Developers

The Shiftbrook API.

Paid plans can create a key in Settings, then Integrations, then API. The key is shown once and stored as a hash. Send it as a bearer token. Free plans see an upgrade prompt instead of a key.

Call the API

curl https://shiftbrook.com/api/v1/people \
  -H "Authorization: Bearer sb_live_example"

List responses include data and nextCursor. Pass cursor and limit (up to 100). A key is limited to 60 requests a minute. A read key cannot create or change records.

Resources

GET /api/v1/people and POST /api/v1/people with name, email and role. Creating a person sends an invite. The invite token is not returned.
GET /api/v1/locations
GET, POST and PATCH /api/v1/shifts. A new shift is a draft. Publish it in the app.
GET and POST /api/v1/leave-requests, then POST /api/v1/leave-requests/{id}/approve.
GET /api/v1/timesheets?status=approved includes approvedHours.
GET /api/v1/absences?from=2026-10-01&to=2026-10-31 lists approved leave in that range.

Webhooks

Create a webhook in the API settings or with POST /api/v1/webhooks. The signing secret is shown once. Each delivery is JSON with id, type, createdAt and data. The signature is hex HMAC SHA256 of the timestamp, a dot, and the raw body, using the secret. It is sent in X-Shiftbrook-Signature as v1=. The timestamp is X-Shiftbrook-Timestamp.

Events: shift.published, leave.approved, timesheet.approved, person.created. A failed delivery is tried again after one minute, five minutes and thirty minutes.

The machine-readable description is the OpenAPI spec.