openapi: 3.0.3
info:
  title: Kenjo Attendance Authentication API
  description: 'The Kenjo API is a documented REST API for the Kenjo all-in-one HR (HRIS) platform. It exposes employees, attendance and time tracking, time off / absences, company documents, compensation and payroll data, organizational structure, and recruiting over HTTPS. Access is gated: the API is available on Kenjo''s top-tier Connect plan and must first be activated for your account (sandbox or production) by the Kenjo Customer Success team. You then generate an API key in the Kenjo web app (Settings > Integrations > API), exchange it for a bearer token via POST /auth/login, and send that token in the Authorization header on every request. A missing, invalid, or expired token returns 401 UNAUTHORIZED.

    Paths and HTTP methods in this document reflect Kenjo''s published API reference (kenjo.readme.io). Request and response bodies are modeled from the documented endpoint descriptions where full field-level schemas are not published; treat the schema components as representative rather than exhaustive, and confirm exact fields against the live reference.'
  version: '1.0'
  contact:
    name: Kenjo Support
    url: https://www.kenjo.io/legal/api
    email: support@kenjo.io
servers:
- url: https://api.kenjo.io/api/v1
  description: Production
- url: https://sandbox-api.kenjo.io/api/v1
  description: Sandbox (test environment)
security:
- bearerAuth: []
tags:
- name: Authentication
  description: Exchange an API key for a bearer token and invalidate tokens.
paths:
  /auth/login:
    post:
      operationId: login
      tags:
      - Authentication
      summary: Log in an API token
      description: Exchanges a Kenjo API key for a bearer token used to authorize subsequent requests.
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LoginRequest'
      responses:
        '200':
          description: A bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LoginResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /auth/logout:
    post:
      operationId: logout
      tags:
      - Authentication
      summary: Log out an API token
      description: Invalidates the current bearer token.
      responses:
        '200':
          description: Token invalidated.
        '401':
          $ref: '#/components/responses/Unauthorized'
components:
  schemas:
    LoginRequest:
      type: object
      required:
      - apiKey
      properties:
        apiKey:
          type: string
          description: The API key generated in Settings > Integrations > API.
    LoginResponse:
      type: object
      properties:
        token:
          type: string
          description: Bearer token to send in the Authorization header.
    Error:
      type: object
      properties:
        code:
          type: string
        message:
          type: string
  responses:
    Unauthorized:
      description: The bearer token is missing, invalid, or expired.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: Bearer token obtained from POST /auth/login by exchanging a Kenjo API key.