BambooHR DSR integration

Setting Up the BambooHR DSR Integration

MineOS can connect to your BambooHR account to help you respond to Data Subject Requests (DSRs) — the access, deletion, and correction requests individuals are entitled to make under privacy laws like the GDPR and CCPA. Once connected, MineOS automatically looks up, previews, or deletes a person's BambooHR employee record whenever a verified request comes in, so your team doesn't have to search BambooHR by hand.

What this integration does

When a privacy request comes in, MineOS identifies the person by their email address and checks it against your BambooHR employee directory. Depending on the type of request:

• Access requests— MineOS looks up the matching employee and confirms whether they were found, returning the identifying details it was able to retrieve (currently: employee ID and work email; see the note below on expanding this).

• Preview (review) requests — MineOS returns the employee's ID, name, status, and work email, so your team can confirm it's the right person before anything is changed or deleted.
• Deletion requests — MineOS permanently removes the matching employee record from BambooHR and confirms the outcome.

If no matching employee is found, MineOS reports that the person doesn't exist in your BambooHR data, so the request can still be closed out accurately.

Before you set this up

BambooHR doesn't have "read-only" or "limited" API keys the way some other systems do. A key simply acts as whichever BambooHR user account created it. Whatever that person can see and edit inside BambooHR, MineOS will be able to see and edit through this integration — nothing more, nothing less.

Because of this, please don't generate the key from your own login or from an existing employee's account. Instead, set up one dedicated account just for this integration (steps below). This keeps the integration's access separate, auditable, and easy to revoke later without touching anyone's real login.

What you'll need before setup

Two things, both entered into MineOS during setup:

1. A BambooHR API key (from the dedicated account — see below)

2. Your BambooHR API base URL, in this exact format:

``` https://{companyDomain}.bamboohr.com/api/v1/employees/ ```

Replace `{companyDomain}` with the subdomain you use to log into BambooHR. For example, if you log in at `https://acme.bamboohr.com`, your base URL is:

``` https://acme.bamboohr.com/api/v1/employees/ ```

Setting the right permissions — read this before creating the key

1. Since the key inherits whatever the account that created it can do, follow these steps rather than using a personal or admin login: Create a new, dedicated BambooHR user account** just for this integration. Give it a clear name like "MineOS DSR Integration" so it's easy to recognize later.

2. Give that account only what this integration needs, nothing broader:

   1. View access to employee records — covering at minimum: name, work email, employee status, and employee ID.

   2. If your organization wants full-record access requests (see the note above), also grant view access to the additional categories you want returned — e.g. contact info, job details, personal information.

   3. Edit/delete access on employee records, so MineOS can act on deletion requests.

   4. Do not grant payroll, compensation, performance review, or other HR permissions this integration doesn't use — the account should be able to do exactly what's described here, and nothing else.

3. Log in as that dedicated account and generate the API key: click the account name in the lower-left corner → API Keys → Add New Key. Copy the key immediately — BambooHR only shows it once, and there's no way to view it again later.

Because this integration can permanently delete records, keeping its access limited to only what's listed above matters — it's the only real safeguard here, since BambooHR itself doesn't restrict what a key can do beyond the account's own permissions.

Setting up the connection

1. In BambooHR, create the dedicated account described above and confirm its permissions match what's listed

2. Log in as that account and generate a new API key

3. Copy the key somewhere secure right away

4. In MineOS, open the configuration screen for the BambooHR integration

5. Enter your Base URL in the format shown above

6. Enter your API key

7. Save your configuration

Once saved, the integration is live and will automatically respond to incoming access, preview, and deletion requests — no further action needed unless you want to review or update it later.

What to expect once it's running

• You'll get a confirmation indicating whether a match was found in BambooHR.

• For access requests, you'll receive the identifying fields the integration is configured to retrieve (see the note above if you want this expanded to a fuller record).

• For preview requests, your reviewing team gets the employee's ID, name, status, and work email to confirm it's the right person.

• For deletion requests, you'll get confirmation once the record is removed, or a "not found" response if no match existed.

• If BambooHR returns an unexpected error partway through, MineOS reports a persistent error rather than guessing — so a request never gets silently marked complete when it wasn't.

This helps your organization meet DSR response-time requirements under regulations like the GDPR and CCPA, while cutting down the manual work of locating and acting on records in BambooHR.

Updating or removing the connection

If your BambooHR API key changes or is revoked, update it on the MineOS configuration screen — and make sure any replacement key comes from the same dedicated account, so permissions stay consistent. Update your Base URL the same way if it ever changes.
If you no longer want MineOS connected to BambooHR, disable or remove the connection from that same screen, and revoke the API key and dedicated account on the BambooHR side as well.