/{user}/access/explain. Needs roles.manage.

Argument	Type	Description
`company_id`required	integer
`user_id`required	integer
`permission`required	string

export_notification_log read only The notifications log as a file (notifications.log.view, docs/notifications.md "سجل الإشعارات"), as...

The notifications log as a file (notifications.log.view, docs/notifications.md "سجل الإشعارات"), as GET notification-log/export: format csv (default) or xlsx, with the same filters as list_notification_log (at most 10,000 notices), or with send (an id) that notice's recipients and each channel's answer. Returns filename, mime, size and the file as base64.

Argument	Type	Description
`company_id`required	integer
`format`	string csv \| xlsx
`send`	integer	One notice's recipients instead of the list.
`from`	string
`to`	string
`category`	string
`channel`	string
`status`	string
`person`	integer
`branch`	integer
`kind`	string
`actor`	integer
`q`	string

face_templates changes data Face templates (attendance.face.manage, docs/attendance-security.md §19). A template is encrypted nu...

Face templates (attendance.face.manage, docs/attendance-security.md §19). A template is encrypted numbers, and neither it nor any picture is ever returned, including the photo waiting for approval, which HR sees on the screen or the API only. action missing: who hasn't taken the biometric photo their company asks for. action list (filters employee, review pending|approved): status, similarity to the profile photo, enrolled and last matched. action consents (filter employee): the audit trail of consent and template events. action approve (id, note): HR accepts an enrolment. action reset (employee_id, note): deletes the template, and the next selfie enrols again. Same API: buddy-punching/faces, buddy-punching/consents.

Argument	Type	Description
`company_id`required	integer
`action`required	string list \| missing \| consents \| approve \| reset
`id`	integer
`employee_id`	integer
`employee`	integer
`review`	string
`note`	string

field_dispatch changes data The field dispatch board (docs/field-proof.md §12), as GET field/dispatch, GET field/jobs/{job}/cand...

The field dispatch board (docs/field-proof.md §12), as GET field/dispatch, GET field/jobs/{job}/candidates, POST field/jobs/{job}/reassign, POST field/jobs/bulk-cancel and GET field/jobs/{job}/events. action candidates (field.dispatch.manage): job_id, q; who could take the job, best first (available, matching zone or skill, nearest, fewest open jobs). action board (field.dispatch.view): the day's jobs (date Y-m-d, default today, plus open jobs from earlier days or without a date) with their sites and status, and the field employees with their latest verified photo position and, where the company uses live location and you have live_location.view, their live ping; filters branch_id, status, q. action reassign (field.dispatch.manage): job_id, employee_id (an active employee of the job's branch), note; an assigned or in-progress job goes to that employee alone, logged, and the employees are told. action bulk_cancel (field.jobs.cancel): job_ids (up to 200) and reason; open jobs are cancelled and logged, others come back as skipped (not_found, not_open). action events: job_id, the job's dispatch log.

Argument	Type	Description
`company_id`required	integer
`action`required	string board \| candidates \| reassign \| bulk_cancel \| events
`date`	string	Y-m-d, for board
`filters`	object	branch_id, status, q
`job_id`	integer
`employee_id`	integer
`note`	string
`q`	string
`job_ids`	array
`reason`	string
`branch`	string

field_overtime changes data Overtime from field proof (docs/field-proof.md §18), as the field/overtime API. action summary (fiel...

Overtime from field proof (docs/field-proof.md §18), as the field/overtime API. action summary (field.overtime.view): job_id → the verified time on site against the schedule (before/after the shift, day off), the overtime, warnings and the linked request. action draft (field.jobs.overtime): job_id → draft the overtime request now for a submitted job. action mine (no permission): the signed-in employee's overtime requests from field jobs, drafts first. action submit: request_id, reason (required), overtime_type_id (optional) → the employee (or HR over them) sends the draft into the normal approval chain. action discard: request_id → cancel the draft. action queue (field.overtime.view): overtime from field jobs in your branches; filters status (pending by default, or all), q. action decide (field.overtime.approve): request_id, decision approved or rejected, note (required to reject); only when the request waits on you, as POST field/overtime/{id}/decide.

Argument	Type	Description
`company_id`required	integer
`action`required	string summary \| draft \| mine \| submit \| discard \| queue \| decide
`job_id`	integer
`request_id`	integer
`reason`	string
`overtime_type_id`	integer
`decision`	string approved \| rejected
`note`	string
`filters`	object
`branch`	string

field_proof_settings changes data The company's Field proof settings (field_setup.manage, docs/field-proof.md), as GET/PATCH field/set...

The company's Field proof settings (field_setup.manage, docs/field-proof.md), as GET/PATCH field/settings. Without values: read them. values may set field_proof_enabled, field_offline_allowed, field_require_hardware_key, field_auto_overtime, field_job_stage_override, field_departure_photo (booleans); field_min_progress_photos, field_progress_interval_min, field_site_radius_m, field_max_accuracy_m, field_max_offline_hours, field_overtime_min_minutes (numbers); field_mock_policy, field_integrity_policy, field_outside_site_policy (reject or flag); field_recapture_policy (flag or off: the queued check for a photo of a screen or a print only ever flags). Everything starts off. With branch_id: that branch's own values over the company's, as GET/PATCH field/settings/branches/{branch}; each key comes back as {company, branch (null = inherited), effective, source}, and a value of null or "inherit" takes it back to the company's.

Argument	Type	Description
`company_id`required	integer
`branch_id`	integer
`values`	object

file_request changes data File a request of a type (see list_request_types) with its fields: for yourself, or with employee_id...

File a request of a type (see list_request_types) with its fields: for yourself, or with employee_id for someone you may file for (requests.manage in scope, or their manager when the type allows it). It goes through the type's approval chain; a type with no approval needed is approved at once. Attachments are sent through the API or the screen.

Argument	Type	Description
`company_id`required	integer
`type`required	string
`fields`required	object
`employee_id`	integer

geocode_address changes data Street addresses from Mihnaro's own geocoder (docs/field-proof.md §21), as GET field/geocode/search...

Street addresses from Mihnaro's own geocoder (docs/field-proof.md §21), as GET field/geocode/search and field/geocode/reverse. action search: q (2–200 characters, Arabic or English), lang (en or ar), optional lat and lng to prefer results near them, limit (1–10); returns places with label, area (street level, no house number), lat, lng and parts. action reverse: lat, lng, lang; returns the nearest address or null. available is false when the geocoder is down or off. Any user of a company with the FSM license; rate-limited per user.

Argument	Type	Description
`company_id`required	integer
`action`required	string search \| reverse
`q`	string
`lang`	string en \| ar
`lat`	number
`lng`	number
`limit`	integer

get_activity_log read only The company's activity log (activity.view, docs/activity-log.md), newest first, 40 a page. tab chang...

The company's activity log (activity.view, docs/activity-log.md), newest first, 40 a page. tab changes: record changes with old → new values (filters scope employee/time/payroll/organization/company/system, area, action created/updated/deleted, level user/employee/branch/company, user, employee, branch, from, to); secrets and ID numbers show as •••. tab requests: every change request from the screens, the API and MCP (filters user, channel web/api/mcp, from, to, q). tab sign_ins: the company's people's sign-ins (filters user, from, to, new_only).

Argument	Type	Description
`company_id`required	integer
`tab`	string changes \| requests \| sign_ins
`scope`	string employee \| time \| payroll \| organization \| company \| system
`area`	string
`action`	string created \| updated \| deleted \| purged
`level`	string user \| employee \| branch \| company
`user`	integer
`employee`	integer
`branch`	integer
`channel`	string web \| api \| mcp
`from`	string
`to`	string
`q`	string
`new_only`	boolean
`page`	integer

get_announcement read only One company announcement in full: title and text {en, ar} (body_format html for ZenHR's rich text),...

One company announcement in full: title and text {en, ar} (body_format html for ZenHR's rich text), publish date, author, ZenHR's recipient criteria (audience) and the targets enforced (only for those with announcements.manage or announcements.recipients) (targets: branches, departments, sections, positions, work_locations, projects, genders, religions, employees), start and expiry (scheduled), read_minutes, gallery (pictures in order with captions {en, ar}; url to read each), attachments (url to download a copied or uploaded file), and the ZenHR record it was imported from. Only one the person may read; another is "not found".

Argument	Type	Description
`company_id`required	integer
`announcement_id`required	integer

get_app_brand read only The main brand the Mihnaro mobile app is built with (docs/mobile-app.md, GET /api/v1/app/brand): the...

The main brand the Mihnaro mobile app is built with (docs/mobile-app.md, GET /api/v1/app/brand): the brand navy and teal from the admin panel, the logo and mark (dark and white), the app icon sources (an uploaded square icon, else the mark) and a version that changes when any of it does.

No arguments.
get_app_branding read only What the Mihnaro mobile app is painted with (docs/mobile-app.md): the system palette (primary, secon...

What the Mihnaro mobile app is painted with (docs/mobile-app.md): the system palette (primary, secondary, sidebar, login panel) and logos from the admin panel, and the addresses single sign-on may return to. A company's own logo is in get_company_context.

No arguments.

get_app_colors read only The mobile app colors of a company or one of its branches (app_colors.view): what this level saved,...

The mobile app colors of a company or one of its branches (app_colors.view): what this level saved, what people see (with the darker button color when white text is hard to read on the chosen one), what it follows, and which branches have their own. Same as GET /api/v1/app/companies/{company}/settings/app-colors.

Argument	Type	Description
`company_id`required	integer
`branch_id`	integer	One branch's own colors; none: the company's.

get_app_navigation read only The mobile app's menu for you: the web menu filtered by license and permission, each item opening an...

The mobile app's menu for you: the web menu filtered by license and permission, each item opening an engine section or one of the app's own screens. pending counts the menu items the app has no screen for yet.

Argument	Type	Description
`company_id`required	integer

get_appearance read only The look in a company: the company's saved choices (for settings.manage), whether people may choose...

The look in a company: the company's saved choices (for settings.manage), whether people may choose their own, the signed-in person's own choices and what they see, and every allowed value. Same as GET /api/v1/app/me/appearance and .../settings/appearance.

Argument	Type	Description
`company_id`required	integer

get_approval_cycle read only A request's approval cycle, as ZenHR shows it (docs/approvals.md): every step in order with approver...

A request's approval cycle, as ZenHR shows it (docs/approvals.md): every step in order with approver (name), approver_ids, step and step_label, status (approved, rejected, skipped, delegated, pending, waiting = ZenHR's "Waiting / Draft", withdrawn), received_at, decided_at, note, override, on_behalf_of, imported (ZenHR history). kind requests (an employee request: financial transaction, overtime, loan, miscellaneous, missing punch…) or leaves (time off), id. Whoever may see the request: the employee, HR over them, or an approver.

Argument	Type	Description
`company_id`required	integer
`kind`required	string requests \| leaves
`id`required	integer

get_branch_context read only The branch workspace the tools work in for this company: the current branch (or all_branches), wheth...

The branch workspace the tools work in for this company: the current branch (or all_branches), whether "all" may be chosen, and the branches this user may switch to. Every other company tool shows only the current branch's data; pass branch (a branch id or "all"; in_branch where a tool already uses branch as a filter) to a tool, or the X-Branch header, to use another branch for one call.

Argument	Type	Description
`company_id`required	integer

get_calculator_country read only One country's calculator rules in force (per variant): every rule's value, its source (law, article,...

One country's calculator rules in force (per variant): every rule's value, its source (law, article, official URL, the date it was read) and whether it is verified, the tools available and notes. available=false when the country has no rules yet. Same as GET /api/v1/tools/countries/{code}.

Argument	Type	Description
`country`required	string	ISO code ("JO") or the site's address part ("jordan").

get_clock_button_scope read only "Hide the clock button outside the work location" (attendance_setup.manage, docs/attendance-security...

"Hide the clock button outside the work location" (attendance_setup.manage, docs/attendance-security.md §17): whether the mobile app shows the clock in/out button only inside a work location, and for whom: scope all, or chosen branch_ids, department_ids and employee_ids (any of them reaches the employee). branch_id reads a branch's own value (empty: the company's). choices lists what that level may name: a branch's own value only that branch, its departments and its employees.

Argument	Type	Description
`company_id`required	integer
`branch_id`	integer

get_clocking_security read only Clocking security settings (attendance.security.manage, docs/attendance-security.md): each anti-spoo...

Clocking security settings (attendance.security.manage, docs/attendance-security.md): each anti-spoofing check's mode (off, flag, hold, block), the numbers they use, whether Play Integrity, App Attest and a GeoIP database are configured on the server, the office Wi-Fi networks, and the clocking rules set elsewhere in Attendance setup (allowed IPs, office network, selfie, rotating QR). branch_id reads a branch's own values.

Argument	Type	Description
`company_id`required	integer
`branch_id`	integer

get_company_context read only For one company of the signed-in user: the modules its license includes, the license dates, and the...

For one company of the signed-in user: the modules its license includes, the license dates, and the branches this user can work in.

Argument	Type	Description
`company_id`required	integer

get_company_settings read only System preferences → Account setup: company names, address, phone, email, logo, currency, working ho...

System preferences → Account setup: company names, address, phone, email, logo, currency, working hours and grace, weekend days (0 = Sunday), end-of-service days and minimum years, org chart type (company or branch) and whether only HR sees it; and mail_server, the company's own mail server (its password is never returned, and it is changed only on the screen or the API), with employee_emails: whether "Email employees" is on (docs/mail.md).

Argument	Type	Description
`company_id`required	integer

get_dashboard read only A dashboard's figures, the same as on the screen (docs/dashboards.md), for the employees in the pers...

A dashboard's figures, the same as on the screen (docs/dashboards.md), for the employees in the person's scope. section hr: the Home Page, built from the widget registry; only the widgets the person may see are computed (each needs its section's permission: headcount, charts and contracts employees.view, documents employees.view_sensitive, time off leaves.view, attendance attendance.view, payroll cost payroll.view, recruitment recruitment.view, field jobs field.jobs.view, and the person's own cards self.*), a part none of them needs is null; widgets narrows it to some keys (see manage_my_dashboards home_widgets); filters: period (this_month, last_month, last_30, this_quarter, this_year) or from/to (YYYY-MM-DD), branch_id, department_id; kpis carry value, previous (the period before) and change in percent. attendance (attendance.view: today, the last 14 days, most late and absent this month), payroll (payroll.view: latest regular run totals, six months, basic salary ranges, recent runs, loans), assets (assets.manage: by status, type and department, value, a year of purchases, expiring soon). Amounts are in the company currency.

Argument	Type	Description
`company_id`required	integer
`section`required	string hr \| attendance \| payroll \| assets \| performance
`widgets`	array
`period`	string this_month \| last_month \| last_30 \| this_quarter \| this_year \| custom
`from`	string
`to`	string
`branch_id`	integer
`department_id`	integer

get_e_signature_image read only The picture of one of the company's e-signatures (list_employee_settings kind e_signatures gives the...

The picture of one of the company's e-signatures (list_employee_settings kind e_signatures gives the ids), as GET /api/v1/app/companies/{id}/employee-settings/e_signatures/{id}/image. Needs employee_settings.e_signatures.manage or letters.manage. Returns filename, mime, size and the image as base64.

Argument	Type	Description
`company_id`required	integer
`id`required	integer

get_employee read only One employee record, by employee_id or by employee_number (the number people use; add branch_id when...

One employee record, by employee_id or by employee_number (the number people use; add branch_id when numbers repeat across branches). Archived records are found too (archived: true).

Argument	Type	Description
`company_id`required	integer
`employee_id`	integer	The internal id; or give employee_number.
`employee_number`	string	The employee number, e.g. 1101.
`branch_id`	integer	With employee_number, when numbers repeat across branches.

get_employee_history read only An employee's job history: hired, changes (department, position, grade, manager...), transfers and e...

An employee's job history: hired, changes (department, position, grade, manager...), transfers and end of service, with dates and readable lines; and their dated professional data records.

Argument	Type	Description
`company_id`required	integer
`employee_id`required	integer

get_employee_numbering read only How the company numbers its employees: prefix, padding (digits), next_number, scope (numbers unique...

How the company numbers its employees: prefix, padding (digits), next_number, scope (numbers unique across the company or per branch), allow_reuse (whether archived and ended numbers may be given again), and per branch its own numbering, the highest number used and the number its next employee gets. Needs employee_settings.manage.

Argument	Type	Description
`company_id`required	integer

get_help read only The help center (docs/help.md): where things are and how the common tasks are done, as topics with t...

The help center (docs/help.md): where things are and how the common tasks are done, as topics with their steps and the page to open, only for what the user may use, in their language.

Argument	Type	Description
`company_id`required	integer

get_help_article read only One public help center article (docs/help-center.md) by `category` and `slug` from search_help_cente...

One public help center article (docs/help-center.md) by `category` and `slug` from search_help_center: its title, summary, HTML body, sections and link, in English, or Arabic with `locale: ar`.

Argument	Type	Description
`category`required	string
`slug`required	string
`locale`	string en \| ar

get_holiday_calendar read only A month of the company's holidays (each with its first and last day), the next holidays, and with le...

A month of the company's holidays (each with its first and last day), the next holidays, and with leaves.view who in the person's scope is on approved leave that month (otherwise leaves is null). month is YYYY-MM, this month by default.

Argument	Type	Description
`company_id`required	integer
`month`	string	YYYY-MM

get_log_retention read only How long the company keeps its activity log (retention 6 | 12 | 24 | forever), the choices allowed u...

How long the company keeps its activity log (retention 6 | 12 | 24 | forever), the choices allowed under Mihnaro's maximum, the months actually kept and the date before which entries are deleted tonight.

Argument	Type	Description
`company_id`required	integer

get_map_tiles read only Where the app's maps take their pictures from: the tile address, its attribution and the highest zoo...

Where the app's maps take their pictures from: the tile address, its attribution and the highest zoom. For anyone signed in, the same as GET map-tiles.

No arguments.

get_my_access read only What the signed-in person may open in a company, as the mobile app uses it: the licensed modules, ea...

What the signed-in person may open in a company, as the mobile app uses it: the licensed modules, each permission with its scope ("company" or the branches, departments and reports it covers), and the features that follow (clock, attendance, leaves, requests, payslips, approvals, directory, documents, tasks, announcements, notifications), and clock_channels (the branch setting "Clocking from": both, web or mobile; clock is false for web-only). The same as GET me/access.

Argument	Type	Description
`company_id`required	integer

get_my_attendance read only Your attendance for a month (YYYY-MM, this month by default): each day with its status (present, lat...

Your attendance for a month (YYYY-MM, this month by default): each day with its status (present, late, absent, leave, holiday, weekend), worked minutes and records, plus today's records and whether you are clocked in, and clock: today's shift, state (not_in, in, out), since, whether clocking in is closed and why, and what clocking needs (location_required, qr, qr_only, photo_required).

Argument	Type	Description
`company_id`required	integer
`month`	string	YYYY-MM

get_my_leaves read only Your leave balances for a year (this year by default) and your leave requests with their status.

Your leave balances for a year (this year by default) and your leave requests with their status.

Argument	Type	Description
`company_id`required	integer
`year`	integer

get_my_performance read only My performance: my evaluations (scores hidden until complete), the evaluations waiting for my review...

My performance: my evaluations (scores hidden until complete), the evaluations waiting for my review, my goals, the 360° feedback requests I owe and my feedback forms.

Argument	Type	Description
`company_id`required	integer

get_my_permissions read only What the signed-in user may do in a company and where: each permission (sub-module permissions inclu...

What the signed-in user may do in a company and where: each permission (sub-module permissions included, also when they come with their module permission) with "company" or the branches, departments and reports it covers. Owners have everything.

Argument	Type	Description
`company_id`required	integer

get_my_profile read only My profile in a company: my name, email, username, roles, and my employee record (number, job, depar...

My profile in a company: my name, email, username, roles, and my employee record (number, job, department, branch, manager, hire date). To change my password use the API (PUT /api/v1/app/me/password).

Argument	Type	Description
`company_id`required	integer

get_my_schedule read only Your work schedule from from to to (YYYY-MM-DD, up to 62 days; the next 7 days by default): each day...

Your work schedule from from to to (YYYY-MM-DD, up to 62 days; the next 7 days by default): each day with working_day, weekend, holiday (its name), day_off (a day off given in the schedule), assigned (from the published schedule rather than your own shift), shift {name, type, start, end, color} and an approved leave {type, hours}.

Argument	Type	Description
`company_id`required	integer
`from`	string	YYYY-MM-DD
`to`	string	YYYY-MM-DD

get_my_timesheet read only Your timesheet period holding week (any date in it; today by default) with its entries, and all your...

Your timesheet period holding week (any date in it; today by default) with its entries, and all your periods with their timesheet ID, hours, contribution percentage and status.

Argument	Type	Description
`company_id`required	integer
`week`	string	YYYY-MM-DD

get_my_two_factor read only My two-step verification: whether it is available, on, required (by the platform or one of my compan...

My two-step verification: whether it is available, on, required (by the platform or one of my companies), and how many recovery codes are left. Setting it up or turning it off is done in the app or the API, never here, so keys and codes don't pass through an AI tool.

No arguments.

get_org_chart read only The org chart: who reports to whom, as nested trees (one for the company, or one per branch if the c...

The org chart: who reports to whom, as nested trees (one for the company, or one per branch if the company set it so). Each person has "reports". Filters (ZenHR's): department, branch, job_role, work_location, section, project, hierarchy_group, business_unit, division, segment (ids), work_type, q (name or number). Hidden from non-HR when the company hides the org structure.

Argument	Type	Description
`company_id`required	integer
`department`	integer	Department id
`branch`	integer	Branch id
`job_role`	integer
`work_location`	integer
`section`	integer
`project`	integer
`hierarchy_group`	integer
`business_unit`	integer
`division`	integer
`segment`	integer
`work_type`	string
`q`	string	Name or employee number

get_performance_kpis read only The performance KPI dashboard (performance.view or .manage, their scope): for a cycle (cycle_id, def...

The performance KPI dashboard (performance.view or .manage, their scope): for a cycle (cycle_id, default the latest) and optional branch_id / department_id: completion by stage, average scores by branch, department and position, the score distribution, goal and OKR progress, top and bottom performers, and overdue evaluations.

Argument	Type	Description
`company_id`required	integer
`cycle_id`	integer
`branch_id`	integer
`department_id`	integer

get_person_access read only See as them: every permission a person has on the web and in the app, each field's level (about_empl...

See as them: every permission a person has on the web and in the app, each field's level (about_employee_id for one employee), and their exceptions. As GET people/{user}/access. Needs roles.manage.

Argument	Type	Description
`company_id`required	integer
`user_id`required	integer
`about_employee_id`	integer

get_person_app_devices read only A person's phones with the Mihnaro app and their sign-in activity in this company (docs/platform-con...

A person's phones with the Mihnaro app and their sign-in activity in this company (docs/platform-control.md "Phone activity"): each phone (version, state, push, first and last IP with the approximate local GeoIP place, first and last seen) with its latest 30 events, and other_activity not tied to a known phone. user_id defaults to the signed-in person (anyone may see their own); another person needs app_devices.view with a scope that covers them. Plus map_points, the events map (docs/platform-control.md «خريطة الأحداث»): [{type clock_in|clock_out|field_photo|sign_in|sign_in_failed|sign_out|app_open|other, event, at, lat, lng, approximate (true = a city from the local GeoIP for the event's IP), accuracy, place, event_id (its timeline row), install_id}], newest first; GPS points (punches, Field proof photos) only with the location permission (map_gps). Event GPS (docs/platform-control.md «موقع الأحداث»): every event row has has_gps (whether the app sent its own GPS point with it: sign_in, app_open, version_changed); with the location permission (platform.phones.location, or live_location.view in scope) the row also carries location {lat, lng, accuracy, at, source app_event, mocked}. Without it only the IP place shows, which is approximate (a city). map_points now also include live-location pings (type live) and the app's own GPS with events; each point has source punch|live|field|app_event|ip (ip = approximate, from the IP); map_gps_hidden = GPS points exist that this viewer may not see.

Argument	Type	Description
`company_id`required	integer
`user_id`	integer

get_person_device_context read only The phone details the Mihnaro app sent for a person in this company (app_devices.context, docs/platf...

The phone details the Mihnaro app sent for a person in this company (app_devices.context, docs/platform-control.md «بيانات الهاتف»), collected only for the categories the company's switches allow: phones [{install_id, device_id, model, platform, location_state {location always|while_using|denied|undetermined, precise, services}, latest {device, network, battery, permissions, security (with the last punch's app integrity verdict), time (with clock_offset_ms vs the server), locale, health}}] and history [{at, trigger open|resume|sign_in|punch, category, install_id, event_id, data}], newest first. Filters: install_id, category, limit (≤500). Same API: GET /api/v1/app/companies/{id}/app-devices/people/{user}/context. Never contains contacts, media, messages, other apps, hardware ids or advertising ids.

Argument	Type	Description
`company_id`required	integer
`user_id`required	integer
`install_id`	integer
`category`	string device \| network \| battery \| permissions \| security \| time \| locale \| health
`limit`	integer

get_regional_settings read only Regional settings (date and time format, calendar, Arabic month names, first day of the week, numera...

Regional settings (date and time format, calendar, Arabic month names, first day of the week, numerals, separators, currency display; docs/regional-settings.md). mine=true: my effective formats (my branch, else the company, else the platform) with English and Arabic samples, for anyone in the company. Otherwise the company defaults, the choices with their labels, and every branch's own values (null = follows the company), effective values and where each comes from (needs settings.manage or branches.manage). Same as GET /api/v1/app/companies/{id}/me/locale and …/regional-settings.

Argument	Type	Description
`company_id`required	integer
`mine`	boolean	true: only my effective formats.

get_sign_in_settings read only System preferences → Sign-in security: whether the company requires two-step verification (and the p...

System preferences → Sign-in security: whether the company requires two-step verification (and the platform mode: off, optional, required), its own password policy next to Mihnaro's, and its single sign-on: OpenID Connect or SAML 2.0 provider, "SSO only" and the exempt users, and the URLs to give the provider (SAML ACS, entity ID, metadata). The client secret is never returned, only whether it is set.

Argument	Type	Description
`company_id`required	integer

get_sso_audit_log read only The company's single sign-on audit log, newest first: sign-ins through the provider (OpenID Connect...

The company's single sign-on audit log, newest first: sign-ins through the provider (OpenID Connect or SAML), refusals with the reason, password sign-ins blocked by "SSO only", and changes to the sign-in settings (field names only).

Argument	Type	Description
`company_id`required	integer
`limit`	integer	1-200, default 50.
`event`	string sign_in \| sign_in_failed \| password_blocked \| settings_changed

get_team_attendance_today read only One day of the team's attendance (attendance.view, today by default): counts of present, late, absen...

One day of the team's attendance (attendance.view, today by default): counts of present, late, absent, not yet, on leave and off, and each person in reach with their status and first and last punch.

Argument	Type	Description
`company_id`required	integer
`date`	string	YYYY-MM-DD; today by default

get_team_calendar read only The team calendar for a month (YYYY-MM, this month by default): leaves — who is off or working remot...

The team calendar for a month (YYYY-MM, this month by default): leaves — who is off or working remotely (remote), with start, end and hours for an hour leave, among the people the branch's "Who's off shows" setting picks; the leave type only for someone with leaves.view — plus holidays {date: name} and the company events.

Argument	Type	Description
`company_id`required	integer
`month`	string	YYYY-MM

get_termination_check read only Leaving (docs/terminations.md, employees.terminate). With employee_id: the background check before t...

Leaving (docs/terminations.md, employees.terminate). With employee_id: the background check before terminate_employee (pending_count; who to substitute as direct manager, supervisor, approver or key staff; pending requests; loans still owed; assets held) with contracts, insurance and cost centers for information, and the end-of-service estimate today for each termination type. Without employee_id: the leaving records of the employees in scope.

Argument	Type	Description
`company_id`required	integer
`employee_id`	integer

get_time_settings read only Attendance setup (clocking rules and missing punches) or Timesheets setup: section attendance or tim...

Attendance setup (clocking rules and missing punches) or Timesheets setup: section attendance or timesheets. Needs attendance_setup.manage.

Argument	Type	Description
`company_id`required	integer
`section`required	string attendance \| timesheets

global_search read only Search the company system the way the top bar does (Ctrl+K): employees (by name in Arabic or Latin l...

Search the company system the way the top bar does (Ctrl+K): employees (by name in Arabic or Latin letters, number, phone), requests and time off (by number such as LV-000012), documents, contracts, payslips, payroll runs, tasks, letters, assets, announcements, departments, job titles, pages, settings and shortcuts such as "Add employee". Typos and partial words are fine. It understands plain Arabic or English filters, e.g. "طلبات إجازة معلقة بفرع Ltd", "موظفين قسم الحسابات", "عقود تنتهي هذا الشهر", "pending overtime requests", "رواتب أكتوبر", and says what it understood. Only what the user may see, in the current branch workspace (or the branch argument). Results come in groups, each with a title, subtitle, url and target (what it opens in the mobile app, or null). A field hidden from the user is neither searched nor shown.

Argument	Type	Description
`company_id`required	integer
`q`	string	What to look for: a name, employee number, request number (e.g. LV-000012), document title, page or setting
`groups`	array	Only these groups; all when left out
`limit`	integer	Results per group, 1-20 (6 by default)
`without`	array	Filters read from the words to ignore (the chips removed): type, kind, status, branch, department, period, mine
`filters`	object	Filters given outright, winning over the words: types (list of employees, leaves, requests, documents, contracts, payslips, payroll, tasks, letters, assets, announcements, departments, positions), status (pending, approved, rejected, cancelled, active, inactive, done), kind (a request type such as overtime), branch_id, department_id, from and to (Y-m-d), date_field (date or end), mine (true)
`branch`	string	Branch id or "all" for this call; the user's chosen branch when left out

import_rows changes data Import data from rows: each row is an object of field → value (fields from list_importers). Without...

Import data from rows: each row is an object of field → value (fields from list_importers). Without commit it only checks every row and lists the problems; with commit=true it saves all rows, or none if anything is wrong. New employees get sign-in accounts; their temporary passwords are returned once.

Argument	Type	Description
`company_id`required	integer
`type`required	string	employees, employees-quick, family-members, contracts, bank-accounts or custom-fields
`rows`required	array	[{"employee_no": "EMP-1", "name_en": "...", ...}]
`mode`	string create \| update	update: change employees that already exist (by employee number)
`commit`	boolean	false (default) only checks
`options`	object	Batch-wide choices from list_importers (e.g. overtime: {"overtime_type_id": 3, "transaction_type_id": 7}), overriding the rows

invite_employees changes data Invite current employees without a sign-in account to the app (employees.manage, docs/attendance.md...

Invite current employees without a sign-in account to the app (employees.manage, docs/attendance.md §13), by branch_id and department_id, channel email or whatsapp. Without send it only previews: how many would be invited, how many are skipped and why (has_account, invited_recently, no_email, no_mobile, email_in_use, emails_off = "Email employees" is held for the company or branch, docs/mail.md) and a masked sample. send true with expected (the previewed count) queues the messages, 20 a minute, one batch per company at a time. Only send when the person asked to send.

Argument	Type	Description
`company_id`required	integer
`channel`required	string email \| whatsapp
`branch_id`	integer
`department_id`	integer
`send`	boolean	true to send; leave out to preview.
`expected`	integer	With send: the eligible count from the preview.

issue_letter changes data HR letters. action issue: a letter from letter_template_id for employee_id in your scope (letters.ma...

HR letters. action issue: a letter from letter_template_id for employee_id in your scope (letters.manage), addressed_to optional; a template that needs approval keeps it from the employee until someone else approves it. action generate: a self-service template for yourself. action confirm: confirm you received your letter (letter_id). action decide: approve or reject a letter waiting for approval (letter_id, decision approved|rejected; letters.manage, not one you issued). The text is filled from the template's placeholders.

Argument	Type	Description
`company_id`required	integer
`action`required	string issue \| generate \| confirm \| decide
`letter_template_id`	integer
`employee_id`	integer
`addressed_to`	string
`effective_date`	string	Y-m-d, defaults to today
`letter_id`	integer
`decision`	string approved \| rejected

list_accounting read only Direct accounting connectors (each ledger needs integrations.{provider}.manage, which integrations.m...

Direct accounting connectors (each ledger needs integrations.{provider}.manage, which integrations.manage grants; docs/accounting-connectors.md): odoo, quickbooks, xero, netsuite, business_central, sap_b1, sap_s4hana, dynamics_fo. kind providers: every ledger and whether the company is connected. kind connection (provider): its state, non-secret fields, posting options and catalog counts (secrets are never returned, only whether each is saved). kind catalog (provider): the ledger's accounts, analytic accounts, partners and journals as last read. kind mappings (provider): Mihnaro accounts, cost centers, branches and employees with their ledger ids and suggestions. kind preview (provider, run_id): the payroll's journal entries in ledger ids, with references and anything blocking them. kind postings (provider optional, status, run_id): the posting log. kind posting (posting_id): one posting with its lines and attempts.

Argument	Type	Description
`company_id`required	integer
`kind`required	string providers \| connection \| catalog \| mappings \| preview \| postings \| posting
`provider`	string odoo \| quickbooks \| xero \| netsuite \| business_central \| sap_b1 \| sap_s4hana \| dynamics_fo
`branch_id`	integer	A branch's own connection (when the ledger is set per branch); empty = the company's.
`run_id`	integer
`posting_id`	integer
`status`	string pending \| posted \| failed \| reversed

list_air_ticket_policies read only Air ticket policies (payroll_setup.manage, HR module). Without policy_id: every policy with its tick...

Air ticket policies (payroll_setup.manage, HR module). Without policy_id: every policy with its tickets per period, period_months, period_anchor hire|calendar, accrual period_start|monthly, amount per ticket, family_members covered, eligible_after_months, applies_to all|assigned, expiry, cash_out, switches and employees_count. With policy_id: that policy plus the employees in my payroll.manage scope it was given to, with their opening_balance.

Argument	Type	Description
`company_id`required	integer
`policy_id`	integer	One policy with the employees it was given to.

list_air_tickets read only Air tickets of the employees in my payroll scope (payroll.view or payroll.manage, HR module). kind t...

Air tickets of the employees in my payroll scope (payroll.view or payroll.manage, HR module). kind transactions: tickets used, newest travel first, with owners, tickets, amount, cash_out, destination, dates, payment_status paid|unpaid and deletable; filters employee_id, policy, status paid|unpaid, payment cash_out|booked, payroll in_payroll|off_cycle, request_status (a request status or added_by_hr), from, to (travel date), paid_from, paid_to. kind balances: each active employee under each of their policies: total, used, pending, balance, amount, per_period, eligible_from, current period; filter policy. page and per_page (10-200).

Argument	Type	Description
`company_id`required	integer
`kind`required	string transactions \| balances
`employee_id`	integer
`policy`	integer	Air ticket policy id.
`status`	string paid \| unpaid
`payment`	string cash_out \| booked
`payroll`	string in_payroll \| off_cycle
`request_status`	string
`from`	string	YYYY-MM-DD
`to`	string	YYYY-MM-DD
`paid_from`	string
`paid_to`	string
`page`	integer
`per_page`	integer

list_announcements read only The company's announcements, pinned first then newest by publish date (imported ones in ZenHR's orde...

The company's announcements, pinned first then newest by publish date (imported ones in ZenHR's order), only those the person may read: the ones for everyone and the ones whose targets reach them (all of them with announcements.manage). q searches the title and text; show: pinned, current or expired.

Argument	Type	Description
`company_id`required	integer
`q`	string
`show`	string pinned \| current \| expired

list_app_device_activity read only The sign-in activity of the company's people on the Mihnaro app (app_devices.view, docs/platform-con...

The sign-in activity of the company's people on the Mihnaro app (app_devices.view, docs/platform-control.md "Phone activity"), only for the people the permission's scope covers and without what other companies recorded: sign-ins and failed attempts, sign-outs, app opens and version changes, push registrations and answers, phone approvals and blocks, each with time, IP and approximate place (local GeoIP), app version, system and model. Filters: user_id, install_id (a phone from list_app_devices), device_id, event, result, from, to; page, per_page. Event GPS (docs/platform-control.md «موقع الأحداث»): every event row has has_gps (whether the app sent its own GPS point with it: sign_in, app_open, version_changed); with the location permission (platform.phones.location, or live_location.view in scope) the row also carries location {lat, lng, accuracy, at, source app_event, mocked}. Without it only the IP place shows, which is approximate (a city).

Argument	Type	Description
`company_id`required	integer
`user_id`	integer
`install_id`	integer
`device_id`	string
`event`	string sign_in \| sign_in_failed \| sign_out \| app_open \| version_changed \| push_registered \| push_result \| push_test \| device_pending \| device_approved \| device_blocked \| device_reset \| device_mismatch \| shared_device_detected \| shared_device_blocked \| shared_device_allowed \| shared_device_revoked \| location_turned_off
`result`	string ok \| failed \| blocked
`from`	string
`to`	string
`page`	integer
`per_page`	integer

list_app_devices read only The phones the company's people use the Mihnaro app on (app_devices.view, docs/platform-control.md "...

The phones the company's people use the Mihnaro app on (app_devices.view, docs/platform-control.md "The company's view"), only for the people the permission's scope covers (company-wide or some branches): person, branches, platform, system version, model, app version, state (below_min, outdated, latest, newer = a test build above the store's latest, store_unknown, unknown = an old app before 1.1 that never reported its version), the last GPS location (only for people whose location the caller may see with live_location.view), push status and first/last seen, plus the summary per platform. Filters: q, branch_id, platform, version, state, push, signed_in, seen_days, shared (only phones used by more than one account; each row has shared {accounts, others, list} when it is); page, per_page.

Argument	Type	Description
`company_id`required	integer
`q`	string
`branch_id`	integer
`platform`	string android \| ios
`version`	string
`state`	string below_min \| outdated \| latest \| newer \| store_unknown \| unknown
`push`	string active \| failing \| none
`signed_in`	boolean
`shared`	boolean
`seen_days`	integer
`page`	integer
`per_page`	integer

list_approvals changes data The approvals page, leave and employee requests together: tab approvals (waiting on me, or what I de...

The approvals page, leave and employee requests together: tab approvals (waiting on me, or what I decided: status pending, approved, rejected, all), my (my own requests), team (the people below me or in my requests.view scope) or override (pending ones I may decide for their approver); type filters by request type key or "leave"; employee_id one employee; sort employee, serial, requested (default, newest first), received or my_action, with dir asc or desc. Serial numbers are as ZenHR shows them ("LEAV - 1000000631950"), list_label the request type name ZenHR shows. Each row has item ("leave:ID" or "request:ID"), who it is from, what it waits on, can_act and can_override. my_action filters by what I did: waiting (not reached me yet), pending, approved, rejected, withdrawn, approved_non_deduct, added_by_hr, delegated, skipped (my step was skipped), cancelled, cancel_requested, none. On tab approvals with status pending, approved requests whose cancellation waits on my step are listed too (action_type cancellation, can_decide_cancel; decide them with cancel_request action decide); action_type approval|cancellation keeps one cycle (ZenHR's "Action type"). On tab my or team with a type that has its own columns (leave, transaction, overtime, loan, general, business_trip, missing_punch, timesheet, vacation_encashment), each row has that type's columns and filters narrows them: {key: value} for a select or yes/no (yes|no), {key_from, key_to} (YYYY-MM-DD) for a date; the answer lists the columns and filters. With request_id, one request with its details and decisions.

