Xoxoday Empuls enforces role-based access control (RBAC) at the API layer, ensuring every API consumer operates strictly within its assigned permissions and cannot read or modify data outside its authorised scope.
API-level access control in Xoxoday Empuls
Xoxoday Empuls treats the API as a first-class security boundary, not an afterthought. Every API token issued by the platform carries a defined role and a corresponding set of scopes. When a request arrives, Xoxoday Empuls evaluates the token’s role before returning any data, so a payroll integration never sees recognition-budget details, and a reporting consumer cannot trigger reward transactions. This role-scoped model matters most in enterprise environments where multiple systems connect to Xoxoday Empuls simultaneously. A typical organisation might have an HRIS like Workday or SAP SuccessFactors syncing employee records, a communication layer in Slack or Microsoft Teams pushing recognition notifications, and a custom analytics dashboard pulling engagement metrics. Each of these integrations receives a dedicated API credential with only the permissions its function requires.How role-based enforcement works at runtime
When your IT or HR team provisions an API client in Xoxoday Empuls, they assign it one or more roles — for example,employee:read, awards:write, or analytics:read. The platform validates these scopes on every API call. A client holding only employee:read that attempts to write an award nomination receives an authorisation error immediately; no data is exposed, and the attempt is logged for audit review.
This design directly supports the principle of least privilege. A Darwinbox integration that needs to sync department hierarchies requires only directory-read access. It cannot, by accident or misuse, access wallet balances or redemption histories that belong to finance or rewards administrators.
Why this matters for compliance
Xoxoday Empuls is built to align with enterprise security standards including ISO 27001 and SOC 2 Type II. API-level RBAC is a core control that satisfies access-management requirements under both frameworks. When your organisation undergoes an audit, you can demonstrate through Xoxoday Empuls logs exactly which API client accessed which data class, at what time, and under which role assignment — without any manual reconstruction. For IT security teams, this also simplifies token rotation and incident response. If a credential is suspected to be compromised, revoking it in Xoxoday Empuls immediately removes all access for that specific role without affecting other integrations.Practical configuration for HR and IT teams
Administrators configure API roles directly from the Xoxoday Empuls settings panel. Role assignments can be as granular as your use case demands — a read-only reporting role for BI tools sits entirely separate from the write-enabled role used by your onboarding automation. Changes to role assignments take effect immediately, requiring no redeployment of your connected systems. This gives HR operations and IT security teams shared, clear ownership: HR defines what data integrations are permitted to surface, and IT controls the credentials that enforce those boundaries at the network layer. Learn more: [Xoxoday Empuls Help Centre — 6. SHARED CAPABILITIES](Does Xoxoday Empuls API support OAuth2 authentication?
Learn how Xoxoday Empuls issues and manages API tokens, including token expiry, rotation policies, and secure credential storage for connected integrations.
Does Xoxoday Empuls have ISO 27001, SOC 2, and GDPR compliance?
Understand how Xoxoday Empuls aligns with ISO 27001 and SOC 2 Type II requirements, including encryption, access logging, and audit trail capabilities.