Platform & security
Developer integrations
You can connect Onboardly to your own systems in two ways: a public M2M API and outbound webhooks. Both are suitable for automation in n8n or synchronization with an HRIS.
Public M2M API
The machine-to-machine API exposes data and operations under an API key created per organization. Each key has assigned permission scopes — you restrict it to only what the integration actually needs. Start with the API documentation and Authentication.
Outbound webhooks
Onboardly sends events from the onboarding and KYC flow to your endpoint. The mechanism is fault-tolerant and verifiable:
- HMAC-SHA256 signature — you confirm that the request comes from Onboardly.
- Durable queue with retries — failed deliveries are retried.
- Resend — the ability to manually send an event again.
The configuration and event format are described on the API webhooks page.
API keys and use cases
You create API keys in the organization's settings. The integration works well with n8n (automations) and HRIS systems.
API documentation
Overview of the public M2M API.
Authentication
Per-organization keys and permission scopes.
API webhooks
Onboarding and KYC events, HMAC-SHA256 signature.
Related: Security and GDPR · API documentation