> For the complete documentation index, see [llms.txt](https://docs.harmony.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.harmony.io/integrations/hris/hibob-oauth.md).
# HiBob (OAuth)
Connect Bob to Harmony with a one-click OAuth consent for automated IT provisioning and org chart syncing
HiBob (Bob) is a modern HR management platform designed for dynamic, distributed workforces. Connecting Bob to Harmony enables automated IT provisioning based on HR events, intelligent employee lifecycle management, and seamless synchronization of organizational data for optimal IT operations.
The HiBob (OAuth) integration connects Bob to Harmony through the [**Harmony app in the Bob Marketplace**](https://www.hibob.com/marketplace/3F7QURUP33/overview). A Bob admin authorizes the connection with a single consent screen - there are no service users to create and no tokens to copy, store, or rotate.
{% hint style="info" %}
Already connected through the legacy **HiBob** service-user integration? Follow the [Migrating HiBob to OAuth](https://docs.harmony.io/guides/people-management/migrating-hibob-to-oauth) guide to reconnect and move your workflows over.
{% endhint %}
***
#### What the HiBob (OAuth) integration enables
| Capability | Description |
| -------------------------- | ------------------------------------------------------------------------------------- |
| Employee Data Sync | Sync employee profiles, departments, roles, position levels, and org structure |
| Automated Onboarding | Trigger IT provisioning when new employees are added |
| Offboarding Workflows | Automate access revocation when employees are terminated |
| Time-Off Sync | Sync approved time off so the agent and desk routing know who is out of office |
| Time-Off Requests | Let employees file time off through the Harmony agent - the request is created in Bob |
| Department Routing | Route IT requests based on employee department and location |
| Lifecycle Automation | Automate IT tasks for role changes, transfers, and promotions |
| Employee Record Automation | Create and update employee records in Bob from workflow steps |
| One-Click Authorization | Authorize once as a Bob admin - no service user, no API token to manage |
***
#### Prerequisites
* **Bob admin access**: An admin who can install apps from the Bob Marketplace and grant the requested permissions
* **HiBob subscription**: Active Bob account for your organization
* **Harmony account**: Active Harmony workspace with admin privileges
***
#### Connect HiBob to Harmony
1. **Navigate to Integrations**
1. Log in to your Harmony dashboard
2. Go to **Settings** > **Integrations**
3. Find **HiBob (OAuth)** under **HRIS** and click the card
4. Click **Connect**
2. **Authorize in Bob**
You are redirected to Bob. Sign in with your **Bob admin account** if prompted.
1. Review the **App permissions** Harmony is requesting (see [Permissions Explained](#permissions-explained) below)
2. Under **People data access**, choose **All company** so Harmony can see every employee - see [Choosing People data access](#choosing-people-data-access)
3. Click **Authorize**
4. You are redirected back to Harmony
3. **Verify the connection**
Confirm that **HiBob (OAuth)** shows a **Connected** status on your Harmony Integrations page. Harmony receives and stores the authorization automatically - no additional configuration is needed.
{% hint style="info" %}
The authorization is bound to the Bob admin who grants it, but it is not tied to their personal session. The connection stays active if that admin later leaves or changes roles - it stops only when the Harmony app is uninstalled in Bob or the integration is disconnected in Harmony.
{% endhint %}
***
#### Permissions Explained
Bob shows the full list of requested permissions on the install screen. Most of them are read permissions used by the employee and time-off sync. A few allow Harmony to write to Bob, and those are used only when you build a workflow with a HiBob write block or when an employee files time off through the Harmony agent - see [What Harmony writes to Bob](#what-harmony-writes-to-bob).
| Permission | Purpose |
| -------------------- | --------------------------------------------------------------------------------------------------------------- |
| Employee data | Employee profiles, work and employment details, manager and reporting lines, and org level |
| Company metadata | Departments, sites, titles, and other named lists used to resolve employee fields |
| Time off | Approved time-off requests and balances, so Harmony knows who is out of office and can answer balance questions |
| Internal / lifecycle | Employment status, termination date, and termination reason - required for offboarding automation |
| Manage time off | File and cancel time-off requests in Bob on an employee's behalf, from the agent or a workflow |
| Manage employees | Create and update employee records from the **Create Employee** and **Update Employee** workflow blocks |
Bob locks permissions and People data access at authorization time. To change either one later, uninstall the Harmony app in Bob and connect again.
**Choosing People data access**
During authorization Bob asks **whose** data the app can access. Harmony's employee directory, routing, and offboarding automations rely on seeing the whole organization:
| Option | Effect in Harmony |
| ------------------- | ----------------------------------------------------------------------------------------- |
| All company | Recommended. Every employee syncs and lifecycle automations cover the whole organization |
| Select by condition | Only employees matching the condition sync. Employees outside it are missing from Harmony |
| Select by name | Only the hand-picked employees sync. Suitable for a pilot, not for production use |
***
#### What Harmony Syncs
Harmony syncs employee data from Bob once a day, and applies employee changes from Bob in near real time between scheduled syncs.
**From HiBob:**
* Employee profiles and personal information
* Employment details (job title, department, employment type)
* Organizational data (manager, direct reports, hierarchy)
* Work information (location, phone, time zone)
* Employment dates (start date, end date)
* Status changes (active, terminated, etc.), including scheduled termination dates
* Department structure and sub-departments
* Position level (Individual Contributor, Management, Senior Management, or Executive Leadership), mapped from Bob's org level data
* Approved time-off requests, from the previous day through the next two weeks
**What Harmony writes to Bob**
Harmony writes to Bob only when you ask it to, through one of these paths:
* **Time-off requests filed through the agent** - when an employee asks the Harmony agent for time off, the agent checks their policies and balance in Bob and files the request there.
