Developer Resources
TheDeskMonitor REST API
Build integrations, automate workflows, and connect TheDeskMonitor to your existing tooling with our REST API.
API Overview
The TheDeskMonitor REST API allows you to programmatically access your tenant's workforce data, trigger actions, and receive real-time webhook events.
- RESTful, JSON responses
- Bearer token authentication
- Rate limited: 2,000/hour · 10,000/day
- Webhook event delivery
- Available: Business+ plans
Available Endpoint Categories
Activity & Timesheets
Retrieve activity summaries, hourly breakdowns, timesheet records, and idle time data for any user or date range.
GET /api/v1/activity/*
GET /api/v1/timesheets/*
Users & Teams
List users, retrieve user profiles, get team memberships, and manage user status programmatically.
GET /api/v1/users/*
GET /api/v1/teams/*
Tasks & Projects
Create tasks, update task status, retrieve project budgets, and sync task data with external project management tools.
GET/POST /api/v1/tasks/*
GET/POST /api/v1/projects/*
Payroll & Billing
Retrieve payroll calculations, cost center reports, and rate card data. Trigger pay run exports programmatically.
GET /api/v1/payroll/*
GET /api/v1/billing/*
Webhooks
Subscribe to real-time event webhooks — user login, timesheet submission, task completion, payroll run, and billing events.
POST /api/v1/webhooks/subscribe
Shifts & Schedules
Retrieve shift templates, user schedules, and upcoming shift data. Integrate TheDeskMonitor shifts with your existing scheduling tools.
GET /api/v1/shifts/*
Authentication
The TheDeskMonitor API uses Bearer token authentication. API tokens are issued by your account administrator. Contact your TheDeskMonitor account manager or use the Request API Access button to get started. All requests must include the token in the Authorization header.
API tokens are tenant-scoped and carry the permissions of the issuing admin account. Keep your API token secure — treat it like a password.
What API tokens can do:
- Read activity, timesheet, user, project, payroll, and shift data for your tenant
- Create and update tasks (read-write scope)
- Subscribe to webhook event notifications
What API tokens cannot do:
- Access data belonging to other tenants
- Modify billing or subscription settings
- Create or modify user accounts
- Access screenshot images directly
Rate Limits
The API enforces two rate limits per API token: 2,000 requests per hour and 10,000 requests per day. Both limits reset independently. Rate limit status is returned in response headers:
X-RateLimit-Remaining-Hour: 1847
X-RateLimit-Limit-Day: 10000
X-RateLimit-Remaining-Day: 9231
X-RateLimit-Reset-Day: 1741910400
Webhook Events
Subscribe to real-time event notifications delivered to your endpoint via HTTP POST. The following 32 events are available across all subscription tiers.
clock.in, clock.out, break.*, location.*) must be explicitly selected when configuring your webhook subscription. All other events are included by default.
Attendance & Clock
| Event | Description |
|---|---|
clock.in | A user clocked in for the day |
clock.out | A user clocked out |
clock.in.failed | A clock-in attempt was rejected (geofence, shift, or 2FA failure) |
break.started | A user started a break |
break.ended | A user ended a break |
idle.detected | User has been idle beyond the configured threshold |
overtime.detected | User has exceeded their scheduled hours |
Timesheets
| Event | Description |
|---|---|
timesheet.submitted | A user submitted a timesheet for approval |
timesheet.approved | A timesheet was approved by a manager |
timesheet.rejected | A timesheet was rejected with a reason |
timesheet.auto_generated | A timesheet was automatically generated by the system |
Activity & Productivity
| Event | Description |
|---|---|
activity.daily_summary | End-of-day activity summary generated for a user |
activity.productivity_drop | User productivity score dropped below the configured threshold |
GPS & Location
| Event | Description |
|---|---|
location.geofence_entered | User entered a defined geofence zone |
location.geofence_exited | User exited a defined geofence zone |
location.outside_zone | User is working outside their assigned location zone |
Tasks & Projects
| Event | Description |
|---|---|
task.created | A new task was created |
task.updated | A task was updated (status, assignee, or due date changed) |
task.completed | A task was marked complete |
project.budget_alert | A project has reached its configured budget alert threshold |
Users & Team
| Event | Description |
|---|---|
user.invited | A new user invitation was sent |
user.activated | A user completed onboarding and activated their account |
user.deactivated | A user account was deactivated by an admin |
user.role_changed | A user's role or permissions were changed |
Payroll
| Event | Description |
|---|---|
payroll.period_closed | A payroll period was closed and finalised |
payroll.export_ready | A payroll export file is ready for download |
Billing & Subscription
| Event | Description |
|---|---|
subscription.plan_changed | The tenant's subscription plan was upgraded or downgraded |
subscription.trial_ending | The tenant's trial period is ending within 3 days |
subscription.payment_failed | A recurring payment attempt failed |
Security
| Event | Description |
|---|---|
security.login_failed | A login attempt failed (invalid credentials or blocked) |
security.2fa_disabled | A user disabled two-factor authentication on their account |
security.new_device_login | A user logged in from a new or unrecognised device |
Webhook Payload Format
All webhook deliveries use a standard envelope structure:
"id": "evt_01HXR4K9VWZMQ7T2BN3D",
"event": "timesheet.approved",
"timestamp": "2026-03-23T09:00:00Z",
"tenant": "acme-corp",
"data": {
"userEmail": "alice@acme.com",
"periodStart": "2026-03-17",
"periodEnd": "2026-03-23",
"totalHours": 38.5,
"approvedByEmail": "manager@acme.com",
"approvedAt": "2026-03-23T09:00:00Z"
}
}
X-TheDeskMonitor-Signature: sha256=<HMAC-SHA256> header. Verify this against your webhook secret to confirm authenticity.
Ready to build an integration?
API access is available on Business plan and above. Contact us to request your API token and Postman collection.
Request API Access