BambooHR Webhook Setup Guide

In the StackOne dashboard, open the BambooHR connector profile and enable the webhook events you want delivered downstream. See the Available Webhook Events section below for the full list.

When webhook events are enabled (or the event selection changes), StackOne creates the webhook on your behalf using the connected account’s credentials. The webhook is registered for all enabled event types in a single call.

• StackOne registers a comprehensive set of standard employee fields as monitorFields so that any change to core employee data triggers employee.updated.
• The webhook is created with format: json so payloads arrive as JSON.

BambooHR webhooks are permanently tied to the user account that created them. If the creating user is deactivated, the webhook silently stops firing with no error or notification.

• For API Key connections, generate the key from a dedicated service account (e.g. a non-person integration user) that will not be deactivated.
• OAuth 2.0 connections are not subject to this limitation.

Trigger a matching change in BambooHR (for example, update an employee’s name) and confirm the event reaches your downstream consumer.

• BambooHR retries failed deliveries up to 5 times with exponential backoff (immediate, +5 min, +10 min, +20 min, +40 min with jitter).

Changing your event selection re-registers the StackOne-managed webhook. Disconnecting the account deletes it, stopping deliveries.

Events fired when employee records are created, updated, or deleted.

• Employee Created (employee.created) — Fired when a new employee record is created. Note: BambooHR also fires employee.updated immediately after employee.created — downstream consumers should expect both.
• Employee Updated (employee.updated) — Fired when any monitored field on an employee changes. The payload includes data.changedFields listing the changed field aliases. Only fires for fields in the registered monitorFields list — StackOne registers all standard fields.
• Employee Deleted (employee.deleted) — Fired when an employee record is deleted.

BambooHR delivers each event as an HTTP POST with a JSON body. The envelope contains type (the event string, e.g. employee.updated), timestamp (ISO 8601), and data (with companyId, employeeId, and for updated events, changedFields).

BambooHR signs each delivery using the privateKey returned in the webhook creation response (201). The key is shown only once and cannot be retrieved again — store it securely at creation time.

• Signature header: X-BambooHR-Signature
• Algorithm: HMAC-SHA256 computed over the raw request body concatenated with the X-BambooHR-Timestamp header value.
• To verify: reconstruct the HMAC using your stored privateKey and compare it to the header value.