Attendance

Punch in / out with geofence and selfie (offline-safe, tamper signals), breaks, live location on duty with consent, the team view, corrections, the attendance register and field report, settings and sites.

PUT/v1/attendance/days

Correct a member’s day

Mark leave (or clear it), add a missed punch-in / punch-out (replacing an automatic punch-out), with a note. Audited; nobody corrects their own attendance.

Access: Signed-in members only (web or Android session) — not for API keys. Permission attendance.manage.

Request body

member_idrequired: Id
Opaque record id.
daterequired: LocalDate
Calendar date YYYY-MM-DD in the company time zone.
status: "leave" or null
punch_in_at: DateTime or null
Instant in ISO 8601, e.g. 2026-10-03T04:30:00.000Z.
punch_out_at: DateTime or null
Instant in ISO 8601, e.g. 2026-10-03T04:30:00.000Z.
noterequired: string

Response · 200

datarequired: AttendanceDay
metarequired: object

Request

curl -X PUT 'https://api.propzolo.com/v1/attendance/days' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"member_id":"cmusrceel0000q7kaafxqi1om","date":"2026-10-06","status":"leave","punch_in_at":"2026-10-06T05:30:00.000Z","punch_out_at":"2026-10-06T05:30:00.000Z","note":"string"}'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "date": "2026-10-06",
    "member_id": "cmusrceel0000q7kaafxqi1om",
    "status": "present",
    "final": true,
    "late": true,
    "late_minutes": 0,
    "early_leave_minutes": 0,
    "punch_in_at": "2026-10-06T05:30:00.000Z",
    "punch_out_at": "2026-10-06T05:30:00.000Z",
    "worked_minutes": 0,
    "break_minutes": 0,
    "on_duty": true,
    "on_break": true,
    "distance_m": 0,
    "idle_minutes": 0,
    "flags": [
      "string"
    ],
    "note": "string",
    "corrected": true
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/attendance/export

Export the register or the field report as CSV

Watermarked with your name and audited; needs attendance view scope too. Step-up for Owner/Admin roles.

Access: Signed-in members only (web or Android session) — not for API keys. Permission reports.export.

Parameters

fromqueryrequired: LocalDate
Calendar date YYYY-MM-DD in the company time zone.
toqueryrequired: LocalDate
Calendar date YYYY-MM-DD in the company time zone.
branch_idquery: Id
Opaque record id.
member_idquery: Id
Opaque record id.
reportqueryrequired: "register" | "field"

Response · 200

Returned as is.

Request

curl -X GET 'https://api.propzolo.com/v1/attendance/export' \
  -H 'Authorization: Bearer pz_live_…'

Response example

"string"

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/attendance/field-report

Field report

Per member and day: visits planned vs done with GPS evidence, distance and idle time.

Access: Signed-in members only (web or Android session) — not for API keys. Permission attendance.view.

Parameters

fromqueryrequired: LocalDate
Calendar date YYYY-MM-DD in the company time zone.
toqueryrequired: LocalDate
Calendar date YYYY-MM-DD in the company time zone.
branch_idquery: Id
Opaque record id.
member_idquery: Id
Opaque record id.

Response · 200

datarequired: FieldReport
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/attendance/field-report' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "from": "2026-10-06",
    "to": "2026-10-06",
    "rows": [
      {
        "date": "2026-10-06",
        "member": {
          "id": "cmusrceel0000q7kaafxqi1om",
          "name": "string",
          "branch": "string"
        },
        "punch_in_at": "2026-10-06T05:30:00.000Z",
        "punch_out_at": "2026-10-06T05:30:00.000Z",
        "worked_minutes": 0,
        "visits_planned": 0,
        "visits_done": 0,
        "visits_with_gps": 0,
        "visits_flagged": 0,
        "distance_m": 0,
        "idle_minutes": 0
      }
    ],
    "totals": {
      "visits_planned": 0,
      "visits_done": 0,
      "visits_with_gps": 0,
      "distance_m": 0
    }
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

POST/v1/attendance/location-consent

Agree to share live location while on duty

Send the version of the notice you read; a newer notice answers 409.

Access: Signed-in members only (web or Android session) — not for API keys. Permission attendance.punch.

Request body

notice_versionrequired: string
device_id: string or null

Response · 200

datarequired: LiveLocationState
metarequired: object

Request

curl -X POST 'https://api.propzolo.com/v1/attendance/location-consent' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"notice_version":"string","device_id":"string"}'

Response example

{
  "data": {
    "enabled": true,
    "interval_minutes": 0,
    "consented": true,
    "notice_version": "string",
    "sharing": true
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

DELETE/v1/attendance/location-consent

Stop sharing live location

Sharing stops at once and your stored positions are deleted.