Argument	Type	Description
`company_id`required	integer
`tab`	string approvals \| my \| team \| override
`status`	string all \| pending \| approved \| rejected \| withdrawn \| cancelled
`type`	string
`request_id`	integer
`my_action`	string waiting \| pending \| approved \| rejected \| withdrawn \| approved_non_deduct \| added_by_hr \| delegated \| skipped \| cancelled \| cancel_requested \| none
`action_type`	string approval \| cancellation
`filters`	object
`employee_id`	integer
`sort`	string employee \| serial \| requested \| received \| my_action
`dir`	string asc \| desc

list_assessments read only Assessments (pre- and post-employment tests). kind mine: the signed-in employee's own tests (anyone)...

Assessments (pre- and post-employment tests). kind mine: the signed-in employee's own tests (anyone). Needs assessments.manage or assessments.grade: summary (counts, pass rate), invitations (filters test, status pending/started/completed/cancelled, candidate, employee; candidates' links included), attempt (attempt_id: every answer with the right one, points and the anti-cheating log), grading (attempts waiting for a person), results (test_id: every attempt and how each question did), export (test_id: every attempt as a CSV file, as GET .../assessments/tests/{test}/export; returns filename, mime, size and base64). Needs assessments.manage: categories, questions (filters category, type, difficulty, active, q), question (question_id), tests (filters status, purpose, q), test (test_id, with items), templates (the ready test library).

Argument	Type	Description
`company_id`required	integer
`kind`	string summary \| mine \| categories \| questions \| question \| tests \| test \| templates \| invitations \| attempt \| grading \| results \| export
`question_id`	integer
`test_id`	integer
`attempt_id`	integer
`category`	integer
`type`	string single \| multiple \| true_false \| short_text \| long_text \| ordering \| matching \| numeric \| file_upload
`difficulty`	string easy \| medium \| hard
`active`	string
`status`	string
`purpose`	string pre_employment \| post_employment
`test`	integer
`candidate`	integer
`employee`	integer
`q`	string

list_assets changes data Company assets (assets.manage): filter by status (available, assigned, damaged, under_repair, archiv...

Company assets (assets.manage): filter by status (available, assigned, damaged, under_repair, archived), type (asset type id), owner (branch id or none), holder (employee id), expiry_from, expiry_to, q (name or serial number). With asset_id, one asset and its history. kind types lists the asset types instead.

Argument	Type	Description
`company_id`required	integer
`kind`	string assets \| types
`asset_id`	integer
`status`	string available \| assigned \| damaged \| under_repair \| archived
`type`	integer
`owner`	string
`holder`	integer
`expiry_from`	string
`expiry_to`	string
`q`	string

list_attendance_recommendations read only Attendance recommendations (absence, lateness, early leaving, incomplete days, overtime) for the emp...

Attendance recommendations (absence, lateness, early leaving, incomplete days, overtime) for the employees your role reaches (attendance.recommendations.view; attendance.view or attendance.manage grant it): status pending (default), applied or ignored, kind, from, to. 50 a page.

Argument	Type	Description
`company_id`required	integer
`status`	string pending \| applied \| ignored
`kind`	string absence \| lateness \| early_out \| incomplete \| overtime \| leave
`from`	string
`to`	string
`page`	integer

list_attendance_records read only Attendance records of the employees your role reaches (attendance.view), 50 a page: from and to (YYY...

Attendance records of the employees your role reaches (attendance.view), 50 a page: from and to (YYYY-MM-DD, this month by default), employee_id, shift_id (work shift: people on it), state (incomplete, complete, trusted).

Argument	Type	Description
`company_id`required	integer
`from`	string	YYYY-MM-DD
`to`	string	YYYY-MM-DD
`employee_id`	integer
`shift_id`	integer
`state`	string incomplete \| complete \| trusted
`page`	integer

list_attendance_sheets read only ZenHR's Attendance Sheets (attendance.manage): sheets imported from attendance machines, newest firs...

ZenHR's Attendance Sheets (attendance.manage): sheets imported from attendance machines, newest first, 50 a page, each with the dates it covers, punches read (success), failures (no employee + unreadable rows) and status (completed, with_errors, failed). Filters: machine_id, status, from and to (import date, YYYY-MM-DD). template_machine_id instead returns that machine's blank sheet (rows of cells, headings first) in its template's columns. Import a sheet with the API (POST biometric-devices/{id}/sheet).

Argument	Type	Description
`company_id`required	integer
`machine_id`	integer
`status`	string completed \| with_errors \| failed
`from`	string	YYYY-MM-DD
`to`	string	YYYY-MM-DD
`template_machine_id`	integer	Return this machine's blank sheet template instead of the list
`page`	integer

list_business_travel read only Business travel setup (payroll_setup.manage, HR module). kind setup: trip_per_diem_type_id, trip_pay...

Business travel setup (payroll_setup.manage, HR module). kind setup: trip_per_diem_type_id, trip_payment in_payroll|off_cycle, trip_air_ticket_type_id, trip_accommodation_type_id, trip_remind_days, trip_expense_type_ids, trip_slip_breakdown, trip_show_amounts and the per diem components (id, name). kind policies: travel policies with position_ids, destinations (category domestic|international, country and cities or countries, travel_types, air_classes, limits, hotel_tiers, components {type_id, amount, mandatory}) and switches. kind policy: one policy (policy_id).

Argument	Type	Description
`company_id`required	integer
`kind`required	string setup \| policies \| policy
`policy_id`	integer

list_calculator_countries read only The countries mihnaro.com's free HR calculators have rules for: each with the tools it can run, its...

The countries mihnaro.com's free HR calculators have rules for: each with the tools it can run, its variants (e.g. nationals and expatriates), currency and how many of its rules are verified. A country not listed is "not available yet". Same as GET /api/v1/tools/countries.

No arguments.

list_company_branches read only The company's branches with their logos, the license's max_branches and whether another can be added...

The company's branches with their logos, the license's max_branches and whether another can be added.

Argument	Type	Description
`company_id`required	integer

list_company_users read only User setup: the company's accounts with username, roles and where each applies, and status (active o...

User setup: the company's accounts with username, roles and where each applies, and status (active or inactive). Filter by q (name, email, username), role id, status.

Argument	Type	Description
`company_id`required	integer
`q`	string
`role`	integer
`position`	integer	Job role (position) id.
`status`	string active \| inactive

list_connected_accounts read only The company's connected accounts (docs/integration-connections.md): Zoom, Google, Microsoft, LinkedI...

The company's connected accounts (docs/integration-connections.md): Zoom, Google, Microsoft, LinkedIn (needs integrations.connections.manage) and each accounting ledger (needs integrations.{provider}.manage); integrations.manage grants all. Per provider: mode (company = one account for every branch, branch = each branch may have its own, the company's is the fallback), the redirect URI and scopes to register at the provider, the company's connection, and each branch's with "uses" (branch, company or none). Client secrets and tokens are never returned, only has_client_secret.

Argument	Type	Description
`company_id`required	integer

list_devices read only Fingerprint and access devices (devices.manage, docs/devices.md). view list (default): every device...

Fingerprint and access devices (devices.manage, docs/devices.md). view list (default): every device with online status, last seen, IP, family, model, firmware. With device_id: view detail (capabilities and counts on the device vs Mihnaro), commands (command history, optional status), users (the device's users against Mihnaro's: in_sync, changed, missing, extra), plan (what a sync would send) or audit (the device audit log; device_id optional). view sync_report: people whose devices are not all in sync (user record, slots missing, outdated, in conflict, pending, out of capacity).

Argument	Type	Description
`company_id`required	integer
`view`	string list \| detail \| commands \| users \| plan \| audit \| sync_report
`device_id`	integer
`status`	string queued \| sent \| done \| failed \| cancelled

list_directory read only The company directory: active colleagues with their job, department, branch and work contact details...

The company directory: active colleagues with their job, department, branch and work contact details (email, phone, extension). Open to everyone in the company. Search by name, job or email.

Argument	Type	Description
`company_id`required	integer
`q`	string	Name, job title or email
`department`	integer	Department id
`branch`	integer	Branch id
`page`	integer

list_discipline read only Discipline data (docs/discipline.md) for the employees in scope. kind actions: disciplinary actions...

Discipline data (docs/discipline.md) for the employees in scope. kind actions: disciplinary actions (discipline.view or manage; filters status approved|draft, employee_id, disciplinary_type_id, from, to). kind suspensions: suspensions with their request, resumption and cancellation states (HR in scope, or a manager up the line; filters employee_id, reason, status, resumption_status, from, to, resumption_from, resumption_to). kind setup: violation types, action types and escalation rules (discipline_setup.manage). Violation types and suspension reasons are edited with save_setup_form_item (entities disciplinary-types, suspension-reasons).

Argument	Type	Description
`company_id`required	integer
`kind`required	string actions \| suspensions \| setup
`filters`	object	Optional filters for the kind, e.g. {"status": "draft"}.

list_documents read only Documents: my file and company documents for everyone; HR (employees.view_sensitive) also sees emplo...

Documents: my file and company documents for everyone; HR (employees.view_sensitive) also sees employees' files in their scope and the ones expired or expiring soon. tab: all, my, employees, company.

Argument	Type	Description
`company_id`required	integer
`tab`	string all \| my \| employees \| company
`employee`	integer
`category`	integer	Document type id
`page`	integer

list_employee_file read only One section of an employee's file: contracts, bank_accounts, family or documents. Bank accounts and...

One section of an employee's file: contracts, bank_accounts, family or documents. Bank accounts and documents need employees.view_sensitive. Files themselves are downloaded through the app or the API.

Argument	Type	Description
`company_id`required	integer
`employee_id`required	integer
`kind`required	string contracts \| bank_accounts \| family \| documents

list_employee_settings read only The lists behind the employee file: contract_types, job_grades, document_types, custom_fields, org_l...

The lists behind the employee file: contract_types, job_grades, document_types, custom_fields, org_levels or field_rules.

Argument	Type	Description
`company_id`required	integer
`kind`required	string contract_types \| job_grades \| document_types \| custom_fields \| org_levels \| field_rules \| e_signatures \| banks

list_employees read only Employee records, 25 per page. status: current (default, not terminated), active, suspended, termina...

Employee records, 25 per page. status: current (default, not terminated), active, suspended, terminated, all, or archived (archived records only; every other status leaves them out). search matches number, name or email; employee_number matches exactly. Also the license headcount.

Argument	Type	Description
`company_id`required	integer
`status`	string current \| active \| suspended \| terminated \| all \| archived
`employee_number`	string	Exact employee number.
`salary_status`	string running \| stopped	Salary running or stopped (Stop employee salary).
`branch_id`	integer
`search`	string	Number, name or email.
`page`	integer

list_eos_policies read only End-of-service (STB) policies (HR module, payroll_setup.manage): termination category, default flag,...

End-of-service (STB) policies (HR module, payroll_setup.manage): termination category, default flag, minimum years, tiers (from_years, to_years, days_per_year), worth tiers (percent), contract type, excluded unpaid leave, nationalities, allowances counted, calculation options and salary caps. policy_id returns one policy; otherwise filters name, category, contract_type limited|unlimited, defaults_only.

Argument	Type	Description
`company_id`required	integer
`policy_id`	integer
`name`	string
`category`	string
`contract_type`	string limited \| unlimited
`defaults_only`	boolean

list_evaluations read only Evaluation cycles and evaluations. With evaluation_id: one evaluation with criteria, scores, notes a...

Evaluation cycles and evaluations. With evaluation_id: one evaluation with criteria, scores, notes and OKRs (the employee, their task holders, or performance.view/manage over them). With cycle_id: the cycle and its evaluations in scope, filtered by q, branch, position, work_location, department, section, project, hierarchy_group, stage (writing_okrs, auditing_okrs, self_assessment, evaluation, auditing_results), status (in_progress, completed), action (yes: the caller holds the current task), okrs (published, not_published), missing (yes, no), employee_status (active, inactive). Otherwise the cycles, filtered by q (name), status (draft, open, closed) and stage (current stage) (performance.view, performance.manage or performance_setup.manage).

Argument	Type	Description
`company_id`required	integer
`evaluation_id`	integer
`cycle_id`	integer
`q`	string
`branch`	integer
`position`	integer
`work_location`	integer
`department`	integer
`section`	integer
`project`	integer
`hierarchy_group`	integer
`stage`	string
`status`	string
`action`	string
`okrs`	string
`missing`	string
`employee_status`	string

list_events read only Company events: coming up, past, and a month (month YYYY-MM, default this one) as events by day with...

Company events: coming up, past, and a month (month YYYY-MM, default this one) as events by day with the company's holidays. Everyone in the company may read them.

Argument	Type	Description
`company_id`required	integer
`month`	string

list_field_jobs changes data Field work orders and sites (docs/field-proof.md), as GET field/jobs, field/sites and field/my-jobs....

Field work orders and sites (docs/field-proof.md), as GET field/jobs, field/sites and field/my-jobs. kind jobs (field.jobs.view or field.jobs.manage): filters status (assigned, in_progress, submitted, approved, rejected, cancelled), branch_id, site_id, employee_id, q, from, to, per_page; with job_id, one job with its photos. Filters also date (one day), flagged (jobs with a standing flagged photo) and flag (one code); each job has flagged_count. kind summary: the board's counts under the same filters (per status, today, in_progress, awaiting_review, flagged). kind flags: every flag and reason code with its plain-language label and explanation in English and Arabic (no permission needed). kind sites: the sites, q. kind mine: the signed-in employee's own jobs (no permission needed). Only the branches the role covers.

Argument	Type	Description
`company_id`required	integer
`kind`	string jobs \| summary \| sites \| mine \| flags
`job_id`	integer
`filters`	object
`branch`	string

list_hr_calculators read only The free HR calculators of mihnaro.com for a country (ISO code, default IQ): each tool with whether...

The free HR calculators of mihnaro.com for a country (ISO code, default IQ): each tool with whether it is available there, its inputs, and the country's rates in force. Same as GET /api/v1/tools/calculators?country=.

Argument	Type	Description
`country`	string	ISO country code, e.g. "AE". Default IQ.
`variant`	string
`date`	string	Y-m-d; default today.

list_importers read only Import data: the kinds of data that can be imported (employees, quick employees, family members, con...

Import data: the kinds of data that can be imported (employees, quick employees, family members, contracts, bank accounts, custom fields) with their fields, the importers coming with later modules, and the last imported sheets. With type: that importer's template rows (the CSV template: headers then examples; language en|ar; existing true fills it with the current data). Needs company-wide employees.manage and employees.view_sensitive.

Argument	Type	Description
`company_id`required	integer
`type`	string
`language`	string en \| ar
`existing`	boolean

list_insurance read only Medical insurance policies (HR module, payroll.view or payroll.manage): insurer, policy number, date...

Medical insurance policies (HR module, payroll.view or payroll.manage): insurer, policy number, dates, adult and minor cost and currency, pro rata, per employee, branch, and the members whose employee is in my scope (owner: the employee or a family member, dependents, custom cost, monthly deduction, cost). policy_id returns one policy; active true keeps the policies in force today.

Argument	Type	Description
`company_id`required	integer
`policy_id`	integer
`active`	boolean

list_integrations read only API keys and webhooks (integrations.api_keys.manage; kind marketplace needs any integration permissi...

API keys and webhooks (integrations.api_keys.manage; kind marketplace needs any integration permission; integrations.manage grants all; docs/integrations.md). kind keys: the API keys (prefix, abilities, IPs, who they act as, status; never the key). kind webhooks: URLs, events and last delivery (never the secret). kind deliveries: the delivery log, optionally for webhook_id and status delivered or failed. kind delivery: one delivery with its body and every attempt (delivery_id). kind events: the events a webhook can listen to. kind marketplace: the connector catalogue by category with each one's state (filters category, active active|inactive, q).

Argument	Type	Description
`company_id`required	integer
`kind`	string keys \| webhooks \| deliveries \| delivery \| events \| marketplace
`category`	string
`active`	string all \| active \| inactive
`q`	string
`webhook_id`	integer
`delivery_id`	integer
`status`	string delivered \| failed

list_leave_adjustments read only Leave balance adjustments (kind=adjustments, default) or balances moved into a new year (kind=moved)...

Leave balance adjustments (kind=adjustments, default) or balances moved into a new year (kind=moved) for the employees your role reaches (leaves.adjustments.view, or leaves.moved_balances.view for kind=moved; leaves.view or leaves.manage grant both), 50 a page: leave_type_id, year, employee_id. Add or remove them with manage_leave_balances.

Argument	Type	Description
`company_id`required	integer
`kind`	string adjustments \| moved
`leave_type_id`	integer
`year`	integer
`employee_id`	integer
`page`	integer

list_leave_types read only Time off types (leave_setup.manage), of one category (annual, casual, hourly for leaves by the hour,...

Time off types (leave_setup.manage), of one category (annual, casual, hourly for leaves by the hour, sick) or all, with every setting and how many employees have each.

Argument	Type	Description
`company_id`required	integer
`category`	string annual \| casual \| hourly \| sick

list_legal_rules read only Payroll legal validation (HR module): the payroll rules not confirmed under Iraqi law. "blocked" rul...

Payroll legal validation (HR module): the payroll rules not confirmed under Iraqi law. "blocked" rules stay off until validated; "unverified" ones work but are flagged. Each shows whether it is validated, by whom, the reference and when.

Argument	Type	Description
`company_id`required	integer

list_letters changes data HR letters you may see: kind letters (yours once released, and those of the employees in your letter...

HR letters you may see: kind letters (yours once released, and those of the employees in your letters scope; the Manage HR Letters filters: employee_id, template, category, status sent, seen, pending, failed, unseen, unconfirmed, approved or rejected, classification, effective_from/effective_to, confirmation required/not_required/confirmed/unconfirmed, creator, created_from/created_to), templates (all for letters.manage, else the self-service ones you can generate), or signatures (documents sent to sign, yours and those in scope; status pending, signed or declined). With id, one letter or signature request with its text.

Argument	Type	Description
`company_id`required	integer
`kind`	string letters \| templates \| signatures
`id`	integer
`status`	string
`employee_id`	integer
`template`	integer
`category`	integer
`classification`	string positive \| neutral \| negative
`effective_from`	string
`effective_to`	string
`confirmation`	string required \| not_required \| confirmed \| unconfirmed
`creator`	integer
`created_from`	string
`created_to`	string

list_machine_users read only A biometric machine's users (attendance_setup.manage, docs/attendance.md): each number (pin) the mac...

A biometric machine's users (attendance_setup.manage, docs/attendance.md): each number (pin) the machine reported or sent punches for, its name and card on the machine, how many punches and the last one, and the employee it links to (null when none). Attendance sheets exported from the machine are read with POST biometric-devices/{id}/sheet in the API.

Argument	Type	Description
`company_id`required	integer
`device_id`required	integer

list_missing_punches read only Missing-punch requests of the employees your role reaches (attendance.missing_punches.view; attendan...

Missing-punch requests of the employees your role reaches (attendance.missing_punches.view; attendance.view or attendance.manage grant it), newest first, 50 a page: status (pending, approved, rejected, cancelled, withdrawn), from and to (punch date, YYYY-MM-DD), employee_id, employee_status. Decide them with the request tools.

Argument	Type	Description
`company_id`required	integer
`status`	string pending \| approved \| rejected \| cancelled \| withdrawn
`from`	string	YYYY-MM-DD
`to`	string	YYYY-MM-DD
`employee_id`	integer
`employee_status`	string active \| suspended \| terminated	Active or inactive employees only (ZenHR: Active / Inactive / Both)
`page`	integer

list_my_connected_apps read only The AI apps connected to the signed-in person's account and their access tokens for AI apps: id, kin...

The AI apps connected to the signed-in person's account and their access tokens for AI apps: id, kind (oauth or token), name, company, when connected and last used. Token values are never shown. docs/ai-integrations.md.

No arguments.

list_my_notifications read only The person's own notices in the company (the header bell, docs/notifications.md), newest first, with...

The person's own notices in the company (the header bell, docs/notifications.md), newest first, with the unread count; after_id gives only the ones that arrived since (the live bell). unread true for unread only; category one of requests, payroll, attendance, performance, tasks, recruitment, documents, announcements, people, greetings, security, general; page (25 a page).

Argument	Type	Description
`company_id`required	integer
`unread`	boolean
`category`	string requests \| payroll \| attendance \| performance \| tasks \| field \| recruitment \| documents \| announcements \| people \| greetings \| security \| admin \| general
`page`	integer
`after_id`	integer	Only notices newer than this id (what the live bell asks for).

list_my_payslips changes data My payslips from approved payroll runs, newest first, with their lines and slip_type (payroll, in_pa...

My payslips from approved payroll runs, newest first, with their lines and slip_type (payroll, in_payroll_settlement or off_cycle_settlement) and slip_title. With payslip_id, one payslip: my own once approved, or any in my payroll scope.

Argument	Type	Description
`company_id`required	integer
`payslip_id`	integer

list_notification_events read only Which events notify whom (notifications.manage, docs/notifications.md §13): every event with its rec...

Which events notify whom (notifications.manage, docs/notifications.md §13): every event with its recipients (en, ar), category, link, channels, kind (request, record, setup, security, action, scheduled) and whether the company has its category on. Filters: kind, category, q (words).

Argument	Type	Description
`company_id`required	integer
`kind`	string request \| record \| setup \| security \| action \| scheduled
`category`	string
`q`	string

list_notification_log read only The company's notifications log (notifications.log.view, docs/notifications.md "سجل الإشعارات"), as...

The company's notifications log (notifications.log.view, docs/notifications.md "سجل الإشعارات"), as GET notification-log: every notice sent, newest first, with category, event (the code that sent it), text en/ar, link, related record, triggered_by (null = the system), recipients, bell read counts and per channel (push, email, whatsapp) how many people got each status (accepted, sent, logged = written to the log only and NOT delivered, queued, held, skipped, no_device, failed). Only the people in your scope are counted; categories whose records you can't open are left out. Filters: from, to (dates), category, channel (bell, push, email, whatsapp), status (delivered, failed, logged, queued, held, skipped, no_device, read, unread), person (user id), branch (id), kind (system, person, announcement), actor (user id), q (words). Also returns summary (sent today, failed, delivery rate per channel) and channels (whether email, push and WhatsApp can deliver right now).

Argument	Type	Description
`company_id`required	integer
`from`	string	YYYY-MM-DD
`to`	string	YYYY-MM-DD
`category`	string requests \| payroll \| attendance \| performance \| tasks \| field \| recruitment \| documents \| announcements \| people \| greetings \| security \| admin \| general
`channel`	string bell \| push \| email \| whatsapp
`status`	string delivered \| failed \| logged \| queued \| held \| skipped \| no_device \| read \| unread
`person`	integer
`branch`	integer
`kind`	string system \| person \| announcement
`actor`	integer
`q`	string
`page`	integer
`limit`	integer	1-100, default 30.

list_org_units read only The organization structure: work locations, departments, sections (with their department as parent_i...

The organization structure: work locations, departments, sections (with their department as parent_id), projects and hierarchy groups. branch_id null means all branches.

Argument	Type	Description
`company_id`required	integer
`type`	string work_location \| department \| section \| project \| hierarchy_group \| business_unit \| division \| segment

list_payroll changes data Payroll data for payroll staff (payroll.view or payroll.manage), for the employees in scope. kind ru...

Payroll data for payroll staff (payroll.view or payroll.manage), for the employees in scope. kind runs: payroll runs (filters month, kind regular|off_cycle, status draft|approved). kind run: one run with its payslips (run_id). kind payslip: one payslip (payslip_id) with its header (ZenHR slip details) and lines. kind transactions: financial transactions (month, employee_id, type earning|deduction, off_cycle, transaction_type_id, status, q). kind transaction: one transaction's details (transaction_id). kind loans: loans with what is left (employee_id, status active|settled). kind packages: an employee's salary packages (employee_id). kind templates: salary package templates. Setup lists such as transaction types, loan types, cost centers and salary bands are list_setup_form entities.

Argument	Type	Description
`company_id`required	integer
`kind`required	string runs \| run \| payslip \| transactions \| transaction \| loans \| packages \| templates
`run_id`	integer
`payslip_id`	integer
`transaction_id`	integer
`transaction_type_id`	integer
`q`	string
`employee_id`	integer
`month`	string	YYYY-MM
`kind_filter`	string regular \| off_cycle	For kind runs: the run kind.
`status`	string
`type`	string earning \| deduction
`off_cycle`	boolean
`page`	integer
`per_page`	integer

list_payroll_costs read only Payroll costs, rates and salaries (read-only), as the API lists them. Setup kinds need payroll_setup...

Payroll costs, rates and salaries (read-only), as the API lists them. Setup kinds need payroll_setup.manage: kind exchange_rates: currency pairs by effective date with the base currency and the multi-currency switch (filters currency, branch: a branch id or "company"). kind cost_center_groups: groups with the cost centers they include (code, center). Employee kinds need payroll.view or payroll.manage and only show employees in scope: kind cost_allocations: each employee's split over cost centers for a period, status active|inactive|upcoming (employee_id, status, group). kind part_time: part-time transaction assignments (employee_id, type: a transaction type id, effective, from, to dates). kind salaries: every payslip as on Manage salaries, with who has their salary stopped (year, month 1-12, salary_type regular|off_cycle, slip_type payroll|in_payroll_settlement|off_cycle_settlement, run_status draft|pending|rejected|approved|sent, date_from / date_to YYYY-MM, in_advance yes|no, q). kind salary_batches: the Salary Batches tab, each run with its date range, headcount and net (year, month 1-12, salary_type regular|off_cycle, run_status draft|approved). kind calculate_options (payroll.manage): what Calculate offers for salary_month YYYY-MM (else the open month): the grouped picker values (branch:<id>, employee:<id>, org:<id>), the cut-off date range and the draft batches to add to. All take page and per_page; employee kinds also take the org filters department and branch.

Argument	Type	Description
`company_id`required	integer
`kind`required	string exchange_rates \| cost_center_groups \| cost_allocations \| part_time \| salaries \| salary_batches \| calculate_options
`currency`	string
`branch`	string	A branch id; for exchange_rates also "company".
`code`	string
`center`	integer
`employee_id`	integer
`status`	string active \| inactive \| upcoming
`group`	integer
`type`	integer
`effective`	string
`from`	string
`to`	string
`year`	integer
`month`	integer
`salary_type`	string regular \| off_cycle
`slip_type`	string payroll \| in_payroll_settlement \| off_cycle_settlement	For kind salaries: ZenHR's salary slip type.
`run_status`	string draft \| pending \| rejected \| approved \| sent
`date_from`	string
`date_to`	string
`in_advance`	string yes \| no
`in_advance_paid`	string yes \| no
`q`	string
`department`	integer
`salary_month`	string	For kind calculate_options: YYYY-MM.
`page`	integer
`per_page`	integer

list_payroll_setup read only Payroll setup for payroll admins (payroll_setup.manage). kind settings: a settings section's current...

Payroll setup for payroll admins (payroll_setup.manage). kind settings: a settings section's current values (switches as booleans, id lists as arrays, the rest as strings): section payroll_setup (cut-off day, day bases, absence/unpaid calculation, gross-up, tax method, payslip options, negative balances, general finance values), in_advance (in-advance salary setup), extra_salaries (extra salaries setup), tax_setup (what comes off the taxable salary), journal (journal entries structure and account codes), provision_setup (which provisions are calculated). kind rules: a payroll rules list, section social-security, tax, extra-salaries, bank-accounts (filter branch_id), bank-templates or slip-templates.

Argument	Type	Description
`company_id`required	integer
`kind`required	string settings \| rules
`section`required	string payroll_setup \| in_advance \| extra_salaries \| tax_setup \| journal \| provision_setup \| social-security \| tax \| extra-salaries \| bank-accounts \| bank-templates \| slip-templates	Settings sections for kind settings, list sections for kind rules.
`branch_id`	integer	For bank-accounts: only this branch's accounts.

list_pending_biometrics read only New biometrics waiting for HR (devices.manage, docs/devices.md): a new finger, face or palm, or a ne...

New biometrics waiting for HR (devices.manage, docs/devices.md): a new finger, face or palm, or a newer enrolment of one, reported by a device; and conflicts (two devices hold different data for a slot). Each item: employee, slot, source device, kind new|conflict, the devices a publish would reach (targets) and those that can't take it with the reason (incompatible). Optional employee_id. Decide with publish_biometrics.

Argument	Type	Description
`company_id`required	integer
`employee_id`	integer

list_permission_groups read only The company's groups: who is in each (branches, units, named people) and the role of its three seats...

The company's groups: who is in each (branches, units, named people) and the role of its three seats (manager, team leader, employee). As GET permission-groups. Needs roles.manage.

Argument	Type	Description
`company_id`required	integer

list_permission_overrides read only Exceptions for people: an action opened or closed, or a field's level, per channel. Filter by user_i...

Exceptions for people: an action opened or closed, or a field's level, per channel. Filter by user_id. As GET permission-overrides. Needs roles.manage.

Argument	Type	Description
`company_id`required	integer
`user_id`	integer

list_positions read only The company's job titles (positions).

The company's job titles (positions).

Argument	Type	Description
`company_id`required	integer

list_projects read only The company's projects (code, names, client, group and entity codes, manager, dates, budget hours, a...

The company's projects (code, names, client, group and entity codes, manager, dates, budget hours, active or closed). Give project_id for one project with the employees assigned to it and its hours from the timesheets (approved, waiting, labour cost, budget used, by employee and month).

Argument	Type	Description
`company_id`required	integer
`project_id`	integer

list_provisions read only Monthly provisions (vacation compensation, end-of-service benefit, extra salaries, air tickets) for...

Monthly provisions (vacation compensation, end-of-service benefit, extra salaries, air tickets) for the employees in my payroll scope (payroll.view or payroll.manage). kind rows: one row per employee and month with the month's provisions, adjustments and totals; filters month YYYY-MM (default this month) or from / to, stb_types (STB policy ids), contract_type limited|unlimited, employee_status active|inactive, kind_filter (employee kind). kind months: the calculated months with people, the month's provisions and the total. Provision setup is list_payroll_setup section provision_setup.

Argument	Type	Description
`company_id`required	integer
`kind`required	string rows \| months
`month`	string	YYYY-MM
`from`	string	YYYY-MM
`to`	string	YYYY-MM
`stb_types`	array
`contract_type`	string limited \| unlimited
`employee_status`	string active \| inactive
`kind_filter`	string	Employee kind.

list_punch_log read only The punch log (attendance.security.review, docs/attendance-security.md): self-service punches of the...

The punch log (attendance.security.review, docs/attendance-security.md): self-service punches of the employees your role reaches with their context (channel, IP, browser or phone, location and accuracy, mock flag, Wi-Fi, offline proof, integrity verdict) and what the security checks found, newest first, 50 a page. Filters: employee_id, branch_id, from and to (YYYY-MM-DD), channel (web, mobile, mcp), device (device id), ip, flagged (only punches with findings), status (accepted, flagged, held, blocked), review (pending, approved, rejected). id returns one punch.

Argument	Type	Description
`company_id`required	integer
`id`	integer
`employee_id`	integer
`branch_id`	integer
`from`	string	YYYY-MM-DD
`to`	string	YYYY-MM-DD
`channel`	string web \| mobile \| mcp
`device`	string
`ip`	string
`flagged`	boolean
`status`	string accepted \| flagged \| held \| blocked
`review`	string pending \| approved \| rejected
`page`	integer

list_recruitment read only Recruitment (recruitment.view): kind summary (counts and the careers page address), jobs (filters st...

Recruitment (recruitment.view): kind summary (counts and the careers page address), jobs (filters status draft/open/closed, type, department, branch, q), job (job_id: the opening and its candidates by stage), candidates (filters job, stage applied/screening/interview/offer/hired/rejected, source, q), candidate (candidate_id: with notes and interviews), interviews (filters status, from, to, candidate). CVs download through the API.

Argument	Type	Description
`company_id`required	integer
`kind`	string summary \| jobs \| job \| candidates \| candidate \| interviews
`job_id`	integer
`candidate_id`	integer
`status`	string
`type`	string full_time \| part_time \| contract \| internship
`department`	integer
`branch`	integer
`job`	integer
`stage`	string applied \| screening \| interview \| offer \| hired \| rejected
`source`	string careers_page \| referral \| linkedin \| job_board \| other
`candidate`	integer
`from`	string
`to`	string
`q`	string

list_recruitment_ats read only Applicant tracking (recruitment.view; offers also recruitment.approve_offers): kind pipeline (the st...

Applicant tracking (recruitment.view; offers also recruitment.approve_offers): kind pipeline (the stages and who is in each; filter job), dashboard (funnel, time to hire, source effectiveness, offer outcomes; filters from, to, job), pool (talent pool; filters q on name/email/skills/tags, tag), offers (filter status), offer (offer_id: with both letters and the candidate's link while sent), availability (interviewers' weekly windows; filter employee), templates (stage emails, the "assessment" email, offer letter templates and their placeholders), assessments (candidate_id: the tests sent, status, best result, passed, gate, link), stage_assessments (the test each stage sends and its gate; and the active tests to pick from), settings (AI switches, candidate email language, connected accounts, job feed address).

Argument	Type	Description
`company_id`required	integer
`kind`	string pipeline \| dashboard \| pool \| offers \| offer \| availability \| templates \| assessments \| stage_assessments \| settings
`candidate_id`	integer
`offer_id`	integer
`from`	string
`to`	string
`job`	integer
`q`	string
`tag`	string
`status`	string draft \| pending_approval \| approved \| rejected \| sent \| accepted \| declined \| expired \| withdrawn
`employee`	integer

list_reports read only The reports the person may run (each needs its permission: employees.view for people reports, leaves...

The reports the person may run (each needs its permission: employees.view for people reports, leaves.view for time off, attendance.view for attendance and timesheets, payroll.view for pay, costs and bank exports, requests.view and assets.view for those), the ones coming with a module, their saved options, and the customized reports when they have reports.custom. With report, that report's form: filters (key, type, params to send, options), columns by group, default columns, switches and exports.

Argument	Type	Description
`company_id`required	integer
`report`	string	A report key, for its filters, columns and switches

list_request_types changes data The request types the company offers (expense, overtime, missing punch, general, vacation resumption...

The request types the company offers (expense, overtime, missing punch, general, vacation resumption, vacation encashment, HR letter…): key, label, whether employees file it themselves or only for someone else, whether it takes an attachment, its default approval chain, the fields it asks for and the choices of fields that take one (options: field → value and label).

Argument	Type	Description
`company_id`required	integer

list_role_assignments read only Who has which role in which scope. Filter by user_id or role_id.

Who has which role in which scope. Filter by user_id or role_id.

Argument	Type	Description
`company_id`required	integer
`user_id`	integer
`role_id`	integer

list_roles read only The company's roles with their permissions and how many people have each, plus the permission catalo...

The company's roles with their permissions and how many people have each, plus the permission catalog (each group's permissions, and under children the sub-module permissions that can be given alone; a module permission grants all its children), scopes and presets; catalog lists every permission flat with its group, module permission, scopes and English and Arabic labels; line_manager_access is what direct managers may do for their reports (set_line_manager_access).

Argument	Type	Description
`company_id`required	integer

list_salary_scales read only Salary scales (HR module). kind scales: the scales with structure, layers, exceed percentages, compa...

Salary scales (HR module). kind scales: the scales with structure, layers, exceed percentages, compa-ratio range, activation date and status (filter status active|inactive|draft; payroll_setup.manage). kind scale: one scale (scale_id) with its grades, bands and levels, each with min/mid/max salary, entitled_to_overtime, the ids it entitles to (job_role, loan_type, air_ticket_policy, insurance_policy, annual_leave, sick_leave) and allowances (payroll_setup.manage). kind job_grades: the job grades screen, each grade with range, ideal compa-ratio, benefits, levels, leave days, headcount, average salary, compa-ratio and who is outside the range, plus salary_scale_enforce (payroll_setup.manage). kind placement: an employee's place on the scale (employee_id, in my payroll.view or payroll.manage scope) with range and compa-ratio.

Argument	Type	Description
`company_id`required	integer
`kind`required	string scales \| scale \| job_grades \| placement
`scale_id`	integer
`employee_id`	integer
`status`	string active \| inactive \| draft

list_setup_form read only Setup forms (ZenHR full forms): the items of one entity with their fields, and the fields' kinds and...

Setup forms (ZenHR full forms): the items of one entity with their fields, and the fields' kinds and options. Entities now: org-levels (organizational levels: type, parent, rank, subsidiary ID, logo, key staff) and attendance-functions (functions such as breaks and visits: deduct per, minutes per day, per transaction and in total, active).

Argument	Type	Description
`company_id`required	integer
`entity`required	string expense-types \| cities \| org-levels \| miscellaneous-types \| attendance-functions \| transaction-types \| loan-types \| part-time-transaction-types \| cost-centers \| salary-bands \| letter-categories \| disciplinary-types \| suspension-reasons \| termination-reasons \| checklist-templates

list_shared_phones read only Phones used by more than one account (app_devices.view, docs/platform-control.md «الهاتف المشترك»),...

Phones used by more than one account (app_devices.view, docs/platform-control.md «الهاتف المشترك»), for the people the permission's scope covers: each phone row as list_app_devices plus shared {accounts (how many accounts used this phone, any company), others (how many of them you can't see: other companies or outside your scope, never named), list [{user, order (1 = first on the phone), first_used_at, last_used_at, first_sign_in_at, last_sign_in_at, sign_ins, allowed (an HR exception), this_phone_row}]}, the summary, and the company's policy {mode allow|warn|block, max_accounts, inherit (the Mihnaro default)}. Filters as list_app_devices; page, per_page.

Argument	Type	Description
`company_id`required	integer
`q`	string
`branch_id`	integer
`platform`	string
`signed_in`	boolean
`seen_days`	integer
`page`	integer
`per_page`	integer

list_stb_encashments read only End-of-service benefit encashments (HR module, payroll.stb_encashments.view, which payroll.view and...

End-of-service benefit encashments (HR module, payroll.stb_encashments.view, which payroll.view and payroll.manage grant; employees in my scope). kind list: encashments newest first (employee_id filter, page, per_page) with the company limits (enabled, max_percent, min_years, every_years). kind available: what an employee can take now (employee_id): service years, accrued benefit, taken before, allowed amount, eligible and the reason when not. kind settings: every encashment rule (stb_encash_* as manage_stb_encashments action settings takes them: limits, eligibility, times per years, line names, policies by contract).

Argument	Type	Description
`company_id`required	integer
`kind`required	string list \| available \| settings
`employee_id`	integer
`page`	integer
`per_page`	integer

list_tasks read only Tasks. tab mine (default: given to me), assigned (given by me) or employees (tasks.manage: the peopl...

Tasks. tab mine (default: given to me), assigned (given by me) or employees (tasks.manage: the people in scope); show pending (default), past_due, completed or all; status, kind, employee (id), template (id), q. With task_id, one task. kind_list templates lists the task templates (tasks.manage).

Argument	Type	Description
`company_id`required	integer
`task_id`	integer
`kind_list`	string tasks \| templates
`tab`	string mine \| assigned \| employees
`show`	string pending \| past_due \| completed \| all
`status`	string todo \| in_progress \| awaiting_confirmation \| done \| cancelled
`kind`	string custom \| document_upload \| document_download \| give_asset \| take_asset \| add_bank_account \| add_family_member \| complete_profile
`employee`	integer
`template`	integer
`q`	string

list_team_leaves read only Leave requests of the employees your role reaches (leaves.view): status pending (default), approved,...

Leave requests of the employees your role reaches (leaves.view): status pending (default), approved, rejected, withdrawn or all; kind days or hours (leaves by the day or by the hour); leave_type_id, employee_id, from, to. 50 a page.

