Advance Employee Updater API

Shubham_21

I need to conform that do Advance Updater API supports reading an employee data, deactivating and activating an employee from policy, deleting an employee in addition to creating and updating an employee data.

Shubham_21

Can any one from Expensify team confirm provide me whether Expensify provide an API for reading an employee data and deleting a employee data? If not is there any other way to automate this process.

Christina Dobryzynski

Hi there @Shubham_21! Expensify's API is a self-serve tool, so I recommend checking out the details provided in this document.

If you can't find what you're looking for, can you provide specific details on the employee data you want so our community can lend some help? Thanks!

Shubham_21

Actually I have used Advance Employee Updater API - https://integrations.expensify.com/Integration-Server/doc/employeeUpdater.html?shell#advanced-employee-updater-introduction. Using it I am able to create an employee and invite the employee to the policy, also able to update employee, able to remove or add employee from a policy. But I am not able to delete the employee from domain members using API i.e., the feature of closing accounts using UI.

Conor Pendergrast

Hiya @Shubham_21 , that's correct - closing user accounts is not a feature within the API. In general, when we see our customers managing employees in Expensify via the API, they also use SAML. So, access management (ie: stopping access to Expensify when an employee leaves) is handled through their SAML Identify Provider. Does your company use SAML to manage access to tools and products?

Shubham_21

I don't have any idea about SAML.

Conor Pendergrast

Ok, that would be a good option to check in with for your company. As I said, if you use a SAML tool, that is a great way to manage access to Expensify

Shubham_21

Okay Thank you

Conor Pendergrast

You're welcome! If you have any more questions we can help with, please let me know

Shubham_21

Hi Conor Pendergrast, do Expensify API support reading of a particular Employee Details?

Katie Oswalt

Hi @Shubham_21 ! Can you please confirm what type of employee details you're referring to so I can best answer this for you?

Shubham_21

Hello @Katie Oswalt,

I am automating user provisioning and de-provisioning for Expensify. For this, I am using Advance Employee Updater API.

In the API documentation, I have found options for creating, updating, and removing users.

Given Employee Email, is there any API to read the user details we assigned using Advance Employee Updater API?

Shubham_21

Hello  @Katie Oswalt,

Any Updates regarding my query?

Ben Fitz

Hey @Shubham_21, I'm afraid if that particular function isn't available in the documentation then it isn't something we support (as opposed to creating, updating, and removing users).

Shubham_21

Hello @Ben Fitz, read functionality is very important for automation. It is helpful to identify the current state. If the current state is identified we can decide whether we are updating details or not.

I know your API is automatically identifying whether to perform create or update. But we still require to read the current state to show related data to the users of my automated code.

Rachael Hopkins

Hi @Shubham_21 can you provide a little context? I.e. what are you using the API for? That will help me make some specific enquiries with my engineers.

Shubham_21

Hi @Rachael Hopkins,

I am using API for automating the process of user provisioning and de-provisioning in Expensify for my Company. For this, I am building a provider using Golang and run it using terraform.

The functionalities I required are creating users, updating users, reading users, deleting users, activating, and deactivating users.

Rachael Hopkins

Thanks, @Shubham_21 - Expensify doesn't add functionality to anything without a very good reason and a lot of customer demand - are you able to explain exactly why you need the 'read' option? What are the consequences of not having it?

Shubham_21

Hi @Rachael Hopkins,

Nowadays, everything is being automated. In automation knowing the current state is very important. Reading the current state helps us to decide whether to create or update.

For example, we are automating employee management, now using the read-option we would come to know if the user exists or not. If user exists means we can update the employee details otherwise we cannot update employee details. If a user does not exist means we can create the employee otherwise we cannot create an employee as it would be like duplicating an employee.

If we don't have read operation in API, we need to traverse through the site to get the employee details if they are deleted from the local storage. But if we can get employee details given employee Email (Which can be remembered), the manual work of visiting the website will be reduced.

Your API automatically detects whether to create or update. But still, there is a need of displaying employee details so that users with the automated code have the access to employee details locally.

I also have some more queries,

1. How to add Policy Admin using Advance Employee Updater API?
2. What do if I need to add the same employee to multiple policies as we need to add them separately according to your API i.e., increasing manual work to synchronize employee details in two policies.

Rachael Hopkins

Thanks for all that detail @Shubham_21 ! I'll go away and chat to a couple of engineers and get their take on it.