Access: Signed-in members only (web or Android session) — not for API keys. Permission attendance.punch.

Response · 200

datarequired: object
data.enabledrequired: boolean
data.interval_minutesrequired: integer
data.consentedrequired: boolean
data.notice_versionrequired: string
data.sharingrequired: boolean
Positions are being shared now (consented, on duty, not on a break).
data.deletedrequired: integer
metarequired: object

Request

curl -X DELETE 'https://api.propzolo.com/v1/attendance/location-consent' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "enabled": true,
    "interval_minutes": 0,
    "consented": true,
    "notice_version": "string",
    "sharing": true,
    "deleted": 0
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

POST/v1/attendance/locations

Upload live-location points

Points outside your on-duty windows (punched in, not on a break) or your consent are dropped; a point sent twice is stored once. The answer says whether to keep sharing and at which interval.

Access: Signed-in members only (web or Android session) — not for API keys. Permission attendance.punch.

Request body

pointsrequired: array of object
points[].atrequired: DateTime
Instant in ISO 8601, e.g. 2026-10-03T04:30:00.000Z.
points[].latrequired: number
points[].lngrequired: number
points[].accuracy_m: number or null
points[].mock_location: boolean or null

Response · 200

datarequired: object
data.acceptedrequired: integer
data.duplicatesrequired: integer
data.rejectedrequired: object
data.rejected.invalidrequired: integer
data.rejected.futurerequired: integer
data.rejected.too_oldrequired: integer
data.rejected.off_dutyrequired: integer
data.rejected.no_consentrequired: integer
data.live_locationrequired: LiveLocationState
metarequired: object

Request

curl -X POST 'https://api.propzolo.com/v1/attendance/locations' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"points":[{"at":"2026-10-06T05:30:00.000Z","lat":0,"lng":0,"accuracy_m":0,"mock_location":true}]}'

Response example

{
  "data": {
    "accepted": 0,
    "duplicates": 0,
    "rejected": {
      "invalid": 0,
      "future": 0,
      "too_old": 0,
      "off_duty": 0,
      "no_consent": 0
    },
    "live_location": {
      "enabled": true,
      "interval_minutes": 0,
      "consented": true,
      "notice_version": "string",
      "sharing": true
    }
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/attendance/members/{id}/days/{date}

A member’s day with every punch

Access: Signed-in members only (web or Android session) — not for API keys. Permission attendance.view.

Parameters

idpathrequired: Id
Opaque record id.
datepathrequired: LocalDate
Calendar date YYYY-MM-DD in the company time zone.

Response · 200

datarequired: object
data.dayrequired: AttendanceDay or null
data.punchesrequired: array of AttendancePunch
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/attendance/members/{id}/days/{date}' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "day": {
      "id": "cmusrceel0000q7kaafxqi1om",
      "date": "2026-10-06",
      "member_id": "cmusrceel0000q7kaafxqi1om",
      "status": "present",
      "final": true,
      "late": true,
      "late_minutes": 0,
      "early_leave_minutes": 0,
      "punch_in_at": "2026-10-06T05:30:00.000Z",
      "punch_out_at": "2026-10-06T05:30:00.000Z",
      "worked_minutes": 0,
      "break_minutes": 0,
      "on_duty": true,
      "on_break": true,
      "distance_m": 0,
      "idle_minutes": 0,
      "flags": [
        "string"
      ],
      "note": "string",
      "corrected": true
    },
    "punches": [
      {
        "id": "cmusrceel0000q7kaafxqi1om",
        "kind": "in",
        "at": "2026-10-06T05:30:00.000Z",
        "source": "string",
        "time_source": "string",
        "captured_at": "2026-10-06T05:30:00.000Z",
        "received_at": "2026-10-06T05:30:00.000Z",
        "location": {
          "lat": 0,
          "lng": 0,
          "accuracy_m": 0
        },
        "mock_location": true,
        "site": {
          "id": "string",
          "name": "string"
        },
        "distance_m": 0,
        "inside": true,
        "outside_reason": "string",
        "has_selfie": true,
        "selfie_status": "string",
        "flags": [
          "string"
        ],
        "voided": true,
        "void_reason": "string"
      }
    ]
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/attendance/members/{id}/track

A member’s on-duty route for a day

Live-location points of one day with the filtered distance and idle spells. Nothing older than the retention period exists.

