For developers

Tiemio API

Read your company's working-time records from your own tools: a payroll spreadsheet, a report, an AI assistant. The API is read-only, so nothing outside the app can change the record.

What it does, and what it does not

Reads your team, each person's hours per day, each day's taps, the corrections and the hash chain.
It cannot clock in, change or approve anything. The worker makes the tap and a person approves each change: that is what makes the record worth something as evidence.
It cannot download timesheets: each download is recorded as evidence of who was handed what, so it stays in the app.
A key never sees a person's DNI/NIE, email or phone, nor the text of hours notes. It does see the reasons given for corrections, because they are part of the record.
There are no webhooks. To see changes, read again.

Get a key

Sign in as the company's owner and open the Company page.
Under API keys, name the key and create it.
Copy it now: it is shown once. We keep only a hash.
Send it on every call as Authorization: Bearer <key>. Keep it on your server, never in a web page or an app: anyone holding it can read your employees' records.
You can revoke a key at any time. The owner gets an email for each new key.

Your first call

curl -H "Authorization: Bearer tmk_your_key" \
  "https://tiemio.com/api/employer/month?month=2026-09"

The answer gives each person's worked milliseconds per day, with approved corrections applied. Index 0 is the 1st of the month.

{
  "month": "2026-09",
  "today": "2026-10-30",
  "timeZone": "Europe/Madrid",
  "days": 30,
  "people": [
    {
      "employmentId": "emp_01",
      "personId": "usr_01",
      "name": "Ana García",
      "from": "2026-01-12",
      "until": null,
      "workedMs": [28800000, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
      "flagged": [false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false]
    }
  ]
}

The five routes

GET /api/employer: The company and its people, with each active person's clock now. Use the employment id from here in the routes below.
GET /api/employer/month?month=YYYY-MM: Worked time per person per day for one month, plus which days fall outside the person's timetable.
GET /api/employer/employments/{id}/day?date=YYYY-MM-DD: One person's day: every tap, with device time, receipt time, whether it waited offline, and the corrections decided that day.
GET /api/employer/corrections: The company's corrections: who asked, who decided, when and why. Add ?status=pending or ?employment=<id> to narrow it.
GET /api/employer/employments/{id}/chain: Every tap exactly as hashed, 500 per page, so your tool can recompute the chain itself. Add ?after=<next> for the next page and ?kind=corrections for the correction rows.

Reading a month without hitting the limit

For totals, one month call covers the whole team.
Start and finish times need one day call per person per day. For 20 people over 31 days that is 620 calls, about 11 minutes at the limit, so space them out.
Days are cut in the company's time zone, given in each answer. Instants are in UTC.
Run it once, after the month has closed, rather than polling.

Limits and errors

60 requests a minute, per key and per client address. Above that: 429 with code rate_limited and Retry-After: 60. Wait, then try again.
401 bad_api_key: the key is unknown or revoked.
400 bad_request: a malformed month, date or parameter, or a future one.
404, on the day and chain routes: that person is not in your company. On corrections, an id that is not yours answers an empty list.
500: something failed on our side, and the answer may carry no code. Try again.
Errors are { error, code }. Use the code: the text may change.
A key keeps reading if your plan lapses. It stops when it is revoked, when the business closes, or when its creator is no longer the owner.

What stays stable

Only the fields in the reference are promised. The routes answer other fields too; do not build on those.
A documented field is not removed or changed. New ones may appear, so ignore what you do not know.

Try it without an account

The test drive opens a demo company with fake people and weeks of history. The answer gives you an owner token that works on the same five routes, on the test-drive host, for 24 hours.

curl -X POST https://testdrive.tiemio.com/api/testdrive

One difference: a test-drive owner token is a session, not an API key, so it also sees contact details and notes that a key does not.