# HiBob

![hibob-logo.png](https://assets.relyanceuat.xyz/images/docs/13865880144397/13865679557133.png)
Hibob is a web-based payroll platform. It helps businesses build a single source of truth, sync with their payroll provider, and to automatically update and create a straightforward accurate payroll process.

In order to integrate HiBob with Relyance AI you will need an **API Token**.

#### In HiBob:

1. Login to your HiBob account.
2. Click on your user logo at the top-right corner and click **API access**.
3. Update the form with your required scopes:
    - Full employee read
    - Document view
    - Payroll info read
    - Timeoff submit request & read who's out
    - *Employee update* (only needed for DSRs)
4. Copy your **Access Token** and click **Save**.

![HiBob-4.png](https://assets.relyanceuat.xyz/images/docs/13865880144397/13866638113421.png)

#### In the Relyance AI application:

1. Login to your Relyance account.
2. Navigate to the **Settings** Menu in the bottom left-hand side.
3. Select **Integrations**.
4. Click on the **Vendor Integration** tab.
5. Find the **HiBob** integration card and click it to open its connections.
6. Under **Authentication Method**, choose **Custom**.
8. Click the **Process DSRs** checkbox if processing DSRs.
9. Paste the **API Token** into its respective field.

![HiBob-1.png](https://assets.relyanceuat.xyz/images/docs/13865880144397/13865859288845.png)

The **Authentication** step asks for:

- **Service User ID**: HiBob Service User ID (e.g. b:service-user-name); required; held as a secret.
- **Service User Token**: HiBob Service User Token; required; held as a secret.

10. Click **Authenticate**.
11. At this point, you should see the following result on the **Vendor** Integrations page:

![HiBob-2.png](https://assets.relyanceuat.xyz/images/docs/13865880144397/13865855648909.png)

12. Congratulations, you are now connected to **HiBob**.

<!-- failure-modes:begin (generated from the integration catalog; do not hand-edit) -->

## If the connection reports Connected but returns nothing

These are the ways this integration comes back empty without reporting an error. Generated from the integration catalog, so it tracks what the connection actually asks for.

1. **A feature you enabled returns nothing.** Some scopes belong to a feature rather than to the connection: **Data subject requests** needs `Service User`. Turning the feature on after the connection exists does not widen the grant it already holds, so re-authenticate the connection.
2. **A credential rotated at the vendor is not picked up here.** **Service User ID** and **Service User Token** are stored when you save the connection, so regenerating the value at the vendor breaks the next scan until it is re-pasted here. Recording the expiry on the connection means Relyance warns you before it lapses.

<!-- failure-modes:end -->

<!-- auth-methods:begin (generated from the integration catalog; do not hand-edit) -->

## Authentication methods and fields

Pick one of these under **Authentication Method** on the connection wizard's **Authentication** step. This table is generated from the integration catalog, so it always matches what the form actually asks for.

| Method | Required | Optional |
| --- | --- | --- |
| **Service User (Basic Auth)** | `Service User ID` (secret), `Service User Token` (secret) | — |

<!-- auth-methods:end -->

<!-- terraform-examples:begin (generated from the integration catalog; do not hand-edit) -->

## Manage this integration with Terraform

Connections for this integration can be managed as code with the [Relyance Terraform provider](https://registry.terraform.io/providers/Relyance/relyance/latest). Non-secret fields go in `auth.params`; secret fields go in `auth.secrets_wo`, which is write-only — never stored in Terraform state. Rotate secrets by bumping `auth.secrets_wo_version`.

```hcl
resource "relyance_integration_connection" "hibob" {
  vendor = "hibob"
  name   = "<your connection name>"

  auth = {
    method = "access-token"
    params = {
      data_storage_location = "us"
    }
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      service_user_id = var.hibob_service_user_id
      service_user_token = var.hibob_service_user_token
    }
    secrets_wo_version = 1
  }

  scans = { "data-inspection" = { enabled = true } }
}
```

<!-- terraform-examples:end -->