Access: Signed-in members only (web or Android session) — not for API keys. Permission attendance.view.

Parameters

idpathrequired: Id
Opaque record id.
datequeryrequired: LocalDate
Calendar date YYYY-MM-DD in the company time zone.

Response · 200

datarequired: object
data.member_idrequired: Id
Opaque record id.
data.daterequired: LocalDate
Calendar date YYYY-MM-DD in the company time zone.
data.pointsrequired: array of object
data.points[].atrequired: DateTime
Instant in ISO 8601, e.g. 2026-10-03T04:30:00.000Z.
data.points[].latrequired: number
data.points[].lngrequired: number
data.points[].accuracy_mrequired: number or null
data.distance_mrequired: integer
data.idle_minutesrequired: integer
data.idle_spellsrequired: array of object
data.idle_spells[].fromrequired: DateTime
Instant in ISO 8601, e.g. 2026-10-03T04:30:00.000Z.
data.idle_spells[].torequired: DateTime
Instant in ISO 8601, e.g. 2026-10-03T04:30:00.000Z.
data.idle_spells[].latrequired: number
data.idle_spells[].lngrequired: number
data.idle_spells[].minutesrequired: integer
data.droppedrequired: integer
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/attendance/members/{id}/track' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "member_id": "cmusrceel0000q7kaafxqi1om",
    "date": "2026-10-06",
    "points": [
      {
        "at": "2026-10-06T05:30:00.000Z",
        "lat": 0,
        "lng": 0,
        "accuracy_m": 0
      }
    ],
    "distance_m": 0,
    "idle_minutes": 0,
    "idle_spells": [
      {
        "from": "2026-10-06T05:30:00.000Z",
        "to": "2026-10-06T05:30:00.000Z",
        "lat": 0,
        "lng": 0,
        "minutes": 0
      }
    ],
    "dropped": 0
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

POST/v1/attendance/punches

Punch in, out, or start / end a break

Idempotent on `client_key`. Outside every office / site the company’s geofence rule applies to punching in (a reason may be asked, or the punch refused); a punch-out is never refused. Tamper signals are recorded, not refused.

Access: Signed-in members only (web or Android session) — not for API keys. Permission attendance.punch.

Request body

kindrequired: "in" | "out" | "break_start" | "break_end"
client_key: string or null
Offline queue key: the same key again returns the stored punch.
captured_at: DateTime or null
The phone’s wall clock at the capture.
sent_at: DateTime or null
The phone’s wall clock when this request was sent.
capture_run: string or null
Id of the app run that captured it.
capture_mono_ms: number or null
Monotonic clock at the capture (ms).
send_run: string or null
send_mono_ms: number or null
lat: number or null
lng: number or null
accuracy_m: number or null
fix_at: DateTime or null
When the GPS fix was taken.
mock_location: boolean or null
The phone reported a mock (fake) location.
selfie_key: string or null
Key from POST /attendance/selfies after the upload.
reason: string or null
Why you punch in outside your office or site.
device_id: string or null

Response · 201

datarequired: PunchResult
metarequired: object

Request

curl -X POST 'https://api.propzolo.com/v1/attendance/punches' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"kind":"in","client_key":"string","captured_at":"2026-10-06T05:30:00.000Z","sent_at":"2026-10-06T05:30:00.000Z","capture_run":"string","capture_mono_ms":0,"send_run":"string","send_mono_ms":0,"lat":0,"lng":0,"accuracy_m":0,"fix_at":"2026-10-06T05:30:00.000Z","mock_location":true,"selfie_key":"string","reason":"string","device_id":"string"}'

Response example

{
  "data": {
    "punch": {
      "id": "cmusrceel0000q7kaafxqi1om",
      "kind": "in",
      "at": "2026-10-06T05:30:00.000Z",
      "source": "string",
      "time_source": "string",
      "captured_at": "2026-10-06T05:30:00.000Z",
      "received_at": "2026-10-06T05:30:00.000Z",
      "location": {
        "lat": 0,
        "lng": 0,
        "accuracy_m": 0
      },
      "mock_location": true,
      "site": {
        "id": "string",
        "name": "string"
      },
      "distance_m": 0,
      "inside": true,
      "outside_reason": "string",
      "has_selfie": true,
      "selfie_status": "string",
      "flags": [
        "string"
      ],
      "voided": true,
      "void_reason": "string"
    },
    "day": {
      "id": "cmusrceel0000q7kaafxqi1om",
      "date": "2026-10-06",
      "member_id": "cmusrceel0000q7kaafxqi1om",
      "status": "present",
      "final": true,
      "late": true,
      "late_minutes": 0,
      "early_leave_minutes": 0,
      "punch_in_at": "2026-10-06T05:30:00.000Z",
      "punch_out_at": "2026-10-06T05:30:00.000Z",
      "worked_minutes": 0,
      "break_minutes": 0,
      "on_duty": true,
      "on_break": true,
      "distance_m": 0,
      "idle_minutes": 0,
      "flags": [
        "string"
      ],
      "note": "string",
      "corrected": true
    },
    "warnings": [
      "string"
    ],
    "replayed": true
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/attendance/punches/{id}/selfie

