BambooHR Integration
INTEGRATIONS · EXPERTINI ATS

BambooHR Integration

Push a new hire into BambooHR the moment an offer is accepted — and import your people directory into the ATS talent pool, both from one connection.

3 min leestijd · Bijgewerkt juli 2026 · Expertini Editorial

The hand-off from recruiting to HR is where new hires most often fall through the cracks: the offer is signed in one system, but the employee record that payroll, IT, and onboarding depend on lives in another, and someone has to remember to retype it. Expertini ATS closes that gap for BambooHR customers with a two-way integration: when a candidate accepts an offer, one click (or an automatic rule) creates the employee record in your BambooHR account with their name, work email, job title, and hire date already filled in.

It works in the other direction too. The same connection can read your BambooHR people directory and import it into the ATS candidate database — deduplicated by email, clearly marked as imported, and immediately searchable. Teams use it to seed internal-mobility searches and referral sourcing with the colleagues they already have. Expertini ATS is an independent product; BambooHR is a trademark of its owner, and this integration simply talks to the same official API your own account exposes.

Bekijk het overzicht van 30 seconden — geen registratie vereist

01How to connect it, step by step

Step one: an owner or admin opens Connectors inside the ATS and clicks Connect on the BambooHR card — a standard sign-in on BambooHR's own site, after which the ATS knows your company subdomain and identity. Step two matters for pushing new hires: BambooHR grants sign-in connections read-only access to employee data, so creating employees needs an API key from your own BambooHR account (Settings → API Keys there). Paste it on the ATS Screening & HRIS page — it is stored encrypted and never shown again. That two-step design is BambooHR's security model, not a workaround, and the app tells you exactly which step is missing rather than failing silently.

02Pushing a new hire

From the Screening & HRIS page, search for the hired candidate — records are picked from a type-ahead, never retyped — and push. The ATS sends first and last name, work email, job title, and the hire date, and BambooHR replies with the created employee record. Prefer zero clicks? Tick BambooHR under "Auto-push on hire" and every accepted offer creates the employee automatically, with each push logged on the app's activity page so you can always see what happened and when.

03Importing your people directory

The "Import your people" action reads BambooHR's employee directory — the same list its own mobile app shows — and adds each person to your ATS candidate database with their name, work email, and job title. Existing records are matched by email and never overwritten; imported people are marked as such, remain fully editable, and carry conservative privacy defaults (no consent is assumed — they never filled in an application form). Re-running the import only adds what's new.

04What this replaces

Without the integration, every hire means retyping the same five fields into HR software, and every internal-mobility search means asking HR for a spreadsheet. With it, the offer workflow ends with a real employee record, and your own workforce is one search away in the candidate database. No middleware subscription, no per-sync fees — the connector is part of the plan.

Technische opmerkingen

Platformarchitectuur & -operaties

A1Connection architecture

The connection uses OAuth 2.0 against the vendor's own consent screen. The authorisation request names the minimum scopes the features need — the exact scope list is shown in the security-flow panel below, pulled from the same provider registry the application uses. The code-for-token exchange happens entirely server-side (client credentials in the token request body, per the vendor's token endpoint contract); tokens are stored encrypted at rest and are never rendered back to any screen — connection pages show presence, not values.

Token lifecycle is handled at a single chokepoint: expiry triggers an automatic refresh, rotated refresh tokens are persisted, and a refresh that the vendor rejects surfaces as a visible reconnect prompt — never as silently broken features. Revocation works from either side: disconnect here, or revoke in the vendor's own security settings.

A2Write semantics and data flow

Every data movement is an explicit action with a logged result. Writes happen on your click — or automatically only where you enabled a rule (auto-push on hire is off by default, per-provider). Reads — imports of people, accounts, or files — run when you press Import, deduplicate against what you already have (clients by name, people by email), skip rather than overwrite, and report created-versus-skipped honestly, which is why re-running any import is safe by design.

Each action writes a row to the app-activity journal (ats_app_activity): what ran, when, for which record, and the outcome — including the vendor's own error text verbatim when something fails. Usage reporting inside the ATS aggregates that same journal, so integration reporting and integration reality cannot diverge.

Anything that leaves the request path — notification fan-out, webhook delivery, activity journalling, mail — runs in fire-and-forget background threads. A slow external endpoint can never make the interface hang, and a failed side effect is logged rather than silently retried into inconsistency.

A3Operational considerations

Connections are organisation-level and gated to owner and admin roles; recruiters use the features a connection powers but cannot connect, disconnect, or reconfigure. Disconnecting removes stored credentials immediately and stops the dependent features visibly, not silently. Data already imported stays yours and editable.

Imported people arrive marked as imported with conservative privacy defaults — no consent is assumed for anyone who never filled in your application form, and retention defaults apply. Everything written is yours to take: CSV exports and the Data Export app cover the same stores the product itself reads. The exit is as open as the entrance — by design, not concession.

