Connect Teamso to the systems you use. Hires, terminations and organization changes go out instantly as webhooks; read and write data with the REST API; with Teamso MCP, AI assistants act within your permissions.
Get started creates a new account for your company. Are you an employee? Sign in
{
"eventId": "8f0c2a4e-...",
"eventType": "EMPLOYEE_HIRED",
"companyId": "...",
"createdAt": "2026-11-02T09:30:00",
"data": {
"userId": "...",
"fullName": "Ayşe Yılmaz",
"email": "[email protected]",
"branch": "Merkez",
"department": "Finans",
"position": "Uzman",
"manager": "Mert Şahin",
"hireDate": "2026-11-03T00:00:00",
"customFields": {}
}
}X-Teamso-EventX-Teamso-Delivery-IdX-Teamso-TimestampX-Teamso-SignatureCall the API that the Teamso web and mobile apps use, with a personal access token. The token works with its owner's current permissions.
When an event happens, Teamso sends a signed request to your URL. If it cannot reach you, it retries at growing intervals.
Leave requests, approvals, reports and guide search from Claude, Cursor and other MCP clients.
When you create a subscription you choose the events to listen to. Employee events are managed in company settings, time and attendance events in the attendance settings.
| Event | When it is sent |
|---|---|
EMPLOYEE_HIRED | An employee started (single entry, Excel or digital onboarding) |
EMPLOYEE_TERMINATED | An employee's termination was recorded |
EMPLOYEE_TERMINATION_CANCELLED | A termination was cancelled or the employee was rehired |
EMPLOYEE_ORG_UPDATED | Branch, department, position or manager changed; the current state and old/new values come together |
BADGE_AWARDED | A badge was awarded (a private badge carries no message) |
| Event | When it is sent |
|---|---|
attendance.created | A clock-in or clock-out record was created |
anomaly.detected | An anomaly was detected (e.g. lateness, a long break) |
security.violation | A security violation (e.g. a fake location) |
excuse.submitted | An employee wrote a reason |
excuse.resolved | A reason was decided |
qr.locked | The QR code was locked for a late employee |
Each request carries the HMAC-SHA256 signature (hex) of the raw body, made with the subscription's secret, in the X-Teamso-Signature header. Delivery is at least once: if the same X-Teamso-Delivery-Id arrives again, ignore it.
import crypto from "node:crypto";
function verify(rawBody, headers, secret) {
const expected = crypto
.createHmac("sha256", secret)
.update(rawBody)
.digest("hex");
const received = headers["x-teamso-signature"] ?? "";
return (
received.length === expected.length &&
crypto.timingSafeEqual(
Buffer.from(received),
Buffer.from(expected),
)
);
}The webhook URL is resolved when it is saved and again on every delivery; requests cannot reach the server's own network (loopback, link-local addresses, the cloud metadata endpoint). Internal systems remain reachable over VPN on private addresses.
Each subscription has its own secret; values such as passwords and tokens in a custom request are stored encrypted and shown masked on screen and in the delivery history.
Only authorized users see and manage subscriptions. Token-based API requests are limited to the owner's permissions; once a token is revoked, the next request is rejected.
When an employee starts, their account is opened in email, Active Directory or the access control system; on termination the account is closed. Organization changes update the department and manager.
New hire and termination data flows to the accounting or ERP system; payroll results are read with the REST API.
Clock-in and clock-out events flow to the turnstile or shift planning system; anomaly and security events reach the right team as notifications.
Leave approvals, reports and guide search from Claude or Cursor. Details on the AI page.
Partners who roll out Teamso for their customers and connect it to their systems. The list and the application form are on the partners page.
Our solution partnersYou create a personal access token on the MCP access page in Teamso. The token works with its owner's permissions and can have an expiry; a user can have at most 10 active tokens. Endpoints for passwords, sessions and security settings are closed to tokens.
Users with the permission to view and manage webhook subscriptions in company settings. A subscription sets the URL, the events and the secret; a test request can be sent before saving.
No. Teamso retries after 1 minute, 5 minutes, 30 minutes, 2 hours and 6 hours; after the last attempt the delivery is marked failed and can be resent from the delivery history with one click.
In custom request mode you set the HTTP method (POST, PUT, GET), the body format (JSON or form) and the fields with a template; variables such as first name, last name, email and branch can be transformed with filters. Secret values are stored encrypted and shown masked.
Compute the HMAC-SHA256 of the request's raw body in hex with the subscription's secret and compare it with the X-Teamso-Signature header in constant time. Do not parse and re-serialize the body; the signature covers the raw body.
Tell us which systems you want to connect; we map the events and fields together during setup.
Get started creates a new account for your company. Are you an employee? Sign in