A punch selfie (short-lived link)

For members whose attendance you may see; each look is audited. 409 while it is being re-encoded.

Access: Signed-in members only (web or Android session) — not for API keys. Permission attendance.view.

Parameters

idpathrequired: Id
Opaque record id.

Response · 200

datarequired: object
data.urlrequired: string
data.expires_atrequired: DateTime
Instant in ISO 8601, e.g. 2026-10-03T04:30:00.000Z.
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/attendance/punches/{id}/selfie' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "url": "string",
    "expires_at": "2026-10-06T05:30:00.000Z"
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/attendance/register

Attendance register

Members × days (at most 62) with status, late and early-leave minutes, hours and exceptions, within your scope.

Access: Signed-in members only (web or Android session) — not for API keys. Permission attendance.view.

Parameters

fromqueryrequired: LocalDate
Calendar date YYYY-MM-DD in the company time zone.
toqueryrequired: LocalDate
Calendar date YYYY-MM-DD in the company time zone.
branch_idquery: Id
Opaque record id.
member_idquery: Id
Opaque record id.

Response · 200

datarequired: AttendanceRegister
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/attendance/register' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "from": "2026-10-06",
    "to": "2026-10-06",
    "days": [
      "2026-10-06"
    ],
    "rows": [
      {
        "member": {
          "id": "cmusrceel0000q7kaafxqi1om",
          "name": "string",
          "branch": "string",
          "employee_code": "string"
        },
        "days": {},
        "totals": {
          "present": 0,
          "late": 0,
          "half_day": 0,
          "absent": 0,
          "leave": 0,
          "holiday": 0,
          "weekly_off": 0,
          "worked_minutes": 0,
          "exceptions": 0
        }
      }
    ]
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

POST/v1/attendance/selfies

Upload a punch selfie

A presigned PUT (private storage, at most 5 MB); send the key with the punch. The stored image is re-encoded without EXIF/GPS and deleted after the selfie retention period. Selfies are never used for face recognition.

Access: Signed-in members only (web or Android session) — not for API keys. Permission attendance.punch.

Request body

filenamerequired: string
content_typerequired: string
sizerequired: integer

Response · 200

datarequired: object
data.keyrequired: string
data.urlrequired: string
data.methodrequired: string
data.headersrequired: map of string
data.expires_atrequired: DateTime
Instant in ISO 8601, e.g. 2026-10-03T04:30:00.000Z.
data.max_bytesrequired: integer
metarequired: object

Request

curl -X POST 'https://api.propzolo.com/v1/attendance/selfies' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"filename":"string","content_type":"string","size":1}'

Response example

{
  "data": {
    "key": "string",
    "url": "string",
    "method": "string",
    "headers": {},
    "expires_at": "2026-10-06T05:30:00.000Z",
    "max_bytes": 0
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/attendance/settings

Attendance settings

Access: Signed-in members only (web or Android session) — not for API keys. Permission attendance.manage or settings.view.

Response · 200

datarequired: AttendanceSettings
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/attendance/settings' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "enabled": true,
    "require_punch_in": true,
    "selfie": "off",
    "geofence": "off",
    "max_accuracy_m": 20,
    "breaks": true,
    "web_punch": true,
    "grace_minutes": 0,
    "half_day_minutes": 60,
    "early_leave_grace_minutes": 0,
    "auto_punch_out": {
      "enabled": true,
      "after_minutes": 15,
      "fallback_hours": 4
    },
    "live_location": {
      "enabled": true,
      "interval_minutes": 5
    }
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

PUT/v1/attendance/settings

Change the attendance settings

Only the fields sent change. Audited.

Access: Signed-in members only (web or Android session) — not for API keys. Permission attendance.manage.

