To list your application in the Rippling App Shop, apply through Rippling's developer portal; you'll receive an app client ID and secret along with integration documentation.
Rippling uses OAuth 2.0 for authorization; redirect users to Rippling's OAuth endpoint and request the relevant scopes (e.g., 'employees:read', 'groups:read') based on your integration's requirements.
Exchange the authorization code for a bearer token; tokens are scoped to the specific Rippling company that authorized your app — store per-company tokens rather than treating them as shared credentials.
For SCIM user provisioning, navigate in Rippling to IT Management > Apps > your app > Provisioning to generate a SCIM base URL and bearer token; Rippling acts as the SCIM identity provider pushing user lifecycle events to your endpoint.
Implement SCIM 2.0 server endpoints in your application: POST /Users (create), PATCH /Users/{id} (update), DELETE /Users/{id} (deprovision); Rippling calls these when employees are hired, changed, or terminated.
For reading HR data, use the Rippling REST API at https://api.rippling.com/platform/api/; GET /employees returns active employees for the authorized company with fields like name, department, start_date, and employment_type.
Known gotchas
Rippling's App Shop integration is reviewed and curated — unapproved apps cannot access the OAuth flow for customer companies; you cannot use Rippling as an HR data source for internal tooling via the App Shop path without going through their review process.
SCIM in Rippling is directional: Rippling pushes to your app, not the other way — if your integration needs to push users into Rippling (rather than sync from Rippling), that requires a different API pattern and additional permissions.
Field availability via the API depends on which Rippling modules the customer has purchased; customers without the PEO or global HR modules will not have certain fields populated, and code that assumes field presence will fail silently or throw null-pointer errors.
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp