Subscribe via the StackOne dashboard

This connector uses Programmatic Webhooks. When you enable webhook events for a connected BambooHR account, StackOne automatically creates a single webhook (via `POST /api/v1/webhooks`) registered for the event types you enable, pointing at your StackOne callback URL.

In the StackOne dashboard, open the BambooHR connector profile and enable the webhook events you want delivered downstream. See the Available Webhook Events section below for the full list.

When webhook events are enabled (or the event selection changes), StackOne creates the webhook on your behalf using the connected account's credentials. The webhook is registered for all enabled event types in a single call.

StackOne registers a comprehensive set of standard employee fields as `monitorFields` so that any change to core employee data triggers `employee.updated`.
The webhook is created with `format: json` so payloads arrive as JSON.

BambooHR webhooks are permanently tied to the user account that created them. If the creating user is deactivated, the webhook silently stops firing with no error or notification.

For API Key connections, generate the key from a dedicated service account (e.g. a non-person integration user) that will not be deactivated.
OAuth 2.0 connections are not subject to this limitation.

Trigger a matching change in BambooHR (for example, update an employee's name) and confirm the event reaches your downstream consumer.

BambooHR retries failed deliveries up to 5 times with exponential backoff (immediate, +5 min, +10 min, +20 min, +40 min with jitter).

Changing your event selection re-registers the StackOne-managed webhook. Disconnecting the account deletes it, stopping deliveries.

Available Webhook Events

The following BambooHR employee events can be enabled using the modern event-based webhook family.

Events fired when employee records are created, updated, or deleted.

Employee Created (`employee.created`) — Fired when a new employee record is created. Note: BambooHR also fires `employee.updated` immediately after `employee.created` — downstream consumers should expect both.
Employee Updated (`employee.updated`) — Fired when any monitored field on an employee changes. The payload includes `data.changedFields` listing the changed field aliases. Only fires for fields in the registered `monitorFields` list — StackOne registers all standard fields.
Employee Deleted (`employee.deleted`) — Fired when an employee record is deleted.

Payload and signature

Details of how BambooHR delivers events to StackOne.

BambooHR delivers each event as an HTTP POST with a JSON body. The envelope contains `type` (the event string, e.g. `employee.updated`), `timestamp` (ISO 8601), and `data` (with `companyId`, `employeeId`, and for updated events, `changedFields`).

BambooHR signs each delivery using the `privateKey` returned in the webhook creation response (201). The key is shown only once and cannot be retrieved again — store it securely at creation time.

Signature header: `X-BambooHR-Signature`
Algorithm: HMAC-SHA256 computed over the raw request body concatenated with the `X-BambooHR-Timestamp` header value.
To verify: reconstruct the HMAC using your stored `privateKey` and compare it to the header value.