Request body

enabled: boolean
require_punch_in: boolean
selfie: "off" | "optional" | "required"
geofence: "off" | "warn" | "reason" | "block"
max_accuracy_m: integer
breaks: boolean
web_punch: boolean
grace_minutes: integer
half_day_minutes: integer
early_leave_grace_minutes: integer
auto_punch_out: object
auto_punch_out.enabledrequired: boolean
auto_punch_out.after_minutesrequired: integer
auto_punch_out.fallback_hoursrequired: integer
live_location: object
live_location.enabledrequired: boolean
live_location.interval_minutesrequired: 5 or 10 or 15 or 30

Response · 200

datarequired: AttendanceSettings
metarequired: object

Request

curl -X PUT 'https://api.propzolo.com/v1/attendance/settings' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"enabled":true,"require_punch_in":true,"selfie":"off","geofence":"off","max_accuracy_m":20,"breaks":true,"web_punch":true,"grace_minutes":0,"half_day_minutes":60,"early_leave_grace_minutes":0,"auto_punch_out":{"enabled":true,"after_minutes":15,"fallback_hours":4},"live_location":{"enabled":true,"interval_minutes":5}}'

Response example

{
  "data": {
    "enabled": true,
    "require_punch_in": true,
    "selfie": "off",
    "geofence": "off",
    "max_accuracy_m": 20,
    "breaks": true,
    "web_punch": true,
    "grace_minutes": 0,
    "half_day_minutes": 60,
    "early_leave_grace_minutes": 0,
    "auto_punch_out": {
      "enabled": true,
      "after_minutes": 15,
      "fallback_hours": 4
    },
    "live_location": {
      "enabled": true,
      "interval_minutes": 5
    }
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/attendance/sites

Offices and sites members punch at

Branch pins with their radius (edited in Settings → Branches) and the extra sites.

Access: Signed-in members only (web or Android session) — not for API keys. Permission attendance.view.

Response · 200

datarequired: array of AttendanceSite
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/attendance/sites' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": [
    {
      "id": "string",
      "kind": "branch",
      "name": "string",
      "branch": {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string"
      },
      "latitude": 0,
      "longitude": 0,
      "radius_m": 0,
      "is_active": true
    }
  ],
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

POST/v1/attendance/sites

Add an attendance site

Access: Signed-in members only (web or Android session) — not for API keys. Permission attendance.manage.

Request body

namerequired: string
branch_id: Id or null
Opaque record id.
latituderequired: number
longituderequired: number
radius_m: integer
is_active: boolean

Response · 201

datarequired: AttendanceSite
metarequired: object

Request

curl -X POST 'https://api.propzolo.com/v1/attendance/sites' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"name":"string","branch_id":"cmusrceel0000q7kaafxqi1om","latitude":0,"longitude":0,"radius_m":25,"is_active":true}'

Response example

{
  "data": {
    "id": "string",
    "kind": "branch",
    "name": "string",
    "branch": {
      "id": "cmusrceel0000q7kaafxqi1om",
      "name": "string"
    },
    "latitude": 0,
    "longitude": 0,
    "radius_m": 0,
    "is_active": true
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

PATCH/v1/attendance/sites/{id}

Change an attendance site

Access: Signed-in members only (web or Android session) — not for API keys. Permission attendance.manage.

Parameters

idpathrequired: Id
Opaque record id.

Request body

name: string
branch_id: Id or null
Opaque record id.
latitude: number
longitude: number
radius_m: integer
is_active: boolean

Response · 200

datarequired: AttendanceSite
metarequired: object

Request

curl -X PATCH 'https://api.propzolo.com/v1/attendance/sites/{id}' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"name":"string","branch_id":"cmusrceel0000q7kaafxqi1om","latitude":0,"longitude":0,"radius_m":25,"is_active":true}'

Response example

{
  "data": {
    "id": "string",
    "kind": "branch",
    "name": "string",
    "branch": {
      "id": "cmusrceel0000q7kaafxqi1om",
      "name": "string"
    },
    "latitude": 0,
    "longitude": 0,
    "radius_m": 0,
    "is_active": true
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

DELETE/v1/attendance/sites/{id}

Remove an attendance site

Access: Signed-in members only (web or Android session) — not for API keys. Permission attendance.manage.

Parameters

idpathrequired: Id
Opaque record id.

Response · 200

datarequired: object
data.deletedrequired: true
metarequired: object

Request

curl -X DELETE 'https://api.propzolo.com/v1/attendance/sites/{id}' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "deleted": true
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/attendance/team

Who is in today

Members in your attendance scope for a day (default today): status, punches, hours, flags — and, today, the latest on-duty position of members who share live location.

