Process

Plug PRISM into your stack.

An admin sets up API keys and webhooks in Settings, plus two-way integrations to the systems you already run.

A developer connecting systems
Keys & webhooks

API keys and webhooks, from Settings.

Create a key scoped read-only or read-and-write; it acts as the person who made it, so it can never reach data they can't, and you send it as an X-API-Key header. Add an HTTPS endpoint and PRISM posts signed events — employee, leave and expense — as they happen.

Screenshot to capture

API keys & webhooks

/admin/settings/developer

Integrations

Two-way, without writing a service.

A connector posts events to an API you already use in the format it expects, from a body template you fill with values from the event. An inbound endpoint lets another system push employee records the other way, matched on email or staff ID, writing only the fields you map — never roles or passwords.

Screenshot to capture

Custom integrations

/admin/settings/custom-integrations

Activity

Every call, on the record.

Each call in and out is logged with its event, result, response code and time. Failed deliveries retry with backoff, and an endpoint that keeps failing pauses itself so a broken receiver doesn't pile up.

Screenshot to capture

Invocation log

/admin/integrations

One platform

Developers & API works with what you already run.

FAQ

Common questions

What can an API key do?

It reads or writes over the API as the person who created it, so it can never reach data that person can't. It can't sign in, manage other keys or change webhooks, and you send it as an X-API-Key header.

Which events can I subscribe to?

Employee created, updated and deactivated, and leave and expense submitted, approved and rejected. Each delivery is signed with HMAC-SHA256 so you can verify it before trusting the payload.

Can another system write back into PRISM?

Yes, through an inbound endpoint. It matches employees on email or staff ID and writes only the fields you map — never roles, passwords or account status. Requests are signed, and anything older than five minutes is rejected.

Connect PRISM to what you already run.

Set up keys, webhooks and integrations from Settings, and see every call in the log.