* **HiBob write blocks in your workflows** - the **Create Employee**, **Update Employee**, **Submit Time Off Request**, and **Cancel Time Off Request** blocks change data in Bob when a workflow that contains them runs. Workflows built only from read blocks never write to Bob.
Outside these paths, Bob remains the source of truth and Harmony does not modify it.
***
#### Using HiBob Blocks in Agent Workflows
HiBob blocks in the Agent workflow builder expose proper inputs and outputs, making it straightforward to connect them to other steps in your workflows. You can:
* **Pass data into HiBob blocks** - supply context from earlier steps to filter or enrich queries
* **Use results downstream** - feed employee data returned by a HiBob block into subsequent workflow logic
* **Resolve employees automatically** - blocks support Employee ID resolution, so Harmony can identify and look up the right employee record as part of a running workflow
The same HiBob blocks work whether your tenant is connected with **HiBob (OAuth)** or the legacy **HiBob** service-user connector. When a block is added, the builder lets you pick which HiBob connection it uses.
| Block | Effect on Bob |
| ----------------------- | --------------------------------------------------------- |
| Get Employee | Read |
| List Employees | Read |
| List Departments | Read |
| Get Time Off Balance | Read |
| List Time Off Requests | Read |
| Create Employee | **Write** - creates a new employee record in Bob |
| Update Employee | **Write** - updates fields on an existing employee in Bob |
| Submit Time Off Request | **Write** - files a time-off request in Bob |
| Cancel Time Off Request | **Write** - cancels a time-off request in Bob |
A block pinned to a connection that has since been disconnected fails rather than falling back to another HiBob connection. Open the block and select the connection you want it to use.
HiBob blocks behave consistently with all other blocks in the builder, giving you a reliable and predictable building experience.
**Prebuilt workflows**
The prebuilt **Time Off Request** and **HRIS to IDP Sync** workflows work with a HiBob (OAuth) connection. Choose the HiBob (OAuth) connection in the workflow's settings when you install or edit it. Workflows you installed earlier pick up HiBob (OAuth) support automatically - no reinstall is needed.
***
#### Disconnect HiBob from Harmony
**From Harmony:**
1. Log in to your Harmony dashboard
2. Go to **Settings** > **Integrations**
3. Find **HiBob (OAuth)** under **HRIS** and click the integration card
4. Click **Disconnect**
5. Confirm the disconnection when prompted
**From Bob:**
Uninstall the **Harmony** app from the Bob Marketplace. Bob revokes Harmony's access immediately. Harmony detects the revoked access on the next sync and marks the integration as disconnected.
Once disconnected, employee and time-off data stop syncing from Bob, and workflows that use HiBob blocks stop working until you reconnect.
***
#### Troubleshooting
Authorization fails or Bob does not show the consent screen
**Possible causes:**
* You are signed in to Bob with an account that cannot install marketplace apps
* Your browser blocked the redirect to Bob
**Solutions:**
1. Sign in to Bob with an admin account that can install apps, then retry **Connect** from Harmony
2. Allow pop-ups and redirects for `app.hibob.com` and your Harmony domain, then retry
Some employees are missing from Harmony
**Possible causes:**
* **People data access** was set to **Select by condition** or **Select by name** during authorization
* The employees were added in Bob after the last sync
**Solutions:**
1. Uninstall the Harmony app in Bob and connect again, choosing **All company**
2. Wait for the next scheduled sync, or contact Harmony support to trigger one
The integration shows as disconnected after it was working
**Possible causes:**
* The Harmony app was uninstalled in Bob
* Harmony's access was revoked in Bob
Workflow steps and agent requests that use the connection fail with a lost-connection error until it is restored.
**Solutions:**
1. Reconnect from Harmony under **Settings** > **Integrations** and complete the Bob authorization again
A workflow step fails with "HiBob integration not found"
**Possible causes:**
* The block is pinned to a HiBob connection that has since been disconnected
**Solutions:**
1. Open the agent from **Agents** in the sidebar, click the block, and select a connected HiBob connection
A workflow step or the agent reports a permission error from HiBob
**Possible causes:**
* A permission the step needs - for example managing time off or employee records - was deselected during authorization
**Solutions:**
1. Uninstall the Harmony app in Bob and connect again, granting all requested permissions. Bob does not allow permissions to be changed on an existing installation
Time off is not reflected in Harmony
**Possible causes:**
* The time-off request is not yet approved in Bob
* The request falls outside the sync window (from the previous day through the next two weeks)
**Solutions:**
1. Approve the request in Bob - only approved time off syncs
2. Requests further out are picked up automatically as they come within the window
***
#### Use Cases
Automated New Hire Provisioning
Trigger complete IT setup when HR adds new employees to HiBob
Role-Based Access Management
Automatically adjust access permissions when employee roles change
Department-Based Request Routing
Route IT tickets to appropriate teams based on employee department
Seamless Offboarding
Automate access removal and asset recovery when employees are terminated
***
#### Data & Privacy
Key privacy principles
For information about how Harmony handles your data, see our [Privacy Policy](https://harmony.io/privacy).
* Harmony reads employee, organizational, and time-off data from Bob to keep your employee directory and automations current
* Harmony writes to Bob only when a workflow runs a HiBob write block or an employee files time off through the Harmony agent. The scheduled sync never modifies Bob
* Authorization is held as an OAuth grant. It can be revoked at any time by uninstalling the Harmony app in Bob or by disconnecting the integration in Harmony
***
Need help? Contact [**support@harmony.io**](mailto:support@harmony.io) for assistance with your HiBob integration.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.harmony.io/integrations/hris/hibob-oauth.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.