Personio setup guide

Agents help with people, candidates and hiring.

Ways to connect

Company admins connect apps, on the Integrations page in Everdeck: open Personio, choose one of the ways below, follow its steps and fill in its fields. Everdeck checks what you enter before it saves anything, and asks you to confirm it’s you (your second factor) before you type any secret. How connecting works.

API credentials (client ID and secret)

Your OAuth app.

This way uses the client ID and secret of an OAuth app you create for Personio. There’s no sign-in page: Everdeck asks Personio for a token with them.

1. Sign in to Personio as an admin with API access rights and open Marketplace > Connected integrations.
2. Click Create custom integration, name it "Everdeck" and give it access to: Persons (read and write), Absences (read and write), Org units (read), Recruiting (read). You don't need Webhooks access: live updates from Personio (starting work when a person, employment or absence changes) aren't available yet.
3. Under Readable employee attributes, tick the attributes the agent may read. Leave out salary, bank and other sensitive data it does not need.
4. Save, then copy the Client ID and Client secret (both start with papi-) into the form.

Disconnecting deletes the access token Everdeck saved for this connection. The OAuth app's client ID and secret stay saved under OAuth apps in Everdeck and keep working at Personio until you delete the app or rotate its secret there.

What agents can do

An agent uses an action only when its charter grants it, on the agent’s Tools tab, where you choose whether each one runs by itself (Auto), asks first or never runs. Each action has a risk tier: tier 3 actions, which customers or the public see, ask first unless you choose otherwise, and tier 4 actions (money, deleting things, access) always need a person. How tools and tiers work.

Actions marked Reads outside content return things people outside your company may have written. Agents treat what they read as information, never as instructions, and their riskier actions later in the same session need approval.

• List or find peopleTier 0 · ReadReads outside contentpersonio_list_persons

  List people (employees) with name, email, status (ACTIVE covers active, on leave and onboarding) and custom attributes the credential may read. Filter by exact email or name, status, or recent changes. Use list_employments for position, department and supervisor.

• Read a personTier 0 · ReadReads outside contentpersonio_get_person

  Read one person by id with name, email, gender, language, status and readable custom attributes.

• Read a person's employmentTier 0 · ReadReads outside contentpersonio_list_employments

  List a person's employments, most recent first: position title, status (ACTIVE, ONBOARDING, LEAVE, INACTIVE), start, probation and end dates, weekly hours, supervisor, office, department and team, legal entity and any termination.

• Add a new hireTier 2 · ReversibleReads outside contentpersonio_create_person

  Create a person with their employment, for example a new hire in onboarding. The email must not belong to anyone else. Department and team ids come from list_org_units; the supervisor is a person id.

• Update a person's name or languageTier 2 · ReversibleReads outside contentpersonio_update_person

  Change a person's first, last or preferred name, language or custom attributes. Email is not changed here because it is the person's Personio login.

• Change position, supervisor or departmentTier 2 · ReversibleReads outside contentpersonio_update_employment

  Update an employment's position title, supervisor, office, or department and team. org_units lists all the org units the employment should have, so include the ones it keeps. Status, legal entity, hours and cost centers are not changed here.

• List departments or teamsTier 0 · ReadReads outside contentpersonio_list_org_units

  List departments or teams with their ids, names and parent org units.

• List absence typesTier 0 · ReadReads outside contentpersonio_list_absence_types

  List the company's absence types (vacation, sick leave and so on) with id, category and unit (DAY or HOUR).

• List absencesTier 0 · ReadReads outside contentpersonio_list_absence_periods

  List absence periods with person, absence type, start and end (local time in timezone_id, with FIRST_HALF or SECOND_HALF for half days), comment and approval status (PENDING, APPROVED, DELETION_PENDING, SUBSTITUTE_REQUESTED). Date filters match absences overlapping the range, so starts_before = day end and ends_after = day start answers who is out that day.

• Request an absence for a personTier 2 · Reversiblepersonio_create_absence_period

  Record an absence request for a person. It goes through the absence type's normal approval (the approver is notified). For day-based types use midnight local time: a full absence from Oct 12 to Oct 14 is starts_from 2026-10-12T00:00:00 FIRST_HALF and ends_at 2026-10-14T00:00:00 SECOND_HALF. Hour-based types under 24 hours use exact times.

• List job applicationsTier 0 · ReadReads outside contentpersonio_list_applications

  List recruiting applications, newest updated first, with candidate name and email, job, current stage (new, screening, interviews, offer, hired, rejected and so on), channel and hiring team. Custom attributes and tags are not returned.

Testing, problems and disconnecting

Everdeck checks the connection when you save it. On the connection’s page in Integrations, Test checks it again at any time.

If Personio later refuses the connection, for example because a key was deleted or a sign-in expired, the connection shows Needs attention on the Integrations page and the people who manage connections are told. Agents can’t use it until a company admin fixes it with Edit.

To stop agents using Personio, open the connection and select Disconnect. Agents stop using it at once and its saved credentials are deleted. What else happens depends on how it was connected: each way above says.