Argument	Type	Description
`company_id`required	integer
`kind`	string days \| hours
`status`	string pending \| approved \| rejected \| withdrawn \| all
`leave_type_id`	integer
`employee_id`	integer
`from`	string
`to`	string
`page`	integer

list_time_setup read only The company's time setup by kind: shifts (work shifts, with how many employees work each), overtime_...

The company's time setup by kind: shifts (work shifts, with how many employees work each), overtime_types, holidays (of year, this year by default), geolocations (work locations), biometric_devices (attendance machines; tokens are never listed) or detected_devices (clocks that called in from the caller's own public IP and are not added yet: serial, family, model, last call; add one with save_time_setup_item kind biometric_devices). Needs attendance_setup.manage.

Argument	Type	Description
`company_id`required	integer
`kind`required	string shifts \| overtime_types \| holidays \| geolocations \| biometric_devices \| detected_devices
`year`	integer	For holidays

list_workflows read only Onboarding, offboarding, vacation clearance and resumption workflows (docs/boarding.md). kind mine:...

Onboarding, offboarding, vacation clearance and resumption workflows (docs/boarding.md). kind mine: the user's own sent workflows with their tasks (a resumption workflow on request starts when the vacation_resumption request is filed). kind workflows: workflows of the employees in employees.view's scope (filters category onboarding|offboarding|clearance|resumption, status pending|in_progress|completed, employee_id, date_from, date_to). kind workflow: one with its tasks (id). kind templates: workflow templates with their tasks (employee_settings.manage; filters category, q). kind template: one template with its tasks (id; employee_settings.manage).

Argument	Type	Description
`company_id`required	integer
`kind`required	string mine \| workflows \| workflow \| templates \| template
`id`	integer
`filters`	object

list_zenhr_history read only History imported from ZenHR (docs/zenhr-import.md), 50 a page, for the employees your role reaches....

History imported from ZenHR (docs/zenhr-import.md), 50 a page, for the employees your role reaches. kind days: ZenHR's day analysis (status, shift, first in/last out with place, minutes required, worked, late, early out, overtime, variance; attendance.manage). kind punches: every punch (function, who added it, machine, card id, place; attendance.manage). kind balances: vacation balances per year (previous, opening, taken, adjustments, encashed, available, financial effect; leaves.manage). Filters: employee_id, from, to (YYYY-MM-DD), status present|absent|partial (days), leave_type_id and year (balances).

Argument	Type	Description
`company_id`required	integer
`kind`required	string days \| punches \| balances
`employee_id`	integer
`from`	string
`to`	string
`status`	string present \| absent \| partial
`leave_type_id`	integer
`year`	integer
`page`	integer

live_location changes data Mandatory live location for field staff (docs/live-location.md). live_location.manage: action get_po...

Mandatory live location for field staff (docs/live-location.md). live_location.manage: action get_policy; action set_policy (fields: enabled, mode while_clocked_in|during_shift|always_when_app_open, interval_seconds, distance_meters, max_silence_minutes, retention_days, reason {en, ar}, rules [{target_type all|branch|department|section|work_location|group|employee, target_id, effect include|exclude}] replacing the current ones; an employee rule is their override). live_location.view (your role's scope, the branch you work in): action positions (filters: branch, department, group, status online|lost|offline|none, q) = latest position, age, battery, accuracy, mocked flag and status per employee; action trail (employee_id, date) = that day's points. action export: the export's rows (with employee_id and date a trail, else the positions by filters), logged as an export. Every positions and trail call is recorded in the location view log. app_policy.manage: action get_rule / set_rule with policy app_lock (fields: enabled, when every_open|after_background, after_minutes, methods biometric|biometric_or_passcode, rules) or punch_auth (fields: enabled, methods, rules): the same targeting; punches then need local_auth {method face|fingerprint|passcode, at}; or screen_capture (fields: enabled): the whole app kept out of screenshots and recordings, company-wide, on by default (Field-proof screens always are); or phone_sharing, one account per phone (fields: inherit = use the Mihnaro default, mode allow|warn|block, max_accounts 1–10, rules; no include rule = everyone; docs/platform-control.md «الهاتف المشترك»); or event_location, keeping the phone's GPS point with app sign-ins and opens (fields: inherit = use the Mihnaro default auto|on|off, enabled, rules; no include rule = everyone; only from people who already allowed location on the phone; never demo or reviewer accounts; docs/platform-control.md «موقع الأحداث»); or location_required, location as a condition of using the app (fields: inherit, enabled, precise, reason_en, reason_ar, rules; the app gates until location is on and the server refuses with location_required; never demo or reviewer accounts; docs/platform-control.md «الموقع شرط لفتح التطبيق»); or context_device|context_network|context_battery|context_permissions|context_security|context_time|context_locale|context_health, each category of phone details the app sends with opens, sign-ins and punches (fields: inherit, enabled, retention_days 7–730, rules; docs/platform-control.md «بيانات الهاتف»).

Argument	Type	Description
`company_id`required	integer
`action`required	string get_policy \| set_policy \| positions \| trail \| export \| get_rule \| set_rule
`fields`	object	set_policy: the policy fields and rules
`filters`	object	positions: branch, department, group, status, q
`employee_id`	integer
`policy`	string app_lock \| punch_auth \| screen_capture \| phone_sharing \| event_location \| location_required \| context_device \| context_network \| context_battery \| context_permissions \| context_security \| context_time \| context_locale \| context_health	get_rule / set_rule
`date`	string	trail: Y-m-d, default today

log_timesheet changes data Your timesheet: action add (project_id, work_date, hours, description), delete (entry_id; a draft or...

Your timesheet: action add (project_id, work_date, hours, description), delete (entry_id; a draft or returned entry) or submit (week: a date in the period).

Argument	Type	Description
`company_id`required	integer
`action`required	string add \| delete \| submit
`project_id`	integer
`work_date`	string
`hours`	number
`description`	string
`entry_id`	integer
`week`	string

manage_accounting can delete Direct accounting connectors (each ledger needs integrations.{provider}.manage, which integrations.m...

Direct accounting connectors (each ledger needs integrations.{provider}.manage, which integrations.manage grants; docs/accounting-connectors.md). provider: odoo, quickbooks, xero, netsuite, business_central, sap_b1, sap_s4hana or dynamics_fo. action save: fields = the provider's connection fields (see list_accounting kind connection; secrets are stored encrypted, empty keeps the saved one) and posting options post_on_approval, post_off_cycle, kinds (payroll, contributions, cost_center, bank_transfer), post_state posted|draft, entry_date month_end|approval, journal, rounding_account, currency, send_partners. action oauth_url: the consent link for QuickBooks and Xero (open it signed in to Mihnaro). action test: sign in and read the organization. action refresh: read the ledger's accounts, analytics, partners and journals. action disconnect: forget the credentials. action map: items [{type account|cost_center|branch|employee, local_key, external_id (empty removes)}]. action auto_match: map accounts whose codes match. action post: run_id, post an approved payroll (idempotent: what is posted is never sent twice). action retry / reverse / repost: posting_id. action sync_employees: employee_ids optional.

Argument	Type	Description
`company_id`required	integer
`action`required	string save \| oauth_url \| test \| refresh \| disconnect \| map \| auto_match \| post \| retry \| reverse \| repost \| sync_employees
`provider`	string odoo \| quickbooks \| xero \| netsuite \| business_central \| sap_b1 \| sap_s4hana \| dynamics_fo
`branch_id`	integer	A branch's own connection (when the ledger is set per branch); empty = the company's.
`fields`	object
`items`	array
`run_id`	integer
`posting_id`	integer
`employee_ids`	array

manage_air_ticket_policies changes data Add, edit, delete and give air ticket policies (payroll_setup.manage, HR module). action create and...

Add, edit, delete and give air ticket policies (payroll_setup.manage, HR module). action create and update (policy_id): fields name_en (required), name_ar, tickets (0-20 a period), period_months (1-120), period_anchor hire|calendar, accrual period_start|monthly, amount (one ticket's value), family_members, eligible_after_months, applies_to all|assigned, expire_option none|immediately|after with expire_after_months, distribution per_person|shared, default_payroll in_payroll|off_cycle, default_request_type cash_out|ticket, transaction_type_id, gl_identifier, clearance_account, setups[] {position_ids[], nationalities "a,b", years_from, years_to, amount, currency, beneficiaries[] {relation parent|spouse|child|sibling, deduction %}}, switches cash_out, active, allow_custom_amount, allow_negative, show_negative, company_expense, tax_exempt, show_home_country (off unless true) and show_balance, allow_partial, requestable, show_amount (on unless false). Update sends every field again; apply_changes update|new with balance_date starts a new balance. action delete: policy_id (no ticket taken under it). action assign: policy_id; fields scope all|selected, employee_ids[], opening_balance (active employees in my payroll.manage scope). action unassign: policy_id, employee_id.

Argument	Type	Description
`company_id`required	integer
`action`required	string create \| update \| delete \| assign \| unassign
`policy_id`	integer
`employee_id`	integer
`fields`	object

manage_air_tickets changes data Air ticket transactions for employees in my payroll.manage scope (HR module). action add: fields emp...

Air ticket transactions for employees in my payroll.manage scope (HR module). action add: fields employee_id, policy_id (one of the employee's policies; empty for the company allowance while no policies exist), slice (ZenHR's eligible slice: the index of one of the policy's slices from list_air_ticket_policies; default the one that fits the employee), tickets[] (ticket cards: {owner "self" or a family member id, count, amount (default count × the slice's ticket value)}) or the older owners[] ("self" and family member ids, one ticket each), travel_date, return_date, destination, cash_out (paid with the salary, when the policy allows), amount (the total; default the cards' amounts added up), notes; checked against the balance on the travel date. action mark_paid: fields ids[], paid_at, payment_reference (booked, unpaid ones). action delete: transaction_id (not paid and not in an approved payroll). action bulk_delete: fields ids[] (paid ones stay; returns how many were deleted).

Argument	Type	Description
`company_id`required	integer
`action`required	string add \| mark_paid \| delete \| bulk_delete
`transaction_id`	integer
`fields`	object

manage_announcement changes data Company announcements (announcements.manage). action save: publish one (the people it is for are not...

Company announcements (announcements.manage). action save: publish one (the people it is for are notified), or change one with announcement_id: fields title {en, ar}, body {en, ar} (HTML as the composer makes it: p, h1-h4, strong, em, u, s, span/mark with color or background-color, ul/ol/li, blockquote, a, table, hr, img only with a picture uploaded by manage_announcement_media; anything else is removed), pinned, starts_on and expires_on (YYYY-MM-DD: shown from, until; a later start is announced on that day), gallery [{file, caption {en, ar}}] in order (first = cover) and attachments [{index} to keep one, {upload, name} to add one] (left out = unchanged), targets (who it is for: branches, departments, sections, positions, work_locations, projects (ids), genders (male, female), religions (muslim, christian, hindu, buddhist, sikh, other), employees (ids); several kinds narrow it, named employees are always added; {} = everyone), or the older branch_id alone (empty = company-wide; default the current branch). action delete: remove the announcement_id.

Argument	Type	Description
`company_id`required	integer
`action`required	string save \| delete
`announcement_id`	integer
`fields`	object

manage_announcement_media changes data An announcement's pictures and files, uploaded into Mihnaro (announcements.manage; docs/communicatio...

An announcement's pictures and files, uploaded into Mihnaro (announcements.manage; docs/communication.md §5ج). action upload: keep a picture (kind image, for the text or the gallery) or file (kind file: pdf, Word, Excel, PowerPoint, txt, csv or a picture), within the announcement_file_kb limit of company_limits, given as data (a data: URL or base64) and name; returns the file to put in manage_announcement's gallery [{file, caption}] or attachments [{upload: file, name}], or in the text as <img src="https://mihnaro-image.invalid/<file>">. On an announcement_id: gallery_add (data, name, caption {en, ar}), gallery_move (index, to), gallery_caption (index, caption), gallery_remove (index), attachment_add (data, name), attachment_rename (index, name), attachment_remove (index). Outside picture addresses are never accepted.

Argument	Type	Description
`company_id`required	integer
`action`required	string upload \| gallery_add \| gallery_move \| gallery_caption \| gallery_remove \| attachment_add \| attachment_rename \| attachment_remove
`announcement_id`	integer
`kind`	string image \| file
`data`	string	data:<type>;base64,… or base64
`name`	string
`caption`	object	{"en": "...", "ar": "..."}
`index`	integer
`to`	integer

manage_api_key can delete Company API keys (integrations.api_keys.manage, which integrations.manage grants; docs/integrations....

Company API keys (integrations.api_keys.manage, which integrations.manage grants; docs/integrations.md). action create: fields name, abilities (read, write, update, delete), ip_addresses (list; empty = any), expires_on, user_id (who it acts as; default the caller), auth_type (basic, oauth1, oauth2, credentials) with its outgoing credentials. The key is in the answer ONCE as token: hand it over safely, it can't be shown again. action update: api_key_id and the same fields (a blank secret keeps the saved one). action revoke: api_key_id; anything using it stops at once.

Argument	Type	Description
`company_id`required	integer
`action`required	string create \| update \| revoke
`api_key_id`	integer
`fields`	object

manage_approval_delegation changes data Approval delegation (ZenHR "Delegated"): list the delegations you gave or received, delegate your ap...

Approval delegation (ZenHR "Delegated"): list the delegations you gave or received, delegate your approval steps to a colleague (delegate_id is their user id; starts_on, ends_on empty = until ended, note), or end one of yours (delete, id). The delegate decides on your behalf and each decision says so.

Argument	Type	Description
`company_id`required	integer
`action`	string list \| delegate \| delete
`delegate_id`	integer
`starts_on`	string	Y-m-d
`ends_on`	string	Y-m-d, empty = until ended
`note`	string
`id`	integer

manage_approval_setup changes data Approval setup (approval_setup.manage). action get: each request kind's chain (empty = its default)...

Approval setup (approval_setup.manage). action get: each request kind's chain (empty = its default) and the approval templates. action save_chains: chains {kind: value}, value one of manager, hr, "manager,hr", "tpl:<template id>" (or "none" for payroll_batch). action save_template: add one, or change it with template_id: name {en, ar}, object_type (a transaction type such as leave, overtime, general, expense) and object_id (its sub-type), assign {work_location_ids, department_ids, section_ids, business_unit_ids, division_ids, segment_ids, hierarchy_group_ids, job_role_ids, project_ids, employee_ids}, steps in order — ZenHR's "Approved By": approvals_officer, manager, manager_2, manager_3, financial_officer, supervisor, hr, payroll, "employee:<employee id>", "department:<department or section id>", "position:<job role id>", "role:<role id>", "user:<user id>", or {kind: committee, members: ["e<employee id>" or user ids]}; action approvers lists every one this template (template_id) or a new one may name, from its own branch only, skip_after with skip_after_unit days|hours, notify_user_ids, override_enabled with overrider_ids and override_self. action delete_template: one no chain points at.

Argument	Type	Description
`company_id`required	integer
`action`required	string get \| approvers \| save_chains \| save_template \| delete_template
`chains`	object
`template_id`	integer
`fields`	object

manage_assessments can delete Assessments. action grade (answer_id; needs assessments.grade or assessments.manage): fields points...

Assessments. action grade (answer_id; needs assessments.grade or assessments.manage): fields points (0 to the question's points), note, reason (required when changing a grade already given, the automatic one too; kept in the attempt's grade_history). Every other action needs assessments.manage. save_category (category_id to change): fields name {en, ar}, description, competency_id. delete_category. save_question (question_id to change): fields type (single, multiple, true_false, short_text, long_text, ordering, matching, numeric, file_upload), assessment_category_id, difficulty (easy, medium, hard), prompt {en, ar}, options [{key?, text {en, ar}}] (choices, items in the right order, or the left side of matching), targets (the right side of matching), answer (single: a key; multiple: keys; true_false: true/false; short_text: accepted answers; matching: {left key: right key}; numeric: {value, tolerance}), points, time_limit_seconds, explanation, is_active, media {name, content_base64} (an image jpg/png/gif/webp, audio mp3/m4a/wav/ogg or video mp4/webm, each within the upload_file_kb limit of company_limits; also options[n].media; options sent back with the same key keep theirs), remove_media (true), options[n].remove_media. delete_question. save_test (test_id to change): fields title {en, ar}, description, instructions, purpose (pre_employment, post_employment), time_limit_minutes, shuffle_questions, shuffle_options, attempts_allowed, pass_mark (%), negative_marking, negative_ratio, show_score, competency_id, pass_stage, fail_stage (recruitment stages), status (draft, active, archived), items [{kind: question, assessment_question_id} or {kind: random, assessment_category_id, difficulty?, draw_count}]. delete_test (only if nobody took it). invite (test_id): fields candidate_ids, employee_ids, expires_at, locale, pass_stage, fail_stage (the gate for candidates); returns the candidates' links. resend_invitation (invitation_id; fields expires_at, needed when the link has expired; returns sent and reason: sandbox, mail_off, employees_held, no_email, failed). cancel_invitation (invitation_id). install_template: fields key (from list_assessments kind templates).

Argument	Type	Description
`company_id`required	integer
`action`required	string save_category \| delete_category \| save_question \| delete_question \| save_test \| delete_test \| invite \| resend_invitation \| cancel_invitation \| grade \| install_template
`category_id`	integer
`question_id`	integer
`test_id`	integer
`invitation_id`	integer
`answer_id`	integer
`fields`	object

manage_asset changes data Company assets and asset types (assets.manage). action save: add an asset, or change it with asset_i...

Company assets and asset types (assets.manage). action save: add an asset, or change it with asset_id: fields asset_type_id, name, serial_number (unique), owner_branch_id, purchase_date, production_date, expiry_date, value, description, notes. action assign: hand it to an employee in scope (fields assigned_to, assigned_at, return_date, notes). action release: take it back. action status: fields.status damaged, under_repair, archived or available. action delete: an asset nobody holds. action save_type: an asset type, or change one with asset_type_id: fields name {en, ar}, branch_ids (ids or ["all"]), active. action delete_type: a type no asset uses. Attachments go through the API or the screen.

Argument	Type	Description
`company_id`required	integer
`action`required	string save \| assign \| release \| status \| delete \| save_type \| delete_type
`asset_id`	integer
`asset_type_id`	integer
`fields`	object

manage_business_travel changes data Change the business travel setup (payroll_setup.manage, HR module). action update_setup: fields trip...

Change the business travel setup (payroll_setup.manage, HR module). action update_setup: fields trip_per_diem_type_id, trip_air_ticket_type_id, trip_accommodation_type_id (transaction type ids, required), trip_payment in_payroll|off_cycle, trip_remind_days (0-60), trip_expense_type_ids[], trip_slip_breakdown, trip_show_amounts, components[] {id, name_en, name_ar} (a listed component with both names empty is removed when no policy uses it). action create and update (policy_id): fields name_en (required), name_ar, position_ids[] (required), destinations[] {category domestic|international; domestic needs country, departure_cities and arrival_cities ("a,b"); international departure_countries[] and arrival_countries[] (codes); travel_types[] airplane|bus|car|train, air_classes[] economy|business|first, max_air_ticket, max_travel_cost, hotel_tiers[] 1-5, max_accommodation, components[] {type_id, amount, mandatory}}, switches active, requestable, notes_required, attachments_required (off unless true). action delete: policy_id.

Argument	Type	Description
`company_id`required	integer
`action`required	string update_setup \| create \| update \| delete
`policy_id`	integer
`fields`	object

manage_calibration can delete Calibrating evaluation results (performance.calibrate, docs/talent-mobile.md). action board (cycle_i...

Calibrating evaluation results (performance.calibrate, docs/talent-mobile.md). action board (cycle_id): who sits in which result band, and whose result you may move. action history (evaluation_id): the moves of one result. action move (evaluation_id): fields score (0 to 100), reason; only a completed evaluation in an open cycle, in your scope, never your own. The employee, the result writer and others who may calibrate are told.

Argument	Type	Description
`company_id`required	integer
`action`required	string board \| history \| move
`cycle_id`	integer
`evaluation_id`	integer
`fields`	object

manage_checklist changes data Joining and leaving checklists (docs/terminations.md). action overview (employees.view: joiners and...

Joining and leaving checklists (docs/terminations.md). action overview (employees.view: joiners and leavers in scope with their progress; fields type onboarding|offboarding, status not_started|in_progress|completed, default not completed). employees.manage over the employee: show (employee_id: the steps), add (employee_id; fields type, title {en, ar}), toggle (item_id: tick a step off or back on), delete (item_id). The standard steps are the setup list checklist-templates (save_setup_form_item).

Argument	Type	Description
`company_id`required	integer
`action`required	string overview \| show \| add \| toggle \| delete
`employee_id`	integer
`item_id`	integer
`fields`	object

manage_connected_account changes data Manages one of the company's connected accounts (docs/integration-connections.md), the same operatio...

Manages one of the company's connected accounts (docs/integration-connections.md), the same operations as the screen and the API. action mode (provider, mode company|branch; also for the ledgers): one account for the whole company or one per branch. action save (provider, branch_id, app own|platform, client_id, client_secret write-only, tenant for microsoft, organization = LinkedIn page id). action authorize_url (provider, branch_id): the consent page to open in a browser signed in to Mihnaro as the same person. action test (provider, branch_id): reads the signed-in account. action disconnect (provider, branch_id): revokes and clears the tokens. branch_id empty = the whole company's connection. Providers zoom, google, microsoft, linkedin (ledgers are set up with manage_accounting and its branch_id).

Argument	Type	Description
`company_id`required	integer
`action`required	string mode \| save \| authorize_url \| test \| disconnect
`provider`required	string zoom \| google \| microsoft \| linkedin \| odoo \| quickbooks \| xero \| netsuite \| business_central \| sap_b1 \| sap_s4hana \| dynamics_fo
`branch_id`	integer	The branch's own connection; empty = the whole company's.
`mode`	string company \| branch
`app`	string own \| platform
`client_id`	string
`client_secret`	string	Write-only: never returned.
`tenant`	string
`organization`	string

manage_cost_allocations changes data Cost center allocations for employees in my payroll scope (payroll.manage). action add: fields emplo...

Cost center allocations for employees in my payroll scope (payroll.manage). action add: fields employee_id, start_date, end_date (optional, on or after the start), allocations[] {cost_center_id, percent} with distinct cost centers whose percentages add up to 100; an employee's periods can't overlap. action delete: allocation_id (the id list_payroll_costs kind cost_allocations shows); removes all its cost centers for that period.

Argument	Type	Description
`company_id`required	integer
`action`required	string add \| delete
`allocation_id`	integer
`fields`	object

manage_cost_center_groups changes data Cost center groups (payroll_setup.manage). action save: a new group, or changes to one with group_id...

Cost center groups (payroll_setup.manage). action save: a new group, or changes to one with group_id; fields name_en (required), name_ar (else the English name), code (optional group code). action delete: group_id; a group that still includes cost centers can't be deleted. Cost centers join a group from the cost centers setup form. list_payroll_costs kind cost_center_groups lists them.

Argument	Type	Description
`company_id`required	integer
`action`required	string save \| delete
`group_id`	integer
`fields`	object

manage_custom_report can delete Customized reports (reports.custom), as POST/PATCH/DELETE custom-reports. action sources: the data s...

Customized reports (reports.custom), as POST/PATCH/DELETE custom-reports. action sources: the data sources and fields the person may pick (each source needs its permission; IDs and passports need employees.view_sensitive). action save: create, or change with id: fields name {en, ar}, locale en|ar, employee_status active|inactive|both, schedule none|daily|weekly|monthly|annually, notify_user_ids (only people who work in the report's branch and may open customized reports are kept), columns ["source.field", …] in order, shared_branch_ids (ZenHR's "Choose the branches…": other branches that may open it, only branches you work in; each viewer sees only the data their own access reaches). A report belongs to the branch it was made in; one shared with your branch can be run but changed only by its own branch. action delete: remove it with id. Run one with run_report and custom_report_id.

Argument	Type	Description
`company_id`required	integer
`action`required	string sources \| save \| delete
`id`	integer
`fields`	object

manage_device_people changes data People on devices (devices.manage, docs/devices.md); the PIN on devices is the employee's biometric...

People on devices (devices.manage, docs/devices.md); the PIN on devices is the employee's biometric ID. action list: active people (q by number, biometric ID or name; department; page) with their profile, enrolled device ids and template count. action get: an employee's device profile, enrolments, why they are (not) on each device and template list. action enroll: by employees (individual enrolments) or by department|branch|position|group|all with ids, onto device_ids: an enrolment rule worked out at every sync, so people who join later are added and people who leave are taken off. action rules (device_id): the device's rules and its individually enrolled employee ids. action exclude: ids (employees) kept off device_ids whatever rule would add them. action delete_rule (rule_id). action unenroll: employee_id (or group_id) from device_ids. action profile: employee_id with card, password (digits), privilege (0 user, 2 enroller, 6 admin, 14 super admin), verify_mode (default, finger, face, card, password, card_and_finger, face_and_password...), enabled, push_photo. action remove: off every device now. action pull_templates: ask the devices for the person's templates again.

Argument	Type	Description
`company_id`required	integer
`action`required	string list \| get \| enroll \| rules \| exclude \| delete_rule \| unenroll \| profile \| remove \| pull_templates
`device_id`	integer
`rule_id`	integer
`q`	string
`department`	integer
`page`	integer
`employee_id`	integer
`group_id`	integer
`by`	string employees \| department \| branch \| position \| group \| all
`ids`	array
`device_ids`	array
`card`	string
`password`	string
`privilege`	integer
`verify_mode`	string default \| any \| finger \| pin \| password \| card \| finger_or_password \| finger_or_card \| card_or_password \| pin_and_finger \| finger_and_password \| card_and_finger \| card_and_password \| finger_password_card \| pin_finger_password \| finger_and_card_or_pin \| face \| face_and_finger \| face_and_password \| face_and_card \| face_finger_card \| face_finger_password \| vein \| palm
`enabled`	boolean
`push_photo`	boolean

manage_discipline changes data Disciplinary actions and their setup (docs/discipline.md). discipline.manage over the employee: acti...

Disciplinary actions and their setup (docs/discipline.md). discipline.manage over the employee: action suggest (fields employee_id, disciplinary_type_id, incident_date: what the escalation rule prescribes); record (fields employee_id, disciplinary_type_id, incident_date, description, optional disciplinary_action_type_id, or action verbal_warning|written_warning|final_warning|deduction with deduction_amount when there is no rule; draft true to save for approval); approve (action_id of a draft); delete (action_id; refused once that month's payroll is approved); generate (fields leave_type_id, kind redundant|grace, effective_date, from, to, optional employee_id, branch_id, department_id: drafts from approved time off). discipline_setup.manage: save_action_type (optional id; fields name {en, ar}, deduction_type none|balanced_vacation|fixed|salary_day|percent, deduction_value, leave_type_id, transaction_type_id, allowance_type_ids, letter_template_id); delete_action_type (id); save_rule (optional id; fields disciplinary_type_id, name {en, ar}, rule_type sequential|separate, drop_after, drop_unit day|month|year, prevent_repetition, prevent_unit, action_type_ids in order); delete_rule (id); save_time_off (id: a time-off type; fields disciplinary_type_id for the generator, redundancy_interval day|week|month, exceed_actions and redundant_actions: rows {amount, rule_id, action_type_id}).

Argument	Type	Description
`company_id`required	integer
`action`required	string suggest \| record \| approve \| delete \| generate \| save_action_type \| delete_action_type \| save_rule \| delete_rule \| save_time_off
`action_id`	integer	The disciplinary action (approve, delete).
`id`	integer	The action type or rule (save to change, delete), or the time-off type (save_time_off).
`fields`	object

manage_eos_policies changes data End-of-service (STB) policies (HR module, payroll_setup.manage), the same rules as the screen. actio...

End-of-service (STB) policies (HR module, payroll_setup.manage), the same rules as the screen. action create / update (policy_id): fields name_en, name_ar, termination_category (any|resignation|termination|end_of_contract|retirement|other), min_years, tiers ("from-to:days" per line such as "0-5:15\n5-:30", or a list of {from_years, to_years, days_per_year}), worth_tiers (same form, the value a percent), contract_type both|limited|unlimited, exclude_unpaid[], nationalities[], end_date, allowance_type_ids[], calc_base calendar|365|360, year_definition calendar|fixed with fixed_year_days, calc_type service|remaining|both, remaining_direction add|deduct, service_min_salaries, service_max_salaries, remaining_min_salaries, remaining_max_salaries, flags tax_exempt, is_default (one default per category), thirty_day_months, distribute_per_slice, override_amount. action delete: policy_id (refused while a monthly provision uses it).

Argument	Type	Description
`company_id`required	integer
`action`required	string create \| update \| delete
`policy_id`	integer
`fields`	object

manage_evaluation_cycle changes data Evaluation cycles (performance.manage). action create: fields evaluation_template_id, name, branch_i...

Evaluation cycles (performance.manage). action create: fields evaluation_template_id, name, branch_ids, year, evaluation_part (Y, H1–H2, Q1–Q4 or M1–M12 by the template period), stages {writing_okrs|auditing_okrs|self_assessment|evaluation|auditing_results: {start, end}} (evaluation required). With cycle_id: launch (an evaluation for each active employee, weights must make 100), close, dates (fields.stages), add_employees (fields.employees ids), delete (drafts). With evaluation_id, for an employee in scope: task_holders (fields okr_writer_id, okr_auditor_ids, result_writer_id, result_auditor_ids: employee ids), evaluation_dates (fields.stages), remove.

Argument	Type	Description
`company_id`required	integer
`action`required	string create \| launch \| close \| dates \| add_employees \| delete \| task_holders \| evaluation_dates \| remove
`cycle_id`	integer
`evaluation_id`	integer
`fields`	object

manage_event changes data Company events (events.manage). action save: add one, or change one with event_id: fields title {en,...

Company events (events.manage). action save: add one, or change one with event_id: fields title {en, ar}, date, start_time (HH:MM), location, description, branch_id (empty = company-wide; default the current branch). action delete: remove the event_id.

Argument	Type	Description
`company_id`required	integer
`action`required	string save \| delete
`event_id`	integer
`fields`	object

manage_exchange_rates changes data Exchange rates (payroll_setup.manage). action save: fields from_currency, to_currency (ISO codes, di...

Exchange rates (payroll_setup.manage). action save: fields from_currency, to_currency (ISO codes, different), rate (> 0), effective_date, optional reverse_rate (else 1 ÷ rate) and branch_id (empty = company-wide); saves the pair and its reverse, replacing a rate for the same pair, branch and date. action copy: fields branch_ids[] and effective_date; copies each pair's latest company-wide rate to those branches. action toggle: fields multi_currency true|false turns multi-currency on or off. action delete: rate_id. list_payroll_costs kind exchange_rates lists them.

Argument	Type	Description
`company_id`required	integer
`action`required	string save \| copy \| toggle \| delete
`rate_id`	integer
`fields`	object

manage_feedback changes data 360° feedback and feedback forms. For everyone: submit (request_id; fields scores {criterion id: 1–5...

360° feedback and feedback forms. For everyone: submit (request_id; fields scores {criterion id: 1–5}, comment; on a survey cycle fields answers {question index: 1–max or text}), open_form (assignment_id: a form assigned to me with its questions and my answers), answer_form (assignment_id; fields.answers {question id: value}), results (cycle_id, employee_id: HR any time, the employee once closed, and their direct manager when the cycle allows; survey cycles add overall, the weighted score). For performance.manage: list_cycles, create_cycle (fields name, evaluation_template_id, due_date, peers_per_employee; or ZenHR's survey cycle: name, description, start_date, due_date, manager_sees_results, groups {manager: {weight}, report: {count, weight}, peer: {count, weight}, self: {}} with weights adding up to 100, assign_to individual with employees ids or group with group {...}, and questions [{type rating|open, text, helper, required, max 2–10, low, high}] or starter general|leadership|customer|culture), show_cycle, launch, close, delete_cycle (cycle_id); list_forms, create_form (fields title, description, start_date, end_date, anonymous, questions [{type text|textarea|checkbox|radio|rating|yes_no, label, helper, mandatory, options [{label, value}], min_rating, max_rating}], assign_to individual with employees ids or group with group {branch, position, department, work_location, work_type}), show_form, delete_form (form_id).

Argument	Type	Description
`company_id`required	integer
`action`required	string submit \| open_form \| answer_form \| results \| list_cycles \| create_cycle \| show_cycle \| launch \| close \| delete_cycle \| list_forms \| create_form \| show_form \| delete_form
`cycle_id`	integer
`employee_id`	integer
`request_id`	integer
`assignment_id`	integer
`form_id`	integer
`fields`	object

manage_field_customers changes data FSM customers (docs/fsm-mobile.md), as GET/POST/PATCH/DELETE field/customers, with the same permissi...

FSM customers (docs/fsm-mobile.md), as GET/POST/PATCH/DELETE field/customers, with the same permissions. action list (filters: q, branch_id, active; field.customers.view), get (id), save (field.customers.create, or .edit with id; fields: name, contact_name, phone, email, address, notes, active, branch_id for a new one), delete (id; field.customers.delete; only a customer with no sites).

Argument	Type	Description
`company_id`required	integer
`action`required	string list \| get \| save \| delete
`id`	integer
`filters`	object
`fields`	object
`branch`	string

manage_field_jobs changes data Field work orders and sites (docs/field-proof.md, docs/fsm-mobile.md), as POST/PATCH/DELETE field/jo...

Field work orders and sites (docs/field-proof.md, docs/fsm-mobile.md), as POST/PATCH/DELETE field/jobs and field/sites; each action its permission, all covered by field.jobs.manage: save_job field.jobs.create or .edit, decide field.jobs.review or .cancel, submit_without_departure field.jobs.review (job_id, fields.reason required: a job waiting for its departure photo goes to review without it, as POST field/jobs/{job}/submit-without-departure), delete_job field.jobs.delete (job_id; only an assigned one with no photos, parts or overtime), save_site field.sites.create or .edit (also field_customer_id), delete_site field.sites.delete (site_id; only with no work orders). action save_job: add a job, or change an assigned or in-progress one with job_id; fields title, description, branch_id (new only), field_site_id, priority (low, normal, high, urgent), planned_start_at, planned_end_at, estimated_minutes, assignee_ids (active employees of the job's branch), min_progress_photos and progress_interval_min (the job's own stage rules; only when field_job_stage_override is on, empty = the company's). action decide: job_id, fields.action approve or reject (a submitted job) or cancel (an open one), fields.note (required to reject or cancel). action save_site: add a site, or change one with site_id; fields name, address, latitude, longitude, radius_m (empty = company default), active, branch_id (new only).

Argument	Type	Description
`company_id`required	integer
`action`required	string save_job \| decide \| submit_without_departure \| delete_job \| save_site \| delete_site
`job_id`	integer
`site_id`	integer
`fields`	object
`branch`	string

manage_finance changes data Financial transactions, loans, salary packages and salary stop for employees in my payroll scope (pa...

Financial transactions, loans, salary packages and salary stop for employees in my payroll scope (payroll.manage). action add_transaction: fields employee_id, transaction_type_id (or type earning|deduction with category), amount, month YYYY-MM or effective_date YYYY-MM-DD (then the payroll month it falls in, after the cut-off the next one), description, off_cycle (then paid_cash, deduct_tax, amount_type total|net, mark_paid), extra_salary, is_net. action update_transaction: transaction_id and the same fields (an unpaid transaction added by HR). action delete_transaction: transaction_id (its month must be open). action add_loan: fields employee_id, loan_type_id, amount, currency (ISO code, default the company currency; payroll deducts each installment converted with the exchange rate of its month), installments or installment_amount, effective_date, first_installment_date (or start_month YYYY-MM), reason (notes), payout off_cycle|payroll. action delete_loan: loan_id (no repayments yet). action loan_details: loan_id (the loan with its installment schedule: id, position, amount, due_date, status unpaid|paid|skipped, cash, in_payroll, payroll_amount and exchange_rate in the payroll currency). action skip_installment / pay_installment_cash: loan_id, installment_id (an unpaid installment not in a payroll; a skipped one moves to the end). action reschedule_loan: loan_id; fields installment_amount or number_of_payments (what is still owed, from the first unpaid installment). action add_salary_package: employee_id; fields effective_on, basic_salary, salary_count (12-16), currency, ss_salary, company_bank_account_id, tax_number, ss_number, gl_account, notes, items[] {kind allowance|deduction|company_expense, transaction_type_id or name_en/name_ar, amount}. action withdraw_salary_package: employee_id, package_id (not started yet). action stop_salary (fields reason) and resume_salary: employee_id. Attachments go through the API or the screen. action bulk_delete_transactions: ids (unpaid regular-payroll transactions; off-cycle and approved months are skipped). action next_month: transaction_id moves to the next payroll month. action settle_off_cycle: ids of unpaid off-cycle transactions marked paid.

Argument	Type	Description
`company_id`required	integer
`action`required	string add_transaction \| update_transaction \| delete_transaction \| bulk_delete_transactions \| next_month \| settle_off_cycle \| add_loan \| delete_loan \| loan_details \| skip_installment \| pay_installment_cash \| reschedule_loan \| add_salary_package \| withdraw_salary_package \| stop_salary \| resume_salary
`employee_id`	integer
`transaction_id`	integer
`loan_id`	integer
`installment_id`	integer
`package_id`	integer
`ids`	array
`fields`	object

manage_goals changes data Goals. action add: fields title, description, due_date, and employee_ids (performance.manage over th...

Goals. action add: fields title, description, due_date, and employee_ids (performance.manage over them; default: myself). action update: goal_id, fields progress 0–100, status open|achieved|missed (the owner or HR). action delete: goal_id (whoever set it, or HR).

Argument	Type	Description
`company_id`required	integer
`action`required	string add \| update \| delete
`goal_id`	integer
`fields`	object

manage_insurance changes data Medical insurance (HR module), the same rules as the screen. action create_policy / update_policy (p...

Medical insurance (HR module), the same rules as the screen. action create_policy / update_policy (policy_id) (payroll_setup.manage): fields insurer, policy_number, start_date, expiry_date (after the start), cost_adult, cost_minor, currency_adult, currency_minor, branch_id (empty = all branches), pro_rata, per_employee. action delete_policy (payroll_setup.manage): policy_id. action add_member (payroll.manage, employee in my scope): policy_id; fields employee_id, family_member_id (one of the employee's family, empty = the employee), offline_insurance_id, start_date, end_date, adult_dependents, minor_dependents, custom_setup with custom_cost, monthly_deduction; the same owner again updates their row. action remove_member (payroll.manage): member_id.

Argument	Type	Description
`company_id`required	integer
`action`required	string create_policy \| update_policy \| delete_policy \| add_member \| remove_member
`policy_id`	integer
`member_id`	integer
`fields`	object

manage_inventory changes data FSM inventory (docs/fsm-sections.md), as field/inventory/*, with the same permissions. Reading (fiel...

FSM inventory (docs/fsm-sections.md), as field/inventory/*, with the same permissions. Reading (field.inventory.view or .manage): list_parts (filters: q, category, low, active, branch_id, per_page), get_part (id), list_locations, get_location (id), list_movements (filters: part_id, location_id, job_id, type, from, to), job_parts (job_id). export_parts and export_movements (field.inventory.export; headers and rows). Parts: save_part (.create, or .edit with id; fields sku, name, category, unit, unit_cost, supplier, min_stock, notes, active, branch_id), delete_part (.delete). Locations (.locations): save_location (fields name, kind of warehouse, van, site, address, active, branch_id), delete_location. Stock on part id: receive (.receive; fields location_id, quantity, reference, note), adjust (.adjust; location_id, counted, note), transfer (.transfer; from_location_id, to_location_id, quantity, note), issue (.issue; location_id, job_id, quantity, employee_id, note), return (.issue; location_id, job_id, quantity, note).

Argument	Type	Description
`company_id`required	integer
`action`required	string list_parts \| get_part \| list_locations \| get_location \| list_movements \| job_parts \| export_parts \| export_movements \| save_part \| delete_part \| save_location \| delete_location \| receive \| adjust \| transfer \| issue \| return
`id`	integer
`job_id`	integer
`filters`	object
`fields`	object
`branch`	string

manage_leave_balances changes data Leave balances of the employees your role reaches. action balances (leaves.view): employee_id, year...

Leave balances of the employees your role reaches. action balances (leaves.view): employee_id, year or as_of. Each action needs its own permission, and leaves.manage grants them all: add_leave (leaves.manage) (approved leave for an employee: employee_id, leave_type_id, start_date, end_date or start_time and end_time, reason), adjust (leaves.adjustments.manage: employee_id, leave_type_id, year, days (+/-), reason), delete_adjustment (adjustment_id; leaves.adjustments.manage, or leaves.moved_balances.manage for a moved balance), move (leaves.moved_balances.manage: leave_type_id, year, max_days; the whole company), set_setup (leaves.balance_corrections.manage: (employee_id, leave_type_id, entitlement_days, open_balance, carry_balance, balance_year, active; reset true for the company setup), apply_type (leaves.balance_corrections.manage: leave_type_id to employee_ids or everyone, with entitlement_days and open_balance), encashments (leaves.encashments.view: year, default this year; the encashments of the employees in scope), encash (leaves.encashments.manage: employee_id, leave_type_id, days, notes), cancel_encashment (leaves.encashments.manage: encashment_id). action balance_breakdown (leaves.view; employee_id, leave_type_id): ZenHR's Show balance, each year split into opening, previous, adjustments, encashed, hourly, total, used, pending, remaining.

Argument	Type	Description
`company_id`required	integer
`to_leave_type_id`	integer
`action`required	string balances \| balance_breakdown \| encashments \| add_leave \| adjust \| delete_adjustment \| move \| set_setup \| apply_type \| encash \| cancel_encashment \| cancel_future \| deactivate_move
`employee_id`	integer
`employee_ids`	array
`leave_type_id`	integer
`year`	integer
`as_of`	string
`days`	number
`reason`	string
`max_days`	number
`start_date`	string
`end_date`	string
`start_time`	string
`end_time`	string
`entitlement_days`	number
`open_balance`	number
`carry_balance`	number
`balance_year`	integer
`active`	boolean
`reset`	boolean
`notes`	string
`adjustment_id`	integer
`encashment_id`	integer

manage_miscellaneous_requests changes data ZenHR's "Manage Miscellaneous Requests". action list (default): the miscellaneous (general) requests...

ZenHR's "Manage Miscellaneous Requests". action list (default): the miscellaneous (general) requests of the employees in your requests.miscellaneous.view scope (or requests.view / requests.manage), filtered by miscellaneous_type_id, status (pending, approved, rejected, cancelled), employee_id, active (active (default), inactive, all), from/to (effective date) and q; each row has the serial number, employment number, employee, transaction name, effective date, status and whether the employee is active. action update (requests.miscellaneous.manage or requests.manage, request_id): change miscellaneous_type_id, subject, effective_date, end_date, details or fields {field id: value}. action delete (requests.miscellaneous.manage or requests.manage, request_id): delete the request and its trail.

Argument	Type	Description
`company_id`required	integer
`action`	string list \| update \| delete
`request_id`	integer
`miscellaneous_type_id`	integer
`status`	string pending \| approved \| rejected \| cancelled
`employee_id`	integer
`active`	string active \| inactive \| all
`from`	string
`to`	string
`q`	string
`page`	integer
`per_page`	integer
`end_date`	string
`subject`	string
`effective_date`	string
`details`	string
`fields`	object

manage_my_connected_app can delete Disconnect one of the signed-in person's own AI apps (kind oauth) or revoke one of their access toke...

Disconnect one of the signed-in person's own AI apps (kind oauth) or revoke one of their access tokens (kind token): id and kind from list_my_connected_apps. Anything using it stops at once; if it is the app making this call, this connection ends too. Confirm first. docs/ai-integrations.md.

Argument	Type	Description
`id`required	integer
`kind`required	string oauth \| token

manage_my_dashboards changes data The person's own dashboards (docs/dashboards.md): tabs of widgets on top of the fixed dashboards, ea...

The person's own dashboards (docs/dashboards.md): tabs of widgets on top of the fixed dashboards, each showing one figure the person may see. action metrics: what can be added. action list: their dashboards (the first time, ZenHR's "Default Dashboard" is made for them with its stock widgets they may see; is_default marks it). action show: dashboard_id with every widget's figure. action create: name {en, ar}. action rename: dashboard_id, name. action delete: dashboard_id. action add_widget: dashboard_id, metric, title {en, ar}, chart, width 1–4 (quarters). action update_widget: widget_id with title, chart, width. action remove_widget: widget_id. action reorder: dashboard_id, ids (widget ids in order). action set_interval: dashboard_id, interval (1–6 for every widget whose report offers it, 0 for each widget's own). action order_dashboards: ids (the person's dashboard ids in order). action home_widgets: the HR dashboard Home Page widgets the person may see (the widget registry, config/dashboard-widgets.php), in their order, with width, shown and the permission each needs; a widget without its permission is never listed. action save_home_widgets: order [keys], show [keys] (the rest hidden) and widths {key: 1–4}, each optional. action home_sections / save_home_sections (show [keys]): the older form, which widgets show. A Command Center report widget (Mawarid's ZenHR Command Center, employees.view): metric report with report_type (approved_leaves, approved_vacations, contract_expiry, document_expiry, termination_reasons, end_of_probation, headcount, joiners_leavers, overtime_hours, pending_tasks, retention_rate, turnover), breakdown for headcount (age_group, gender, nationality, service_period, work_type), level (company, branch, work_location, department, section, group, project, job_role) with unit_ids, interval (1 Today, 2 7D, 3 30D, 4 3M, 5 6M, 6 12M, as the report offers), upcoming, options (the report's extra field, e.g. leave_type_id, document_type_id, termination_category, overtime_type, task_kind; company_documents for document_expiry) and chart (numbers, stacked, bar, line, area, donut, pie, as the shape allows).

Argument	Type	Description
`company_id`required	integer
`action`required	string metrics \| list \| show \| create \| rename \| delete \| add_widget \| update_widget \| remove_widget \| reorder \| set_interval \| order_dashboards \| home_sections \| save_home_sections \| home_widgets \| save_home_widgets
`dashboard_id`	integer
`widget_id`	integer
`name`	object
`metric`	string headcount \| joined_this_month \| employees_by_department \| on_leave_today \| pending_leaves \| leave_days_by_type \| attendance_rate \| waiting_on_me \| upcoming_holidays \| attendance_trend \| most_late \| payroll_trend \| active_loans \| payroll_cost \| loans_outstanding \| assets_by_status \| assets_expiring \| performance_completion \| performance_average \| performance_overdue \| performance_stages \| performance_distribution \| performance_by_department \| performance_top \| goal_progress \| field_jobs_today \| my_leave_remaining \| my_net_salary \| unread_notifications \| report
`title`	object
`chart`	string
`width`	integer
`ids`	array
`report_type`	string approved_leaves \| approved_vacations \| contract_expiry \| document_expiry \| termination_reasons \| end_of_probation \| headcount \| joiners_leavers \| overtime_hours \| pending_tasks \| retention_rate \| turnover \| loans \| net_salaries \| overtime_pay
`breakdown`	string none \| age_group \| gender \| nationality \| service_period \| work_type
`level`	string company \| branch \| work_location \| department \| section \| group \| project \| job_role
`unit_ids`	array
`interval`	integer
`upcoming`	boolean
`options`	object
`show`	array
`order`	array
`widths`	object

manage_my_list_columns changes data Show / hide columns of a list for the signed-in user (saved on the account, same on every device). L...

Show / hide columns of a list for the signed-in user (saved on the account, same on every device). Lists: salaries, salary_batches, transactions, transactions_off_cycle, overtimes, loans, and requests.<type> for My Requests per request type. action get: one list (list) or all, with each column's key, label and visible. action set: list and hidden (column keys to hide; empty shows them all).

Argument	Type	Description
`action`required	string get \| set
`list`	string	A list key, e.g. salaries or requests.leave.
`hidden`	array	Column keys to hide (action set).

manage_my_notifications changes data The person's own notices and channels (docs/notifications.md). action read: mark notice_id read (unr...

The person's own notices and channels (docs/notifications.md). action read: mark notice_id read (unread true to mark it unread). action read_all: mark every notice read. action preferences: their channels per category (in_app, email, whatsapp). action save_preferences: categories {category: {in_app, email, whatsapp}}; sign-in alerts always stay in the bell, and WhatsApp needs a mobile number on the profile.

Argument	Type	Description
`company_id`required	integer
`action`required	string read \| read_all \| preferences \| save_preferences
`notice_id`	integer
`unread`	boolean
`categories`	object

manage_my_push_tokens changes data The phones the signed-in person gets push notices on through the Mihnaro mobile app (docs/mobile-app...

The phones the signed-in person gets push notices on through the Mihnaro mobile app (docs/mobile-app.md). action list: the phones (tokens shortened, provider fcm | apns | expo, active, disabled_reason). action register: token (the phone's native FCM registration token or APNs device token; Expo tokens are refused), platform (ios or android), provider (fcm or apns, defaults from the platform), device_name, apns_environment (production or sandbox, which of Apple's servers this build uses, if known). action forget: token, to stop pushes to that phone. Notices that reach the bell are pushed straight to Google/Apple for every active phone.

Argument	Type	Description
`action`required	string list \| register \| forget
`token`	string
`platform`	string ios \| android
`provider`	string fcm \| apns
`device_name`	string
`apns_environment`	string production \| sandbox

manage_my_system_announcements changes data Messages from the Mihnaro team for the signed-in person (docs/platform-control.md). action list: the...

Messages from the Mihnaro team for the signed-in person (docs/platform-control.md). action list: the ones still open on a channel (web or app, default web), in the person's language. action dismiss: close one (id) that may be dismissed. action acknowledge: confirm reading one (id) that must be acknowledged.

Argument	Type	Description
`action`required	string list \| dismiss \| acknowledge
`id`	integer
`channel`	string web \| app

manage_nine_box changes data The 9-box grid (performance × potential, docs/succession.md). action grid (performance.view or .mana...

The 9-box grid (performance × potential, docs/succession.md). action grid (performance.view or .manage, their scope): filters cycle_id, branch_id, department_id, position_id, box (1–9; 1 low/low, 9 high/high) → each box with its employees, and those not placed yet. action history: employee_id → their box in each cycle and their potential assessments. action assess (performance.manage over the employee, or their direct manager): fields employee_id, rating (low|medium|high), criteria {learning_agility, leadership, drive, adaptability, aspiration: 1–5}, notes, evaluation_cycle_id, assessed_on. action delete_assessment: assessment_id.

Argument	Type	Description
`company_id`required	integer
`action`required	string grid \| history \| assess \| delete_assessment
`cycle_id`	integer
`branch_id`	integer
`department_id`	integer
`position_id`	integer
`box`	integer
`employee_id`	integer
`assessment_id`	integer
`fields`	object

manage_notification_setup changes data The company's Notifications setup (notifications.manage, docs/notifications.md). Without save: categ...

The company's Notifications setup (notifications.manage, docs/notifications.md). Without save: categories_off, receiver_emails, the reminders and document_notice (each expiring document type with its notify_before period). save true with any of: categories_off (list of categories no one is told about; security can't be off), receiver_emails (list, copies of employee-record reminders), reminders {key: value}: switches rem_contract_on, rem_probation_on, rem_documents, rem_anniversary, rem_anniversary_employee, rem_birthday, rem_birthday_greetings, punch_alerts_on (true/false); days rem_contract_hr_days, rem_contract_manager_days, rem_contract_employee_days, rem_probation_hr_days, rem_probation_manager_days, rem_probation_employee_days, rem_documents_hr_days, rem_documents_manager_days, rem_documents_employee_days, rem_anniversary_hr_days, rem_anniversary_manager_days, rem_birthday_hr_days (0–365, null = not told); minutes punch_alert_employee, punch_alert_manager, punch_alert_hr (0–2880).

Argument	Type	Description
`company_id`required	integer
`save`	boolean
`categories_off`	array
`receiver_emails`	array
`reminders`	object
`document_notice`	object	Per document type that expires, how long before expiry HR is told: {"type id": "week\|2_weeks\|month\|2_months\|3_months\|6_months"} (ZenHR's list).
`email_everyone`	boolean	Also send every notice by email to everyone who has an email.

manage_okrs changes data An employee's OKRs in a cycle, for their OKR writer, OKR auditors, result writer or performance.mana...

An employee's OKRs in a cycle, for their OKR writer, OKR auditors, result writer or performance.manage over them, while unpublished. action save_objective: evaluation_id (new) or objective_id (change), fields name {en, ar}, description {en, ar}, weight, key_results [{name {en, ar}, weight, measurement_unit_id, target}] (weights make 100). action delete_objective: objective_id. action publish: evaluation_id (objectives must make 100%). action mass_assign: template_id (OKR template), fields.evaluations (ids).

Argument	Type	Description
`company_id`required	integer
`action`required	string save_objective \| delete_objective \| publish \| mass_assign
`evaluation_id`	integer
`objective_id`	integer
`template_id`	integer
`fields`	object

manage_overtimes changes data Manage Overtimes for employees in my payroll scope (payroll.overtime.manage, which payroll.manage gr...

Manage Overtimes for employees in my payroll scope (payroll.overtime.manage, which payroll.manage grants). action add: fields employee_id, overtime_type_id, date (YYYY-MM-DD, not in the future), from_time and till_time (HH:MM) or hours, reason; it is approved at once and paid with the open payroll month. action update: overtime_id, the same fields without employee_id (refused once paid in an approved payroll or converted to time off). action convert_to_time_off (ZenHR's Overtime Converter): fields from, to, leave_type_id, rate (% of the hours), effective_date, minimum_hours, combined, notes, optional department, work_location, section, main_project; approved, unconverted overtime not yet in an approved payroll becomes leave balance (off until legally validated). action batch_as_income: fields employee_id, transaction_type_id (an earning type), overtime_type_id, hours, date, description: hours × the employee's overtime rate as an earning in the open payroll month. GET /overtimes on the API lists them.

Argument	Type	Description
`company_id`required	integer
`action`required	string add \| update \| convert_to_time_off \| batch_as_income
`overtime_id`	integer
`fields`	object

manage_part_time changes data Part-time transactions for employees in my payroll scope (payroll.manage). action add: fields employ...

Part-time transactions for employees in my payroll scope (payroll.manage). action add: fields employee_id, transaction_type_id (a part-time transaction type), amount (else the type's default amount, times recurring_value when given; required when it has none), recurring_value (ZenHR's "Recurring": the number of units), net (true: the amount is net and grossed up for tax), effective_date, end_date (optional), recurring true (paid every month from the date) or false (once), note. action update: assignment_id and the same fields without employee_id. action delete: assignment_id. list_payroll_costs kind part_time lists them.

Argument	Type	Description
`company_id`required	integer
`action`required	string add \| update \| delete
`assignment_id`	integer
`fields`	object

manage_payroll_run changes data Payroll runs (payroll.manage). action calculate: Manage salaries → Calculate (fields salary_type mon...

Payroll runs (payroll.manage). action calculate: Manage salaries → Calculate (fields salary_type monthly|extra, month YYYY-MM, picks[] from list_payroll_costs kind calculate_options: branch:<id>, employee:<id>, org:<id>, anyone matching one is calculated, none = everyone not paid yet; monthly: period_from / period_to YYYY-MM-DD (default: the cut-off range), batch_id to add to a draft batch of the month instead of a new one, move_pending true to move this month's transactions dated after period_to to next month; extra: title, percent_of_basic). action run: calculate a month (fields month YYYY-MM; optional batch departments[], branches[], employees[] ids). action off_cycle: an extra payment (fields title, month, percent_of_basic). action recalculate, approve (approved at once, or sent through the salary batch approval chain: result approved or sent), paid (fields paid_at, payment_reference) and delete (a draft) take run_id. action adjust: a one-off amount on a draft payslip (payslip_id; fields adjustment, note). action remove_employee: Delete on a salary row, takes the employee of payslip_id out of draft run_id (recalculating leaves them out). action revert_check: whether approved run_id can go back to draft (can_revert, blockers). action revert: Revert to draft, undoing what approving did (installments unpaid, loans active again, provisions as before); refused while blockers exist (fields reason). action settlement_candidates: leavers in scope whose leaving month has no slip yet (employee_id, employee_number, employee_name, terminated_on, month). action off_cycle_settlement: ZenHR's Off-Cycle Settlement slip, the leaver's final settlement worked out on its own as a draft one-person batch of the leaving month (fields employee_id; refused when the month already has their slip); approve it with action approve.

Argument	Type	Description
`company_id`required	integer
`action`required	string calculate \| run \| off_cycle \| recalculate \| approve \| paid \| delete \| adjust \| remove_employee \| revert_check \| revert \| settlement_candidates \| off_cycle_settlement
`run_id`	integer
`payslip_id`	integer
`fields`	object

manage_payroll_setup changes data Change payroll setup (payroll_setup.manage), the same as the screens. action update_settings: sectio...

Change payroll setup (payroll_setup.manage), the same as the screens. action update_settings: section payroll_setup | in_advance | extra_salaries | tax_setup | journal | provision_setup, fields = only the settings to change (names and value shapes as list_payroll_setup kind settings gives them; the others keep their values; e.g. journal fields je_type summary|detailed, je_match_levels[], acct_* codes; extra_salaries es_reimburse_type_id is required when es_reimburse_tax is on). action add_rule / update_rule (id) / delete_rule (id): section social-security (name_en, name_ar, employee_percent, employer_percent, salary_from, salary_to, floor (ZenHR minimum salary: the least SS wage charged), ceiling, base basic|gross, min_work_days, effective_from, effective_to, active, external_ref), tax (name_en, name_ar, effective_from, effective_to, bracket_rows [{min, max, rate, extra_exemption}] with bracket_period monthly|annual, or brackets "from:rate" per line, personal_exemption, family_exemption, other_exemption, notes, external_ref), extra-salaries (name_en, name_ar, percent, base basic|gross, distribution once|monthly, pay_month 1-12, prorate, taxable, in_final_settlement, active), bank-accounts (bank_name, account_number, iban, bank_branch, account_name, country, currency, exchange_account, establishment_number, branch_id, bank_export_template_id, is_default), bank-templates (name_en, name_ar, kind, bank, extension, delimiter, header_lines, footer_lines, columns_text "field|Header" per line, date_format, amount_decimals, include_header, active) or slip-templates (slip_type, language, header, footer); update_rule takes the whole record (a switch left out is off); an item in use can't be deleted. action update_ss_salaries: fields.base basic|gross sets the SS salary of the active employees in my payroll.manage scope.

Argument	Type	Description
`company_id`required	integer
`action`required	string update_settings \| add_rule \| update_rule \| delete_rule \| update_ss_salaries
`section`	string payroll_setup \| in_advance \| extra_salaries \| tax_setup \| journal \| provision_setup \| social-security \| tax \| extra-salaries \| bank-accounts \| bank-templates \| slip-templates
`id`	integer
`fields`	object

manage_performance_setup changes data Performance setup. action list (performance.view/manage/setup): kind evaluation-templates, general-f...

Performance setup. action list (performance.view/manage/setup): kind evaluation-templates, general-factor-templates, okr-templates, rating-types, categories, levels, competencies or position-competencies. The rest need performance_setup.manage; id changes an existing record. save_template (fields as on the template form: name {en, ar}, period, result_format, branch_ids, self_assessment, max_okrs, general_factor_template_id, okrs_creator, okr_auditors [supervisor|manager_1|manager_2|key_staff], result_writer, result_auditors [same], self_assessment_stage, okr_followup, evaluate_based_on objectives|key_results, factors {okrs|general_factors|competencies: {active, weight}}, scales [{name, min, max}], active), delete_template, add_criterion (id = template; title {en, ar}, weight, kind factor|okr, target, measurement_unit_id), delete_criterion, save_factor_template (name, branch_ids, factors [{name, weight}]), delete_factor_template, save_okr_template (name), delete_okr_template, save_template_objective (id = OKR template, index to replace; the objective fields), delete_template_objective (id, index), save_rating_type (name, units [{id?, name}]), delete_rating_type, save_category (name, levels, linked_to_position), save_level (name, rank), save_competency (name, description, competency_category_id), delete_category, delete_level, delete_competency, link_position (position_id, competency_id, required_level, weight), unlink_position. action rate_competency (performance.manage or the line manager): employee_id, competency_id, level.

Argument	Type	Description
`company_id`required	integer
`action`required	string
`kind`	string
`id`	integer
`index`	integer
`fields`	object

manage_project_contributions changes data Per-project contribution percentages of an employee in my payroll scope (docs/payroll-project-contri...

Per-project contribution percentages of an employee in my payroll scope (docs/payroll-project-contributions.md), as GET/PUT /employees/{id}/project-contributions. action get (payroll.view or payroll.manage): employee_id, optional month YYYY-MM; returns total, complete (adds up to 100) and projects[] {assignment_id, project_id, project, code, contribution_percent, hours (approved timesheet hours that month), hours_share (% of the month's hours)}. action set (payroll.manage): employee_id, projects[] {project_id, contribution_percent} for the projects the employee is assigned to, adding up to exactly 100 (a project left out gets 0). The Calculated Costs report by project and the Project Summary report split salaries by these.

Argument	Type	Description
`company_id`required	integer
`action`required	string get \| set
`employee_id`required	integer
`month`	string	YYYY-MM
`projects`	array

manage_provisions changes data Monthly provisions (payroll.manage), the same as the screen. action calculate: month YYYY-MM, or fro...

Monthly provisions (payroll.manage), the same as the screen. action calculate: month YYYY-MM, or from + to (YYYY-MM, up to 24 months, worked out oldest first), for every employee or only those picked by any of employee_ids, job_role_ids, department_ids, work_location_ids, section_ids, project_ids, hierarchy_group_ids, business_unit_ids, division_ids, segment_ids (id lists), work_type and contract_type (limited | unlimited); follows provision setup and replaces what those months had for them; gives the number of employees. action delete_month: month, deletes that month's provisions of the employees in my payroll.manage scope. action bulk_delete: ids (provision row ids); only an employee's latest month can go, so deleted can be less than chosen. Provision setup is manage_payroll_setup update_settings section provision_setup.

Argument	Type	Description
`company_id`required	integer
`action`required	string calculate \| delete_month \| bulk_delete
`month`	string	YYYY-MM
`from`	string	YYYY-MM
`to`	string	YYYY-MM
`work_type`	string full_time \| part_time \| freelance \| internship \| contractor
`contract_type`	string limited \| unlimited
`ids`	array
`employee_ids`	array
`job_role_ids`	array
`work_location_ids`	array
`department_ids`	array
`section_ids`	array
`project_ids`	array
`hierarchy_group_ids`	array
`business_unit_ids`	array
`division_ids`	array
`segment_ids`	array

manage_recruitment can delete Recruitment (recruitment.manage). action save_job: post a job opening, or change one with job_id: fi...

Recruitment (recruitment.manage). action save_job: post a job opening, or change one with job_id: fields title {en, ar}, department_id, branch_id, position_id, employment_type (full_time, part_time, contract, internship), description, requirements, positions, closing_date, status (draft, open, closed). action delete_job: an opening nobody was hired from. action add_candidate (job_id): fields name, email, phone, source (careers_page, referral, linkedin, job_board, other), cover_note. action update_candidate (candidate_id): fields stage (not hired), rejection_reason, rating 1–5. action delete_candidate. action add_note (candidate_id): fields body. action schedule_interview (candidate_id): fields interviewer_id (an employee), panel_ids, scheduled_at, kind (onsite, video, phone), duration_minutes, location, video_provider (zoom, google_meet, teams, manual), video_link; the candidate gets an invitation with an .ics. action update_interview (interview_id): fields status (scheduled, done, cancelled), rating, feedback. action hire (candidate_id): creates the employee record (needs employees.manage); fields employee_number, hire_date, branch_id, department_id, position_id, manager_id, basic_salary, create_login. action careers: fields enabled true/false turns the public careers page on or off. CV uploads go through the API or the screen.

Argument	Type	Description
`company_id`required	integer
`action`required	string save_job \| delete_job \| add_candidate \| update_candidate \| delete_candidate \| add_note \| schedule_interview \| update_interview \| hire \| careers
`job_id`	integer
`candidate_id`	integer
`interview_id`	integer
`fields`	object

manage_recruitment_ats can delete Applicant tracking (recruitment.manage unless noted), with fields in `fields`. Pipeline: move (candi...

Applicant tracking (recruitment.manage unless noted), with fields in `fields`. Pipeline: move (candidate_id; stage, reason), bulk (ids, action move/reject/tag/untag/pool/unpool/email/delete, stage, reason, tags, template), profile (candidate_id; tags, in_talent_pool, linkedin_url), email (candidate_id; template = a stage), pool_add (name, email, phone, linkedin_url, tags, source, cover_note), add_to_job (candidate_id; job_opening_id). AI (only when the platform has a key and the company turned AI on; candidate data needs the company's consent): ai_parse (candidate_id), ai_match (candidate_id), ai_rank (job_id; refresh), ai_questions (job_id; count), ai_draft (title, department, employment_type, notes). LinkedIn: linkedin (job_id): posts to the connected page or returns the share link. Interviews: booking_link (candidate_id; interviewer_id, panel_ids, kind, duration_minutes, location, video_provider, video_link, booking_from, booking_to), availability (employee_id; windows [{weekday 0-6, starts_at, ends_at}]), scorecard (interview_id; your own as a panel member: ratings [{criterion, rating}], overall, recommendation strong_yes/yes/no/strong_no, notes). Offers: offer_draft (candidate_id; offer_template_id, salary_package_id, job_title, start_date, basic_salary, currency, items, expires_on, language), offer_update (offer_id), offer_submit, offer_send, offer_withdraw (offer_id), offer_decide (offer_id; decision approve/reject, note; needs recruitment.approve_offers), offer_convert (offer_id; employee_number, branch_id, department_id, boarding_template_id; needs employees.manage). Assessments: send_assessment (candidate_id; assessment_id, due_date Y-m-d, pass_stage, fail_stage, locale): sends a test link by the "Assessment" email, with an optional gate that moves the candidate on a pass or a fail; stage_assessments (fields {stage: {assessment_test_id (null removes), auto_send, pass_stage, fail_stage, due_days}}): the test a stage sends when a candidate enters it. Setup: email_template (stage, or "assessment" for the test link email with {test_name} {assessment_link} {due_date} {time_limit}; subject, body, auto_send), offer_template (template_id to change; name, body, active), offer_template_delete (template_id), settings (ai_enabled, ai_candidate_data, ai_auto_parse, recruitment_email_language).

Argument	Type	Description
`company_id`required	integer
`action`required	string move \| bulk \| profile \| email \| pool_add \| add_to_job \| ai_parse \| ai_match \| ai_rank \| ai_questions \| ai_draft \| linkedin \| booking_link \| availability \| scorecard \| offer_draft \| offer_update \| offer_submit \| offer_send \| offer_withdraw \| offer_decide \| offer_convert \| send_assessment \| stage_assessments \| email_template \| offer_template \| offer_template_delete \| settings
`candidate_id`	integer
`job_id`	integer
`offer_id`	integer
`interview_id`	integer
`employee_id`	integer
`template_id`	integer
`stage`	string applied \| screening \| interview \| offer \| hired \| rejected \| assessment
`fields`	object

manage_salary_package_templates changes data Salary package templates (ZenHR Salary Package Templates, payroll.manage), the same rules as the scr...

Salary package templates (ZenHR Salary Package Templates, payroll.manage), the same rules as the screen. action create: fields name_en, name_ar, basic_salary, active (default true), external_ref (the ZenHR id). action update (template_id): only the fields to change. action delete (template_id). action add_item (template_id): fields type allowance|deduction, transaction_type_id or name_en/name_ar, amount. action remove_item (template_id, item_id). An inactive template isn't offered when applying a template to an employee. list_payroll kind templates lists them.

Argument	Type	Description
`company_id`required	integer
`action`required	string create \| update \| delete \| add_item \| remove_item
`template_id`	integer
`item_id`	integer
`fields`	object

manage_salary_scales changes data Salary scales (HR module), the same rules as the screen. Setup actions need payroll_setup.manage. ac...

Salary scales (HR module), the same rules as the screen. Setup actions need payroll_setup.manage. action create_scale / update_scale (scale_id): fields name_en, name_ar, has_grades, has_bands, has_levels (at least one), salary_range_layer, benefits_layer, timeoffs_layer (grade|band|level, a layer the scale has), exceed_range_percent, exceed_benefits_percent, compa_from, compa_to, activation_date YYYY-MM-DD, status active|inactive|draft, auto_move_vacations. action delete_scale: scale_id (refused while an employee sits on it). action add_layer / update_layer (layer_id): scale_id, layer grade|band|level; fields name_en, name_ar, scale_grade_id (band, level), scale_band_id (level), min_salary, mid_salary, max_salary, entitled_to_overtime, and id lists job_role, loan_type, air_ticket_policy, insurance_policy, annual_leave, sick_leave (a list sent replaces the old one), allowances [{transaction_type_id, amount}]. action delete_layer: scale_id, layer, layer_id (refused while in use). action update_job_grade: grade_id; fields ideal_compa_ratio (0.5-1.5), benefits, leave {leave_type_id: days}. action add_job_grade_level: grade_id; fields name_en, name_ar, rank, salary. action delete_job_grade_level: level_id. action set_enforcement: fields salary_scale_enforce off|block. action place_employee (payroll.manage, employee in my scope): employee_id; fields scale_level_id, scale_band_id, scale_grade_id (all empty = off the scale); returns a warning when the salary is outside an enforced range.

Argument	Type	Description
`company_id`required	integer
`action`required	string create_scale \| update_scale \| delete_scale \| add_layer \| update_layer \| delete_layer \| update_job_grade \| add_job_grade_level \| delete_job_grade_level \| set_enforcement \| place_employee
`scale_id`	integer
`layer`	string grade \| band \| level
`layer_id`	integer
`grade_id`	integer	A job grade (job grades screen).
`level_id`	integer	A job grade level.
`employee_id`	integer
`fields`	object

manage_saved_report can delete The person's saved report options ("Save selected options"), as POST /reports/{report}/saved and DEL...

The person's saved report options ("Save selected options"), as POST /reports/{report}/saved and DELETE /saved-reports/{id}. action save: report (key), name, options (the run_report filters, cols, show); the same name replaces. action delete: id. Run saved options with run_report and saved_id.

Argument	Type	Description
`company_id`required	integer
`action`required	string save \| delete
`report`	string
`name`	string
`options`	object
`id`	integer

manage_slack changes data The company's Slack channel (integrations.slack.manage, which integrations.manage grants; docs/integ...

The company's Slack channel (integrations.slack.manage, which integrations.manage grants; docs/integrations.md): a readable line is posted there for the webhook events chosen. action show: connected or not, and the events (the webhook address is a secret and is never returned). action save: fields webhook_url (a Slack incoming webhook, https://hooks.slack.com/…; empty keeps the current one), events (see list_integrations kind events), disconnect, test (post a test line now; the answer has Slack's test_status).

Argument	Type	Description
`company_id`required	integer
`action`required	string show \| save
`fields`	object

manage_stb_encashments changes data End-of-service benefit encashments (HR module), the same rules as the screen. action create (payroll...

End-of-service benefit encashments (HR module), the same rules as the screen. action create (payroll.stb_encashments.manage, which payroll.manage grants; employee in my scope): fields employee_id, amount (at most what list_stb_encashments kind available allows), payment payroll|off_cycle, notes; it adds an earning to the open payroll month (paid now when off_cycle). action delete (payroll.manage): encashment_id, while its payroll month is not approved and it was not paid off-cycle. action settings (payroll_setup.manage): fields = only the settings to change (the others keep their values): stb_encash_enabled, stb_encash_max_percent (0-100), stb_encash_min_years, stb_encash_every_years, stb_encash_min_amount, stb_encash_max_amount, stb_encash_after_months (after the hiring date), stb_encash_times per stb_encash_per_years, stb_encash_eligible all|citizens|non_citizens, stb_encash_attachments_required, stb_encash_notes_required, stb_encash_requestable, stb_encash_default_payment payroll|off_cycle, stb_encash_limited_policy_id / stb_encash_unlimited_policy_id (STB policy ids), stb_encash_income_name_en/_ar, stb_encash_deduction_name_en/_ar. create also takes external_ref (the ZenHR id); payment defaults to stb_encash_default_payment.

Argument	Type	Description
`company_id`required	integer
`action`required	string create \| delete \| settings
`encashment_id`	integer
`fields`	object

manage_succession changes data Succession planning (succession.manage, limited to its scope). action list: key positions with succe...

Succession planning (succession.manage, limited to its scope). action list: key positions with successors and whether each is critical (high risk, high impact, nobody ready now). action save: key_position_id to change, fields title {en, ar}, position_id, department_id, holder_id, risk_of_loss and impact (low|medium|high), notes. action delete: key_position_id. action add_successor: key_position_id, fields employee_id, readiness (ready_now|one_two_years|three_plus_years), development_plan. action remove_successor: successor_id.

Argument	Type	Description
`company_id`required	integer
`action`required	string list \| save \| delete \| add_successor \| remove_successor
`key_position_id`	integer
`successor_id`	integer
`fields`	object

manage_suspension changes data Employee suspensions (docs/discipline.md). HR (discipline.manage over the employee) acts at once; a...

Employee suspensions (docs/discipline.md). HR (discipline.manage over the employee) acts at once; a manager up the employee's line asks, and the request follows the "Employee Suspensions & Resumptions" approval chain (HR without one). action create (fields employee_id, start_date, end_date, paid, suspension_reason_id, reason: notes, required unless the reason says otherwise). With suspension_id: decide (fields decision approve|reject, for the step it waits on), withdraw, resume (fields resumption_notes: come back early; HR's is approved at once), decide_resumption (decision), withdraw_resumption, cancel (HR at once, a manager asks), decide_cancel (decision, HR), cancel_resumption, decide_cancel_resumption (decision, HR), delete (HR, for one entered by mistake). Attachments go through the API or the screen.

Argument	Type	Description
`company_id`required	integer
`action`required	string create \| decide \| withdraw \| resume \| decide_resumption \| withdraw_resumption \| cancel \| decide_cancel \| cancel_resumption \| decide_cancel_resumption \| delete
`suspension_id`	integer
`fields`	object

manage_task changes data Tasks. action assign: fields kind (custom, document_upload, document_download, give_asset, take_asse...

Tasks. action assign: fields kind (custom, document_upload, document_download, give_asset, take_asset, add_bank_account, add_family_member), title, description, due_date, priority (low, normal, high), task_template_id, notes_required, attachments_required (left out, an ordinary custom task starts from the setting of each employee's branch; an explicit value wins), and employee_id (yourself, or anyone in tasks.manage's scope) or assign_mode group with group_dimension and group_value; document_type_id, document_id, asset_type_id, asset_id and target_employee_id for their kinds. action status: fields.status todo, in_progress or done. A give_asset task, once completed, waits (status awaiting_confirmation) until the employee who got the asset runs action confirm_receipt. action complete (the assignee): fields completion_notes, asset_id (give asset), profile {column: value} (complete profile, a workflow task: the columns its profile_fields ask for); files go through the API or the screen. Workflow tasks (docs/boarding.md) in a sequential workflow wait for the earlier ones (locked). action delete: a pending task. action bulk_delete: fields.tasks (ids). action save_template / delete_template (tasks.templates.manage): with template_id, fields title {en, ar}, description, priority, due_in_days, related_to, branch_id (empty: the whole company), steps. steps on assign or a template: a list of {name {en, ar}, photos_allowed, videos_allowed, min_photos, min_videos, max_photos, max_videos}; a template with steps needs tasks.templates.use to assign, its own steps tasks.proof.require. group_dimension my_team: everyone who reports to you. action settings (tasks.proof.settings): the task settings, as GET/PATCH tasks/settings; without values read them, values may set task_default_notes_required, task_default_attachments_required and the task_proof_* switches, branch_id for one branch (null takes a key back to the company).

Argument	Type	Description
`company_id`required	integer
`action`required	string assign \| status \| complete \| confirm_receipt \| delete \| bulk_delete \| save_template \| delete_template \| settings
`task_id`	integer
`template_id`	integer
`fields`	object
`values`	object
`branch_id`	integer

manage_technicians changes data FSM technicians (docs/fsm-sections.md), as GET/POST/PATCH/DELETE field/technicians, with the same pe...

FSM technicians (docs/fsm-sections.md), as GET/POST/PATCH/DELETE field/technicians, with the same permissions. action list (filters: q, availability, skill, zone, branch_id, per_page; field.technicians.view or .manage), get (id), export (field.technicians.export; returns headers and rows), save (field.technicians.create, or .edit with id; fields: employee_id for a new one, skills, zones, availability of available, busy, off_duty, on_leave, available_until, work_days with 0 = Sunday, day_start, day_end, max_daily_jobs, notes), delete (id; field.technicians.delete).

Argument	Type	Description
`company_id`required	integer
`action`required	string list \| get \| export \| save \| delete
`id`	integer
`filters`	object
`fields`	object
`branch`	string

manage_tv changes data Office TV screens (tv.manage). action list: channels, TVs (no tokens) and items. save_channel (chann...

Office TV screens (tv.manage). action list: channels, TVs (no tokens) and items. save_channel (channel_id to change): fields name, layout (full, split, quad), areas (one list per area of: today, announcements, birthdays, off_today, coming_up, content (slides and videos), clock, attendance_qr (the TV site's rotating clock-in QR code)), is_default (TVs without a channel show it; one per company), active. delete_channel. save_device (device_id to change): fields name, branch_id, work_location_id (site), tv_channel_id, locale (en, ar, or empty: the link's ?lang); a new TV comes back with its link and token, shown once. rotate_device: a new link and token, once; the old one stops working. delete_device. save_item (item_id to change): fields kind (news, slide, video), title {en, ar}, body {en, ar}, starts_on, ends_on, active; pictures and video files (mp4/webm, within the upload_file_kb limit of company_limits) go through the API or the screen. delete_item.

Argument	Type	Description
`company_id`required	integer
`action`required	string list \| save_channel \| delete_channel \| save_device \| rotate_device \| delete_device \| save_item \| delete_item
`channel_id`	integer
`device_id`	integer
`item_id`	integer
`fields`	object

manage_vehicles changes data FSM vehicles (docs/fsm-sections.md), as field/vehicles/*, with the same permissions. Reading (field....

FSM vehicles (docs/fsm-sections.md), as field/vehicles/*, with the same permissions. Reading (field.vehicles.view or .manage): list (filters: q, status, driver_id, branch_id, per_page), get (id, with documents and logs), alerts (documents expiring and maintenance due), list_log (id, log of documents, maintenance, fuel). export (field.vehicles.export; headers and rows). save (.create, or .edit or .driver with id; fields plate_number, make, model, year, vin, status of active, maintenance, retired, driver_employee_id, odometer_km, notes, branch_id), delete (.delete). Log lines (field.vehicles.documents, .maintenance or .fuel): save_log (id is the vehicle, log, row_id to change one; documents: type, number, expires_on, note; maintenance: done_on, kind, description, vendor, cost, odometer_km, next_due_on; fuel: filled_on, liters, cost, odometer_km, station, employee_id), delete_log (id, log, row_id).

Argument	Type	Description
`company_id`required	integer
`action`required	string list \| get \| alerts \| list_log \| export \| save \| delete \| save_log \| delete_log
`id`	integer
`row_id`	integer
`log`	string documents \| maintenance \| fuel
`filters`	object
`fields`	object
`branch`	string

manage_webhook can delete Company webhooks (integrations.api_keys.manage, which integrations.manage grants; docs/integrations....

Company webhooks (integrations.api_keys.manage, which integrations.manage grants; docs/integrations.md). action create: fields url (public http/https), events (see list_integrations kind events), name, format json or xml, active, group (financial_employee or financial_journal for a financial integration), api_key_id (signs the call with that key's authentication). The signing secret is in the answer ONCE as secret. action update: webhook_id and the fields to change. action delete: webhook_id (its log goes too). action rotate_secret: a new secret, returned once. action test: send a test event now and return the delivery. action resend: delivery_id, send a failed delivery again now.

Argument	Type	Description
`company_id`required	integer
`action`required	string create \| update \| delete \| rotate_secret \| test \| resend
`webhook_id`	integer
`delivery_id`	integer
`fields`	object

manage_workflow changes data Changes workflows (docs/boarding.md); the tasks themselves are completed with manage_task. employees...

Changes workflows (docs/boarding.md); the tasks themselves are completed with manage_task. employees.manage over the employee: send (employee_id; fields category onboarding|offboarding, boarding_template_id, and optionally boarding_date, arrive_by, location_name, contact_employee_id, manager_employee_id, description, sequential, tasks [{include, due_days}] in the template's order), mass_onboard (fields boarding_template_id, employee_ids, description, notes), cancel (id). employee_settings.manage: save_template (id to edit, or none to add; fields category, name {en, ar}, description, when_to_send on_date|before, days_to_send, arrive_by, location_name, contact_employee_id, sequential, min_vacation_days, leave_type_id, filters {field: [values]}, resumption_trigger first_punch|employee_request|auto_send, auto_adjust, notify_after_days, notify_user_ids (employee ids told with the employee when resumption tasks are still open), tasks [{kind, title, document_type_id, document_id, asset_type_id, assignee employee|person, assignee_employee_id, due_days, notes, notes_required, attachments_required, profile_fields}]), copy_template (id), delete_template (id).

Argument	Type	Description
`company_id`required	integer
`action`required	string send \| mass_onboard \| cancel \| save_template \| copy_template \| delete_template
`id`	integer
`employee_id`	integer
`fields`	object

mark_announcement_read changes data Marks a company announcement read for you (your notification of it), as opening it on the screen doe...

Marks a company announcement read for you (your notification of it), as opening it on the screen does. Only one you may read; another is "not found". Returns how many notifications were marked.

Argument	Type	Description
`company_id`required	integer
`announcement_id`required	integer

my_face_consent changes data The employee's own face consent and presence check (self.face, docs/attendance-security.md §19). act...

The employee's own face consent and presence check (self.face, docs/attendance-security.md §19). action get: the consent text, your answer, whether a template exists, and an open presence check. action withdraw: withdraws consent and deletes the template at once. Giving consent and taking the selfie only happen in the mobile app.

Argument	Type	Description
`company_id`required	integer
`action`required	string get \| withdraw

payroll_lists changes data The payroll list screens (docs/payroll.md), read through the API so filters and scope are the same....

The payroll list screens (docs/payroll.md), read through the API so filters and scope are the same. action requests (list air-tickets|business-trips|expenses|missing-punches; payroll.view or the list's sub-module, e.g. payroll.expenses.view): requests with details and whether payroll paid them, filters in filters (status, from, to, travel_policy, travel_from, travel_to, expense_name, page). action screening (payroll.view): salary packages screening, filters active_employees, effective_from, effective_to, approval_status, package_status, page. action package (payroll.view): employee_id and package_id with totals and the package before it. action add_amortized (payroll.expenses.manage): fields employee_id, type earning|deduction, amount, months 2-60, start_month YYYY-MM, description.

Argument	Type	Description
`company_id`required	integer
`action`required	string requests \| screening \| package \| add_amortized
`list`	string air-tickets \| business-trips \| expenses \| missing-punches
`employee_id`	integer
`package_id`	integer
`filters`	object
`fields`	object

phone_biometric_keys changes data Phone keys bound to the faces and fingers on the phone (docs/attendance-security.md §19). action lis...

Phone keys bound to the faces and fingers on the phone (docs/attendance-security.md §19). action list (attendance.buddy.view; filters employee, status active|broken|awaiting_key|retired). action approve or reset (attendance.device_key.approve; id): after a new face or finger a key is "broken" and that phone follows the company's setting until HR approves it, then the app makes a new key; reset takes a key away for a lost or changed phone. Same API: buddy-punching/keys.

Argument	Type	Description
`company_id`required	integer
`action`required	string list \| approve \| reset
`id`	integer
`employee`	integer
`status`	string

publish_biometrics changes data Publish biometrics to devices (devices.manage, docs/devices.md). action decide: template_id with dec...

Publish biometrics to devices (devices.manage, docs/devices.md). action decide: template_id with decision publish (device_ids to publish only there), source_only or reject. action publish_all_pending: every pending item (optional employee_id, or employee_ids for several people). action auto_publish: read the setting, or set it with on true|false (new biometrics then reach the person's other devices without approval). action publish_slot: template_id to device_id (or every device). action publish_missing: employee_id's approved slots to every device they may use. action remove_slot: template_id off device_id, or out of the master set without device_id; needs confirm true. action update_all: send every approved template, photo and user record again to all devices (optional employee_id); returns a batch. action progress: batch → queued/sent/done/failed per device. action matrix: employee_id's slots × devices.

Argument	Type	Description
`company_id`required	integer
`action`required	string decide \| publish_all_pending \| auto_publish \| publish_slot \| publish_missing \| remove_slot \| update_all \| progress \| matrix
`template_id`	integer
`employee_id`	integer
`device_id`	integer
`device_ids`	array
`employee_ids`	array
`on`	boolean
`decision`	string publish \| source_only \| reject
`confirm`	boolean
`batch`	string

queue_report changes data Large reports in the background (docs/reports.md), the same as POST /reports/{report}/queue and GET...

Large reports in the background (docs/reports.md), the same as POST /reports/{report}/queue and GET /me/report-files. action queue: report (a key from list_reports), format xlsx|csv, filters (as run_report) or saved_id; the file is built as you, in your current branch workspace, and you get a notification when it is ready. action list: your files with status (queued, running, ready, failed), row_count and download_path (GET it with your API token). action show: one file by id.

Argument	Type	Description
`company_id`required	integer
`action`required	string queue \| list \| show
`report`	string
`format`	string xlsx \| csv
`filters`	object
`saved_id`	integer
`id`	integer

read_section read only Reads an engine section: part=records (a list, with search, filters, sort, page), record (one, with...

Reads an engine section: part=records (a list, with search, filters, sort, page), record (one, with its field_levels and actions), form (a form's starting values), options (choices of a field), blocks (cards and charts), export (the list as CSV text) or file (a record's file, in base64: a copy, so it needs documents.download). A hidden value isn't in the answer. A section under a record needs parent.

Argument	Type	Description
`company_id`required	integer
`section`required	string employees \| employee_contracts \| employee_bank_accounts \| employee_family \| employee_documents \| employee_job_history \| terminations \| attendance_sheet \| attendance_records \| missing_punches \| team_locations \| team_leaves \| leave_balances \| leave_adjustments \| employee_shifts \| team_schedule \| work_shifts \| approval_delegations \| manage_announcements \| manage_events \| manage_tasks \| manage_letters \| disciplinary_actions \| suspensions \| company_assets \| field_jobs \| field_sites \| field_customers \| field_customer_sites \| field_technicians \| field_parts \| field_part_movements \| field_stock_locations \| field_movements \| field_vehicles \| field_vehicle_documents \| field_vehicle_maintenance \| field_vehicle_fuel \| field_overtime \| evaluation_cycles \| cycle_evaluations \| goals \| key_positions \| successors \| job_openings \| job_candidates \| candidates \| candidate_notes \| candidate_interviews \| candidate_offers \| my_interviews \| offers \| assessment_tests \| assessment_questions \| assessment_invitations \| assessment_grading \| my_assessments \| boardings \| boarding_tasks \| boarding_templates \| employee_checklists \| payroll_runs \| payroll_run_payslips \| payroll_salaries \| payroll_packages \| payroll_package_templates \| payroll_transactions \| payroll_settlements \| payroll_settlement_slips \| payroll_loans \| payroll_loan_installments \| payroll_overtimes \| payroll_insurance \| payroll_air_tickets \| payroll_provisions \| setup_branches \| setup_org_units \| setup_positions \| setup_org_levels \| setup_termination_reasons \| setup_checklist_templates \| setup_shifts \| setup_holidays \| setup_overtime_types \| setup_attendance_functions \| setup_leave_types \| setup_payroll_general \| setup_payroll_advance \| setup_payroll_extra_settings \| setup_payroll_tax_settings \| setup_payroll_social_security \| setup_payroll_tax \| setup_payroll_extra \| setup_payroll_bank_accounts \| setup_transaction_types \| setup_part_time_transaction_types \| setup_loan_types \| setup_cost_centers \| setup_salary_bands \| setup_expense_types \| setup_cities \| setup_attendance_devices \| setup_device_time_zones \| setup_roles \| setup_roles_assignments \| setup_permission_groups \| setup_permission_exceptions \| setup_api_keys \| setup_webhooks \| setup_imports
`part`required	string records \| record \| form \| options \| blocks \| export \| file
`record_id`	integer
`parent`	integer	The parent record, for a section under a record (an employee, for employee_documents).
`field`	string	For options and file.
`search`	string
`sort`	string
`direction`	string asc \| desc
`page`	integer
`per_page`	integer
`filters`	object

rehire_employee changes data ZenHR's "Add Employee for an Existing User": a new employee record for someone whose record has ende...

ZenHR's "Add Employee for an Existing User": a new employee record for someone whose record has ended (employee_id = the ended record). Personal and contact data and the sign-in account carry over; hire_date is required and comes after the last working day; branch_id, employee_number, position_id, units, manager_id, work_type, contract_type_id, contract_end_date and probation_end_date set the new job. copy_bank_accounts and copy_family (default true) copy those. Counts against the license.

Argument	Type	Description
`company_id`required	integer
`employee_id`required	integer	The ended record
`hire_date`required	string	YYYY-MM-DD
`branch_id`	integer
`employee_number`	string
`position_id`	integer
`work_location_id`	integer
`department_id`	integer
`section_id`	integer
`project_id`	integer
`manager_id`	integer
`work_type`	string full_time \| part_time \| freelance \| internship \| contractor
`contract_type_id`	integer
`contract_end_date`	string	YYYY-MM-DD
`probation_end_date`	string	YYYY-MM-DD
`copy_bank_accounts`	boolean
`copy_family`	boolean

remove_project_assignment can delete Take an employee off a project (by assignment id from list_projects).

Take an employee off a project (by assignment id from list_projects).

Argument	Type	Description
`company_id`required	integer
`assignment_id`required	integer

remove_role_assignment can delete Take a role away from someone (by assignment id from list_role_assignments).

Take a role away from someone (by assignment id from list_role_assignments).

Argument	Type	Description
`company_id`required	integer
`assignment_id`required	integer

request_comments changes data The comments under a request's Approval Cycle, as in ZenHR ("Comments and replies are visible to any...

The comments under a request's Approval Cycle, as in ZenHR ("Comments and replies are visible to anyone who has access to this item", docs/approvals.md). kind requests (an employee request) or leaves (time off), id. action list (default): the comments oldest first, each with id, author, body and at. action add: post body (up to 2000 characters). Whoever may see the request: the employee, HR over them, their managers, or an approver.

Argument	Type	Description
`company_id`required	integer
`kind`required	string requests \| leaves
`id`required	integer
`action`	string list \| add
`body`	string

request_field_upload changes data Asks the employees on an open field job to upload the signed photos still saved on their phones (fie...

Asks the employees on an open field job to upload the signed photos still saved on their phones (field.jobs.request_upload in the job's branch, docs/field-proof.md §12), as POST field/jobs/{job}/request-upload. Fields: job_id, note (optional, up to 500 characters). They get a notice and a push; the phone sends its drafts by itself once it is online and the app can run. At most once per job every 10 minutes. It can't read the phone: the answer says who was told, not how many photos wait.

Argument	Type	Description
`company_id`required	integer
`job_id`required	integer
`note`	string
`branch`	string

request_leave changes data Ask for time off (action request): leave_type_id, start_date and end_date (YYYY-MM-DD), or for an ho...

Ask for time off (action request): leave_type_id, start_date and end_date (YYYY-MM-DD), or for an hourly type start_date with start_time and end_time (HH:MM); reason, half_day. A type that needs a document is asked for on the screen or the API. Or withdraw your pending request (action withdraw, leave_id).

Argument	Type	Description
`company_id`required	integer
`action`required	string request \| withdraw
`leave_type_id`	integer
`start_date`	string
`end_date`	string
`start_time`	string
`end_time`	string
`reason`	string
`half_day`	boolean
`leave_id`	integer	To withdraw

reset_user_two_factor can delete User setup: turn off a user's two-step verification (lost phone) so they set it up again. Not for yo...

User setup: turn off a user's two-step verification (lost phone) so they set it up again. Not for yourself, the company admin, or someone who also works in another company (Mihnaro support does those).

Argument	Type	Description
`company_id`required	integer
`user_id`required	integer

resolve_app_link read only What a notification's or a search result's link opens in the mobile app for you: status open with it...

What a notification's or a search result's link opens in the mobile app for you: status open with its target (an engine section or one of the app's screens, with the record), closed with the reason (permission, not_found, web_only) and a message, or none when there is no link. Checks your permissions and the record itself.

Argument	Type	Description
`company_id`required	integer
`url`	string	The link, as a notification or a search result gives it

resolve_template_conflict changes data Settle a template conflict (devices.manage, docs/devices.md): template_id with version_id keeps that...

Settle a template conflict (devices.manage, docs/devices.md): template_id with version_id keeps that version and pushes it to every device the person may use; or re_enroll_device_id asks that terminal to enrol the slot again (the newer enrolment then wins). Logged in the device audit log.

Argument	Type	Description
`company_id`required	integer
`template_id`required	integer
`version_id`	integer
`re_enroll_device_id`	integer

resolve_termination changes data Resolve an item of the termination check, or cancel a termination (docs/terminations.md, employees.t...

Resolve an item of the termination check, or cancel a termination (docs/terminations.md, employees.terminate over employee_id). action substitute (fields kind approvers|manager|supervisor|key_staff, substitute_id: an employee who takes the leaver's place), withdraw_requests (every pending request), take_asset (fields asset_id), expire_insurance (fields insurance_id), pay_loans (each remaining loan amount repaid in cash), deduct_loans (left for the final settlement; needs the legal rule validated), cancel_termination (undo a termination entered by mistake, before payroll paid the final settlement). Returns the check after the change.

Argument	Type	Description
`company_id`required	integer
`employee_id`required	integer
`action`required	string substitute \| withdraw_requests \| take_asset \| expire_insurance \| pay_loans \| deduct_loans \| cancel_termination
`fields`	object

restore_employee changes data Brings an archived employee back as it was, with its number. Refused when another current employee n...

Brings an archived employee back as it was, with its number. Refused when another current employee now has that number, the subscription is full, or the person already has a current record. Find archived records with list_employees status=archived. Needs employees.archive.

Argument	Type	Description
`company_id`required	integer
`employee_id`	integer	The internal id; or give employee_number.
`employee_number`	string
`branch_id`	integer	With employee_number, when numbers repeat across branches.

review_evaluation changes data Fill in an evaluation. action self (the employee, while in self review) or review (the result writer...

Fill in an evaluation. action self (the employee, while in self review) or review (the result writer or performance.manage over the employee; completes it with the weighted score): fields scores {criterion id: 1–5}, actuals {template OKR criterion id: number reached}, kr_actuals {key result id: number reached}, comment; self also takes self_performance_summary, self_key_strengths, self_weaknesses, self_recommendations. action notes (result writer or HR): performance_summary, key_strengths, weaknesses, recommendations. action final (a result auditor or HR, once complete): final_rate_override 0–100, final_notes, notify_people.

Argument	Type	Description
`company_id`required	integer
`evaluation_id`required	integer
`action`required	string self \| review \| notes \| final
`fields`	object

review_field_evidence changes data Signed field photos (field.evidence.review, docs/field-proof.md), as GET field/evidence and POST fie...

Signed field photos (field.evidence.review, docs/field-proof.md), as GET field/evidence and POST field/evidence/{id}/void. action list: filters job_id, stage (arrival, progress, completion, departure), employee_id, accepted, flag (e.g. mock_location, outside_site, time_unverified), flagged (any flag, not voided: the review queue), voided, branch_id, from, to, per_page. action show: evidence_id, every detail (time, place, flags, device key, hash) and its void log. action void (field.evidence.void): evidence_id and reason (required); the photo stays, the void is logged, and the job goes back to the stage its standing photos show. action c2pa: evidence_id, its C2PA (Content Credentials) copy signed by the Mihnaro server: status (none, pending, signed, failed), validation, trust (self_signed = Mihnaro's own certificate, validators show an unknown signer), assertions, as GET field/evidence/{id}/c2pa. action c2pa_download: evidence_id, the signed copy as base64 (filename, mime, size, sha256), only when signed, valid and not voided, as GET field/evidence/{id}/c2pa/download. action devices (field.evidence.devices): the phone keys in the branches covered; action revoke_key (field.evidence.devices): key_id (a lost phone). Photos themselves are only taken by the mobile app with its hardware key, never through MCP.

Argument	Type	Description
`company_id`required	integer
`action`required	string list \| show \| void \| c2pa \| c2pa_download \| devices \| revoke_key
`evidence_id`	integer
`reason`	string
`key_id`	string
`filters`	object
`branch`	string

review_payroll_run read only The review of a payroll run: its totals, last month's and who joined, left or changed, only for the...

The review of a payroll run: its totals, last month's and who joined, left or changed, only for the people you reach and the amounts open to you. Approve or return it with run_section_action on payroll_runs (docs/mobile-payroll.md).

Argument	Type	Description
`company_id`required	integer
`run_id`required	integer

review_punch changes data Decides a suspicious or held punch of the punch log (attendance.security.review, docs/attendance-sec...

Decides a suspicious or held punch of the punch log (attendance.security.review, docs/attendance-security.md): decision approve or reject, note, approve_device (also approve its pending phone or browser). Approving a held punch applies it exactly like a normal punch at its original time, for that employee only; rejecting writes nothing. A flagged punch is already in attendance: the decision only records the review.

Argument	Type	Description
`company_id`required	integer
`id`required	integer
`decision`required	string approve \| reject
`note`	string
`approve_device`	boolean

review_timesheets changes data Timesheets submitted by the employees your role reaches (timesheets.approve): with no decision, list...

Timesheets submitted by the employees your role reaches (timesheets.approve): with no decision, lists the submitted periods (timesheet ID, hours, contribution percentage, entries); with employee_id, week and decision (approved or rejected), approves or returns that period.

Argument	Type	Description
`company_id`required	integer
`employee_id`	integer
`week`	string
`decision`	string approved \| rejected

role_matrix changes data Read a role's table of web and app switches for every action and of web and app levels for every fie...

Read a role's table of web and app switches for every action and of web and app levels for every field. Send actions {"key": {"web": true, "app": false}} or fields {"entity.field": {"web": "edit", "app": "hidden"}} to change those rows; the rest stays. Company setup keys (setup.*) are closed on the app until opened here.

Argument	Type	Description
`company_id`required	integer
`role_id`required	integer
`actions`	object	Rows to change: {"setup.positions.view": {"web": true, "app": true}}
`fields`	object	Rows to change: {"setup_positions.code": {"web": "edit", "app": "view"}}

run_mass_action can delete One change for many employees (docs/activity-log.md "Mass actions"), through the same rules as chang...

One change for many employees (docs/activity-log.md "Mass actions"), through the same rules as changing one. Always run with dry_run true first and show the person the lines. tab personal (employees.manage): gender, marital_status, religion, nationality (2 letters) with nationality_action empty (set it), add (as the second) or replace (with nationality_to_replace), citizen (citizen/non_citizen), roster_action add/remove with roster_shift_id, roster_from, roster_to and roster_conflict keep|replace (needs attendance.manage). tab professional (employees.manage): position_id, department_id and the other org unit ids, manager_id, supervisor_id, work_type, employee_kind, shift_id (default shift, at once), effective_date (required; dated professional data). tab financial (payroll.manage): one of basic_salary, raise_amount, raise_percent; salary_count, company_bank_account_id, payment_method, social_security_rule_id, effective_date (required; a new salary package), reason. employee_ids: every one must be in scope. kind history lists past mass actions.

Argument	Type	Description
`company_id`required	integer
`kind`	string run \| history
`tab`	string personal \| professional \| financial
`changes`	object
`employee_ids`	array
`dry_run`	boolean

run_report read only Runs a report for the employees in the person's scope, the same as the screen and GET /reports/{repo...

Runs a report for the employees in the person's scope, the same as the screen and GET /reports/{report}/run. report: a key from list_reports. filters: the filter params (multi filters as arrays of ids or values, dates YYYY-MM-DD, date ranges as key_from / key_to, months YYYY-MM), plus cols (column keys), show (switch keys) and show_zero. saved_id starts from saved options. Or custom_report_id to generate a customized report (reports.custom). limit: rows per table, 100 by default, 2000 at most. Returns the columns, rows, totals (and sections for sectioned reports) and the row count.

Argument	Type	Description
`company_id`required	integer
`report`	string
`filters`	object
`saved_id`	integer
`custom_report_id`	integer
`limit`	integer

run_section_action changes data Does an action of an engine section on one record (record_id) or on up to 100 (ids): archive, restor...

Does an action of an engine section on one record (record_id) or on up to 100 (ids): archive, restore, delete and others, as describe_section lists them for you. An action not listed for you is closed. With ids, each record is checked alone and the answer says which failed.

Argument	Type	Description
`company_id`required	integer
`section`required	string employees \| employee_contracts \| employee_bank_accounts \| employee_family \| employee_documents \| employee_job_history \| terminations \| attendance_sheet \| attendance_records \| missing_punches \| team_locations \| team_leaves \| leave_balances \| leave_adjustments \| employee_shifts \| team_schedule \| work_shifts \| approval_delegations \| manage_announcements \| manage_events \| manage_tasks \| manage_letters \| disciplinary_actions \| suspensions \| company_assets \| field_jobs \| field_sites \| field_customers \| field_customer_sites \| field_technicians \| field_parts \| field_part_movements \| field_stock_locations \| field_movements \| field_vehicles \| field_vehicle_documents \| field_vehicle_maintenance \| field_vehicle_fuel \| field_overtime \| evaluation_cycles \| cycle_evaluations \| goals \| key_positions \| successors \| job_openings \| job_candidates \| candidates \| candidate_notes \| candidate_interviews \| candidate_offers \| my_interviews \| offers \| assessment_tests \| assessment_questions \| assessment_invitations \| assessment_grading \| my_assessments \| boardings \| boarding_tasks \| boarding_templates \| employee_checklists \| payroll_runs \| payroll_run_payslips \| payroll_salaries \| payroll_packages \| payroll_package_templates \| payroll_transactions \| payroll_settlements \| payroll_settlement_slips \| payroll_loans \| payroll_loan_installments \| payroll_overtimes \| payroll_insurance \| payroll_air_tickets \| payroll_provisions \| setup_branches \| setup_org_units \| setup_positions \| setup_org_levels \| setup_termination_reasons \| setup_checklist_templates \| setup_shifts \| setup_holidays \| setup_overtime_types \| setup_attendance_functions \| setup_leave_types \| setup_payroll_general \| setup_payroll_advance \| setup_payroll_extra_settings \| setup_payroll_tax_settings \| setup_payroll_social_security \| setup_payroll_tax \| setup_payroll_extra \| setup_payroll_bank_accounts \| setup_transaction_types \| setup_part_time_transaction_types \| setup_loan_types \| setup_cost_centers \| setup_salary_bands \| setup_expense_types \| setup_cities \| setup_attendance_devices \| setup_device_time_zones \| setup_roles \| setup_roles_assignments \| setup_permission_groups \| setup_permission_exceptions \| setup_api_keys \| setup_webhooks \| setup_imports
`action`required	string
`record_id`	integer
`ids`	array
`parent`	integer
`input`	object

save_attendance_record changes data Record a day for an employee your role reaches (attendance.records.manage): work_date, clock_in and...

Record a day for an employee your role reaches (attendance.records.manage): work_date, clock_in and clock_out (HH:MM). With replace true the day's records are replaced (correct a day, e.g. a forgotten clock-out). Or trust (or untrust) a record with record_id.

Argument	Type	Description
`company_id`required	integer
`employee_id`	integer
`work_date`	string	YYYY-MM-DD
`clock_in`	string	HH:MM
`clock_out`	string	HH:MM
`replace`	boolean
`record_id`	integer	To trust or untrust a record

save_branch changes data Add a branch (without branch_id) or change one. New branches stay within the license. Country sets t...

Add a branch (without branch_id) or change one. New branches stay within the license. Country sets the default currency and timezone. Logos are uploaded in the app or with multipart POST to the API.

Argument	Type	Description
`company_id`required	integer
`branch_id`	integer	Leave out to add a branch.
`name`	object	{"en": "...", "ar": "..."}; en is required for a new branch.
`code`	string
`country`	string	ISO code from the supported list, e.g. IQ, SA, AE.
`currency`	string	3 letters; defaults to the country's.
`timezone`	string	e.g. Asia/Baghdad; defaults to the country's.
`is_active`	boolean	The main branch can't be turned off.

save_clock_button_scope changes data Changes "Hide the clock button outside the work location" (attendance_setup.manage, docs/attendance-...

Changes "Hide the clock button outside the work location" (attendance_setup.manage, docs/attendance-security.md §17); send only what changes. clock_hide_outside_location (off by default), scope: all or chosen, branch_ids, department_ids, employee_ids (lists replace the saved ones). branch_id saves a branch's own value, which can name only that branch, its departments and its employees; without it, the company's value, which only someone working across every branch may change. Only hides the button in the app: the punch check is "Clock-in must be at a work location" (clock_geofence).

Argument	Type	Description
`company_id`required	integer
`branch_id`	integer
`clock_hide_outside_location`	boolean
`scope`	string all \| chosen
`branch_ids`	array
`department_ids`	array
`employee_ids`	array

save_clocking_security changes data Changes clocking security (attendance.security.manage, docs/attendance-security.md); send only what...

Changes clocking security (attendance.security.manage, docs/attendance-security.md); send only what changes. checks: {check: off|flag|hold|block|on} for mock_location, integrity, new_device, browser_binding, shared_phone, shared_browser, offline_unproven, accuracy, ip_location, travel, wifi ("on" = the usual action: hold for offline_unproven, new_device and browser_binding, flag otherwise; integrity can only flag until a provider is configured). clock_sec_shared_window_hours, clock_sec_desktop_accuracy_m, clock_sec_travel_kmh, clock_sec_ip_distance_m, clock_sec_geoip_distance_km (IP city vs GPS, km), clock_sec_office_ips, clock_sec_datacenter_ips (comma-separated IPs or CIDR ranges), clock_sec_alert_email. clock_offline_enabled (the mobile app keeps punches made with no internet and sends them later) and clock_offline_hours (1–168, how far back). branch_id saves a branch's own values. add_wifi {bssid, ssid, label, branch_id, work_location_id} adds an office Wi-Fi access point; remove_wifi_id removes one.

Argument	Type	Description
`company_id`required	integer
`branch_id`	integer
`checks`	object	check → off, flag, hold, block or on
`clock_sec_shared_window_hours`	integer
`clock_sec_desktop_accuracy_m`	integer
`clock_sec_travel_kmh`	integer
`clock_sec_ip_distance_m`	integer
`clock_sec_geoip_distance_km`	integer
`clock_sec_office_ips`	string
`clock_sec_datacenter_ips`	string
`clock_sec_alert_email`	boolean
`clock_offline_enabled`	boolean
`clock_offline_hours`	integer
`add_wifi`	object	bssid (aa:bb:cc:dd:ee:ff), ssid, label, branch_id, work_location_id
`remove_wifi_id`	integer

save_company_settings changes data Change System preferences → Account setup. Send only what changes; the rest stays. The logo is uploa...

Change System preferences → Account setup. Send only what changes; the rest stays. The logo is uploaded on the screen or the API, not here (remove_logo works).

Argument	Type	Description
`company_id`required	integer
`company_name_en`	string
`company_name_ar`	string
`company_address`	string
`company_phone`	string
`company_email`	string
`currency`	string
`work_start`	string	HH:MM
`work_end`	string	HH:MM
`late_grace_minutes`	integer
`weekend_days`	array	0 = Sunday … 6 = Saturday
`eos_days_per_year`	number
`eos_min_years`	number
`org_level_type`	string company \| branch
`hide_org_chart`	boolean
`secure_documents`	boolean	The mobile app's file viewer is kept out of screenshots and recordings
`remove_logo`	boolean

save_employee changes data Add (without employee_id) or change an employee record. New employees count against the license acro...

Add (without employee_id) or change an employee record. New employees count against the license across all branches. create_login: true makes a sign-in account from the work email and returns a temporary password once. Use transfer_employee to change branch.

Argument	Type	Description
`company_id`required	integer
`employee_id`	integer	Leave out to add an employee.
`employee_number`	string	Leave out for the next number (E0001...).
`name`	object	{"en": "...", "ar": "..."}; en required for a new employee.
`email`	string	Work email; the sign-in account uses it.
`personal_email`	string
`phone`	string	Digits, optional +, e.g. +9647701234567.
`hire_date`	string	YYYY-MM-DD; required for a new employee.
`branch_id`	integer	Required for a new employee.
`status`	string active \| suspended
`position_id`	integer
`work_location_id`	integer
`department_id`	integer
`section_id`	integer
`project_id`	integer
`manager_id`	integer
`create_login`	boolean
`name_parts`	object	Four-part names: {"en": [first, second, third, last], "ar": [...]}; builds the full name.
`gender`	string male \| female
`birth_date`	string
`marital_status`	string single \| married \| divorced \| widowed
`nationality`	string	Two-letter country code.
`national_id`	string	Needs employees.view_sensitive, like the passport and permit fields.
`passport_number`	string
`job_title`	object	{"en": "...", "ar": "..."}
`work_type`	string full_time \| part_time \| freelance \| internship \| contractor
`job_grade_id`	integer
`contract_type_id`	integer
`supervisor_id`	integer
`probation_end_date`	string
`change_effective_date`	string	The date written in the job history for these changes.
`custom_fields`	object	{"custom field id": "value"}; list fields take the choice number.

save_employee_file_record changes data Add (without record_id) or change a contract, bank account or family member in an employee's file. B...

Add (without record_id) or change a contract, bank account or family member in an employee's file. Bank accounts need employees.view_sensitive; their shares can't pass 100%. Documents need a file, so upload them through the app or the API.

Argument	Type	Description
`company_id`required	integer
`employee_id`required	integer
`kind`required	string contracts \| bank_accounts \| family
`record_id`	integer	Leave out to add.
`fields`	object	Send the fields themselves at the top level. contracts: contract_type_id, start_date, end_date, auto_renewal (inherit\|enabled\|disabled), renew_within_days, notes. bank_accounts: bank_name, bank_branch, country, account_number, iban, swift_code, transfer_percent, custom_fields ({"field id": value} for the custom fields of the bank_account level). family: name_parts ({"en": [first, second, third, family], "ar": [...]}; builds name and name_ar) or name, name_ar, relation (spouse\|child\|parent\|sibling\|other), birth_date, national_id, is_dependent, gender, marital_status, nationalities, phone, email.

save_employee_numbering changes data Changes the employee numbering. Without branch_id: the company's prefix, padding, next_number, scope...

Changes the employee numbering. Without branch_id: the company's prefix, padding, next_number, scope (company or branch) and allow_reuse; changing scope to company is refused while current employees of different branches share a number. With branch_id: that branch's own numbering (custom true with prefix, padding, next_number) or back to the company's (custom false). Numbers already given never change. Returns get_employee_numbering. Needs employee_settings.manage.

Argument	Type	Description
`company_id`required	integer
`branch_id`	integer	A branch's own numbering instead of the company's.
`custom`	boolean	With branch_id: true gives the branch its own prefix, padding and counter; false returns it to the company's.
`prefix`	string	Optional letters, digits, - or _, up to 20; empty for none.
`padding`	integer	Pad the digits with zeros to this width (0 = none, up to 12).
`next_number`	integer	Where new numbers start; numbers already used are skipped.
`scope`	string company \| branch	Without branch_id: numbers unique across the company or per branch.
`allow_reuse`	boolean	Without branch_id: let HR give out the numbers of archived and ended employees again.

save_employee_setting changes data Add (without record_id) or change an entry in one of the employee file lists (contract_types, job_gr...

Add (without record_id) or change an entry in one of the employee file lists (contract_types, job_grades, document_types, custom_fields, org_levels, field_rules, e_signatures, banks). Names are {"en","ar"}; list custom fields need options [{"en","ar"}]. Document types take applies_to (employees|company|both), is_default, deletable, has_expiry and notify_before (week|2_weeks|month|2_months|3_months|6_months: how long before expiry HR is told); custom fields take field_level (personal|professional|financial|bank_account: bank_account fields are asked on each bank account); custom fields take group_name {"en","ar"} (ZenHR Manage Additional Info); field rules take allow_numbers/allow_lowercase/allow_uppercase/allow_special (false = not allowed); e_signatures take signer_title, user_id and image_base64 (a PNG/JPG data URL).

Argument	Type	Description
`company_id`required	integer
`kind`required	string contract_types \| job_grades \| document_types \| custom_fields \| org_levels \| field_rules \| e_signatures \| banks
`record_id`	integer	Leave out to add.
`name`	object	{"en": "...", "ar": "..."} (not for field_rules).
`field`	string	field_rules only: one of the ZenHR field configuration keys (list_employee_settings kind=field_rules shows them).
`applies_to`	string employees \| company \| both	document_types only.
`notify_before`	string week \| 2_weeks \| month \| 2_months \| 3_months \| 6_months	document_types only: how long before expiry HR is told.
`group_name`	object	custom_fields only: the Additional Info group.
`image_base64`	string	e_signatures only: data:image/png;base64,...
`country`	string	banks only: ISO country code, e.g. IQ.
`branches`	array	banks only: the branches, [{"en": "...", "ar": "..."}].
`external_ref`	string	The id this entry had in ZenHR (import).

save_leave_type changes data Add a time off type (category annual, casual, hourly or sick) or change one with leave_type_id (leav...

Add a time off type (category annual, casual, hourly or sick) or change one with leave_type_id (leave_setup.manage), sending its whole form in fields as the screen does: name {en, ar}, entitlement_days (entitlement_hours for hourly), balance_type, notice and weekend rules, exceeding, accumulation, balance_setups, encashment, rules [{type, values}], hourly limits and deductions, sick_slices, switches (true/false). With balance_update_type "new" and effective_date, a changed amount counts from that date. delete true deletes an unused type.

Argument	Type	Description
`company_id`required	integer
`category`	string annual \| casual \| hourly \| sick
`leave_type_id`	integer	To change or delete one
`fields`	object
`delete`	boolean

save_letter_template changes data Letter templates (letters.manage). action save: add one, or change it with template_id, sending fiel...

Letter templates (letters.manage). action save: add one, or change it with template_id, sending fields: name {en, ar}, language ar|en, letter_category_id, body with {placeholders} (name, employee_no, job_title, department, branch, hire_date, salary, national_id, addressed_to, today, company; {signature:ID} prints an active e-signature from list_employee_settings e_signatures), active, is_draft, self_service, needs_confirmation, needs_approval, financial (a letter that shows pay: HR admins see it only where the branch allows; set by itself when the body uses {salary}, {salary_en} or {total_salary}). action duplicate: a draft copy. action favorite: star or un-star it for you.

Argument	Type	Description
`company_id`required	integer
`action`required	string save \| duplicate \| favorite
`template_id`	integer
`fields`	object

save_org_unit changes data Add (without unit_id) or change a unit of the organization structure. A section needs parent_id (its...

Add (without unit_id) or change a unit of the organization structure. A section needs parent_id (its department). branch_id ties a unit to one branch.

Argument	Type	Description
`company_id`required	integer
`unit_id`	integer	Leave out to add a unit.
`type`	string work_location \| department \| section \| project \| hierarchy_group \| business_unit \| division \| segment	Required for a new unit; can't change.
`name`	object	{"en": "...", "ar": "..."}
`code`	string
`establishment_number`	string
`branch_id`	integer	Null for all branches.
`parent_id`	integer	For a section: its department.
`is_active`	boolean
`subsidiary_id`	string
`establishment_name`	string	Governmental info (ZenHR), with governance_location, ss_number, tax_number, address and po_box.
`governance_location`	string
`ss_number`	string
`tax_number`	string
`address`	string
`po_box`	string

save_permission_group changes data Add (without group_id) or change a group. Members: branch_ids narrow it, unit_rules ({"department":...

Add (without group_id) or change a group. Members: branch_ids narrow it, unit_rules ({"department": [ids], "work_location": [ids]…}) and people (employee ids) fill it. Seats: manager_role_id reaches everyone under a registered manager inside the group, team_leader_role_id a registered supervisor's direct team inside the group, employee_role_id each member themselves. As POST and PATCH permission-groups. Needs roles.manage.

Argument	Type	Description
`company_id`required	integer
`group_id`	integer	Leave out to add a group.
`name`	object	{"en": "...", "ar": "..."}
`description`	object
`is_active`	boolean
`branch_ids`	array
`unit_rules`	object	{"department": [ids], "work_location": [ids], "section": [ids], "project": [ids]…}
`people`	array	Employee ids.
`manager_role_id`	integer
`team_leader_role_id`	integer
`employee_role_id`	integer

save_permission_override changes data Set one person's exception. kind action: subject is a permission key, web and app are open, closed o...

Set one person's exception. kind action: subject is a permission key, web and app are open, closed or null (no exception there); closed beats every role and group. kind field: subject is a field (employee.basic_salary…), web and app are hidden, view, edit or null. Both null takes it off. As POST permission-overrides. Needs roles.manage.

Argument	Type	Description
`company_id`required	integer
`user_id`required	integer
`kind`required	string action \| field
`subject`required	string
`web`	string open \| closed \| hidden \| view \| edit
`app`	string open \| closed \| hidden \| view \| edit
`scope`	string	Where an opened action applies (company by default): a scope from list_roles.
`scope_id`	integer
`reason`	string

save_position changes data Add (without position_id) or change a job title (job role): name, code, active, type (regular or haz...

Add (without position_id) or change a job title (job role): name, code, active, type (regular or hazardous), available across all branches, job description.

Argument	Type	Description
`company_id`required	integer
`position_id`	integer	Leave out to add a position.
`name`	object	{"en": "...", "ar": "..."}
`code`	string
`is_active`	boolean
`job_role_type`	string regular \| hazardous
`company_level`	boolean	Available across all branches
`job_description`	string

save_professional_data changes data A dated professional data record for an employee: new job role (position), units, manager, superviso...

A dated professional data record for an employee: new job role (position), units, manager, supervisor, work type or outsourced, from effective_on (and until expires_on, after which the old values come back). Applied now if the date has come, otherwise on its date. Send only what changes; notes are ZenHR's Notes. Or cancel a future record with cancel_record_id; edit a record with update_record_id (a future one as it is, or the one in effect: ZenHR's "Update Current Professional Info", no new dated record); delete one with delete_record_id (the one in effect puts back what it replaced).

Argument	Type	Description
`company_id`required	integer
`employee_id`	integer
`cancel_record_id`	integer
`update_record_id`	integer
`delete_record_id`	integer
`notes`	string
`effective_on`	string	YYYY-MM-DD
`expires_on`	string	YYYY-MM-DD
`notify_employee`	boolean
`position_id`	integer
`work_location_id`	integer
`department_id`	integer
`section_id`	integer
`project_id`	integer
`hierarchy_group_id`	integer
`business_unit_id`	integer
`division_id`	integer
`segment_id`	integer
`work_type`	string
`manager_id`	integer
`supervisor_id`	integer
`employee_kind`	string

save_project changes data Add a project, or edit one with project_id (send only what changes). Code is unique; names in Arabic...

Add a project, or edit one with project_id (send only what changes). Code is unique; names in Arabic and English are required; status is active or closed.

Argument	Type	Description
`company_id`required	integer
`project_id`	integer	To edit
`code`	string
`name`	object	{"en": "...", "ar": "..."}
`client`	string
`group_name`	string
`group_code`	string
`entity_code`	string
`manager_id`	integer	Employee id
`start_date`	string	YYYY-MM-DD
`end_date`	string	YYYY-MM-DD
`budget_hours`	number
`status`	string active \| closed

save_regional_settings changes data Change regional settings (docs/regional-settings.md). Without branch_id: the company defaults (setti...

Argument	Type	Description
`company_id`required	integer
`branch_id`	integer	Leave out to change the company defaults.
`date_format`	string\|null	Platform default: j M Y
`time_format`	string\|null	Platform default: 24
`week_start`	string\|null	Platform default: sunday
`calendar`	string\|null	Platform default: gregorian
`month_names`	string\|null	Platform default: levant
`numerals`	string\|null	Platform default: latn
`thousands_separator`	string\|null	Platform default: comma
`decimal_separator`	string\|null	Platform default: dot
`currency_display`	string\|null	Platform default: name
`currency_position`	string\|null	Platform default: after
`country`	string	Branch only: ISO code, e.g. IQ.
`timezone`	string	Branch only: e.g. Asia/Baghdad.

save_role changes data Add (without role_id) or change a role. permissions are keys from list_roles, module permissions or...

Add (without role_id) or change a role. permissions are keys from list_roles, module permissions or sub-module ones (leaves.adjustments.manage…); preset (hr_manager, branch_manager, line_manager) fills a new role. is_active false switches a role off: its people keep it but it grants nothing until switched on.

Argument	Type	Description
`company_id`required	integer
`role_id`	integer	Leave out to add a role.
`name`	object	{"en": "...", "ar": "..."}
`description`	object
`permissions`	array
`channels`	object	Per permission: both, web, app or none. Set on a sub-module permission it decides over its module permission. Left out: it stays; a permission with no switch works on both.
`fields`	object	Per field from list_roles meta (employee.basic_salary…): {"web": "hidden\|view\|edit", "app": "hidden\|view\|edit"}. A field with no setting follows the permissions it always followed.
`is_active`	boolean
`preset`	string hr_manager \| branch_manager \| line_manager \| recruiter \| finance

save_section_record changes data Adds (no record_id) or changes a record of an engine section. Send only what changes, in values, by...

Adds (no record_id) or changes a record of an engine section. Send only what changes, in values, by the keys describe_section gives. What you can't edit is dropped and named in ignored; send version from the record to refuse overwriting a newer change. Files go through the API.

Argument	Type	Description
`company_id`required	integer
`section`required	string employees \| employee_contracts \| employee_bank_accounts \| employee_family \| employee_documents \| employee_job_history \| terminations \| attendance_sheet \| attendance_records \| missing_punches \| team_locations \| team_leaves \| leave_balances \| leave_adjustments \| employee_shifts \| team_schedule \| work_shifts \| approval_delegations \| manage_announcements \| manage_events \| manage_tasks \| manage_letters \| disciplinary_actions \| suspensions \| company_assets \| field_jobs \| field_sites \| field_customers \| field_customer_sites \| field_technicians \| field_parts \| field_part_movements \| field_stock_locations \| field_movements \| field_vehicles \| field_vehicle_documents \| field_vehicle_maintenance \| field_vehicle_fuel \| field_overtime \| evaluation_cycles \| cycle_evaluations \| goals \| key_positions \| successors \| job_openings \| job_candidates \| candidates \| candidate_notes \| candidate_interviews \| candidate_offers \| my_interviews \| offers \| assessment_tests \| assessment_questions \| assessment_invitations \| assessment_grading \| my_assessments \| boardings \| boarding_tasks \| boarding_templates \| employee_checklists \| payroll_runs \| payroll_run_payslips \| payroll_salaries \| payroll_packages \| payroll_package_templates \| payroll_transactions \| payroll_settlements \| payroll_settlement_slips \| payroll_loans \| payroll_loan_installments \| payroll_overtimes \| payroll_insurance \| payroll_air_tickets \| payroll_provisions \| setup_branches \| setup_org_units \| setup_positions \| setup_org_levels \| setup_termination_reasons \| setup_checklist_templates \| setup_shifts \| setup_holidays \| setup_overtime_types \| setup_attendance_functions \| setup_leave_types \| setup_payroll_general \| setup_payroll_advance \| setup_payroll_extra_settings \| setup_payroll_tax_settings \| setup_payroll_social_security \| setup_payroll_tax \| setup_payroll_extra \| setup_payroll_bank_accounts \| setup_transaction_types \| setup_part_time_transaction_types \| setup_loan_types \| setup_cost_centers \| setup_salary_bands \| setup_expense_types \| setup_cities \| setup_attendance_devices \| setup_device_time_zones \| setup_roles \| setup_roles_assignments \| setup_permission_groups \| setup_permission_exceptions \| setup_api_keys \| setup_webhooks \| setup_imports
`record_id`	integer
`parent`	integer	The parent record, for a section under a record.
`values`required	object
`version`	string

save_setup_form_item changes data Add (without id) or change (with id, send only what changes) an item of a setup form, with name {"en...

Add (without id) or change (with id, send only what changes) an item of a setup form, with name {"en","ar"} and the entity's fields from list_setup_form. Files (logo) are uploaded on the screen or the API. With delete=true and id, deletes it unless it is in use.

Argument	Type	Description
`company_id`required	integer
`entity`required	string expense-types \| cities \| org-levels \| miscellaneous-types \| attendance-functions \| transaction-types \| loan-types \| part-time-transaction-types \| cost-centers \| salary-bands \| letter-categories \| disciplinary-types \| suspension-reasons \| termination-reasons \| checklist-templates
`id`	integer
`name`	object	{"en": "...", "ar": "..."}
`delete`	boolean
`level_type`	string
`parent_id`	integer
`rank`	integer
`subsidiary_id`	string
`key_staff`	array	[{"employee_id": 1, "role": "approvals\|evaluation\|financial"}]
`country`	string	cities: the ISO country code (JO, IQ…)
`active`	boolean

save_time_settings changes data Change attendance setup or timesheets setup (section), sending only the settings that change in valu...

Change attendance setup or timesheets setup (section), sending only the settings that change in values, e.g. {"clock_geofence": true, "mp_max_days": 30} or {"ts_period": "biweekly"}. get_time_settings lists them. Punches by shift (docs/attendance.md): punch_in_window_minutes (early clock-in window before a shift, default 60), punch_out_grace_minutes (clock-out grace after it, past midnight too, default 30), shift_punches_from (Y-m-d H:i on the company clock: punches from then follow the shift; earlier ones keep the calendar day; empty = all, "off" = never).

Argument	Type	Description
`company_id`required	integer
`section`required	string attendance \| timesheets
`values`required	object

save_time_setup_item changes data Add or change a time setup item (attendance_setup.manage). kind shifts or overtime_types: the whole...

Add or change a time setup item (attendance_setup.manage). kind shifts or overtime_types: the whole item in fields, as on the screen (a shift: name {en, ar}, type, start_time, end_time..., punch_in_window_minutes and punch_out_grace_minutes for punches by shift, empty = the device's then the company's; an overtime type: name, applies_on, rate, allowance_method...). kind holidays: name, date, end_date, religions, recurring. kind geolocations: name, latitude, longitude, radius_m, restricted. kind biometric_devices: name, serial, work_location_id, punches_from (Y-m-d: older punches are kept but not added to attendance); a new machine's token is shown once. Give id to change one; for holidays, geolocations and machines send only what changes.

Argument	Type	Description
`company_id`required	integer
`kind`required	string shifts \| overtime_types \| holidays \| geolocations \| biometric_devices
`id`	integer	To change one
`fields`required	object

schedule_employees changes data The employee shift schedule and work locations, for the employees your role reaches. action list, we...

The employee shift schedule and work locations, for the employees your role reaches. action list, week and regular need attendance.shift_planner.view; assign_shift, plan and publish attendance.shift_planner.manage; set_locations and replace_location attendance.manage; location_for_everyone attendance_setup.manage (attendance.manage grants them all). action list: schedule rows between from and to (a week by default). action assign_shift: employees, shift_id (or "off"), start_date, end_date (none = open-ended), conflict replace or keep. action plan (ZenHR's roster): shift_ids, start_date, end_date (up to two months, e.g. a month), optional employees, max_in_a_row, days_off_a_week, max_weekly_hours, fair_nights: drafts days. action publish: start_date, end_date, optional employees, notify: publishes the drafts. action week: the Employee Shifts week (week = any date in it; filters q, department, job_role, manager, gender, schedule with|without) as one row per employee with a cell per day (the CSV export). action regular: regular (non-roster) shift assignments and each person's own default shift. action set_locations: employees, locations and mode assign, unassign or replace. action replace_location: everyone at from_location moves to to_location. action location_for_everyone: location_id with mode assign, unassign or replace for every active employee in reach. action reprocess_punches (attendance_setup.manage): match machine punches to employees again.

Argument	Type	Description
`company_id`required	integer
`action`required	string list \| week \| regular \| assign_shift \| plan \| publish \| set_locations \| replace_location \| location_for_everyone \| reprocess_punches
`from`	string
`to`	string
`employee`	integer
`employees`	array
`shift_id`	string	A shift id, or off
`start_date`	string
`end_date`	string
`conflict`	string replace \| keep
`shift_ids`	array
`max_in_a_row`	integer
`days_off_a_week`	integer
`max_weekly_hours`	number
`fair_nights`	boolean
`notify`	boolean
`week`	string
`q`	string
`department`	integer
`job_role`	integer
`manager`	integer
`gender`	string male \| female
`schedule`	string with \| without
`from_location`	integer
`to_location`	integer
`location_id`	integer
`locations`	array
`mode`	string assign \| unassign \| replace

search_help_center read only The public help center at help.mihnaro.com (docs/help-center.md): its topics, and its articles match...

The public help center at help.mihnaro.com (docs/help-center.md): its topics, and its articles matching a search (`query`) or in a topic (`category`), with their title, summary and link. In English, or Arabic with `locale: ar`. Read one with get_help_article.

Argument	Type	Description
`query`	string	Words to search for, e.g. "leave balance".
`category`	string getting-started \| employees \| payroll \| leaves \| attendance \| documents \| performance \| recruitment \| reports \| settings \| api
`locale`	string en \| ar

send_company_test_email changes data Settings → Email server → "Send a test email" (settings.manage, docs/mail.md): one test email throug...

Settings → Email server → "Send a test email" (settings.manage, docs/mail.md): one test email through the company's own mail server. A failure says why in plain words (wrong username or password, connection refused, encryption and port mismatch…). Only send when the person asked for a test.

Argument	Type	Description
`company_id`required	integer
`to`required	string

send_for_signature changes data E-signatures. action send (letters.manage): send a document for employee_ids in your scope to read a...

E-signatures. action send (letters.manage): send a document for employee_ids in your scope to read and sign, as title + body or an issued letter_id. action decline: decline to sign your own document (signature_id, decline_reason). Signing itself is done by the employee on the screen or the API, with their password and a drawn signature.

Argument	Type	Description
`company_id`required	integer
`action`required	string send \| decline
`employee_ids`	array
`title`	string
`body`	string
`letter_id`	integer
`signature_id`	integer
`decline_reason`	string

send_phone_test_push changes data One test notification to one phone of a person in your scope (docs/notifications.md «الإشعار التجريب...

One test notification to one phone of a person in your scope (docs/notifications.md «الإشعار التجريبي»): install_id from list_app_devices. Straight to Apple or Google, nothing in the bell, logged on the phone's timeline (push_test) with who sent it. Returns sent and, per token: provider, status (ok, invalid, error), error, environment (which of Apple's servers took it), fallback (the first server refused it) and reason in plain words. "ok" means accepted for delivery, not shown on screen. At most 5 a minute per phone. Needs app_devices.test_push.

Argument	Type	Description
`company_id`required	integer
`install_id`required	integer

set_employee_emails changes data Settings → Email server → "Email employees" (settings.manage, docs/mail.md): on lets the company ema...

Settings → Email server → "Email employees" (settings.manage, docs/mail.md): on lets the company email its people (invitations, welcome emails, notices, reminders); off holds them (notices still reach the bell; password resets and candidate emails are not held). Kept per branch like the reminders: branch_id for one branch, else the branch being worked in (the main branch's value is the company's). Only change it when the person asked.

Argument	Type	Description
`company_id`required	integer
`on`required	boolean
`branch_id`	integer

set_legal_validation changes data Needs legal_rules.validate (the company admin always has it): record that a payroll rule was legally...

Needs legal_rules.validate (the company admin always has it): record that a payroll rule was legally validated (who validated it and the reference, e.g. a lawyer's opinion), or withdraw the validation. A blocked rule starts working once validated.

Argument	Type	Description
`company_id`required	integer
`rule`required	string overtime_to_leave \| rest_day_overtime \| holiday_overtime \| loan_settlement_deduction \| eos_formula \| tax_scale \| day_divisor
`action`required	string record \| withdraw
`validated_by`	string
`reference`	string

set_line_manager_access changes data Turn on or off what direct managers may do for the people who report to them, with or without a role...

Turn on or off what direct managers may do for the people who report to them, with or without a role: lm_rate_competencies, lm_assess_potential, lm_salary_adjustments, lm_team_suspensions. Keys left out keep their value. Needs roles.manage.

Argument	Type	Description
`company_id`required	integer
`lm_rate_competencies`	boolean	Rate the competencies of their direct reports
`lm_assess_potential`	boolean	Assess the potential (9-box) of their direct reports
`lm_salary_adjustments`	boolean	File salary adjustment requests for the people who report to them
`lm_team_suspensions`	boolean	See the suspensions of their direct reports

set_main_branch changes data Make an active branch the company's main one (owners land on it).

Make an active branch the company's main one (owners land on it).

Argument	Type	Description
`company_id`required	integer
`branch_id`required	integer

set_user_status changes data User setup: switch a company account on (active) or off (inactive). An inactive user can't work in t...

User setup: switch a company account on (active) or off (inactive). An inactive user can't work in this company. Not for yourself or the company admin.

Argument	Type	Description
`company_id`required	integer
`user_id`required	integer
`status`required	string active \| inactive

shared_phone_allowances changes data HR exceptions to one account per phone (docs/platform-control.md «الاستثناء»): let one more account...

HR exceptions to one account per phone (docs/platform-control.md «الاستثناء»): let one more account use a phone another account already uses (a shared tablet at reception). action list (app_devices.view; phone_key optional, active_only): the exceptions for the people in scope. action allow (app_devices.allow_shared): user_id, install_id (a phone row from list_shared_phones or list_app_devices) or phone_key, reason (3–500 chars); logged on the phone's timeline and told to the person. action revoke (app_devices.allow_shared): allowance_id. Same as /api/v1/app/companies/{id}/app-devices/allowances.

Argument	Type	Description
`company_id`required	integer
`action`required	string list \| allow \| revoke
`user_id`	integer
`install_id`	integer
`phone_key`	string
`reason`	string
`allowance_id`	integer
`active_only`	boolean

shift_setup changes data Shift and overtime setup actions (attendance_setup.manage, docs/attendance.md). action get: shift_id...

Shift and overtime setup actions (attendance_setup.manage, docs/attendance.md). action get: shift_id with its fields and employee count. action copy_to_roster: a roster copy of shift_id. action sync: give shift_id to every active employee who has no shift (not roster or archived shifts). action get_overtime_limit / set_overtime_limit: the Limit Setup, ot_limit_scope per_type|total, ot_total_limit_hours (0-744), ot_total_limit_period day|week|month.

Argument	Type	Description
`company_id`required	integer
`action`required	string get \| copy_to_roster \| sync \| get_overtime_limit \| set_overtime_limit
`shift_id`	integer
`ot_limit_scope`	string per_type \| total
`ot_total_limit_hours`	number
`ot_total_limit_period`	string day \| week \| month

show_notification_log read only One notice of the notifications log in full (notifications.log.view, docs/notifications.md "سجل الإش...

One notice of the notifications log in full (notifications.log.view, docs/notifications.md "سجل الإشعارات"), as GET notification-log/{id}: the send, then every person in your scope with their branch, bell (read and when), push (status and what Google/Apple answered per phone), email (status, reason, and the mail log row: via, attempts, error) and WhatsApp; receiver emails too when you see the whole company.

Argument	Type	Description
`company_id`required	integer
`id`required	integer	The notice (send) id from list_notification_log.

succession_intelligence changes data Succession intelligence (succession.manage, its scope; docs/succession.md). action coverage: key pos...

Succession intelligence (succession.manage, its scope; docs/succession.md). action coverage: key positions with risk flags (vacant, single_incumbent, high_risk, high_impact, no_successors, no_ready_successor), exposure (critical|exposed|watch|covered), bench and bench strength, and the summary; filters exposure, department_id. action suggestions: key_position_id, limit → candidates ranked by a score out of 100 with each part (competency_fit, performance, potential, readiness, tenure), the weights, gaps and a suggested readiness. action explain: key_position_id, employee_id → why (rule-based, or the AI provider's text when it is set). action successor: successor_id → readiness history and development plan. action draft_plan: successor_id, apply (true saves the actions). action save_action: successor_id or action_id, fields title, kind (training|mentoring|assignment|project|other), owner_id, due_date, status (planned|in_progress|done), progress 0–100, competency_id, notes. action delete_action: action_id. Readiness itself is set with manage_succession add_successor.

Argument	Type	Description
`company_id`required	integer
`action`required	string coverage \| suggestions \| explain \| successor \| draft_plan \| save_action \| delete_action
`key_position_id`	integer
`employee_id`	integer
`successor_id`	integer
`action_id`	integer
`exposure`	string
`department_id`	integer
`limit`	integer
`apply`	boolean
`fields`	object

switch_branch changes data Switches the branch workspace (like the branch switcher in the app header): a branch id, or "all" fo...

Switches the branch workspace (like the branch switcher in the app header): a branch id, or "all" for every branch (company-wide roles only). Remembered for the web app, the API and later tool calls.

Argument	Type	Description
`company_id`required	integer
`branch`required	string	A branch id, or "all".

task_proof changes data Signed proof photos on tasks (docs/field-proof.md §23), the same as the tasks/{task}/proof API route...

Signed proof photos on tasks (docs/field-proof.md §23), the same as the tasks/{task}/proof API routes. action list (tasks.proof.view): the tasks with photos of the people in scope, with show (open, flagged, done, all), employee (id), q, page, per_page; each with its photos, videos, needs_look and last_photo_at. action show (tasks.proof.view): task_id, the task, its rules and photos, and can {void, request_upload, waive} for you. action own (self.tasks.view): task_id, one of your own tasks with every photo you took, open or finished. action void (tasks.proof.void): evidence_id, reason. action request_upload (tasks.proof.request_upload): task_id, note; at most once per task every 10 minutes. action waive (tasks.proof.waive): task_id, reason; the task no longer needs photos. action settings (tasks.proof.settings): with values task_proof_enabled, task_proof_offline_allowed, task_proof_departure, task_proof_min_progress_photos, and branch_id for one branch (null takes a key back to the company). Photos are only taken by the mobile app with its hardware key, never through MCP. To require proof on a new task pass fields.proof_required to manage_task action assign (tasks.proof.require).

Argument	Type	Description
`company_id`required	integer
`action`required	string own \| list \| show \| void \| request_upload \| waive \| settings
`task_id`	integer
`evidence_id`	integer
`reason`	string
`note`	string
`values`	object
`branch_id`	integer
`show`	string open \| flagged \| done \| all
`employee`	integer
`q`	string
`page`	integer
`per_page`	integer

team_schedule changes data Work shifts HR shares with managers (docs/attendance.md «مشاركة جداول الدوام»). HR (attendance_setup...

Work shifts HR shares with managers (docs/attendance.md «مشاركة جداول الدوام»). HR (attendance_setup.manage): action shares (shift_id) lists who a shift is shared with; action share (shift_id, targets [{target_type department|group|employee, target_id, can_edit}]) replaces them. Managers (shifts.assign_team) and HR: action list: the shifts shared with you (every shift for HR) and your team; action assign: employees (your team only), shift_id (a shared shift, or "off"), start_date, end_date (none = open-ended; the same date for one roster day), conflict replace|keep, draft; action clear: employees, start_date, end_date; action plan: the shift planner for your team (shift_ids shared with you, start_date, end_date at most 62 days, employees optional = whole team, max_in_a_row, days_off_a_week, max_weekly_hours, fair_nights), drafts only; action copy: source_from, source_to, target_from, target_to (same length or a multiple), employees optional, draft; days on shifts not shared with you are not copied; action publish: start_date, end_date, employees optional (a manager publishes drafts on shared shifts and days off only); action update_shift: shift_id and the shift fields, only where a share lets you change it.

Argument	Type	Description
`company_id`required	integer
`action`required	string list \| shares \| share \| assign \| clear \| plan \| copy \| publish \| update_shift
`shift_id`	string	A shift id, or off when assigning a day off
`targets`	array
`employees`	array
`start_date`	string
`end_date`	string
`conflict`	string replace \| keep
`draft`	boolean
`shift_ids`	array	plan: the shared shifts to use
`source_from`	string
`source_to`	string
`target_from`	string
`target_to`	string
`max_in_a_row`	integer
`days_off_a_week`	integer
`max_weekly_hours`	number
`fair_nights`	boolean

terminate_employee can delete End an employee's service. The record is kept, stops counting against the license, and the person ca...

End an employee's service. The record is kept, stops counting against the license, and the person can't sign in any more (unless they are the owner). It is refused while the termination check (get_termination_check) has pending items; then the leaving record is kept, the offboarding checklist starts, and HR, the manager and key staff are told as Notifications setup says.

Argument	Type	Description
`company_id`required	integer
`employee_id`required	integer
`terminated_on`required	string	Last working day, YYYY-MM-DD.
`termination_type`required	string resignation \| dismissal \| end_of_contract \| other \| retirement \| transfer
`note`	string
`termination_reason_id`	integer	A specific reason (setup list termination-reasons); it decides the termination type.
`custom_fields`	object	Custom fields shown at end of service: {"field id": "value"} (a list field takes its option index).

transfer_employee changes data Move an employee to another branch: the old record ends (transfer) on effective_date and a new one s...

Move an employee to another branch: the old record ends (transfer) on effective_date and a new one starts there with the same number, hire date and sign-in. Returns the new record.

Argument	Type	Description
`company_id`required	integer
`employee_id`required	integer
`branch_id`required	integer
`effective_date`required	string	YYYY-MM-DD
`position_id`	integer
`work_location_id`	integer
`department_id`	integer
`section_id`	integer
`project_id`	integer
`note`	string

update_app_colors changes data Changes the mobile app colors of a company or one of its branches (app_colors.manage): primary (butt...

Changes the mobile app colors of a company or one of its branches (app_colors.manage): primary (buttons, active tabs, links), secondary (header, titles), as #RRGGBB. Only what is given changes; empty follows the level above; reset=true clears both. The admins are told. Same as PATCH and DELETE /api/v1/app/companies/{company}/settings/app-colors.

Argument	Type	Description
`company_id`required	integer
`branch_id`	integer	One branch's own colors; none: the company's. The main branch uses the company's.
`primary`	string	#RRGGBB for buttons, active tabs and links. Empty: follow the level above.
`secondary`	string	#RRGGBB for the header and titles. Empty: follow the level above.
`reset`	boolean	Clear both colors at this level.

update_company_appearance changes data System preferences → Appearance (settings.manage): the company's default look for everyone, and allo...

System preferences → Appearance (settings.manage): the company's default look for everyone, and allow_user_override (may people choose their own). Only the options given change; empty follows the platform. Same as PATCH /api/v1/app/companies/{company}/settings/appearance.

Argument	Type	Description
`company_id`required	integer
`allow_user_override`	boolean
`mode`	string \| light \| dark \| system	Empty: follow the level above.
`layout`	string \| default \| mini \| detached \| modern \| transparent \| horizontal \| horizontal-single \| horizontal-overlay \| horizontal-box \| horizontal-fullwidth \| horizontal-sidemenu \| twocolumn \| stacked	Empty: follow the level above.
`color`	string \| primary \| brightblue \| lunargreen \| lavendar \| magenta \| chromeyellow \| lavared	Empty: follow the level above.
`sidebar`	string \| light \| brand \| darkgreen \| darkgray \| royalblue \| indigo	Empty: follow the level above.
`topbar`	string \| white \| darkaqua \| whiterock \| rockblue \| bluehaze \| orangegradient \| purplegradient \| bluegradient \| maroongradient	Empty: follow the level above.
`topbarcolor`	string \| white \| primary \| blackpearl \| maroon \| bluegem \| firefly	Empty: follow the level above.
`card`	string \| bordered \| borderless \| shadow	Empty: follow the level above.
`size`	string \| default \| compact	Empty: follow the level above.
`width`	string \| fluid \| box	Empty: follow the level above.
`loader`	string \| enable \| disable	Empty: follow the level above.

update_log_retention changes data Set how long the company keeps its activity log: 6, 12 or 24 months, or forever (only the choices un...

Set how long the company keeps its activity log: 6, 12 or 24 months, or forever (only the choices under Mihnaro's maximum). Older entries are deleted by the nightly cleanup, which logs itself. Shorter retention deletes history for good: confirm with the user first.

Argument	Type	Description
`company_id`required	integer
`retention`required	string 6 \| 12 \| 24 \| forever

update_my_appearance changes data The signed-in person's own layout, colors and mode, when their company lets people choose. Only the...

The signed-in person's own layout, colors and mode, when their company lets people choose. Only the options given change; empty follows the company. Same as PATCH /api/v1/app/me/appearance.

Argument	Type	Description
`company_id`required	integer
`mode`	string \| light \| dark \| system	Empty: follow the level above.
`layout`	string \| default \| mini \| detached \| modern \| transparent \| horizontal \| horizontal-single \| horizontal-overlay \| horizontal-box \| horizontal-fullwidth \| horizontal-sidemenu \| twocolumn \| stacked	Empty: follow the level above.
`color`	string \| primary \| brightblue \| lunargreen \| lavendar \| magenta \| chromeyellow \| lavared	Empty: follow the level above.
`sidebar`	string \| light \| brand \| darkgreen \| darkgray \| royalblue \| indigo	Empty: follow the level above.
`topbar`	string \| white \| darkaqua \| whiterock \| rockblue \| bluehaze \| orangegradient \| purplegradient \| bluegradient \| maroongradient	Empty: follow the level above.
`topbarcolor`	string \| white \| primary \| blackpearl \| maroon \| bluegem \| firefly	Empty: follow the level above.
`card`	string \| bordered \| borderless \| shadow	Empty: follow the level above.
`size`	string \| default \| compact	Empty: follow the level above.
`width`	string \| fluid \| box	Empty: follow the level above.
`loader`	string \| enable \| disable	Empty: follow the level above.

update_my_preferences changes data Set the signed-in user's own language (en or ar) and theme (light, dark or system). Saved on the acc...

Set the signed-in user's own language (en or ar) and theme (light, dark or system). Saved on the account, so it applies on every device. Only the fields given change.

Argument	Type	Description
`locale`	string en \| ar	Interface language.
`theme`	string light \| dark \| system	system follows the device setting.

update_sign_in_settings changes data Change the company's sign-in security. Send only what changes. Two-step verification; the company's...

Change the company's sign-in security. Send only what changes. Two-step verification; the company's own password policy (pw_*: it only tightens Mihnaro's); single sign-on on or off, its protocol (oidc or saml), OpenID Connect issuer URL and client ID, SAML provider entity ID, sign-in URL and email attribute; "SSO only" (no password sign-in except for the exempt users; turning it on exempts you) and the exempt user ids. The OIDC client secret and the SAML certificate or metadata can't be set here on purpose: enter them on the screen or through the API.

Argument	Type	Description
`company_id`required	integer
`two_factor_required`	boolean
`sso_enabled`	boolean
`sso_name`	string
`sso_issuer`	string
`sso_client_id`	string
`sso_protocol`	string oidc \| saml
`sso_only`	boolean	No password sign-in for this company, except the exempt users. Needs single sign-on on.
`sso_exempt_user_ids`	array	The whole list of user ids still allowed a password (replaces it).
`saml_idp_entity_id`	string
`saml_idp_sso_url`	string	The provider's HTTP-Redirect sign-in URL (https).
`saml_email_attribute`	string	The attribute holding the email; empty = the usual ones, then the NameID.
`pw_min_length`	integer	6-64.
`pw_upper`	boolean
`pw_lower`	boolean
`pw_numbers`	boolean
`pw_special`	boolean
`pw_max_age_days`	integer	0 = never expire, up to 365.
`pw_reuse`	integer	The last N passwords can't be reused, 0-24.
`pw_max_attempts`	integer	Failed sign-ins before the account locks, 3-20; 0 = Mihnaro's.
`pw_lock_minutes`	integer	Lock length in minutes, up to 1440; 0 = Mihnaro's.

whoami read only The signed-in company user and the companies they belong to, with whether each can be accessed now.

The signed-in company user and the companies they belong to, with whether each can be accessed now.

No arguments.

`https://api.mihnaro.com/mcp/platform` 155 tools

add_backup_folder_destination changes data Add another folder on this server as a backup destination (docs/backups.md). A full path outside the...

Add another folder on this server as a backup destination (docs/backups.md). A full path outside the app and web folders, empty or new. It does not survive losing the server. S3 and SFTP take keys, so they are added in the panel or the API.

Argument	Type	Description
`name`required	string
`path`required	string	A full path, for example /var/backups/mihnaro.
`enabled`	boolean
`keep_daily`	integer
`keep_weekly`	integer
`keep_monthly`	integer

add_license changes data Renew or change a company's license by adding a new one (history is kept). It applies from its start...

Renew or change a company's license by adding a new one (history is kept). It applies from its start date. max_branches cannot be lower than the branches the company already has.

Argument	Type	Description
`company_id`required	integer
`modules`required	array
`max_employees`required	integer	Maximum active employees across all branches.
`max_branches`required	integer
`starts_on`required	string	YYYY-MM-DD
`ends_on`required	string	YYYY-MM-DD
`notes`	string

archive_lead changes data Archive a contact-form message (it leaves the Inbox and its counts; a soft delete, nothing is delete...

Archive a contact-form message (it leaves the Inbox and its counts; a soft delete, nothing is deleted) or restore an archived one. action: archive or restore.

Argument	Type	Description
`lead_id`required	integer
`action`required	string archive \| restore

buddy_punching_defaults changes data The platform default of each buddy-punching layer, which every company has until it sets its own (pl...

The platform default of each buddy-punching layer, which every company has until it sets its own (platform.app_control, docs/attendance-security.md §19). All start off. action get: each layer's mode and settings, and the companies with their own. action set with layer bp_face|bp_device_key|bp_presence|bp_pattern and mode off|flag|refuse (bp_pattern can only flag), plus the layer's settings. Same API: GET platform/buddy-punching, PUT platform/buddy-punching/{layer}.

Argument	Type	Description
`action`required	string get \| set
`layer`	string bp_face \| bp_device_key \| bp_presence \| bp_pattern
`mode`	string off \| flag \| refuse

calculate_hr read only Run one of mihnaro.com's free HR calculators for a country (ISO code, default IQ; list_calculator_co...

Argument	Type	Description
`tool`required	string end-of-service \| net-salary \| gross-salary \| overtime \| leave \| cost-to-company
`inputs`required	object	The tool's inputs, e.g. {"basic": 1500000, "allowances": 300000}.
`country`	string	ISO country code, e.g. "SA". Default IQ.
`variant`	string	The country's rule variant when it has more than one (e.g. "saudi", "non-saudi"); default its first.
`date`	string	Use the rules in force on this day (Y-m-d); default today.

cancel_broadcast changes data Cancel a platform broadcast that hasn't started yet: a scheduled one, or one still waiting for the q...

Cancel a platform broadcast that hasn't started yet: a scheduled one, or one still waiting for the queue (docs/platform-control.md).

Argument	Type	Description
`broadcast_id`required	integer

check_company_field_availability read only Whether a value is free before creating or editing a company: name_en / name_ar (compared without ca...

Whether a value is free before creating or editing a company: name_en / name_ar (compared without case, spaces, punctuation, Arabic diacritics or tatweel, with alef forms, taa marbuta/haa and yaa/alef maqsura folded; either name of another company counts), slug, owner_email (any account's email), personal_email, phone (E.164; 0770… is read as Iraqi), tax_number (another company's branch), company_email (another company's contact email). Returns available, the normalized value, the message and the company that holds it. Pass company_id / user_id when editing so their own values don't count. create_company and update_company refuse taken values with the same messages.

Argument	Type	Description
`field`required	string name_en \| name_ar \| slug \| owner_email \| personal_email \| phone \| tax_number \| company_email
`value`required	string
`company_id`	integer	The company being edited.
`user_id`	integer	The account being edited.

choose_login_design changes data Set which sign-in design each area uses; only the areas given change. Live immediately. Same as PATC...

Set which sign-in design each area uses; only the areas given change. Live immediately. Same as PATCH /api/v1/platform/login-designs/areas.

Argument	Type	Description
`app`	string classic \| illustration \| minimal \| command \| card	app.mihnaro.com sign-in pages
`admin`	string classic \| illustration \| minimal \| command \| card	admin.mihnaro.com sign-in
`demo`	string classic \| illustration \| minimal \| command \| card	demo.mihnaro.com entry page

company_deletion_preview read only What deleting a company would lose: its payroll runs, attendance records, employees and accounts; re...

What deleting a company would lose: its payroll runs, attendance records, employees and accounts; real: true means delete_company needs force. Needs platform.companies.

Argument	Type	Description
`company_id`required	integer

create_calculator_rule_set changes data Create a calculator rule set as a draft: a new country (country_code ISO), a variant of one (variant...

Create a calculator rule set as a draft: a new country (country_code ISO), a variant of one (variant slug + variant_label {en, ar}, e.g. nationals and expatriates) or a new version from a date (effective_from Y-m-d, copy_from the id to copy). Optional rules, sources, notes and requires_confirmation as in update_calculator_rule_set. Publish it with publish_calculator_rule_set. Same as POST /api/v1/platform/calculator-rule-sets.

Argument	Type	Description
`country_code`required	string
`effective_from`required	string	Y-m-d
`variant`	string
`variant_label`	object
`copy_from`	integer
`rules`	object
`sources`	object
`notes`	object
`requires_confirmation`	array	What is not confirmed yet: [{rules: [rule keys or group names], reason {en, ar}, needed {en, ar}}]; [] or null for none

create_company changes data Onboard a customer company: creates the company, its first license, its main branch and the company...

Onboard a customer company: creates the company, its first license, its main branch and the company admin (owner). Returns the owner's one-time temporary password when a new user was created; they must change it at first sign-in.

Argument	Type	Description
`name`required	object
`slug`required	string	Unique URL-safe id, e.g. "alfaris-trading".
`country`required	string AD \| AE \| AF \| AG \| AI \| AL \| AM \| AO \| AQ \| AR \| AS \| AT \| AU \| AW \| AX \| AZ \| BA \| BB \| BD \| BE \| BF \| BG \| BH \| BI \| BJ \| BL \| BM \| BN \| BO \| BQ \| BR \| BS \| BT \| BW \| BY \| BZ \| CA \| CC \| CD \| CF \| CG \| CH \| CI \| CK \| CL \| CM \| CN \| CO \| CR \| CU \| CV \| CW \| CX \| CY \| CZ \| DE \| DJ \| DK \| DM \| DO \| DZ \| EC \| EE \| EG \| EH \| ER \| ES \| ET \| FI \| FJ \| FK \| FM \| FO \| FR \| GA \| GB \| GD \| GE \| GF \| GG \| GH \| GI \| GL \| GM \| GN \| GP \| GQ \| GR \| GS \| GT \| GU \| GW \| GY \| HK \| HN \| HR \| HT \| HU \| ID \| IE \| IL \| IM \| IN \| IO \| IQ \| IR \| IS \| IT \| JE \| JM \| JO \| JP \| KE \| KG \| KH \| KI \| KM \| KN \| KP \| KR \| KW \| KY \| KZ \| LA \| LB \| LC \| LI \| LK \| LR \| LS \| LT \| LU \| LV \| LY \| MA \| MC \| MD \| ME \| MF \| MG \| MH \| MK \| ML \| MM \| MN \| MO \| MP \| MQ \| MR \| MS \| MT \| MU \| MV \| MW \| MX \| MY \| MZ \| NA \| NC \| NE \| NF \| NG \| NI \| NL \| NO \| NP \| NR \| NU \| NZ \| OM \| PA \| PE \| PF \| PG \| PH \| PK \| PL \| PM \| PN \| PR \| PS \| PT \| PW \| PY \| QA \| RE \| RO \| RS \| RU \| RW \| SA \| SB \| SC \| SD \| SE \| SG \| SH \| SI \| SJ \| SK \| SL \| SM \| SN \| SO \| SR \| SS \| ST \| SV \| SX \| SY \| SZ \| TC \| TD \| TF \| TG \| TH \| TJ \| TK \| TL \| TM \| TN \| TO \| TR \| TT \| TV \| TW \| TZ \| UA \| UG \| UM \| US \| UY \| UZ \| VA \| VC \| VE \| VG \| VI \| VN \| VU \| WF \| WS \| YE \| YT \| ZA \| ZM \| ZW	ISO country code of the company.
`timezone`	string	IANA timezone. Defaults to the country's.
`notes`	string	Internal notes.
`license`required	object
`main_branch`required	object
`owner`required	object

create_platform_admin changes data Add a Mihnaro platform admin (name, email, permissions). Returns a temporary password once; they cho...

Add a Mihnaro platform admin (name, email, permissions). Returns a temporary password once; they choose their own at the first sign-in. An email of a company account is refused; a former platform admin gets the access back. Needs platform.admins.

Argument	Type	Description
`name`required	string
`email`required	string
`permissions`	array

delete_backup_destination changes data Remove a backup destination (docs/backups.md). New copies stop going there; copies already stored th...

Remove a backup destination (docs/backups.md). New copies stop going there; copies already stored there stay there. Refused for the only destination that is on.

Argument	Type	Description
`destination_id`required	integer

delete_company can delete Delete a company (docs/company-management.md). Needs confirm_name (its English or Arabic name, or it...

Delete a company (docs/company-management.md). Needs confirm_name (its English or Arabic name, or its slug, typed exactly) and confirm: true. Refused while it has payroll runs or attendance unless force: true. A backup of every row is written first; the company is hidden at once and can be restored (restore_company) for the restore window (30 days), then it is removed for good. The other platform admins are emailed. Call company_deletion_preview first to see what it holds. Needs platform.companies.

