Employment Hero

Connect Employment Hero to collect hris evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In Employment Hero:

   1. Log in to your Employment Hero HR platform as an Admin.
   2. Click your Profile Name in the top right-hand corner and select Developer Portal from the dropdown menu.
   3. Register a new application to generate your Client ID and Client Secret, defining its Access Scopes (read access to employees).
   4. Obtain an access token with the OAuth 2.0 flow under Obtain Access Token in the API reference's Authentication section. PKCE is mandatory for all authentication flows from 2026-09-30 (non-PKCE requests are rejected), and client_id, client_secret, code and code_verifier must be sent as application/x-www-form-urlencoded in the request body.
   5. Copy the access token from the response (it is sent as a Bearer token) and renew it as described under Refresh Access Token.

   Employment Hero's public documentation does not cover every step.

   API access and the Developer Portal require the Platinum HR, eOS Plus or eOS Unlimited plan (Lite and Standard Plus have no access); the user must be an Admin. Missing: the exact button and field labels on the Developer Portal's application registration screen, the exact name of the employee read scope, and whether the Client Secret is shown only once. The API reference's Authentication sections (Developer Portal Access, Obtain Credentials) load in the browser only and could not be read; the help-center articles were read through Employment Hero's own Zendesk help-center API because the article pages returned 403. The Organisation ID lookup is from the endpoint list in the official Postman collection. Verification 2026-10-07: the OAuth authorize and token URLs and the Organisation ID lookup (GET /api/v1/organisations, from the Postman collection) were removed because the pages read during verification (two help-center articles via Employment Hero's help-center API, and the API reference page) do not state them; the API reference's Authentication details load in the browser only.

   Source: help.employmenthero.com, help.employmenthero.com, developer.employmenthero.com, developer.employmenthero.com, checked 2026-10-07.

   The permissions Safeguard needs: employees read.

2. On Compliance › Connectors, open Employment Hero, click Connect, choose API token and fill in:

   Field	What to enter
   Access token	Required. Stored encrypted and never shown again.
   Organization ID	Required.

3. Click Connect with token.

Frameworks

Safeguard's automated tests read Employment Hero and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• HRIS connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks