> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/integrations/hris/bamboohr.md).
# BambooHR
BambooHR provides human resources software as a service to over 25,000 organizations. It automates common HR tasks, such as hiring, onboarding, preparing compensation, building culture, payroll monitoring, and time tracking.
After setting up the integration, DoControl captures data from employee records to calculate specific groups that can be leveraged in workflows. These [groups](/docontrol-user-guide/saas-data-monitoring/inventory/settings-groups.md#default-hr-groups) include:
* About-to-leave employees
* Current employee personal emails
* Former employee personal emails
* Former employee work emails
## Use cases
Integrate BambooHR with DoControl to make smarter decisions and reduce security risk in the following ways:
* **Get full inventory visibility** - View all BambooHR users, departments and [HR groups](/docontrol-user-guide/saas-data-monitoring/inventory/settings-groups.md#default-hr-groups), including terminated and about-to-leave employees. In a single glance, view your organizational posture to see: how many Google assets are accessible by former employees? How many employees share with their personal emails?
* **Trigger alerts** - Get real-time notifications when anomalous behavior occurs, such as when an about-to-leave employee performs a burst download of files and sends them to his personal email account. To see all DoControl alert types that leverage HR metadata from BambooHR, go to **Help > DoControl Alert Specifications**:
* Possible former employee accessed assets (DC30)
* File download by about-to-leave employee (DC33)
* Possible former employee publicly shared (DC34)
* Possible former employee externally shared (DC35)
* Burst download by about-to-leave employee (DC36)
* **Remediate future data exposure** - Define security workflows to handle a specific department in your organization, and prevent about-to-leave employees from downloading or externally sharing documents.
* **Get user metadata** - You can run a query to get user metadata for specific events. For example, if an employee in your organization changes user access for a Google Drive asset so it's now publicly shared, you can choose to remove the public sharing if the employee fulfills certain criteria.
* **Monitor risky identities** - Discover your internal SaaS identities to protect your organization from identity threats in Google Workspace.
## Prerequisites
To integrate BambooHR with DoControl, make sure you have fulfilled these prerequisites:
* Integrator must have the following **read-only** permissions:
* Basic Info
* Employment Status
* Job Information
* Create a BambooHR [custom access level](#create-a-bamboohr-custom-access-level)
* Before starting to integrate, you need to sign up with DoControl. Follow the onboarding steps in [Create first account](/docontrol-user-guide/getting-started/quick-start/set-up-docontrol-basics.md#create-first-account).
## Required permission scopes
The following **view-only** permissions enable DoControl to retrieve information from BambooHR:
#### Personal
* Basic information: Status, First Name, Middle Name, Last Name
* Contact information: Work Email (required) Mobile Phone and Home Email (optional)
#### Job
* Employment Status, Job Title, Department, Date
## Create a BambooHR custom access level
As a prerequisite to integrating BambooHR with DoControl, you first need to create a BambooHR custom access level.
{% hint style="success" %}
We recommend to set up a dedicated user for the integration.
{% endhint %}
1. Log in with your domain to the BambooHR Access Level Settings.
2. Copy and paste this URL with your domain name:\
`https://{your_company}.bamboohr.com/settings/access_levels/all`
3. In the BambooHR Settings Dashboard, go to **Levels**, click the **Plus** **+** icon, and select **Custom Access Level**.
4. Under **Basic Info**, enter an **Access Level Name** (required) and a description (optional), then click **Next Step**.
5. Under **What Can People with this Access Level Do?** select **Company Field Settings**. Then click **Next step**.
6. Under **See About Other Employees,** change the access levels of the fields below from No Access to **View Only** . Hover over each field, and click the eye icon that appears when the row is highlighted:
1. Go to **Personal** **tab > Basic info** - Grant **View Only** access to these fields: Status, First Name, Middle Name, Last Name
2. Go to **Personal** **tab > Contact** - Grant **View Only** access to these fields: Work Email, Home Email
3. Go to **Job > Employment status** - Grant **View** access to these fields: Employment Status: Date, Employment Status
4. Go to **Job > Job information** - Grant **View** access to these fields: Job title, Department
7. Click **Save & Finish.**
## Integrate BambooHR with DoControl
{% hint style="info" %}
If you start the integration without first creating a [custom access level](#create-a-bamboohr-custom-access-level), you will be redirected to the BambooHR homepage to log in and create the access level.
{% endhint %}
1. From the DoControl side menu, click **Integrations**.
2. Under the HRIS icon, click **Connect**.\
\
3. Under Available, select **BambooHR**.\
\
4. For the subdomain, enter your company name as it appears in the BambooHR URL.
5. For the API key, create a new API key in BambooHR:
1. In BambooHR, click **My Account**.
2. Select **My** **API keys > Add new key**.
3. Click **Generate key**, and copy it.
6. In the DoControl integration wizard, paste the generated key from BambooHR.
7. Click **Save**. \
BambooHR is now integrated.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.docontrol.io/docontrol-user-guide/integrations/hris/bamboohr.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
. Hover over each field, and click the eye icon that appears when the row is highlighted:
1. Go to **Personal** **tab > Basic info** - Grant **View Only** access to these fields: Status, First Name, Middle Name, Last Name
