Send punches with the Mark Attendance API
Record employee check-ins and check-outs from your own system with the Mark Attendance API, and understand its responses and errors.
The Mark Attendance API lets your own system record a punch for an employee, just like a clock-in on a biometric device. This article is for the admin or developer setting up the integration.
Before you start
- Create an API key — see Create and manage API keys.
- Know each employee's employee code in Attendex (for example EMP010). The API finds employees by this code.
- Only current employees (active, on probation or serving notice) can be punched.
Make a request
- Send a
POSTrequest to/api/mark-attendanceon your Attendex address. The exact URL is shown in the Code Examples tab on the API & Integrations page ( open API & Integrations). - Pass your key in the
X-API-Keyheader, or asAuthorization: Bearer <key>. - Send a JSON body (form fields also work) with these fields:
| Field | Required | Description |
|---|---|---|
employee_code | Yes | The employee's code, for example EMP010 |
punch_type | Yes | in for check-in or out for check-out |
punch_time | No | YYYY-MM-DD HH:MM:SS. Defaults to now. Must be within the last 7 days and not in the future |
curl -X POST https://yourcompany.attendex.in/api/mark-attendance \
-H "X-API-Key: YOUR_API_KEY_HERE" \
-H "Content-Type: application/json" \
-d '{"employee_code": "EMP010", "punch_type": "in"}'What a successful response contains
A 200 response has "success": true, a message such as "Punch recorded at 09:15 AM", and a data object with the attendance date, first punch in, last punch out, day status, late and early-leaving minutes, worked minutes and overtime minutes.
Every punch is stored, then the whole day is recalculated using the employee's shift. punch_type is a hint: the first punch of the day counts as check-in and the last as check-out. See Attendance & shifts.
Errors
| Code | What it means | What to do |
|---|---|---|
400 | employee_code or punch_type missing or invalid, or punch_time out of range | Fix the request body |
401 | API key missing or invalid | Check the header and the key |
403 | Key deactivated, IP not allowed, company inactive, or API & Integrations not in your plan | Turn the key on, check the IP lists, or contact Attendex |
404 | No current employee with that code | Check the employee code in Attendex |
405 | Not a POST request | Use POST |
409 | Duplicate punch — the same employee punched moments ago — or the punch couldn't be recorded | Usually safe to ignore duplicates |
429 | Rate limit exceeded, or too many failed key attempts | Slow down, or raise the key's rate limit |
Every call, successful or not, is counted on the API dashboard, so you can spot problems in Error Code Distribution.