# Bedrijfsrooster Developers Documentation > The official Bedrijfsrooster Developers Hub. Learn how to connect to our API and start creating productive integrations, provide feedback and tell us all about your experience and feature requests. ## Guides - [IAM & Authentication](https://developers.bedrijfsrooster.nl/docs/authentication): How to authenticate using the IAM API and gain access to protected resources. - [Setup a Customer API User & Client](https://developers.bedrijfsrooster.nl/docs/create-a-customer-api-user): This user can authenticate to Bedrijfsrooster Connect and serves as OAuth2 API Client. - [Bedrijfsrooster Developer Hub](https://developers.bedrijfsrooster.nl/docs): Hi and welcome to our developer hub! We are exploring most wanted features in collaboration with customers. Feel free to contact us or suggest edits, we'd love to hear from you! - [Request & Response basics](https://developers.bedrijfsrooster.nl/docs/json-request-response-format): The API endpoints request and response handlers explained. ## Company Feeds - [Timetable Feed](https://developers.bedrijfsrooster.nl/reference/TimetableFeed.md): Get a detailed ShiftCollection snapshot for the Company Timetable, by default for the day on which the request is made. Query the calendar on a specific day by adding the date parameter, from -8 day to +38 days ranging the current date. ## Company - [getConfiguration](https://developers.bedrijfsrooster.nl/reference/getConfiguration.md): Get a configuration object for the Company related to your ID Token. This object contains information about the primary entities in a Company. Entities can be linked to the related ID provided in other Company API endpoints like /timetable. - [getCompanyUsers](https://developers.bedrijfsrooster.nl/reference/getCompanyUsers.md): Get a CompanyUserCollection for the Company related to your ID Token. Company Users are employees that have an active or future employment at the company at the time of the request, or within the period as specified by parameters. - [getCompanyContracts](https://developers.bedrijfsrooster.nl/reference/getCompanyContracts.md): Get a CompanyContractCollection for the Company related to your ID Token. Company Contracts are the agreements between a Company and its employees, active at the time of the request, or within the period as specified by parameters. - [getTimetable](https://developers.bedrijfsrooster.nl/reference/getTimetable.md): Get a ShiftCollection for the Company Timetable related to your ID Token. Shifts are schedule related objects like employee work times, availability, relief and absence registrations. - [createRevenue](https://developers.bedrijfsrooster.nl/reference/createRevenue.md): Process a batch of revenue items. This can be either realised revenue or a prognosis, on a daily or weekly basis, or both. - [createWageBudget](https://developers.bedrijfsrooster.nl/reference/createWageBudget.md): Process a batch of wage budget items. This should be values on a daily or weekly basis, or both. ## IAM & OAuth2 - [oauthToken](https://developers.bedrijfsrooster.nl/reference/oauthToken.md): # OAuth2 / ID Token Request Getting access to secured API endpoints is easy using industry standard frameworks. * **OAuth2** protocol as the token request and response format. * **OpenID Connect** ID Tokens as access_token and refresh_token format. Depending on the type of application you want to give access and the scopes required, you need end User authorization, which is the default authorization flow. The API User email and secret created while setting up your API Client can be used to authorize the request. **Setup an API User and API Client Credentials** Any customer organization is required to create its own unique API Client and API User. Read more about how to create an API User and client credentials at the following link. https://developers.bedrijfsrooster.nl/docs/create-a-customer-api-user **Learn more about the Authorization Code Flow** Get a deeper understaning about the Authorization Code flow at the following link. https://auth0.com/docs/flows/authorization-code-flow **Client Credentials Flow Requirements** If your app needs to use the client credentials flow, we might request for specific requirements. Please inform support about your request, which needs to allow your API Client to be able to use this flow. --- # OAuth2 Authorization Code Flow (default) **To start the authorization code flow** send the User browser to the following URL. `https://id.bedrijfsrooster.nl` `/oauth/authorize?response_type=code&scope=all` `&client_id={ABC}&state={XYZ}&redirect_uri={URI}` Take into account the following while generating and using this URL. * Notice that the user facing domain is **id.**bedrijfsrooster.nl * As scope you can use [all] and should not change this * Authenticate using the API User email and secret that relate to the API Client * The redirect_uri must match the one configured when you created your API Client --- **After successful authentication by the User** the browser will be redirected to your URL. `{YOUR_REDIRECT_URI}?code={XXX}&state={XYZ}` Use the code in a JSON POST to the IAM API token endpoint to request a refresh_token. `POST https://api.bedrijfsrooster.nl/api/v1/iam/oauth/token` ``` { "grant_type": "authorization_code", "audience": "bedrijfsrooster-api", "code": "{XXX}", "redirect_uri": "{URI}", "client_id": "{API_CLIENT_ID}", "client_secret": "{API_CLIENT_SECRET}", } ``` Take into account the following while calling the token endpoint. * If your OAuth2 program is not able to post everything, you can provide the audience as URI query parameter. * The Bedrijfrooster API default audience name is [bedrijfsrooster-api] * The code will expire within a few minutes and can be used only once * Of the response refresh and access tokens, prefer to use refresh token --- **Now you might use the access_token** immediatly, but we recommend the following. * Securely store the refresh_token next to your API User secret and API Client secret * Securely store and cache an access_token, and check the expiration before reusing * The access_token / ID Token is valid for about 3600 seconds or 1 hour * The refresh_token is long lived and should be used to renew an expired access_token * Use the IAM API /idToken endpoint to exchange the refresh token for an ID Token * ID Token is identical to access_token and can be used to authenticate **You are now ready to fully access all secure API endpoints with your ID Token.** --- # OAuth2 Client Credentials Flow If your app needs to use the client credentials flow, we might request for specific requirements. Please inform support about your request, which needs to allow your API Client to be able to use this flow. --- # OAuth2 Refresh Token Flow If your app needs to use the refresh token flow, we might request for specific requirements. However, we prefer that you use a refresh_token combined with the /idToken endpoint. More information is described in the "Authorization Code Flow" chapter. --- # Single Sign On Flow If your app needs to use Single Sign On (SSO), we might request for specific requirements. Please inform support about your request, which needs to allow your API Client to be able to use this flow. - [idToken](https://developers.bedrijfsrooster.nl/reference/idToken.md): # Get an ID Token / OAuth2 access_token You can use an OAuth2 refresh_token at this endpoint to get an ID Token and thus an OAuth2 access_token. * Tokens issued by the IAM API are OpenID Connect JSON Web Tokens. * OAuth2 access tokens issued by the IAM API are valid ID Tokens, and vice versa. Make sure to use access_tokens and ID Token as long as they are not expired, before requesting new tokens. This API may restrict or penalize excessive token authorization and refresh requests. --- Use the [Authorization: Bearer {{REFRESH_TOKEN}}] header to provide a refresh_token and obtain a fresh ID Token, accompanied by an access_token and optionally (a renewed) refresh_token. Tokens and responses are OAuth2 compatible. ## Timeclock - [getTimeclockBadgeCollection](https://developers.bedrijfsrooster.nl/reference/getTimeclockBadgeCollection.md): Get a TimeclockBadgeCollection for every activated CompanyUser related to your ID Token, optionally filtered on the specified companyId. - [createTimeclockEvent](https://developers.bedrijfsrooster.nl/reference/createTimeclockEvent.md): Process a new timeclock event registered via the Bedrijfsrooster App or hardware devices. Always make sure that creating events related to a specific person is done in chronologically ordered requests. Each request should receive a 200 OK response before you can send the next time based event for the same person.