Agent skill · software engineering · jeremylongshore
bamboohr-webhooks-events
Create and operate BambooHR event- or field-based webhooks with one-time key custody, HMAC-SHA256 verification, idempotency, and replay controls. Use when building employee-change delivery or diagnosing webhook failures. Trigger with "BambooHR webhook", "BambooHR events", or "BambooHR webhook signature".
Why this skill is useful
Adds specific API commands and HMAC signature verification procedures for BambooHR webhooks that the AI wouldn't reliably generate on its own.
What it needs
Requires bamboohr account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
BambooHR Webhook Operations Overview Operate permissioned BambooHR webhooks as a security boundary. The creation response contains a privateKey used for HMAC-SHA256 and returns it only once; losing it requires controlled replacement, not a retrieval call. Prerequisites The target repository or integration path and the requested operator outcome. The tenant, identity, and data scope only when approved live work is in scope. The current evidence register plus customer-specific permissions and agreements. Current Contract Create/list/get/update/delete and log endpoints live under /api/v1/webhooks. The destination URL must use HTTPS and format is required (json or form-encoded in the reviewed OpenAPI). monitorFields is required when events include employee.updated or employeewithfields.updated; omitted events default to field-based employee events that also require monitored fields. Receiver 4xx responses are not retried. Receiver 5xx responses may be retried up to five times at documented 5, 10, 20, 40, and 80 minute intervals. Authentication Webhook management requires OAuth scope webhooks or a permitted API-key user. Store the one-time privateKey immediately in a secret manager scoped to tenant and webhook ID. Keep management credentials separate from receiver verification. Instructions 1. Choose event-based or field-based delivery and list only the events, monitorFields, and postFields needed by the consumer. 2. Validate an HTTPS destination and use a non-production receiver for creation tests. Prepare secret storage before the create call. 3. Capture id and privateKey from the 201 response atomically; store the key once and ensure it never enters logs, tickets, fixtures, or source control. 4. Implement HMAC-SHA256 over the exact raw request bytes according to BambooHR's current webhook documentation. Do not parse or reserialize before checking. Confirm the documented signature carrier/header from current docs or a controlled sample; this pack does not invent one. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/bamboohr-webhooks-events