Argument	Type	Description
`company_id`required	integer
`confirm_name`required	string	The company's English or Arabic name, or its slug, typed exactly.
`confirm`required	boolean	The second confirmation: true.
`force`	boolean	Delete although it has payroll runs or attendance.
`reason`	string

delete_license can delete Delete a license entered by mistake. Refused for the company's only license and for the license in e...

Delete a license entered by mistake. Refused for the company's only license and for the license in effect (add a newer one or suspend it first). Kept in the activity log. Needs platform.companies.

Argument	Type	Description
`company_id`required	integer
`license_id`required	integer

delete_office can delete Delete an office from the contact page. To hide it for now, use save_office with is_visible false in...

Delete an office from the contact page. To hide it for now, use save_office with is_visible false instead.

Argument	Type	Description
`office_id`required	integer

delete_plan can delete Delete a pricing plan. To take it off the site for now, use save_plan with is_active false instead.

Delete a pricing plan. To take it off the site for now, use save_plan with is_active false instead.

Argument	Type	Description
`plan_id`required	integer

delete_section can delete Delete a page section. To hide it for now, use save_section with is_visible false.

Delete a page section. To hide it for now, use save_section with is_visible false.

Argument	Type	Description
`section_id`required	integer

delete_system_announcement can delete Delete a system announcement that nobody has seen yet. One that was already shown can only be switch...

Delete a system announcement that nobody has seen yet. One that was already shown can only be switched off (save_system_announcement with is_active false), so its numbers stay.

Argument	Type	Description
`id`required	integer

device_data_defaults changes data The platform defaults every company has until it sets its own in Mobile app rules (platform.app_cont...

The platform defaults every company has until it sets its own in Mobile app rules (platform.app_control, docs/platform-control.md «الموقع شرط لفتح التطبيق» and «بيانات الهاتف»). action get: location_required {enabled, precise, reason_en, reason_ar} (the app shows a full-screen gate until location is on, and the server refuses the company's app calls with location_required; never for demo or store-reviewer accounts), categories {device|network|battery|permissions|security|time|locale|health: {enabled, retention_days 7–730}}, and the companies with their own. action set: any of location_required and categories (only what is given changes). Same API: GET/PUT /api/v1/platform/device-data.

Argument	Type	Description
`action`required	string get \| set
`location_required`	object	{enabled, precise, reason_en, reason_ar}
`categories`	object	{category: {enabled, retention_days}}

end_support_session changes data End a support session now; the admin is taken out of the company on their next click.

End a support session now; the admin is taken out of the company on their next click.

Argument	Type	Description
`support_session_id`required	integer

event_location_default changes data Keeping the phone's own GPS point with app sign-ins, app opens and version changes, the platform def...

Keeping the phone's own GPS point with app sign-ins, app opens and version changes, the platform default (platform.app_control, docs/platform-control.md «موقع الأحداث»): what every company has until it sets its own in Mobile app rules (policy event_location). action get: mode, who changed it last, and the companies with their own setting. action set: mode auto (on for companies with live location or the clock-in geofence) | on | off. Only from people who already allowed location on the phone; demo and store-reviewer accounts are never recorded; points older than 10 minutes or from a fake-location app are dropped.

Argument	Type	Description
`action`required	string get \| set
`mode`	string auto \| on \| off

export_platform_notification_log read only The platform notifications log as a file (platform.notifications, docs/notifications.md), as GET /ap...

The platform notifications log as a file (platform.notifications, docs/notifications.md), as GET /api/v1/platform/notification-log/export: tab notices, broadcasts or emails with the same filters as list_platform_notification_log (at most 10,000 rows), or send (a notice id) for that notice's recipients. format csv (default) or xlsx. Returns filename, mime, size and the file as base64.

Argument	Type	Description
`tab`	string notices \| broadcasts \| emails
`format`	string csv \| xlsx
`send`	integer
`from`	string
`to`	string
`company`	integer
`category`	string
`channel`	string
`status`	string
`kind`	string
`q`	string

get_ai_settings read only The platform AI provider, model and on/off switch (docs/ai.md), and whether a key is saved. The key...

The platform AI provider, model and on/off switch (docs/ai.md), and whether a key is saved. The key itself is never returned.

No arguments.

get_app_debug_report read only One phone diagnostics report in full (docs/mobile-debug.md): the phone's state (version, server, acc...

One phone diagnostics report in full (docs/mobile-debug.md): the phone's state (version, server, account, permissions, push, location and camera permission, offline drafts, clock skew, certificate pins) and its recent requests (method, path, status, time) and errors. Redacted: no tokens, passwords, bodies, photos, face data or coordinates.

Argument	Type	Description
`id`required	integer	The report id.

get_app_person_activity read only One person's phones with the Mihnaro app and their sign-in activity (docs/platform-control.md "Phone...

One person's phones with the Mihnaro app and their sign-in activity (docs/platform-control.md "Phone activity"): each phone as in list_app_phones (version, state, push, first and last IP with the local GeoIP place) with its latest 30 events, and other_activity: events not tied to a known phone (sign-ins from an app too old to send its device id). user_id is required. Needs platform.app_control. Plus map_points, the events map (docs/platform-control.md «خريطة الأحداث»): [{type clock_in|clock_out|field_photo|sign_in|sign_in_failed|sign_out|app_open|other, event, at, lat, lng, approximate (true = a city from the local GeoIP for the event's IP), accuracy, place, event_id (its timeline row), install_id}], newest first; GPS points (punches, Field proof photos) only with the location permission (map_gps). Event GPS (docs/platform-control.md «موقع الأحداث»): every event row has has_gps (whether the app sent its own GPS point with it: sign_in, app_open, version_changed); with the location permission (platform.phones.location, or live_location.view in scope) the row also carries location {lat, lng, accuracy, at, source app_event, mocked}. Without it only the IP place shows, which is approximate (a city). map_points now also include live-location pings (type live) and the app's own GPS with events; each point has source punch|live|field|app_event|ip (ip = approximate, from the IP); map_gps_hidden = GPS points exist that this viewer may not see.

Argument	Type	Description
`user_id`required	integer

get_app_person_context read only A person's phone details from the Mihnaro app across companies (platform.app_control, docs/platform-...

A person's phone details from the Mihnaro app across companies (platform.app_control, docs/platform-control.md «بيانات الهاتف»): phones with location_state and the latest of each category (device, network, battery, permissions, security, time, locale, health), and the history [{at, trigger open|resume|sign_in|punch, category, data}]. Filters: install_id, category, limit. Same API: GET /api/v1/platform/app-fleet/people/{id}/context.

Argument	Type	Description
`user_id`required	integer
`install_id`	integer
`category`	string device \| network \| battery \| permissions \| security \| time \| locale \| health
`limit`	integer

get_app_releases read only The mobile app release rules (docs/platform-control.md): per platform (android, ios) the latest and...

The mobile app release rules (docs/platform-control.md): per platform (android, ios) the latest and minimum version, the version actually required (the latest when update_mode is force), the store link and message; plus each company's own rule (stricter or exempt), the versions a minimum can be picked from (known_versions), and each store's last check (store_checks; the latest version is read from the stores, never typed). Pass platform and version to see what that version would get: ok, suggest or force; add company_id for that company's rule.

Argument	Type	Description
`platform`	string android \| ios
`version`	string
`company_id`	integer

get_app_update_impact read only Before forcing a mobile app update (docs/platform-control.md): how many signed-in phones and people...

Before forcing a mobile app update (docs/platform-control.md): how many signed-in phones and people would get the update screen (426) if the platform required this version, against how many are blocked today. Without version: forcing today's latest version. Company rules (stricter, exempt) still apply; phones that never reported their version are counted as unknown, not blocked.

Argument	Type	Description
`platform`required	string android \| ios
`version`	string

get_backup_connect_link changes data A link for the admin to open in a browser signed in to the panel, to connect a Google Drive, OneDriv...

A link for the admin to open in a browser signed in to the panel, to connect a Google Drive, OneDrive or Dropbox destination to his own account (docs/backups.md). The sign-in happens on the service. It lasts 15 minutes. The link holds no secret.

Argument	Type	Description
`destination_id`required	integer

get_backup_run read only One backup in full (docs/backups.md): its parts and checksums, each copy, the row count of every tab...

One backup in full (docs/backups.md): its parts and checksums, each copy, the row count of every table, and its restore tests.

Argument	Type	Description
`run_id`required	integer

get_backup_status read only The automatic backups now (docs/backups.md): settings, next run, problems, the 3-2-1-1-0 checks, RPO...

The automatic backups now (docs/backups.md): settings, next run, problems, the 3-2-1-1-0 checks, RPO and measured RTO, last good backup, last restore test, and destinations. Never holds a secret.

No arguments.

get_broadcast_preview read only Before a platform broadcast (docs/platform-control.md): how many people the audience reaches, how ma...

Before a platform broadcast (docs/platform-control.md): how many people the audience reaches, how many have the mobile app (and how many working phones), how many have an email, and push status (enabled, fcm.configured, apns.configured: sent straight to Google and Apple). company_ids empty = every company; roles (owners, hr, employees) empty = everyone; user_ids, branch_ids, install_ids, platform, version_state and version narrow it to those people, branches and phones.

Argument	Type	Description
`company_ids`	array
`roles`	array
`user_ids`	array
`branch_ids`	array
`install_ids`	array
`platform`	string android \| ios
`version_state`	string below_min \| outdated \| latest \| newer \| store_unknown \| unknown
`version`	string

get_calculator_country read only One country's calculator rules in force (per variant): every rule's value, its source (law, article,...

Argument	Type	Description
`country`required	string	ISO code ("JO") or the site's address part ("jordan").

get_calculator_rates read only Read a country's rates in force for mihnaro.com's free HR calculators (country ISO code, default IQ;...

Read a country's rates in force for mihnaro.com's free HR calculators (country ISO code, default IQ; variant when it has more than one): social security, income tax brackets and allowances, overtime rates, salary divisors and end of service. Sources and verified marks: get_calculator_rule_set.

Argument	Type	Description
`country`	string	ISO code; default IQ.
`variant`	string

get_calculator_rule_set read only One calculator rule set with its rules, each rule source (law en/ar, article, url, as_of, verified,...

One calculator rule set with its rules, each rule source (law en/ar, article, url, as_of, verified, verified_by, verified_at, note) and its change history. Same as GET /api/v1/platform/calculator-rule-sets/{id}.

Argument	Type	Description
`id`required	integer

get_company read only Get one company with its current license, full license history, branches and owners.

Get one company with its current license, full license history, branches and owners.

Argument	Type	Description
`company_id`required	integer	The company id.

get_contact_settings read only The contact page settings: form topics (interests, each with the team that gets its email: sales, su...

The contact page settings: form topics (interests, each with the team that gets its email: sales, support or hello), company sizes, recipients per team, default phone country, auto-reply template, search-engine title/description, Turnstile and Google Maps keys. The Turnstile secret is never returned (has_turnstile_secret says whether it is set).

No arguments.
get_domains read only Mihnaro's six domains (marketing, app, admin, api, help, demo) with each one's address, and the live...

Mihnaro's six domains (marketing, app, admin, api, help, demo) with each one's address, and the live demo's state: enabled, ready, when it was last rebuilt and its nightly reset time.

No arguments.
get_flash_messages read only How the web app shows its save, edit, delete and error messages, for everyone (docs/flash-messages.m...

How the web app shows its save, edit, delete and error messages, for everyone (docs/flash-messages.md): position (top-center, top-start, top-end, center, bottom), duration_seconds (2 to 30), auto_close. Errors stay until closed whatever is set. last_change {by, at} is null while it is the default.

No arguments.

get_lead read only One contact-form message with its sender, topic, status, notes, assignee and whether the emails went...

One contact-form message with its sender, topic, status, notes, assignee and whether the emails went out (mail_error says why not). Archived messages too (archived: true).

Argument	Type	Description
`lead_id`required	integer

get_login_designs read only List the sign-in page designs (classic, illustration, minimal, command, card), which one the app, ad...

List the sign-in page designs (classic, illustration, minimal, command, card), which one the app, admin and demo use, each design's editable fields, saved values and what it shows in English and Arabic, and the built-in illustrations. Same as GET /api/v1/platform/login-designs.

No arguments.
get_mail_health read only Is email going anywhere (docs/mail.md): status ok | failing | not_delivering, the sending method (dr...

Is email going anywhere (docs/mail.md): status ok | failing | not_delivering, the sending method (driver "log" and "disabled" deliver nothing), a plain message, counts for the last 24 hours (sent, logged, queued, failed), how many wait in the queue, and the last failure. "sent" means handed to the SMTP server, not proof of reaching an inbox.

No arguments.
get_messaging_status read only Email and WhatsApp settings without secrets: driver, sender details, whether a password/token is sav...

Email and WhatsApp settings without secrets: driver, sender details, whether a password/token is saved, and whether each channel is ready to send reset links.

No arguments.
get_platform_appearance read only The theme customizer's platform default (layout, color, sidebar, topbar, topbarcolor, card, size, wi...

The theme customizer's platform default (layout, color, sidebar, topbar, topbarcolor, card, size, width, loader, mode) for every company and the admin panel, and every allowed value. Same as GET /api/v1/platform/appearance.

No arguments.
get_platform_limits read only Every limit at platform level (docs/limits.md): file sizes, counts and lengths, each with its defaul...

Every limit at platform level (docs/limits.md): file sizes, counts and lengths, each with its default, its allowed range, the value saved and the server's ceiling for files.

No arguments.
get_security_policy read only Read the security policy: lockout, password rules and expiry, reset links, sessions and "Remember me...

Read the security policy: lockout, password rules and expiry, reset links, sessions and "Remember me".

No arguments.
get_seo read only Read the SEO center: site-wide settings (verification tokens, analytics ids, consent, JSON-LD organi...

Read the SEO center: site-wide settings (verification tokens, analytics ids, consent, JSON-LD organization), every public page with its saved tags per language (key like "marketing.pricing" or "help.article"), and robots.txt per domain. Same as GET /api/v1/platform/seo.

No arguments.

get_server_history read only Server metrics over time (docs/server-monitor.md), as chart series: cpu, load1, memory, swap, disk (...

Server metrics over time (docs/server-monitor.md), as chart series: cpu, load1, memory, swap, disk (% of the fullest mount), disk_read/disk_write and net_rx/net_tx (bytes/s), db_connections, errors and db_timeouts (the most in one minute). range 24h = 5-minute points, 7d = hourly, 30d = 4-hourly. Kept 30 days.

Argument	Type	Description
`range`	string 24h \| 7d \| 30d	Default 24h.

get_server_overview read only The server right now (docs/server-monitor.md): CPU per core and load, RAM/swap, every disk (usage, i...

The server right now (docs/server-monitor.md): CPU per core and load, RAM/swap, every disk (usage, inodes, I/O), network, uptime, hardware, services (Nginx, PHP-FPM, PostgreSQL, Cloudflare Tunnel, cron), PostgreSQL connections/sizes/long queries/locks, Laravel errors and database connection timeouts, failed jobs, the ZenHR sync, biometric devices last seen, the newest backup, HTTPS/SSL of the public sites, whether email is delivered, push status (FCM and APNs configured yes/no; sent straight to Google and Apple), and alert_values (each alert metric now). Read-only. Pass section to get one part only.

Argument	Type	Description
`section`	string system \| services \| processes \| database \| app \| sites \| mail \| push \| alert_values	Only this part of the overview.

get_server_switch read only Whether the mobile app's hidden live/dev switch works now (docs/mobile-server-switch.md): on, until...

Whether the mobile app's hidden live/dev switch works now (docs/mobile-server-switch.md): on, until (when it turns itself off; null = only by hand), by and at (who changed it last and when). Off by default. While off, 15 taps do nothing, and a phone on dev goes back to the live server at its next open.

No arguments.
get_sign_in_options read only The sign-in screen switches for the mobile app and the web sign-in page (docs/platform-control.md):...

The sign-in screen switches for the mobile app and the web sign-in page (docs/platform-control.md): forgot_password, sso, privacy (true = shown). Off hides the link and the server refuses forgot-password and SSO with 403. The privacy switch only hides the sign-in link; Settings always keeps the privacy policy. last_change {by, at} is null while they are the defaults (all on).

No arguments.
get_site_settings read only Read mihnaro.com settings: site name, tagline, footer, colors, fonts, currency, emails, page titles,...

Read mihnaro.com settings: site name, tagline, footer, colors, fonts, currency, emails, page titles, menu and header button. Texts are {"en","ar"}.

No arguments.

get_zenhr_connection changes data A company's ZenHR connection: status, where its keys are kept, masked keys, branches and last succes...

A company's ZenHR connection: status, where its keys are kept, masked keys, branches and last success. Never returns a secret. Keys are typed by a person in the panel; no MCP tool takes them.

Argument	Type	Description
`company_id`required	integer

get_zenhr_health changes data The sync's state for a company: running, paused or idle, next run, last run, last success, failures,...

The sync's state for a company: running, paused or idle, next run, last run, last success, failures, open conflicts and alerts. Times carry the company's offset (Baghdad: +03:00). Read-only.

Argument	Type	Description
`company_id`required	integer

get_zenhr_payroll_compare changes data The last payroll comparison: ZenHR's figures against Mihnaro's engine, totals only.

The last payroll comparison: ZenHR's figures against Mihnaro's engine, totals only.

Argument	Type	Description
`company_id`required	integer

get_zenhr_run changes data One run: counts per type, progress while running, and the records it touched (table, reference, colu...

One run: counts per type, progress while running, and the records it touched (table, reference, column names; never values).

Argument	Type	Description
`company_id`required	integer
`run_id`required	integer
`action`	string inserted \| updated \| flagged
`per_page`	integer

get_zenhr_sync read only The ZenHR → Mihnaro sync of a company (until the move is final): whether it is on, whether ZenHR's A...

The ZenHR → Mihnaro sync of a company (until the move is final): whether it is on, whether ZenHR's API is configured, its ZenHR branches, open flagged rows and the last 10 runs with counts per area (inserted, updated, unchanged, skipped, flagged). Counts only, never employee data.

Argument	Type	Description
`company_id`required	integer

get_zenhr_totals changes data ZenHR and Mihnaro totals per branch and list: records read through the API against the rows they bec...

ZenHR and Mihnaro totals per branch and list: records read through the API against the rows they became. Counts only.

Argument	Type	Description
`company_id`required	integer

list_ai_models read only The models the chosen AI provider offers the saved key, read live from the provider (docs/ai.md). fr...

The models the chosen AI provider offers the saved key, read live from the provider (docs/ai.md). fresh: true skips the six-hour copy.

Argument	Type	Description
`fresh`	boolean

list_app_activity read only Phone activity (docs/platform-control.md "Phone activity"): what happened on phones with the Mihnaro...

Phone activity (docs/platform-control.md "Phone activity"): what happened on phones with the Mihnaro app, newest first. Each event has event (sign_in, sign_in_failed, sign_out, app_open, version_changed, push_registered, push_result, push_test, device_pending, device_approved, device_blocked, device_reset, device_mismatch), result (ok, failed, blocked), time, person, install_id, device_id, IP and place from the local GeoIP (country, city, ASN, organisation; approximate, never looked up outside), app version, system, model, who decided (actor) and detail (a failed sign-in's reason and half-hidden login, a version change's from/to, a push error; push_result and push_test also have push_reason, the answer in plain words). Filters: user_id, install_id (a phone from list_app_phones: its own timeline), device_id, event, result, from, to (dates); page, per_page (max 200). Needs platform.app_control. Event GPS (docs/platform-control.md «موقع الأحداث»): every event row has has_gps (whether the app sent its own GPS point with it: sign_in, app_open, version_changed); with the location permission (platform.phones.location, or live_location.view in scope) the row also carries location {lat, lng, accuracy, at, source app_event, mocked}. Without it only the IP place shows, which is approximate (a city).

Argument	Type	Description
`user_id`	integer
`install_id`	integer
`device_id`	string
`event`	string sign_in \| sign_in_failed \| sign_out \| app_open \| version_changed \| push_registered \| push_result \| push_test \| device_pending \| device_approved \| device_blocked \| device_reset \| device_mismatch \| shared_device_detected \| shared_device_blocked \| shared_device_allowed \| shared_device_revoked \| location_turned_off
`result`	string ok \| failed \| blocked
`from`	string
`to`	string
`page`	integer
`per_page`	integer

list_app_debug_reports read only Phone diagnostics (docs/mobile-debug.md): the accounts with the app's debug mode (on, until, by) and...

Phone diagnostics (docs/mobile-debug.md): the accounts with the app's debug mode (on, until, by) and the newest reports their phones sent (kept 14 days). Filters: user_id, install_id, build. Read one with get_app_debug_report.

Argument	Type	Description
`user_id`	integer	Only this account's reports.
`install_id`	string	Only this phone's reports.
`build`	string	Only this build number.

list_app_phones read only Phones and versions (docs/platform-control.md): every phone the Mihnaro app is signed in on, with it...

Phones and versions (docs/platform-control.md): every phone the Mihnaro app is signed in on, with its person, companies, branches, platform, system version, model, app version and build, state (below_min = refused with 426, outdated, latest, newer = above the store's latest (a test build), store_unknown = the store's latest isn't known yet, unknown = an old app before 1.1 that never reported its version), the last GPS location (location: the newest punch, live-location ping or Field proof point from that phone; only with platform.phones.location), push status (active, failing, none; last accepted/failed and the provider's error) and first/last seen; plus the summary per platform (people per version, below the minimum, people who never opened the latest version, % on the latest). Filters: q, company_id, branch_id, platform, version, state, push, signed_in, seen_days, shared (only phones used by more than one account; each row has shared {accounts, others, list} when it is); page, per_page (max 200).

Argument	Type	Description
`q`	string
`company_id`	integer
`branch_id`	integer
`platform`	string android \| ios
`version`	string
`state`	string below_min \| outdated \| latest \| newer \| store_unknown \| unknown
`push`	string active \| failing \| none
`signed_in`	boolean
`shared`	boolean
`seen_days`	integer
`page`	integer
`per_page`	integer

list_backup_restore_tests read only The restore tests, newest first (docs/backups.md): result, where the copy came from, tables, rows an...

The restore tests, newest first (docs/backups.md): result, where the copy came from, tables, rows and files compared, how long it took, and any counts that did not match.

Argument	Type	Description
`limit`	integer	How many, 1 to 100. Default 25.

list_backup_runs read only The backup history, newest first (docs/backups.md): status, size, duration, checksums, copies at eac...

The backup history, newest first (docs/backups.md): status, size, duration, checksums, copies at each destination, and any error.

Argument	Type	Description
`limit`	integer	How many, 1 to 100. Default 25.

list_branches read only List a company's branches with country, currency, timezone, main/active flags and logo URLs, plus ho...

List a company's branches with country, currency, timezone, main/active flags and logo URLs, plus how many more the license allows.

Argument	Type	Description
`company_id`required	integer

list_broadcasts read only Platform broadcasts (docs/platform-control.md), newest first, with who sent them and counts per resu...

Platform broadcasts (docs/platform-control.md), newest first, with who sent them and counts per result: push accepted (Google FCM or Apple APNs took it for delivery, sent directly with no relay; not proof it was shown) | failed | no_device | not_configured (the provider of that phone has no credentials yet) | disabled (push switched off) | sent_to_expo (older sends through Expo), receipts pending | ok | error (only on older Expo sends), email sent | logged (not delivered) | queued | skipped | off (mail switched off) | failed | no_email. Pass id for one with up to 200 of its people (result filters by push result).

Argument	Type	Description
`id`	integer
`result`	string accepted \| failed \| no_device \| not_configured \| disabled \| sent_to_expo

list_calculator_countries read only The countries mihnaro.com's free HR calculators have rules for: each with the tools it can run, its...

The countries mihnaro.com's free HR calculators have rules for: each with the tools it can run, its variants (e.g. nationals and expatriates), currency and how many of its rules are verified. A country not listed is "not available yet". Same as GET /api/v1/tools/countries.

No arguments.

list_calculator_rule_sets read only Every calculator rule set of mihnaro.com (docs/calculators.md), filtered by country (ISO) and status...

Every calculator rule set of mihnaro.com (docs/calculators.md), filtered by country (ISO) and status (draft|published): id, country, variant, effective_from, status, in_force, tools available, verified coverage, rules and sources. Same as GET /api/v1/platform/calculator-rule-sets.

Argument	Type	Description
`country`	string	ISO code.
`status`	string draft \| published

list_companies read only List customer companies with their current license status, modules, limits and owners. Search by nam...

List customer companies with their current license status, modules, limits and owners. Search by name or slug, filter by status.

Argument	Type	Description
`search`	string	Part of the company name (English or Arabic) or slug.
`status`	string active \| suspended	Only companies with this status.
`page`	integer	Page number, 25 companies per page. Default 1.

list_company_users read only List a company's accounts a page at a time, as the admin panel's table does: search by name or email...

List a company's accounts a page at a time, as the admin panel's table does: search by name or email, filter by role (admin, user) and status (active, temporary, disabled), sort (name, email, role, status, joined).

Argument	Type	Description
`company_id`required	integer
`q`	string	Part of a name or email.
`role`	string admin \| user
`status`	string active \| temporary \| disabled
`sort`	string name \| email \| role \| status \| joined
`dir`	string asc \| desc
`per_page`	integer 10 \| 25 \| 50 \| 100
`page`	integer

list_deleted_companies read only The deleted companies still restorable: when and why each was deleted, whether it was forced, its ba...

The deleted companies still restorable: when and why each was deleted, whether it was forced, its backup file and the date it is removed for good. Needs platform.companies.

No arguments.

list_hr_calculators read only The free HR calculators of mihnaro.com for a country (ISO code, default IQ): each tool with whether...

Argument	Type	Description
`country`	string	ISO country code, e.g. "AE". Default IQ.
`variant`	string
`date`	string	Y-m-d; default today.

list_leads read only List messages from the mihnaro.com contact form (the admin Inbox), newest first. Filter by status (n...

List messages from the mihnaro.com contact form (the admin Inbox), newest first. Filter by status (new, contacted, closed), interest key, assigned_to (admin user id) or q (name, email, company, phone). Archived messages are left out; archived: true lists only them.

Argument	Type	Description
`status`	string new \| contacted \| closed
`interest`	string
`assigned_to`	integer
`q`	string
`archived`	boolean	true: only archived messages.
`page`	integer
`per_page`	integer

list_mail_deliveries read only Emails the app handed to a mailer, newest first (docs/mail.md): recipient, subject, company, via (sm...

Emails the app handed to a mailer, newest first (docs/mail.md): recipient, subject, company, via (smtp, company_smtp, log), status (sent, logged, queued, failed), attempts and the error in plain words. Filter by status or search an address/subject. Kept 90 days.

Argument	Type	Description
`status`	string sent \| logged \| queued \| failed
`q`	string	Part of the recipient address or the subject.
`limit`	integer	1-100, default 30.

list_monitor_alert_events read only The server alerts log, newest first (docs/server-monitor.md): fired, repeat (still lasting after the...

The server alerts log, newest first (docs/server-monitor.md): fired, repeat (still lasting after the cooldown) or recovered, the value and threshold, the message, the recipients and mail_result (sent, logged = written to the server log only and not delivered, queued, skipped, failed, no_recipients).

Argument	Type	Description
`kind`	string fired \| repeat \| recovered
`metric`	string cpu \| memory \| disk \| load \| db_connections \| db_timeouts \| errors \| failed_jobs \| service_down \| site_down \| ssl_days \| zenhr_sync_failed \| device_offline_hours \| backup_age_hours
`limit`	integer	1-100, default 30.

list_monitor_alert_rules read only Server alert rules (docs/server-monitor.md): metric, threshold (fires at_or_above, or at_or_below fo...

Server alert rules (docs/server-monitor.md): metric, threshold (fires at_or_above, or at_or_below for ssl_days), for_minutes it must last, cooldown_minutes between reminders, enabled, state ok|firing and the last value; plus the recipients and the alert language.

No arguments.
list_offices read only List Mihnaro's offices shown on the contact page (head office first), with addresses, phones, workin...

List Mihnaro's offices shown on the contact page (head office first), with addresses, phones, working hours and map coordinates. Hidden ones have is_visible false.

No arguments.
list_plans read only List the pricing plans on mihnaro.com in order, including hidden ones.

List the pricing plans on mihnaro.com in order, including hidden ones.

No arguments.

list_platform_admins read only List the Mihnaro team's platform admins with their platform permissions and status (temporary passwo...

List the Mihnaro team's platform admins with their platform permissions and status (temporary password, two-step). Filter by search (name or email) or one permission. Also returns every permission there is and what it allows. Needs platform.admins.

Argument	Type	Description
`search`	string
`permission`	string platform.ai \| server.monitor \| platform.app_control \| platform.broadcast \| platform.companies \| platform.phones.location \| platform.admins \| platform.notifications \| platform.zenhr \| platform.flash_messages \| platform.server_switch \| platform.app_debug \| platform.backups \| platform.backups_change \| platform.backups_run

list_platform_notification_log read only The platform notifications log (platform.notifications, docs/notifications.md "سجل إشعارات المنصة"),...

The platform notifications log (platform.notifications, docs/notifications.md "سجل إشعارات المنصة"), as GET /api/v1/platform/notification-log. tab notices (default): every company's notices with category, event, text en/ar, company, triggered_by, recipients, bell read counts and per channel (push, email, whatsapp) each status count (logged = written to the server log only, NOT delivered), plus summary; filters from, to, company, category, channel, status, kind, q. tab broadcasts: the Mihnaro team's push broadcasts with their results; filters from, to, q. tab emails: system emails that are not notice copies (password resets, invitations, codes, reports) from the mail log; filters from, to, company, status (sent, logged, queued, failed), q. Also returns channels: whether email, push and WhatsApp can deliver right now.

Argument	Type	Description
`tab`	string notices \| broadcasts \| emails
`from`	string
`to`	string
`company`	integer
`category`	string
`channel`	string bell \| push \| email \| whatsapp
`status`	string
`kind`	string
`q`	string
`page`	integer
`limit`	integer	1-100, default 30.

list_sections read only List the sections of a mihnaro.com page in order, with their content. Also returns the section types...

List the sections of a mihnaro.com page in order, with their content. Also returns the section types and their fields.

Argument	Type	Description
`page`required	string home \| pricing \| contact \| tools \| end-of-service \| net-salary \| gross-salary \| overtime \| leave \| cost-to-company \| salary-guide \| privacy \| terms \| account-deletion

list_support_sessions read only The support audit trail of a company: every time a platform admin opened its account, with the reaso...

The support audit trail of a company: every time a platform admin opened its account, with the reason, times, state and how it ended. Newest first.

Argument	Type	Description
`company_id`required	integer

list_system_announcements read only System announcements from the Mihnaro team (docs/platform-control.md), newest first, optionally by s...

System announcements from the Mihnaro team (docs/platform-control.md), newest first, optionally by state (live, scheduled, ended, off). Pass id for one with its stats: audience (people it is meant for now), seen, dismissed, acknowledged.

Argument	Type	Description
`id`	integer
`state`	string live \| scheduled \| ended \| off

list_zenhr_audit changes data The sync's audit log: who changed what, when and from where. Secrets are never recorded.

The sync's audit log: who changed what, when and from where. Secrets are never recorded.

Argument	Type	Description
`company_id`required	integer
`action`	string
`per_page`	integer

list_zenhr_data_types changes data What moves: each data type with on/off, how often, starting point, how it arrives, and what the code...

What moves: each data type with on/off, how often, starting point, how it arrives, and what the code cannot do. With branch_id: that branch's values.

Argument	Type	Description
`company_id`required	integer
`branch_id`	integer

list_zenhr_runs changes data The company's run history, newest first: who started each, its counts, duration and errors in plain...

The company's run history, newest first: who started each, its counts, duration and errors in plain words. Paused hours are left out unless status=off.

Argument	Type	Description
`company_id`required	integer
`status`	string
`trigger`	string
`per_page`	integer

list_zenhr_sync_conflicts read only Rows the ZenHR sync flagged instead of overwriting: changed in ZenHR and also edited in Mihnaro (rea...

Rows the ZenHR sync flagged instead of overwriting: changed in ZenHR and also edited in Mihnaro (reason "edited"), or imported before the baseline (reason "no_baseline"). Gives the table, row id, external_ref and the column names involved, not their values.

Argument	Type	Description
`company_id`required	integer
`status`	string open \| applied \| kept \| all
`limit`	integer
`offset`	integer

move_section changes data Move a page section one place up or down. Returns the sections of the page in their new order.

Move a page section one place up or down. Returns the sections of the page in their new order.

Argument	Type	Description
`section_id`required	integer
`direction`required	string up \| down

phone_sharing_default changes data One account per phone, the platform default (platform.app_control, docs/platform-control.md «الهاتف...

One account per phone, the platform default (platform.app_control, docs/platform-control.md «الهاتف المشترك»): what every company has until it sets its own in Mobile app rules. action get: mode, max_accounts, who changed it last, and the companies with their own setting. action set: mode allow (only marked as shared) | warn (sign-in goes through, the phone is flagged, the company is notified) | block (the sign-in is refused with a message to ask HR), max_accounts 1–10. Demo and store-reviewer accounts are never stopped. Shared phones themselves: list_app_phones with shared=true.

Argument	Type	Description
`action`required	string get \| set
`mode`	string allow \| warn \| block
`max_accounts`	integer

publish_calculator_rule_set changes data Publish a draft calculator rule set (action publish; from its effective_from it is the set in force)...

Publish a draft calculator rule set (action publish; from its effective_from it is the set in force) or take one off the site (action unpublish). Same as POST /api/v1/platform/calculator-rule-sets/{id}/publish and /unpublish.

Argument	Type	Description
`id`required	integer
`action`	string publish \| unpublish

remove_platform_admin changes data Remove a platform admin's access: no admin panel, no permissions, their platform API keys revoked an...

Remove a platform admin's access: no admin panel, no permissions, their platform API keys revoked and their sessions ended. The account stays; create_platform_admin with the same email gives it back. The last admin with platform.admins can't be removed. Needs platform.admins.

Argument	Type	Description
`admin_id`required	integer

reset_company_user_password can delete Replace a company user's password with a new temporary one they must change at next sign-in. The old...

Replace a company user's password with a new temporary one they must change at next sign-in. The old password stops working immediately. Returns the temporary password once.

Argument	Type	Description
`company_id`required	integer
`user_id`required	integer	A user of that company (see get_company owners).

reset_demo can delete Rebuild the live demo's sandbox company (demo.mihnaro.com) now with fresh fictional data, instead of...

Rebuild the live demo's sandbox company (demo.mihnaro.com) now with fresh fictional data, instead of at the nightly reset. Visitors inside it are signed out.

No arguments.

reset_user_two_factor can delete Turn off a company user's two-step verification (lost phone), so they set it up again. Their recover...

Turn off a company user's two-step verification (lost phone), so they set it up again. Their recovery codes stop working.

Argument	Type	Description
`company_id`required	integer
`user_id`required	integer

resolve_zenhr_sync_conflict can delete Settle a row the ZenHR sync flagged: "apply" writes ZenHR's values over the Mihnaro edit; "keep" lea...

Settle a row the ZenHR sync flagged: "apply" writes ZenHR's values over the Mihnaro edit; "keep" leaves Mihnaro's row and stops flagging the same ZenHR values (a later ZenHR change is flagged again).

Argument	Type	Description
`company_id`required	integer
`conflict_id`required	integer
`action`required	string apply \| keep

restore_calculator_rule_set changes data Put a calculator rule set back to how one of its history entries (revision_id, from get_calculator_r...

Put a calculator rule set back to how one of its history entries (revision_id, from get_calculator_rule_set) left it; the restore is itself kept in the history. Same as POST /api/v1/platform/calculator-rule-sets/{id}/restore/{revision}.

Argument	Type	Description
`id`required	integer
`revision_id`required	integer

restore_company changes data Restore a deleted company within its restore window: it shows again and its people can sign in. Need...

Restore a deleted company within its restore window: it shows again and its people can sign in. Needs platform.companies.

Argument	Type	Description
`company_id`required	integer

resume_zenhr_run changes data Starts a new run with what a stopped or failed run was given. What it finished is not done twice.

Starts a new run with what a stopped or failed run was given. What it finished is not done twice.

Argument	Type	Description
`company_id`required	integer
`run_id`required	integer

retry_mail_delivery changes data Put one failed email (from list_mail_deliveries, retryable true) back in the queue; it goes out with...

Put one failed email (from list_mail_deliveries, retryable true) back in the queue; it goes out within a minute through the current settings. Only when the person asked to resend it.

Argument	Type	Description
`delivery_id`required	integer

run_backup changes data Start a backup now (docs/backups.md). It starts within a minute and never overlaps another; read get...

Start a backup now (docs/backups.md). It starts within a minute and never overlaps another; read get_backup_run for its result.

No arguments.

run_backup_restore_test changes data Restore one backup into a new throwaway database and compare its row counts (docs/backups.md). It st...

Restore one backup into a new throwaway database and compare its row counts (docs/backups.md). It starts within a minute. It never touches a real database; there is no tool that does.

Argument	Type	Description
`run_id`required	integer

run_zenhr_payroll_compare changes data Queues a payroll comparison of the last months: recalculated and rolled back, so it changes nothing....

Queues a payroll comparison of the last months: recalculated and rolled back, so it changes nothing. Takes the sync's lock.

Argument	Type	Description
`company_id`required	integer
`months`	integer

run_zenhr_sync changes data Queue a ZenHR → Mihnaro sync run: one at a time, refused while another runs. source "api" reads what...

Queue a ZenHR → Mihnaro sync run: one at a time, refused while another runs. source "api" reads what changed through ZenHR's API; "extraction" applies a new extraction. dry_run rolls everything back and only reports counts: do it first. data_types (list_zenhr_data_types), branch_ids and since (a date, API only, not for attendance) narrow it. Follow it with get_zenhr_run.

Argument	Type	Description
`company_id`required	integer
`source`	string api \| extraction
`dry_run`	boolean
`data_types`	array
`branch_ids`	array
`since`	string	YYYY-MM-DD

save_company_branch changes data Add a branch to a company (no branch_id; within the license's branch limit) or edit one: names, code...

Add a branch to a company (no branch_id; within the license's branch limit) or edit one: names, code, legal name, country, currency, timezone, city, active, main (is_main: true makes it the main branch) and the governmental details. Logos are uploaded through the API. Needs platform.companies.

Argument	Type	Description
`company_id`required	integer
`branch_id`	integer	Leave out to add a new branch.
`name`	object	Required for a new branch.
`legal_name`	object
`code`	string
`country`	string	ISO code, e.g. IQ. Sets the currency and timezone unless they are given.
`currency`	string	ISO code, e.g. IQD
`timezone`	string	e.g. Asia/Baghdad
`city`	string
`is_active`	boolean	The main branch stays on.
`is_main`	boolean	true makes it the main branch.
`establishment_number`	string
`establishment_name`	string
`governance_location`	string
`ss_number`	string
`ss_governance_location`	string
`tax_number`	string
`address`	string
`po_box`	string
`zip_code`	string
`mol_number`	string

save_office changes data Add an office (no office_id; name.en required) or change one (office_id; only the fields given chang...

Add an office (no office_id; name.en required) or change one (office_id; only the fields given change). Texts are {"en","ar"}; address lines are separated by new lines. phones: list of international numbers. hours: [{"days": ["sun","mon",...], "opens": "09:00", "closes": "17:00"}]. latitude/longitude in decimal degrees. is_primary makes it the head office.

Argument	Type	Description
`office_id`	integer	Omit to add a new office.
`name`	object
`address`	object
`city`	object
`country`	object
`country_code`	string
`postal_code`	string
`phones`	array
`whatsapp`	string
`email`	string
`hours`	array
`hours_note`	object
`timezone`	string
`latitude`	number
`longitude`	number
`map_zoom`	integer
`is_primary`	boolean
`is_visible`	boolean

save_plan changes data Create a plan (no plan_id) or update one (with plan_id; only fields given change). A null price show...

Create a plan (no plan_id) or update one (with plan_id; only fields given change). A null price shows as "Coming soon".

Argument	Type	Description
`plan_id`	integer	Omit to create a plan.
`slug`	string	Required when creating, e.g. "hrm".
`name`	object	{"en": "...", "ar": "..."}; en required when creating.
`summary`	object
`unit`	object	e.g. {"en": "per employee / month"}
`price_monthly`	number
`price_yearly`	number	Monthly price when billed yearly.
`features`	object	{"en": ["...", "..."], "ar": [...]}
`is_featured`	boolean
`is_active`	boolean	false hides it from the site.

save_section changes data Add a section to a page (page + type, no section_id; added at the end) or replace the content of a s...

Add a section to a page (page + type, no section_id; added at the end) or replace the content of a section (section_id). Content follows the fields of its type from list_sections; texts are {"en","ar"}, repeated items go in "items".

Argument	Type	Description
`section_id`	integer	Omit to add a new section.
`page`	string home \| pricing \| contact \| tools \| end-of-service \| net-salary \| gross-salary \| overtime \| leave \| cost-to-company \| salary-guide \| privacy \| terms \| account-deletion	Required when adding.
`type`	string hero \| modules \| features \| plans_preview \| plans \| faq \| cta \| page_header \| contact \| contact_form \| offices \| social \| calculator \| tools_grid \| salary_guide \| text	Required when adding.
`content`required	object	The fields of the section.
`is_visible`	boolean

save_system_announcement changes data Create a system announcement shown after sign-in (docs/platform-control.md), or change one by id (on...

Create a system announcement shown after sign-in (docs/platform-control.md), or change one by id (only what is passed changes; is_active false withdraws it). New ones need title_en, title_ar, body_en, body_ar, severity (info|warning|critical), starts_at, channel (web|app|both) and display (dismissible|acknowledge). ends_at optional. company_ids empty = every company; roles (owners, hr, employees) empty = everyone.

Argument	Type	Description
`id`	integer
`title_en`	string
`title_ar`	string
`body_en`	string
`body_ar`	string
`severity`	string info \| warning \| critical
`starts_at`	string
`ends_at`	string
`company_ids`	array
`roles`	array
`channel`	string web \| app \| both
`display`	string dismissible \| acknowledge
`is_active`	boolean
`existing_only`	boolean	Only accounts made before it starts: for news about a change, so a new employee doesn't see it.

send_app_update_reminder changes data "Please update" (docs/platform-control.md): a push to the people whose phone on this platform runs a...

"Please update" (docs/platform-control.md): a push to the people whose phone on this platform runs an older version than the latest (version_state outdated, the default) or one below the minimum (below_min), linking to the store, with the release's update message (or a default text). Needs platform.app_control and platform.broadcast. Goes out in the background; follow it with list_broadcasts.

Argument	Type	Description
`platform`required	string android \| ios
`version_state`	string outdated \| below_min

send_broadcast changes data Send a push notification (and optionally an email) to every company or chosen ones (docs/platform-co...

Send a push notification (and optionally an email) to every company or chosen ones (docs/platform-control.md). Check get_broadcast_preview first. Needs title_en, title_ar, body_en, body_ar; url (an app path starting with / or an https link, opened on tap) optional; push (default true), email (default false). Narrow it with user_ids, branch_ids, install_ids (phones from list_app_phones), platform, version_state (outdated, below_min, latest, unknown = an old app before 1.1 that never reported its version) or version (exact); scheduled_at (a future date and time) sends it later; test=true sends it now only to your own phones and email. Images are added from the admin panel or the API (an uploaded file). It goes out in the background in batches; follow it with list_broadcasts. "accepted" means Google (FCM) or Apple (APNs) took it for delivery, sent straight from the server; it is not proof the phone showed it. iPhones get nothing until APNs is configured (see get_server_overview push).

Argument	Type	Description
`title_en`required	string
`title_ar`required	string
`body_en`required	string
`body_ar`required	string
`url`	string
`push`	boolean
`email`	boolean
`scheduled_at`	string
`test`	boolean
`company_ids`	array
`roles`	array
`user_ids`	array
`branch_ids`	array
`install_ids`	array
`platform`	string android \| ios
`version_state`	string below_min \| outdated \| latest \| newer \| store_unknown \| unknown
`version`	string

send_phone_test_push changes data One test notification to one phone (docs/notifications.md «الإشعار التجريبي»): install_id from list_...

One test notification to one phone (docs/notifications.md «الإشعار التجريبي»): install_id from list_app_phones. Straight to Apple or Google, nothing in the bell, logged on the phone's timeline (push_test) with who sent it. Returns sent and, per token: provider, status (ok, invalid, error), error, environment (which of Apple's servers took it), fallback (the first server refused it) and reason in plain words. "ok" means accepted for delivery, not shown on screen. At most 5 a minute per phone. Needs platform.app_control.

Argument	Type	Description
`install_id`required	integer

send_test_email changes data Send one test email through the platform email settings saved in Admin → Security and messaging (doc...

Send one test email through the platform email settings saved in Admin → Security and messaging (docs/mail.md). A failure says why in plain words (wrong username or password, connection refused, encryption and port mismatch, sender refused…). result "sent" means the server accepted it (not that it reached the inbox); "logged" means it was only written to the server log. Only send when the person asked for a test.

Argument	Type	Description
`to`required	string

set_company_app_rule changes data One company's own mobile app update rule (docs/platform-control.md). mode stricter: its people need...

One company's own mobile app update rule (docs/platform-control.md). mode stricter: its people need at least min_android / min_ios (or the platform minimum if higher); exempt: they are never blocked for an old version; none: remove the rule.

Argument	Type	Description
`company_id`required	integer
`mode`required	string stricter \| exempt \| none
`min_android`	string
`min_ios`	string
`note`	string

set_company_user_access changes data Switch a company account on or off (is_active) and make it a company admin or not (is_owner). The co...

Switch a company account on or off (is_active) and make it a company admin or not (is_owner). The company always keeps one active company admin; a platform admin can't be one. Logged. Needs platform.companies.

Argument	Type	Description
`company_id`required	integer
`user_id`required	integer
`is_active`	boolean
`is_owner`	boolean

set_monitor_alert_recipients changes data Who receives server alerts (docs/server-monitor.md): the full list of addresses (replaces the saved...

Who receives server alerts (docs/server-monitor.md): the full list of addresses (replaces the saved one; an empty list stops alert emails) and the language, en or ar. Only addresses the person gave. While email is in log mode nothing is delivered (see get_mail_health).

Argument	Type	Description
`recipients`required	array
`language`	string en \| ar

set_zenhr_emergency_stop changes data The emergency stop: on stops every company's sync at once, a run in progress included; off lifts it.

The emergency stop: on stops every company's sync at once, a run in progress included; off lifts it.

Argument	Type	Description
`on`required	boolean

show_platform_notification_log read only One company notice of the platform notifications log in full (platform.notifications, docs/notificat...

One company notice of the platform notifications log in full (platform.notifications, docs/notifications.md), as GET /api/v1/platform/notification-log/{id}: the send, every person with branch, bell (read and when), push (per phone what Google/Apple answered), email (status, mail log row with via, attempts and error) and WhatsApp, and the receiver emails.

Argument	Type	Description
`id`required	integer

start_support_session changes data Open a support session in a company as the signed-in platform admin. Returns a one-time entry_url (v...

Open a support session in a company as the signed-in platform admin. Returns a one-time entry_url (valid 2 minutes) that signs the admin into the company's account in a browser. Give the link only to that admin. A reason is required and is kept in the audit trail.

Argument	Type	Description
`company_id`required	integer
`reason`required	string	Why support is entering, e.g. a ticket number (5-500 characters).

stop_zenhr_run changes data Stops a queued or running run. A running one stops at its next safe place; what finished stays.

Stops a queued or running run. A running one stops at its next safe place; what finished stays.

Argument	Type	Description
`company_id`required	integer
`run_id`required	integer

submit_contact_lead changes data Add a message to the Inbox as if sent from the contact form (e.g. a lead taken by phone), and email...

Add a message to the Inbox as if sent from the contact form (e.g. a lead taken by phone), and email the team that handles its topic. interest is a key from get_contact_settings; phone_country an ISO code (IQ by default); consent must be true.

Argument	Type	Description
`name`required	string
`email`required	string
`interest`required	string
`message`required	string
`consent`required	boolean
`company`	string
`phone_country`	string
`phone`	string
`company_size`	string
`preferred_contact`	string email \| phone \| whatsapp
`locale`	string en \| ar	The language of the auto-reply.

suspend_license changes data Suspend a license (suspended: true) or reactivate it (false). A suspended license does not count: th...

Suspend a license (suspended: true) or reactivate it (false). A suspended license does not count: the license before it applies again, or with none the company's users can't sign in. Needs platform.companies.

Argument	Type	Description
`company_id`required	integer
`license_id`required	integer
`suspended`required	boolean

switch_zenhr_branch changes data Pauses or resumes one branch's sync.

Pauses or resumes one branch's sync.

Argument	Type	Description
`company_id`required	integer
`branch_id`required	integer
`enabled`required	boolean

switch_zenhr_sync changes data Turn a company's ZenHR → Mihnaro sync on or off. Turn it off when employees have moved to Mihnaro fo...

Turn a company's ZenHR → Mihnaro sync on or off. Turn it off when employees have moved to Mihnaro for good. It also needs ZENHR_SYNC_ENABLED=true on the server to run.

Argument	Type	Description
`company_id`required	integer
`enabled`required	boolean

sync_app_stores changes data Read the app's latest version from the App Store (Apple's public lookup) and Google Play (the Play D...

Read the app's latest version from the App Store (Apple's public lookup) and Google Play (the Play Developer API when PLAY_SERVICE_ACCOUNT is configured, otherwise the public Play listing) now, as the hourly check does (docs/platform-control.md). Returns each check (ok, failed or not_configured) and the releases.

No arguments.

test_backup_destination changes data Writes, reads and removes a small file at a backup destination and says what it found (docs/backups....

Writes, reads and removes a small file at a backup destination and says what it found (docs/backups.md).

Argument	Type	Description
`destination_id`required	integer

test_zenhr_connection changes data Makes one real read call to ZenHR to see the connection works. Refused while a sync runs. Ask a pers...

Makes one real read call to ZenHR to see the connection works. Refused while a sync runs. Ask a person before calling it.

Argument	Type	Description
`company_id`required	integer

unlock_user changes data Lift the lock on a company user after too many failed sign-ins.

Lift the lock on a company user after too many failed sign-ins.

Argument	Type	Description
`company_id`required	integer
`user_id`required	integer

update_ai_settings changes data Change the platform AI provider, model or on/off switch (docs/ai.md). provider: anthropic, openai or...

Change the platform AI provider, model or on/off switch (docs/ai.md). provider: anthropic, openai or none. model: an id from list_ai_models, empty for the default. enabled: boolean. The key is only typed in the admin panel.

Argument	Type	Description
`provider`	string anthropic \| openai \| none
`model`	string
`enabled`	boolean

update_app_debug_account changes data Turn the app's debug mode on or off for one account (docs/mobile-debug.md). user_id or email; on (bo...

Turn the app's debug mode on or off for one account (docs/mobile-debug.md). user_id or email; on (boolean); hours (1–168, default 24; null = no end); send (true asks its phone for a report at its next open). The person sees a band on the phone while it is on. Recorded with your name and emailed to the other platform admins with platform.app_debug.

Argument	Type	Description
`user_id`	integer	The account.
`email`	string	The account, by email, instead of user_id.
`on`required	boolean	On or off.
`hours`	integer\|null	Hours until it turns itself off (1–168). Default 24; null for no end.
`send`	boolean	Ask the phone for a report at its next open.

update_app_release changes data Change the mobile app release rule for one platform (docs/platform-control.md): min_version (one of...

Change the mobile app release rule for one platform (docs/platform-control.md): min_version (one of known_versions from get_app_releases; phones older than it get 426 update_required; empty = no minimum), update_mode none|suggest|force (needs the store's latest version), message_en, message_ar, release_notes_en, release_notes_ar ("what's new", shown on the app's update screen). Only what is passed changes. latest_version and store_url are read from the stores (sync_app_stores) and are refused here.

Argument	Type	Description
`platform`required	string android \| ios
`min_version`	string	One of known_versions from get_app_releases.
`update_mode`	string none \| suggest \| force
`message_en`	string
`message_ar`	string
`release_notes_en`	string
`release_notes_ar`	string

update_backup_destination changes data Switch a backup destination on or off and change how many daily, weekly and monthly copies it keeps...

Switch a backup destination on or off and change how many daily, weekly and monthly copies it keeps (docs/backups.md). Refused for the only destination that is on. S3 and SFTP destinations and their keys are entered in the panel or the API, so secrets never pass through a chat.

Argument	Type	Description
`destination_id`required	integer
`enabled`	boolean
`keep_daily`	integer	1 to 365.
`keep_weekly`	integer	0 to 104.
`keep_monthly`	integer	0 to 120.

update_backup_settings changes data Change the backup schedule and what it includes (docs/backups.md). Only what is passed changes. The...

Change the backup schedule and what it includes (docs/backups.md). Only what is passed changes. The passphrase is not set here: it is typed in the panel. The other admins with platform.backups get an email.

Argument	Type	Description
`enabled`	boolean
`frequency`	string hours \| daily \| weekly
`every_hours`	integer	With frequency hours: 1, 2, 3, 4, 6, 8 or 12.
`time`	string	HH:MM in the chosen time zone.
`weekday`	integer	With frequency weekly: 0 is Sunday.
`timezone`	string	For example Asia/Baghdad.
`include_database`	boolean
`include_files`	boolean
`include_secrets`	boolean	.env and keys. Refused until a passphrase is set.
`restore_test`	string every_run \| daily \| weekly \| monthly \| off
`free_space_factor`	number	Free disk needed, as a multiple of the expected size.
`overdue_grace_hours`	integer
`job_timeout_minutes`	integer
`target_rto_minutes`	integer
`notify_success`	boolean

update_calculator_rates changes data Change a country's rates in force for mihnaro.com's free HR calculators (country ISO code, default I...

Change a country's rates in force for mihnaro.com's free HR calculators (country ISO code, default IQ; variant); only the keys given change, live immediately, kept in the history, and a changed rate loses its verified mark. For sources, versions and verifying use update_calculator_rule_set and verify_calculator_rules. Keys: ss_employee_percent, ss_employer_percent, ss_base gross|basic, ss_ceiling (0 = none), tax_period annual|monthly, tax_brackets [{min, max (null = no limit, last only), rate}], tax_exemption_single, tax_exemption_married, tax_allowances_exempt_percent, tax_ss_deductible, overtime_multiplier, rest_day_multiplier, holiday_multiplier, day_base, hours_per_day, eos_days_per_year, eos_min_years, currency_code (ISO).

Argument	Type	Description
`ss_employee_percent`	number
`ss_employer_percent`	number
`ss_base`	string gross \| basic
`ss_ceiling`	number
`tax_period`	string annual \| monthly
`tax_brackets`	array	[{"min": 0, "max": 250000, "rate": 3}, …]
`tax_exemption_single`	number
`tax_exemption_married`	number
`tax_allowances_exempt_percent`	number
`tax_ss_deductible`	boolean
`overtime_multiplier`	number
`rest_day_multiplier`	number
`holiday_multiplier`	number
`day_base`	number
`hours_per_day`	number
`eos_days_per_year`	number
`eos_min_years`	number
`currency_code`	string
`country`	string	ISO code; default IQ.
`variant`	string

update_calculator_rule_set changes data Change a calculator rule set; only what is given changes, each change is kept in its history. rules:...

Change a calculator rule set; only what is given changes, each change is kept in its history. rules: {key: value|null (null = not known yet)}; keys: currency_code, day_base, hours_per_day, work_days_per_week, annual_leave_days, overtime_multiplier, rest_day_multiplier, holiday_multiplier, ss_employee_percent, ss_employer_percent, ss_base gross|basic, ss_ceiling (monthly, 0 = none), ss_employee_brackets and ss_employer_brackets [{min, max, rate}] (monthly bands, override the percents), tax_period annual|monthly, tax_brackets [{min, max (null = no limit), rate}] ([] = no income tax), tax_exemption_single, tax_exemption_married, tax_allowances_exempt_percent, tax_ss_deductible, tax_round_down_to (taxable income rounded down to a multiple of it), tax_bracket_sets [{up_to, brackets}] (the scale chosen by total taxable income), tax_formula {round_down, zones: [{min, max, offset, divisor, a, b, c}]} ((a·t + b)·t + c, t = (x − offset) ÷ divisor), tax_expense_deduction {percent, min, max}, tax_credits [{label {en, ar}, kind credit|deduction, basis income|tax, rows [{from, to, base, rate}] (base + rate% × (x − from)), tax_on, max_income, marginal_relief, for single|married}], tax_surtaxes [{label, base tax|gross|taxable, rate, threshold, marginal_rate, exempt}], tax_household {single, married, children [parts], cap_per_half_part}, tax_cumulative (bool), tax_min_wage_exempt (monthly), tax_regions [{code, name {en, ar}, exemption, brackets or bracket_sets, credits, surtaxes, source {law, url, as_of, verified, note}}], tax_region_optional (bool) — amounts in tax_period units, eos_days_per_year, eos_min_years, eos_tiers [{from_year, to_year, days}], eos_cap_months, eos_resignation_tiers [{from_year, to_year, percent}]. sources: {key: {law: {en, ar}, article, url, as_of Y-m-d, note: {en, ar}, verified}}. Also notes {en, ar}, requires_confirmation [{rules: [keys or groups], reason {en, ar}, needed {en, ar}}] (what could not be confirmed from an official source; shown on the country page), allow_estimates (bool, default false: a calculator runs only when every rule it uses is verified; true lets this set run on estimates, marked so), variant_label, effective_from, position. A changed value loses its verified mark unless the same call verifies it. Same as PATCH /api/v1/platform/calculator-rule-sets/{id}.

Argument	Type	Description
`id`required	integer
`rules`	object
`sources`	object
`notes`	object
`allow_estimates`	boolean	Let this set's calculators run on rules not verified yet (results marked "estimate"). Off by default; every change is logged.
`requires_confirmation`	array	What is not confirmed yet: [{rules: [rule keys or group names], reason {en, ar}, needed {en, ar}}]; [] or null for none
`variant_label`	object
`effective_from`	string
`position`	integer

update_company changes data Change a company's details or status. Only the fields given change. Setting status to "suspended" bl...

Change a company's details or status. Only the fields given change. Setting status to "suspended" blocks sign-in for all its users; "active" restores it.

Argument	Type	Description
`company_id`required	integer
`name`	object	Company name; give one or both languages.
`slug`	string
`status`	string active \| suspended
`country`	string AD \| AE \| AF \| AG \| AI \| AL \| AM \| AO \| AQ \| AR \| AS \| AT \| AU \| AW \| AX \| AZ \| BA \| BB \| BD \| BE \| BF \| BG \| BH \| BI \| BJ \| BL \| BM \| BN \| BO \| BQ \| BR \| BS \| BT \| BW \| BY \| BZ \| CA \| CC \| CD \| CF \| CG \| CH \| CI \| CK \| CL \| CM \| CN \| CO \| CR \| CU \| CV \| CW \| CX \| CY \| CZ \| DE \| DJ \| DK \| DM \| DO \| DZ \| EC \| EE \| EG \| EH \| ER \| ES \| ET \| FI \| FJ \| FK \| FM \| FO \| FR \| GA \| GB \| GD \| GE \| GF \| GG \| GH \| GI \| GL \| GM \| GN \| GP \| GQ \| GR \| GS \| GT \| GU \| GW \| GY \| HK \| HN \| HR \| HT \| HU \| ID \| IE \| IL \| IM \| IN \| IO \| IQ \| IR \| IS \| IT \| JE \| JM \| JO \| JP \| KE \| KG \| KH \| KI \| KM \| KN \| KP \| KR \| KW \| KY \| KZ \| LA \| LB \| LC \| LI \| LK \| LR \| LS \| LT \| LU \| LV \| LY \| MA \| MC \| MD \| ME \| MF \| MG \| MH \| MK \| ML \| MM \| MN \| MO \| MP \| MQ \| MR \| MS \| MT \| MU \| MV \| MW \| MX \| MY \| MZ \| NA \| NC \| NE \| NF \| NG \| NI \| NL \| NO \| NP \| NR \| NU \| NZ \| OM \| PA \| PE \| PF \| PG \| PH \| PK \| PL \| PM \| PN \| PR \| PS \| PT \| PW \| PY \| QA \| RE \| RO \| RS \| RU \| RW \| SA \| SB \| SC \| SD \| SE \| SG \| SH \| SI \| SJ \| SK \| SL \| SM \| SN \| SO \| SR \| SS \| ST \| SV \| SX \| SY \| SZ \| TC \| TD \| TF \| TG \| TH \| TJ \| TK \| TL \| TM \| TN \| TO \| TR \| TT \| TV \| TW \| TZ \| UA \| UG \| UM \| US \| UY \| UZ \| VA \| VC \| VE \| VG \| VI \| VN \| VU \| WF \| WS \| YE \| YT \| ZA \| ZM \| ZW
`timezone`	string
`notes`	string

update_contact_settings changes data Change the contact page settings; only the keys given change, lists (interests, company_sizes) are r...

Change the contact page settings; only the keys given change, lists (interests, company_sizes) are replaced whole. interests: [{"key","label":{"en","ar"},"team":"sales|support|hello"}]. recipients: {"sales": ["[email protected]"], ...}. auto_reply: {"enabled", "subject": {"en","ar"}, "body": {"en","ar"}} with {name}, {interest}, {site}. A blank turnstile_secret keeps the saved one; clear_turnstile_secret true removes it.

Argument	Type	Description
`interests`	array
`company_sizes`	array
`recipients`	object
`default_country`	string IQ \| JO \| SA \| AE \| KW \| QA \| BH \| OM \| EG \| LB \| SY \| PS \| YE \| LY \| TN \| DZ \| MA \| SD \| TR \| IR \| GB \| DE \| FR \| US \| IN \| PK
`auto_reply`	object
`seo_title`	object
`seo_description`	object
`turnstile_site_key`	string
`turnstile_secret`	string
`clear_turnstile_secret`	boolean
`google_maps_key`	string

update_flash_messages changes data Change how the web app shows its save, edit, delete and error messages, for every company and user (...

Change how the web app shows its save, edit, delete and error messages, for every company and user (docs/flash-messages.md). Only what is passed changes. Errors stay until closed whatever is set. The other platform admins with platform.flash_messages get an email.

Argument	Type	Description
`position`	string top-center \| top-start \| top-end \| center \| bottom	Where messages appear. Start and end flip in Arabic.
`duration_seconds`	integer	How long a message stays, 2 to 30 seconds.
`auto_close`	boolean	Whether messages close by themselves. Errors never do.

update_lead changes data Change a contact-form message: status (new, contacted, closed), internal notes, or assigned_to (a pl...

Change a contact-form message: status (new, contacted, closed), internal notes, or assigned_to (a platform admin user id, or null). Only the fields given change.

Argument	Type	Description
`lead_id`required	integer
`status`	string new \| contacted \| closed
`notes`	string
`assigned_to`	integer	A platform admin user id; null to unassign.

update_license changes data Edit one of a company's licenses in place (dates, modules, limits, notes); fields left out keep thei...

Edit one of a company's licenses in place (dates, modules, limits, notes); fields left out keep their value. Returns the license and any other licenses whose dates it overlaps: while they overlap, the one that started last is in effect. Needs platform.companies.

Argument	Type	Description
`company_id`required	integer
`license_id`required	integer
`modules`	array
`max_employees`	integer
`max_branches`	integer	Not below the branches the company already has.
`starts_on`	string	YYYY-MM-DD
`ends_on`	string	YYYY-MM-DD
`notes`	string

update_login_design changes data Change one sign-in design's texts and images: eyebrow (command only), headline and text as {"en","ar...

Change one sign-in design's texts and images: eyebrow (command only), headline and text as {"en","ar"}; image and background as a path under public/ (e.g. "auth-art/authentication-bg-05.svg") or a full URL. Fields a design does not use are ignored; empty values bring back the default. Same as PATCH /api/v1/platform/login-designs/{design}.

Argument	Type	Description
`design`required	string classic \| illustration \| minimal \| command \| card
`eyebrow`	object
`headline`	object
`text`	object
`image`	string
`background`	string

update_monitor_alert_rule changes data Change one server alert rule (docs/server-monitor.md), found by its metric: threshold, for_minutes (...

Change one server alert rule (docs/server-monitor.md), found by its metric: threshold, for_minutes (1-1440), cooldown_minutes (5-10080) or enabled. Only what is passed changes. Switching off a firing rule clears it without a recovery email.

Argument	Type	Description
`metric`required	string cpu \| memory \| disk \| load \| db_connections \| db_timeouts \| errors \| failed_jobs \| service_down \| site_down \| ssl_days \| zenhr_sync_failed \| device_offline_hours \| backup_age_hours
`threshold`	number
`for_minutes`	integer
`cooldown_minutes`	integer
`enabled`	boolean

update_platform_admin changes data Rename a platform admin and change their platform permissions: permissions is the whole list they ke...

Rename a platform admin and change their platform permissions: permissions is the whole list they keep, or grant / revoke one. At least one admin always keeps platform.admins. Needs platform.admins.

Argument	Type	Description
`admin_id`required	integer
`name`	string
`permissions`	array
`grant`	string platform.ai \| server.monitor \| platform.app_control \| platform.broadcast \| platform.companies \| platform.phones.location \| platform.admins \| platform.notifications \| platform.zenhr \| platform.flash_messages \| platform.server_switch \| platform.app_debug \| platform.backups \| platform.backups_change \| platform.backups_run
`revoke`	string platform.ai \| server.monitor \| platform.app_control \| platform.broadcast \| platform.companies \| platform.phones.location \| platform.admins \| platform.notifications \| platform.zenhr \| platform.flash_messages \| platform.server_switch \| platform.app_debug \| platform.backups \| platform.backups_change \| platform.backups_run

update_platform_appearance changes data Change the platform's default look; only the options given change, an empty value brings back the or...

Change the platform's default look; only the options given change, an empty value brings back the original. Same as PATCH /api/v1/platform/appearance.

Argument	Type	Description
`mode`	string \| light \| dark \| system	Empty: follow the level above.
`layout`	string \| default \| mini \| detached \| modern \| transparent \| horizontal \| horizontal-single \| horizontal-overlay \| horizontal-box \| horizontal-fullwidth \| horizontal-sidemenu \| twocolumn \| stacked	Empty: follow the level above.
`color`	string \| primary \| brightblue \| lunargreen \| lavendar \| magenta \| chromeyellow \| lavared	Empty: follow the level above.
`sidebar`	string \| light \| brand \| darkgreen \| darkgray \| royalblue \| indigo	Empty: follow the level above.
`topbar`	string \| white \| darkaqua \| whiterock \| rockblue \| bluehaze \| orangegradient \| purplegradient \| bluegradient \| maroongradient	Empty: follow the level above.
`topbarcolor`	string \| white \| primary \| blackpearl \| maroon \| bluegem \| firefly	Empty: follow the level above.
`card`	string \| bordered \| borderless \| shadow	Empty: follow the level above.
`size`	string \| default \| compact	Empty: follow the level above.
`width`	string \| fluid \| box	Empty: follow the level above.
`loader`	string \| enable \| disable	Empty: follow the level above.

update_platform_limits changes data Change limits at platform level (docs/limits.md): values {key: number, or null for the built-in defa...

Change limits at platform level (docs/limits.md): values {key: number, or null for the built-in default}, sizes in KB. Only the keys sent change. Companies without their own value follow it at once. See get_platform_limits for the keys.

Argument	Type	Description
`values`required	object	{key: number or null}.

update_robots changes data Replace robots.txt rules for one or more domains (marketing, help, api, demo, app, admin). The Sitem...

Replace robots.txt rules for one or more domains (marketing, help, api, demo, app, admin). The Sitemap line is added automatically; an empty text restores the default. Same as PATCH /api/v1/platform/seo/robots.

Argument	Type	Description
`marketing`	string
`help`	string
`api`	string
`demo`	string
`app`	string
`admin`	string

update_security_policy changes data Change parts of the security policy; fields not given keep their value. Applies from the next reques...

Change parts of the security policy; fields not given keep their value. Applies from the next request. See get_security_policy for the fields.

Argument	Type	Description
`max_attempts`	integer	Failed sign-ins before the account locks (3-20).
`lock_minutes`	integer	How long a locked account stays locked.
`password_min_length`	integer	8-64.
`password_require_mixed_case`	boolean
`password_require_numbers`	boolean
`password_require_symbols`	boolean
`password_expiry_months`	integer	0 = passwords never expire.
`reset_link_minutes`	integer	How long a reset link works (5-1440).
`reset_requests_per_hour`	integer
`reset_channels`	array
`app_idle_minutes`	integer	Sign out of the app after this long without activity.
`admin_idle_minutes`	integer
`expire_on_close`	boolean	Also sign out when the browser closes.
`remember_me_days`	integer	0 hides "Remember me".
`admin_remember_me`	boolean
`support_session_minutes`	integer	How long a support session inside a company lasts (5-480).
`activity_log_max_months`	integer 0 \| 6 \| 12 \| 24	The longest any company keeps its activity log, in months; 0 = no maximum (companies may keep it forever).

update_seo_page changes data Set one public page's search and sharing tags per language. Fields: title, description, keywords, ca...

Set one public page's search and sharing tags per language. Fields: title, description, keywords, canonical, robots ("index, follow" | "noindex, follow" | "index, nofollow" | "noindex, nofollow"), og_title, og_description, og_image, twitter_title, twitter_description. An empty string clears a field (the page then uses its own content). Template pages (help.category, help.article) accept {title}, {description}, {site}. Same as PATCH /api/v1/platform/seo/pages/{key}.

Argument	Type	Description
`page`required	string marketing.home \| marketing.pricing \| marketing.contact \| marketing.tools \| marketing.end-of-service \| marketing.net-salary \| marketing.gross-salary \| marketing.overtime \| marketing.leave \| marketing.cost-to-company \| marketing.salary-guide \| help.home \| help.category \| help.article \| help.search \| demo.home \| developers.home \| developers.reference
`en`	object	English fields.
`ar`	object	Arabic fields.

update_seo_settings changes data Change the SEO center's site-wide settings; only the keys given change. Live immediately on every pu...

Change the SEO center's site-wide settings; only the keys given change. Live immediately on every public page. Same as PATCH /api/v1/platform/seo/settings.

Argument	Type	Description
`title_separator`	string	Between a page title and the site name, e.g. " \| ".
`google_verification`	string	Google Search Console token(s), the content="" value only; several separated by spaces.
`bing_verification`	string	Bing Webmaster Tools token(s).
`ga_id`	string	Google Analytics 4 id, G-XXXXXXX, or null.
`gtm_id`	string	Google Tag Manager id, GTM-XXXXXX, or null.
`consent_mode`	string banner \| none	banner: no measuring until the visitor accepts.
`consent_text`	object	{"en","ar"} text of the cookie banner.
`noindex_all`	boolean	Hide every public page from search engines (staging only).
`default_og_image`	string	Path under public/ or full URL; 1200x630.
`apple_touch_icon`	string
`twitter_site`	string	@handle
`organization`	object	{"legal_name", "logo", "same_as": [urls]} for the Organization JSON-LD.
`software_application`	boolean
`application_category`	string BusinessApplication \| FinanceApplication \| ProductivityApplication \| WebApplication

update_server_switch changes data Turn the mobile app's hidden live/dev switch on or off (docs/mobile-server-switch.md). on: boolean....

Turn the mobile app's hidden live/dev switch on or off (docs/mobile-server-switch.md). on: boolean. hours: how long it stays on (1–168, default 24; null = until turned off by hand). Off: 15 taps do nothing, and phones on dev go back to the live server at their next open; their dev drafts stay on the phone for dev. The other platform admins with platform.server_switch get an email.

Argument	Type	Description
`on`required	boolean	On or off.
`hours`	integer\|null	Hours until it turns itself off (1–168). Default 24; null for no end.

update_sign_in_options changes data Switch the sign-in screen links on or off for the mobile app and the web sign-in page (docs/platform...

Switch the sign-in screen links on or off for the mobile app and the web sign-in page (docs/platform-control.md): forgot_password, sso, privacy (booleans; only what is passed changes). Off hides the link and the server refuses forgot-password and SSO with 403 sign_in_option_off. privacy off hides only the sign-in link: Settings always keeps the privacy policy (Apple 5.1.1, Google Play). The other platform admins with platform.app_control get an email.

Argument	Type	Description
`forgot_password`	boolean	Show "Forgot password" on sign-in.
`sso`	boolean	Show "Sign in with SSO".
`privacy`	boolean	Show "Privacy policy" on the sign-in screen.

update_site_settings changes data Change mihnaro.com and system settings (app_theme is the system palette); only the keys given change...

Change mihnaro.com and system settings (app_theme is the system palette); only the keys given change and each replaces the whole value (e.g. send the full colors object). Colors are #RRGGBB; fonts are slugs from config/site.php. Changes are live immediately.

Argument	Type	Description
`site_name`	object	{"en": "...", "ar": "..."}
`tagline`	object
`footer_text`	object
`colors`	object	brand, accent, ink, muted, surface as #RRGGBB.
`fonts`	object	latin_heading, latin_body, arabic_heading, arabic_body.
`currency`	object
`emails`	object	hello, sales, support.
`page_titles`	object	home, pricing, contact, each {"en","ar"}.
`nav`	array	Menu links in order: [{"label": {"en","ar"}, "url": "/pricing"}].
`app_theme`	object	The system palette (HRM, FSM, admin, sign-in): {"primary","secondary","sidebar","login_panel"} as #RRGGBB, and "sidebar_style": light\|colored. Send all five.
`auth_panel`	object	Sign-in page panel: {"headline": {"en","ar"}, "text": {"en","ar"}}
`header_button`	object	{"label": {"en","ar"}, "url": "mailto:..."}

update_user_contact changes data Set where the password reset links of a company user go: personal email and WhatsApp phone (+ and co...

Set where the password reset links of a company user go: personal email and WhatsApp phone (+ and country code).

Argument	Type	Description
`company_id`required	integer
`user_id`required	integer
`personal_email`	string
`phone`	string	International format, e.g. +9647701234567.

update_zenhr_data_type changes data Turns a data type on or off (it also pauses that type in a running sync), or sets how often it is re...

Turns a data type on or off (it also pauses that type in a running sync), or sets how often it is read and its starting point. With branch_id: for that branch only. Refuses what the code cannot do.

Argument	Type	Description
`company_id`required	integer
`data_type`required	string
`branch_id`	integer
`enabled`	boolean
`frequency`	string hourly \| every_6h \| daily \| weekly \| manual
`starting_from`	string	YYYY-MM-DD

verify_calculator_rules changes data Mark rules of a calculator rule set verified (checked against the official source recorded for each;...

Mark rules of a calculator rule set verified (checked against the official source recorded for each; a rule without a source is refused) or, with verified=false, back to estimate. Same as POST /api/v1/platform/calculator-rule-sets/{id}/verify.

Argument	Type	Description
`id`required	integer
`keys`required	array	Rule keys, e.g. ['ss_employee_percent'].
`verified`	boolean	Default true.

`apply_changes`	`nullable\|in:update,new`
`balance_date`	`required_if:apply_changes,new\|nullable\|date`
`name_ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(150)`
`name_en`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`tickets`required	`required\|numeric\|min:0\|max:20`
`period_months`required	`required\|integer\|min:1\|max:120`
`period_anchor`required	`required\|in:hire,calendar`
`accrual`required	`required\|in:period_start,monthly`
`amount`required	`required\|numeric\|min:0`
`family_members`	`nullable\|integer\|min:0\|max:20`
`eligible_after_months`	`nullable\|integer\|min:0\|max:120`
`applies_to`required	`required\|in:all,assigned`
`expire_option`	`nullable\|in:after,immediately,none`
`expire_after_months`	`required_if:expire_option,after\|nullable\|integer\|min:1\|max:120`
`distribution`	`nullable\|in:per_person,shared`
`default_payroll`	`nullable\|in:in_payroll,off_cycle`
`default_request_type`	`nullable\|in:cash_out,ticket`
`transaction_type_id`	`nullable\|exists:transaction_types,id`
`gl_identifier`	`nullable\|string\|max:60`
`clearance_account`	`nullable\|string\|max:60`
`setups`	`nullable\|array\|max:30`
`setups.*.position_ids`	`nullable\|array`
`setups..position_ids.`	`integer\|exists:positions,id`
`setups.*.nationalities`	`nullable\|string\|max:500`
`setups.*.years_from`	`nullable\|numeric\|min:0\|max:60`
`setups.*.years_to`	`nullable\|numeric\|min:0\|max:60`
`setups.*.amount`	`nullable\|numeric\|min:0`
`setups.*.currency`	`nullable\|string\|max:3`
`setups.*.beneficiaries`	`nullable\|array`
`setups..beneficiaries..relation`	`nullable\|in:parent,spouse,child,sibling`
`setups..beneficiaries..deduction`	`nullable\|numeric\|min:0\|max:100`

`apply_changes`	`nullable\|in:update,new`
`balance_date`	`required_if:apply_changes,new\|nullable\|date`
`name_ar`	`nullable\|string\|'max:' . \App\Support\Limits::chars(150)`
`name_en`required	`required\|string\|'max:' . \App\Support\Limits::chars(150)`
`tickets`required	`required\|numeric\|min:0\|max:20`
`period_months`required	`required\|integer\|min:1\|max:120`
`period_anchor`required	`required\|in:hire,calendar`
`accrual`required	`required\|in:period_start,monthly`
`amount`required	`required\|numeric\|min:0`
`family_members`	`nullable\|integer\|min:0\|max:20`
`eligible_after_months`	`nullable\|integer\|min:0\|max:120`
`applies_to`required	`required\|in:all,assigned`
`expire_option`	`nullable\|in:after,immediately,none`
`expire_after_months`	`required_if:expire_option,after\|nullable\|integer\|min:1\|max:120`
`distribution`	`nullable\|in:per_person,shared`
`default_payroll`	`nullable\|in:in_payroll,off_cycle`
`default_request_type`	`nullable\|in:cash_out,ticket`
`transaction_type_id`	`nullable\|exists:transaction_types,id`
`gl_identifier`	`nullable\|string\|max:60`
`clearance_account`	`nullable\|string\|max:60`
`setups`	`nullable\|array\|max:30`
`setups.*.position_ids`	`nullable\|array`
`setups..position_ids.`	`integer\|exists:positions,id`
`setups.*.nationalities`	`nullable\|string\|max:500`
`setups.*.years_from`	`nullable\|numeric\|min:0\|max:60`
`setups.*.years_to`	`nullable\|numeric\|min:0\|max:60`
`setups.*.amount`	`nullable\|numeric\|min:0`
`setups.*.currency`	`nullable\|string\|max:3`
`setups.*.beneficiaries`	`nullable\|array`
`setups..beneficiaries..relation`	`nullable\|in:parent,spouse,child,sibling`
`setups..beneficiaries..deduction`	`nullable\|numeric\|min:0\|max:100`