Access: Signed-in members only (web or Android session) — not for API keys. Permission attendance.view.

Parameters

datequery: LocalDate
Calendar date YYYY-MM-DD in the company time zone.
branch_idquery: Id
Opaque record id.

Response · 200

datarequired: TeamAttendance
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/attendance/team' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "date": "2026-10-06",
    "is_today": true,
    "live_location": true,
    "summary": {
      "members": 0,
      "on_duty": 0,
      "on_break": 0,
      "present": 0,
      "late": 0,
      "not_in": 0,
      "absent": 0,
      "leave": 0,
      "off": 0
    },
    "members": [
      {
        "member": {
          "id": "cmusrceel0000q7kaafxqi1om",
          "name": "string",
          "designation": "string",
          "branch": {
            "id": "cmusrceel0000q7kaafxqi1om",
            "name": "string"
          }
        },
        "status": "string",
        "state": "off",
        "day": {
          "id": "cmusrceel0000q7kaafxqi1om",
          "date": "2026-10-06",
          "member_id": "cmusrceel0000q7kaafxqi1om",
          "status": "present",
          "final": true,
          "late": true,
          "late_minutes": 0,
          "early_leave_minutes": 0,
          "punch_in_at": "2026-10-06T05:30:00.000Z",
          "punch_out_at": "2026-10-06T05:30:00.000Z",
          "worked_minutes": 0,
          "break_minutes": 0,
          "on_duty": true,
          "on_break": true,
          "distance_m": 0,
          "idle_minutes": 0,
          "flags": [
            "string"
          ],
          "note": "string",
          "corrected": true
        },
        "plan_kind": "working",
        "position": {
          "lat": 0,
          "lng": 0,
          "accuracy_m": 0,
          "at": "2026-10-06T05:30:00.000Z"
        }
      }
    ]
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/attendance/today

My attendance today

The company’s rules, today’s day (or a night shift still open) with its punches, the plan of the day, my offices and sites, and whether my live location is being shared.

Access: Signed-in members only (web or Android session) — not for API keys. Permission attendance.view.

Response · 200

datarequired: AttendanceToday
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/attendance/today' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "enabled": true,
    "require_punch_in": true,
    "selfie": "off",
    "geofence": "off",
    "max_accuracy_m": 0,
    "breaks": true,
    "web_punch": true,
    "can_punch": true,
    "can_view_team": true,
    "state": "off",
    "day": {
      "id": "cmusrceel0000q7kaafxqi1om",
      "date": "2026-10-06",
      "member_id": "cmusrceel0000q7kaafxqi1om",
      "status": "present",
      "final": true,
      "late": true,
      "late_minutes": 0,
      "early_leave_minutes": 0,
      "punch_in_at": "2026-10-06T05:30:00.000Z",
      "punch_out_at": "2026-10-06T05:30:00.000Z",
      "worked_minutes": 0,
      "break_minutes": 0,
      "on_duty": true,
      "on_break": true,
      "distance_m": 0,
      "idle_minutes": 0,
      "flags": [
        "string"
      ],
      "note": "string",
      "corrected": true
    },
    "punches": [
      {
        "id": "cmusrceel0000q7kaafxqi1om",
        "kind": "in",
        "at": "2026-10-06T05:30:00.000Z",
        "source": "string",
        "time_source": "string",
        "captured_at": "2026-10-06T05:30:00.000Z",
        "received_at": "2026-10-06T05:30:00.000Z",
        "location": {
          "lat": 0,
          "lng": 0,
          "accuracy_m": 0
        },
        "mock_location": true,
        "site": {
          "id": "string",
          "name": "string"
        },
        "distance_m": 0,
        "inside": true,
        "outside_reason": "string",
        "has_selfie": true,
        "selfie_status": "string",
        "flags": [
          "string"
        ],
        "voided": true,
        "void_reason": "string"
      }
    ],
    "plan": {
      "date": "2026-10-06",
      "kind": "working",
      "shift_start": "2026-10-06T05:30:00.000Z",
      "shift_end": "2026-10-06T05:30:00.000Z"
    },
    "sites": [
      {
        "id": "string",
        "name": "string",
        "lat": 0,
        "lng": 0,
        "radius_m": 0
      }
    ],
    "live_location": {
      "enabled": true,
      "interval_minutes": 0,
      "consented": true,
      "notice_version": "string",
      "sharing": true
    },
    "server_time": "2026-10-06T05:30:00.000Z"
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.