Gusto setup guide

Agents help with people, candidates and hiring.

Ways to connect

Company admins connect apps, on the Integrations page in Everdeck: open Gusto, choose one of the ways below, follow its steps and fill in its fields. Everdeck checks what you enter before it saves anything, and asks you to confirm it’s you (your second factor) before you type any secret. How connecting works.

Your Gusto developer app (Gusto-approved apps only)

Your OAuth app.

This way signs in with an OAuth app you create for Gusto, as its steps describe: Everdeck never uses an app of its own. Register this redirect URI with your app:

https://everdeck.io/api/oauth/callback

Then save the app’s client ID and secret in Everdeck, on the connect page or under OAuth apps, and sign in.

1. Sign in to the Gusto Developer Portal (https://dev.gusto.com), finish your organization setup and create an application with the redirect URI https://everdeck.io/api/oauth/callback.
2. Copy the client ID and secret into the form. These keys only work against the demo environment until Gusto approves the app for production (Production Pre-Approval, Security Review and QA), and Gusto does not approve apps that only connect a customer's own company.
3. Click Connect and sign in as a primary or full-access admin of the company. Gusto asks which company to connect; each connection covers exactly one company.

Field	What to enter
Environment (optional)	Choice: Production (needs a Gusto-approved app), Demo (sandbox companies from the Developer Portal). Starts as https://api.gusto.com.

When you disconnect, Everdeck asks Gusto to revoke the sign-in, then deletes the tokens it saved.

What agents can do

An agent uses an action only when its charter grants it, on the agent’s Tools tab, where you choose whether each one runs by itself (Auto), asks first or never runs. Each action has a risk tier: tier 3 actions, which customers or the public see, ask first unless you choose otherwise, and tier 4 actions (money, deleting things, access) always need a person. How tools and tiers work.

Actions marked Reads outside content return things people outside your company may have written. Agents treat what they read as information, never as instructions, and their riskier actions later in the same session need approval.

• Read the companyTier 0 · ReadReads outside contentgusto_get_company

  Read the connected company: legal and trade name, entity type, Gusto plan tier, status, locations, paid time off types and the primary payroll admin (returned only when the app has the company_admin:read scope; non-work locations need employees:read).

• List or find employeesTier 0 · ReadReads outside contentgusto_list_employees

  List employees (onboarding, active and terminated) with title, department, manager, hire date, work email and onboarding status. Search by name or filter to active or terminated people. Pay rates appear only when the app has the compensations:read scope.

• Read an employeeTier 0 · ReadReads outside contentgusto_get_employee

  Read one employee with jobs and work location, eligible paid time off (policy, accrual and current balance), terminations and the record's version, which update_employee needs.

• Add a new hireTier 3 · ExternalReads outside contentgusto_create_employee

  Add an employee to the company in Gusto. With self_onboarding (the default) the new hire enters their own tax, bank and personal details through Gusto, which contacts them at their personal email; job, pay and start date are finished by an admin in Gusto.

• Update an employee's name or work emailTier 2 · ReversibleReads outside contentgusto_update_employee

  Change an employee's legal or preferred name or work email. Pass the version from get_employee or list_employees; a 409 means the record changed since, so read it again. Personal email, birth date, pay and job details are not changed here.

• List contractorsTier 0 · ReadReads outside contentgusto_list_contractors

  List contractors, individual and business, active and inactive, with wage type, hourly rate, start and dismissal dates, department and onboarding status.

• List departmentsTier 0 · ReadReads outside contentgusto_list_departments

  List departments with the employees and contractors in each, and each department's version for add_to_department.

• Move people into a departmentTier 2 · ReversibleReads outside contentgusto_add_to_department

  Assign employees and/or contractors to a department. Pass the department's current version from list_departments; a stale version is refused, so list again and retry.

• List time off requestsTier 0 · ReadReads outside contentgusto_list_time_off_requests

  List time off requests with employee name, policy, status (pending, approved, declined, consumed), the hours per day and notes. Give start_date and/or end_date to limit the window. Requests are approved or declined in Gusto itself; the API cannot change them.

• Read time off balance historyTier 0 · ReadReads outside contentgusto_get_time_off_activities

  List an employee's accruals, usage and adjustments for vacation or sick time, each with the balance after it. The latest entry is the current balance.

• List payrollsTier 0 · ReadReads outside contentgusto_list_payrolls

  List payroll runs with pay period, check date, deadline, whether processed, and totals. Without dates it returns processed regular payrolls from the last 6 months; ask for unprocessed ones to see what is coming up. end_date can be at most 3 months ahead and the range at most a year.

• Read a payrollTier 0 · ReadReads outside contentgusto_get_payroll

  Read one payroll run: status and dates, and once calculated or processed, totals and each employee's gross pay, net pay, taxes, deductions and hours. Employee compensations are paged (at most 100 per page); ask for the next page when X-Total-Pages says there are more.

Testing, problems and disconnecting

Everdeck checks the connection when you save it. On the connection’s page in Integrations, Test checks it again at any time.

If Gusto later refuses the connection, for example because a key was deleted or a sign-in expired, the connection shows Needs attention on the Integrations page and the people who manage connections are told. Agents can’t use it until a company admin fixes it with Edit or Reconnect.

To stop agents using Gusto, open the connection and select Disconnect. Agents stop using it at once and its saved credentials are deleted. What else happens depends on how it was connected: each way above says.