You can only add a new user as an employee as far as I'm aware, they must have their Role changed manually on the policy. And yes, you are correct regarding policies. Due to the way that Expensify is structured, each policy is completely independent of each other.

Shubham_21

Okay Thanks, @Rachael Hopkins. I will be waiting for your reply.

Shubham_21

Hello @Rachael Hopkins, any update regarding the operation read.

Francois Laithier

Hi @Shubham_21, to read the employee information from a policy, you'll need to use the Policy Getter API, and use employees as the list of fields to return:

{
    "type": "get",
    "credentials":{
        "partnerUserID": "_REPLACE_",
        "partnerUserSecret": "_REPLACE_"
    },
    "inputSettings":{
        "type": "policy",
        "fields": ["employees"],
        "policyIDList": ["0123456789ABCDEF", "BA5EBA11BA5EBA11"]
    }
}

Deleting accounts is not supported via the API, as explained above. However, you can remove employees from a policy via the Advanced Employee Update API, by setting their isTerminated flag to true , for example

{
    "employeeEmail": "[email protected]",
    "policyID": "0123456789ABCDEF",
    "employeeID": "12345",
    "isTerminated": true
}

Cheers

Shubham_21

Thank you @Francois Laithier this will help me to get the employee details. But if the employee list contains 1000 employees then it will increase the complexity of searching.

One more point to be considered is - Update in fields Manager Email, Approves To, Over Limit Approver make meaning only if we have Advanced Approval Mode.

If I am using any other mode and updating these fields then your API updates it but after exporting to CSV shows manager email which is the same as before updating. So, this may lead to asynchronous data in local and server which is not good automation I think. Your API should have given an error in this case for an update according to me.

Can you help me out from not going to this asynchronous state?

Also If I update of Frist Name and Last Name in one policy it has been updated in others too. It may also lead to asynchronous data in local and server.

Please help me to get rid of these asynchronous states.

Francois Laithier

Hi @Shubham_21, please find answers inline below.

But if the employee list contains 1000 employees then it will increase the complexity of searching.

I'm not sure I follow this - since you're automating, why does it matter whether the policy has 10 or 1000 employees? If you have to search multiple times for a given employee by email in the list, you can update your code to post-process the response and index each one by their email address, essentially converting the response:

[
    {
        "email": "[email protected]",
        "submitsTo": "[email protected]",
        "role": "admin"
    },
    {
        "email": "[email protected]",
        "submitsTo": "[email protected]",
        "role": "admin"
    }
]

to:

{
    "[email protected]": {
        "email": "[email protected]",
        "submitsTo": "[email protected]",
        "role": "admin"
    },
    "[email protected]": {
        /* alternatively, you can drop the "email" field since it's redundant with the key */ 
        "submitsTo": "[email protected]",
        "role": "admin"
    }
}

and then you'll be able to get the details for a given employee in O(1) without having to iterate over the list.

One more point to be considered is - Update in fields Manager Email, Approves To, Over Limit Approver make meaning only if we have Advanced Approval Mode

Yes, that's correct. If you don't use this approval mode, you don't need to update these fields.

If I am using any other mode and updating these fields then your API updates it but after exporting to CSV shows manager email which is the same as before updating. So, this may lead to asynchronous data in local and server which is not good automation I think. Your API should have given an error in this case for an update according to me.

That's a fair point, though typically this API is really meant to be used on policies with the Advanced Approval mode enabled.

Also If I update of Frist Name and Last Name in one policy it has been updated in others too. It may also lead to asynchronous data in local and server.

Also If I update of Frist Name and Last Name in one policy it has been updated in others too. It may also lead to asynchronous data in local and server.

First and last names are set at the account level, not the policy level (after all, an individual typically has at most 1 name at any given time) - you cannot configure an Expensify account to have multiple names across different policies.

Shubham_21

Thank you @Francois Laithier, your answers will really help me.

Kirk Barrett

I'm glad to hear this! Francois is not online at the moment, but I will make sure that he sees this!

Shubham21

Is there any API to read the Approval mode of a Policy?

Kadie Alexander

Hi @Shubham21, thanks for the great question! Our API focuses on Report and Expense level exports. I don't believe this includes policy-level information such as Approval Mode, though you may wish to take a look through our Integration Server Manual to see if there's anything that would be suitable!

Let me know if you have any other questions!

Shubham_21

Does Expensify have just in time users provisioning via SAML enabled?

Matt Moore

Hi @Shubham_21

Which SAML integration do you mean?

We have quite a few