A4Placement in the integration topology

This integration is live in the registry today. One connection per provider unlocks every feature it powers, and the topology grid below shows the neighbouring connectors in the same capability area — statuses come from the same registry that drives the in-app hub, so this page can never claim more than the product does. For anything the catalogue does not cover, Webhooks and Zapier are the generic, documented escape hatch.

Afhankelijkheidskaart

Connection typeOAuth 2.0 (vendor consent screen)
Scopes requestedopenid · email · employee:name · employee:job
Callback path/apps/oauth/callback/bamboohr/
Token exchangeserver-side; credentials in body
Secrets at restencrypted; UI shows presence flags, never values
Action journalats_app_activity — one row per action, vendor errors verbatim
Auto-push rulesoff by default, per-provider, every run logged
Registry statuslive

Interface-blauwdruk

Structureel schema van de interface — panelen, hiërarchie en interactiemogelijkheden. Een contract, geen screenshot.
Verbindingskaart
● verbonden — aanwezigheidsstatus
scopes: minimaal vereist verbinding verbreken
Acties
push — expliciete klikimport — ontdubbeld
Activiteitenlogboek
Fig. 1 — BambooHR Integration: structureel interfaceschema. Panelen en statussen vormen het contract; de getoonde gegevens zijn tijdelijke aanduidingen.

Interactiestroom — statussen, validaties, feedback

Elke onderstaande status wordt aan de serverzijde afgedwongen; de interface rapporteert deze alleen en bepaalt deze niet.
Connectowner/admin clicks Connect on the Connectors page
Vendor consentthe vendor's own screen lists the exact scopes
Token exchangeserver-side callback; secrets never touch the browser
Connectedencrypted store; card flips with presence flag
Explicit actionspush / import / schedule — each one journalled
Consent denied → the vendor's error code surfaces in a toast, namedPlatform keys missing → honest setup pointer, not a silent bounceToken expired → automatic refresh at the chokepointRefresh rejected → visible reconnect prompt, features never break silentlyPlan below minimum → lock card names the exact plan
Fig. 2 — interactiestroom: marineblauw = statussen, goud = door de server afgedwongen poorten, groen = bevestigde resultaten; tags tonen de randgevallen en hun feedback.

OAuth 2.0-beveiligingsstroom — BambooHR

1
AutorisatieverzoekDoorverwijzing naar het toestemmingsscherm van de leverancier zelf, met uitsluitend de onderstaande scopes — nooit meer.
2
Identiteitscontrole & toestemmingU verifieert zich bij de leverancier, op het domein van de leverancier. Inloggegevens komen nooit bij Expertini terecht.
3
Tokenuitwisseling aan serverzijdeDe callback op /apps/oauth/callback/bamboohr/ wisselt de code uit met client credentials in request body — volledig aan de serverzijde.
4
Beheerde sessiestatusTokens versleuteld in rust; automatische vernieuwing op één centraal controlepunt; weergave van aanwezigheidsindicator; intrekken vanaf beide kanten mogelijk.
openidemailemployee:nameemployee:job
Scope-lijst uitgelezen uit hetzelfde provider-register waarmee de applicatie autoriseert — deze pagina kan dit niet overdrijven of afzwakken.

Neighbouring connectors — Human Resources Information System

BambooHRthis page SAP SuccessFactorslive ADPplanned
Statussen zijn afkomstig uit het actieve register — bekijk de volledige catalogus →

Veelgestelde vragen

Why does pushing employees need an API key when I already signed in?
BambooHR's sign-in connections are read-only for employee data by design. Employee creation uses an API key generated inside your own BambooHR account — the ATS stores it encrypted and uses it only for the pushes you trigger or enable.
What exactly is sent to BambooHR on a push?
First name, last name, work email, job title, and hire date — enough for a valid employee record. Everything else stays in the ATS until your HR team enriches the record in BambooHR.
Does the people import overwrite existing candidates?
No. Matching is by email: if a person is already in your candidate database, the import skips them. Imported records are marked as imported and stay editable.
Is Expertini affiliated with BambooHR?
No. BambooHR is a trademark of its owner. Expertini ATS integrates through the official API available to any BambooHR customer, using your own account and credentials.
What does the integration cost?
It's included in the subscription — see pricing. There are no per-push or per-import fees.

In één oogopslag

  • One-click or automatic new-hire push on offer acceptance
  • Name, work email, job title, and hire date arrive pre-filled
  • Import the BambooHR people directory into the ATS talent pool
  • Email-based dedupe — nothing overwritten, safe to re-run
  • Every push and import logged on the app's activity page
  • Uses your own BambooHR account and API key, stored encrypted

Bekijk bamboohr integration op uw eigen wervingsproces.

Breng een echte vacaturetekst mee naar een demo van 30 minuten — inclusief gratis proefperiode.

Boek een demo
Expertini Intelligentie
Nu online
Hallo! Ik ben Expertini's intelligente productexpert. Stel me gerust alle vragen over onze oplossingen, krijg begeleiding bij elk van onze Hiring Tools, of vertel me gewoon wat u wilt doen — ik wijs u de juiste richting op. Voor accountspecifieke kwesties kunt u mailen naar support@expertini.com.